24 casos · pág. 1/2
Microsoft has released PowerToys 0.102, an open-source Windows utility pack, adding two mouse tools, new command-line tools and Command Palette improvements. This is product news with no vulnerability, exploitation or threat activity described. Mouse Button Lock keeps a mouse button treated as held until the next click, which helps with d…
Microsoft says it mistakenly marked a bug affecting Always On VPN connections as resolved in the October 2026 Patch Tuesday cumulative updates for Windows 11. The status was reverted to Mitigated, and a permanent fix is planned for an update "in the coming weeks". The issue first appeared after the September 2026 security updates on Windo…
Certificate authority eMudhra revoked eight intermediate certificates after a researcher known as Wayne found on October 17 that their P-384 private keys were so weak that anyone could recover them almost instantly. The keys, generated in April 2025, had values below 256, so an attacker could recover them by testing 256 candidates. This w…
Zeabur, a developer hosting and deployment platform, disclosed that on October 14-15, 2026 an attacker used leaked internal credentials stored in plaintext to compromise its shared clusters, some Dedicated Servers and internal systems, and ultimately read the production database. The breach affected shared clusters in nine regions, 321,81…
OpenAI says its newer models are much better at writing and migrating code in legacy languages such as COBOL, Fortran and Visual Basic. The company cites the importance of these languages to critical infrastructure: COBOL reportedly supports over 40% of online banking systems, 80% of in-person card transactions and 95% of ATM transactions…
The U.S. Department of Homeland Security (DHS) has issued an order requiring federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from DeepSeek's affiliates and third-party products or services built on DeepSeek technology. DHS cites concerns that the Chinese gov…
A Nigerian national, Chukwuemeka Victor Amachukwu (aliases Chukwuemeka Victor Eletuo and So Kwan Leung), 40, was sentenced to eight years in prison for his role in spearphishing attacks against US tax preparation businesses between 2019 and 2021. He pleaded guilty to conspiracy to commit computer intrusions and wire fraud after being extr…
Microsoft announced that quick machine recovery (QMR) is now available on Windows Server 2025 after installing the October 2026 security update. The feature lets IT administrators fix critical boot failures through targeted Windows Update remediations, without physical access to affected systems. QMR was introduced in November 2024 under …
Ahold Delhaize, one of the world's largest food retailers, confirmed that a cyberattack discovered last week forced it to take systems offline, including brand websites and apps, in Europe and the United States. Affected brands include Albert Heijn, Etos and Gall & Gall in the Netherlands, Delhaize in Belgium, and Stop & Shop in the US, w…
OVHcloud disclosed that attackers hijacked a developer's GitHub account and used it to modify the open-source OVHcloud CLI repository, publishing trojanized releases 0.11.0 through 0.15.0 that carry information-stealing malware. According to CEO Octave Klaba, the malicious release appeared at 14:47 on October 19 and was detected and block…
Revolut is working to resolve a major worldwide outage that began Tuesday morning and disrupted most of its services. Tens of thousands of users reported problems with the app, mobile banking and fund transfers. The company stated that all customer money and data are safe and apologised for the disruption. The cause has not been disclosed…
A supply-chain attack compromised Rank Math PRO (WordPress SEO plugin) version 3.0.123, downloaded from the vendor's official website between October 15 20:02 UTC and October 16 07:12 UTC. The trojanized package planted persistent, self-recreating hidden backdoors on sites where it was activated, and exposed database credentials, API keys…
Nikkei Inc. disclosed a third data breach in about a month, exposing 1.83 million records stored in the cloud. Attackers used stolen credentials to access a development system in the early hours of October 7. About 150,000 records contained at least one of: full names, email addresses, physical addresses, phone numbers or dates of birth, …
Burger King Japan, the Japanese subsidiary of Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. The article excerpt does not say how the intrusion happened, who was responsible, or exactly which data fields were exposed. The scale makes this a mass customer-data exposur…
Citizen Lab reports that Candiru spyware was delivered to devices at Al Jazeera Media Network through targeted online advertisements, in a zero-click attack that only required the malicious ad to render on the victim's device. Citizen Lab calls the technique AdFection and says its report is the first public technical confirmation of merce…
Sansec warns that a maximum-severity flaw, CVE-2026-103849 (dubbed BlockStrap), in Magento Open Source and Adobe Commerce could allow attackers to execute arbitrary PHP code on store servers. No in-the-wild exploitation has been observed yet, but Sansec identified four potential attack paths in under 24 hours and expects mass exploitation…
ConnectWise shut down its Cloud Backup service (formerly SkyKick Cloud Backup) after an attacker gained unauthorized access to application identities and used them to compromise Microsoft 365 tenants. Huntress identified at least 162 compromised tenants in its environment, and Microsoft Threat Intelligence characterized the incident as an…
Microsoft has fixed a known issue in the classic Outlook desktop client for Windows that hid the Copilot Chat and Copilot buttons for users with a Copilot Chat (Basic) or Microsoft 365 Copilot (Premium) license. Microsoft first announced a fix in June through a service change, but the bug resurfaced after recent updates and was investigat…
Microsoft has confirmed that the October 2026 Windows Server security updates cause Outlook on the web (OWA) sign-in failures and mail delivery problems on some on-premises Exchange Server systems. Affected hosts run Windows Server 2019 and later. Messages sent from Outlook may stay in the Outbox, and Exchange may have trouble accessing m…
F5 released out-of-band security patches for multiple NGINX flaws, including three critical vulnerabilities: CVE-2026-15176 and CVE-2026-97205 in the ngxhttpv3module, and CVE-2026-93479 in the NGINX map directive. Unprivileged remote attackers can exploit them against systems with non-default configurations to cause denial of service or, …
