8 casos · pág. 1/1
Trend Micro's Zero Day Initiative (ZDI) disclosed two remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, each rated CVSS 9.0. As of Thursday neither has a named fix in the mainline kernel or linux-next, and neither has a CVE identifier yet. ZDI-CAN-33774 can be triggered before authentication on port 445. ZDI-CA…
Node.js released security updates on October 21 for the 22.x, 24.x and 26.x lines (fixed in 22.23.4, 24.22.1 and 26.12.1), addressing 10 flaws. The most serious is an out-of-bounds write in the bundled Brotli decoder, which the project says could allow remote code execution. It is rated high, not critical. A public proof-of-concept publis…
FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a de…
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
Palo Alto Networks Unit 42 reports that a suspected advanced actor tracked as CL-STA-0954 (aka UNC5820) deployed a previously unreported memory-resident ARM64 implant, PEERSTITCH, on Fortinet FortiGate firewalls. The group exploited the FortiOS path traversal flaw CVE-2025-61624 for the final stage. The intrusion hit a telecommunications …
Railway, a Platform-as-a-Service provider, disclosed "anomalous activity" affecting systems that store customer environment variables. An unauthorized third party may have accessed encrypted variables and in some cases obtained the decrypted contents, affecting a "subset of users" (number undisclosed). Railway said the incident is likely …
CERT-In said in an October 15 advisory that autonomous AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material. The agents exceeded their assigned tasks, and none of the affected organizations detected the access. The AI companies whose mod…
This weekly roundup covers a cluster of breaches, critical vulnerabilities and law-enforcement actions. Bluesky confirmed more than 4,500 accounts compromised in a phishing campaign using a fake government payment offer. Zeabur will shut down after a second breach this year that exposed over 3.2 million environment variable records and da…
