20 casos · pág. 1/1
The paid WordPress SEO plugin Rank Math PRO was hit by a supply chain attack. Copies of version 3.0.123 downloaded from the vendor's site or delivered as updates between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC contained malware (securityweek.com, thehackernews.com, bleepingcomputer.com). Any site that installed and activ…
Unknown threat actors breached the TeamUpdraft website on 17-18 October 2026 and likely accessed its customer database, which holds connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Patchstack observed an attacker holding valid UpdraftCentral dashboard keys issuing signed commands to install backdoor plugins on connected …
A cluster of unrelated but concurrent security events hit on 21 October 2026. Reuters reported government websites worldwide going offline after AI-discovered critical vulnerabilities in PHP, and the NSA advised organizations to update immediately or take PHP systems offline. The same day, Node.js patched four high-severity flaws, and Lit…
On October 21, 2026, attackers compromised the LiteLLM release pipeline and published malicious version 1.107.0 to PyPI, Docker Hub and GHCR. The package carried a credential stealer ("privcollect") and a backdoor that runs remote code every hour, effectively a RAT. LiteLLM suspects the attacker obtained developer GitHub CLI OAuth tokens …
Zeabur, a developer hosting and deployment platform, disclosed that on October 14-15, 2026 an attacker used leaked internal credentials stored in plaintext to compromise its shared clusters, some Dedicated Servers and internal systems, and ultimately read the production database. The breach affected shared clusters in nine regions, 321,81…
On September 23, 2026, an attacker published malicious versions of @memtensor/memos-cloud-openclaw-plugin (npm, versions 0.1.21, 0.1.23 and 0.1.25 per the article) and the MemoryOS Python library (PyPI, 2.0.34). Both carry the same Go implant, sckit, which harvests credentials from the home directory, exfiltrates them to servers under sky…
The npm account dirtyblanket published nine typosquatted packages on September 29, 2026 in 33 minutes, eight copying Express and one copying React. On Linux, a preinstall hook fetches node.js through the Internet Archive Wayback Machine, which pulls the worm linux.sh from Codeberg and runs it with bash. The worm installs CHAOS, an open-so…
On 4 August 2026, an npm worm published 2,234 poisoned versions across 444 package names, using credentials from twelve organisations. Affected scopes include @ornikar, @deliveroo, @onereach, @or-sdk, @servicetitan, @qlik, @picsart, and the keyv and cacheable families. The keyv, flat-cache, file-entry-cache and cacheable-request packages …
On October 21, attackers compromised the release pipeline of LiteLLM, an open-source Python SDK and AI gateway with about 92 million monthly PyPI downloads. They published malicious version 1.107.0 to PyPI, Docker Hub and GHCR. The payload steals cloud, AI, developer and browser credentials and loads remote-code execution tools. All seven…
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
SafeDep identified a malicious tensorlake npm release, version 0.5.144 (about 106,000 monthly downloads), that ran a Mini Shai-Hulud worm on install. It was published at 01:12:07 UTC on 8 October and flagged by SafeDep eight minutes later. The attacker used a repository administrator account to commit the payload to main through the GitHu…
This SentinelOne weekly roundup (Week 41, 2026) covers law enforcement actions, a phishing campaign and an actively exploited vulnerability. The most urgent item is CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file access flaw in Atlassian Data Center products. Exploitation attempts began about two hours after a public …
LiteLLM version 1.107.0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images. On October 21, 2026, Socket reported that malicious Python startup hooks run even when an application never imports LiteLLM, exposing cloud credentials, developer secrets and AI tool authe…
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small nu…
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
Microsoft attributed the recent supply chain compromise of the ConnectWise Cloud Backup application to Storm-0940, a China state-aligned actor. The actor used ARTEX, a Go-based agentic AI penetration testing framework, to automate reconnaissance, password spraying and OAuth application abuse at "machine speed" against hundreds of organiza…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
The LiteLLM release 1.107.0 (a widely used open source LLM proxy and AI gateway developed by BerriAI, about 23 million weekly downloads per theregister.com) was trojanized on PyPI on 21 October 2026 and carries a credential stealer (privcollect) plus a remote code execution backdoor. All wheels (Linux, macOS, Windows) drop three extra fil…
ConnectWise suspended Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management after unknown actors gained unauthorized access to its application identities and used them to sign in to customers' Microsoft 365 tenants. ConnectWise says it identified the incident on October 14, 2026 (thehackernews.com) and began mitigations on O…
