107 casos · pág. 1/6
Siemens warned customers that attackers are actively exploiting CVE-2026-110936 (CVSS 8.4 under v4.0, 6.7 under v3.1; CWE-427 uncontrolled DLL search path), a DLL side-loading vulnerability in Siemens Software Center, to distribute malware. The activity is attributed to the Romulus multi-platform ClickFix campaign. Romulus is a server hos…
ThreatFabric has documented Hirudo, an Android banking remote-access trojan that steals credentials and gives operators remote control of the phone. Its distinguishing feature is replacing selected genuine banking apps with modified copies that interfere with security checks from inside the app. Victims first install a lure app (Shopora, …
Unit 42 (Palo Alto Networks) tracks a campaign, CL-UNK-1211, in which operators compromised government Linux infrastructure between October 2025 and April 2026. The operators used PHP and shell scripts that appear to be AI-generated, with conversational comments and step-by-step reasoning. They harvested credentials and went after databas…
Node.js released security updates on October 21 for the 22.x, 24.x and 26.x lines (fixed in 22.23.4, 24.22.1 and 26.12.1), addressing 10 flaws. The most serious is an out-of-bounds write in the bundled Brotli decoder, which the project says could allow remote code execution. It is rated high, not critical. A public proof-of-concept publis…
FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a de…
Splunk and SolarWinds released security updates this week for vulnerabilities that allow code execution, privilege escalation, denial-of-service (DoS) and information disclosure. The article does not report exploitation in the wild. Splunk's updates cover Splunk Enterprise and Splunk SOAR, and SolarWinds fixed flaws in Observability and P…
Lazarus Group, linked to North Korea, ran a cyberespionage campaign dubbed Operation FlashHole against South Korean organizations. The campaign combined spear-phishing, tailored websites, abuse of the financial security application INISAFE CrossWeb EX, and modular malware that ran largely in memory. It follows Operation SyncHole, which ab…
Oracle released its October 2026 Critical Patch Update (CPU) with 1,295 new fixes across dozens of products. Tenable counts 1,209 unique CVEs: 95 critical, 439 high and 582 medium severity. Oracle Fusion Middleware received the most fixes (206), of which 134 are remotely exploitable without authentication. Oracle has not flagged any of th…
Indian certification authority eMudhra has publicly responded to the disclosure that private keys behind some of its root and issuing CAs were trivially weak. One key was reportedly the number "4" and others were short, easily guessed numbers. The company says a flaw in a Key Generation Ceremony (KGC) held on April 30, 2025 produced a sec…
The Node.js Project released security updates on October 21, 2026 fixing 10 vulnerabilities (four high, three medium, three low severity) across the 26.x, 24.x and 22.x release lines. The most significant is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that allows remote code execution in all three lines. The advisory giv…
A vulnerability in Signal's open-source RingRTC calling library, tracked as CVE-2026-113380 (CVSS v4.0 9.3), can stop a call from terminating properly. This can leave audio, and possibly video, channels open after a user hangs up. MITRE published the CVE on October 20, 2026, classified as CWE-754. The affected versions are every RingRTC r…
A Chinese-speaking threat operator combined the agentic penetration-testing framework ARTEX with Claude Code, Codex and configurations requesting DeepSeek, GLM and Grok models to coordinate attacks on organizations worldwide. Recovered prompts dated August 4 to October 4, 2026 referenced targets in financial services, cryptocurrency, reta…
Attackers gained unauthorized access to Onamae.com Desktop Cloud, operated by GMO Internet, and installed malicious programs in some customer server environments. GMO confirmed the installations on October 20, 2026. On October 21 it began rolling shutdowns of all Desktop Cloud plans and identified 26,739 potentially affected servers. Info…
Microsoft attributed the recent supply-chain attack on ConnectWise customers' Microsoft 365 environments to Storm-0940, a China-state aligned actor active since 2021. Since at least September 2026 the group has used the open-source agentic AI penetration testing framework ARTEX to automate attacks against hundreds of organizations worldwi…
Hackers compromised the infrastructure of Onamae.com Desktop Cloud, a VPS service operated by GMO Internet in Japan, and installed malicious programs on up to 26,739 customer servers. The company confirmed the intrusion on October 20, 2026. It began progressively shutting down customer servers at 04:00 local time on October 21, and all De…
Security teams are racing to remediate two critical PHP vulnerabilities, collectively dubbed PHP2Shell, after technical details leaked and exploitation attempts were reported. The article excerpt gives no CVE identifiers, affected versions or attribution. The name suggests a path to shell access, but the excerpt does not confirm the impac…
On 19 October 2026 an attacker used a hijacked GitHub account of an OVHcloud contributor to overwrite the download archives of five existing OVHcloud CLI releases (v0.11.0 to v0.15.0) with a build designed to steal secrets from the disk of any machine that ran it (thehackernews.com, bleepingcomputer.com). The files were live for about 94 …
Symantec's Threat Hunter Team used an AI honeypot to capture the full instruction set of a malicious autonomous AI agent in summer 2026. The agent is designed to run up to 100,000 malicious actions without human approval: scanning for targets, exploiting vulnerabilities, stealing credentials, deploying cryptocurrency miners and reinfectin…
CrowdStrike researchers analyzed AI infrastructure left openly exposed on web servers by four previously unreported criminal groups (Chinese-, Spanish/English-, Indonesian- and Russian-speaking). The groups ran attacks between May and August 2026 using mostly older versions of Anthropic's Claude and open-weight Deepseek models. All four b…
Google promoted Chrome 156 to the stable channel for Windows, macOS and Linux on October 20, 2026, fixing 353 vulnerabilities, six of them critical (gbhackers.com, securityweek.com). The critical flaws are five memory corruption bugs and one use-after-free in Accessibility. Most of the 353 are memory safety issues: 163 memory corruption b…
