8 casos · pág. 1/1
Splunk and SolarWinds released security updates this week for vulnerabilities that allow code execution, privilege escalation, denial-of-service (DoS) and information disclosure. The article does not report exploitation in the wild. Splunk's updates cover Splunk Enterprise and Splunk SOAR, and SolarWinds fixed flaws in Observability and P…
Oracle released its October 2026 Critical Patch Update (CPU) with 1,295 new fixes across dozens of products. Tenable counts 1,209 unique CVEs: 95 critical, 439 high and 582 medium severity. Oracle Fusion Middleware received the most fixes (206), of which 134 are remotely exploitable without authentication. Oracle has not flagged any of th…
Google promoted Chrome 156 to the stable channel for Windows, macOS and Linux on October 20, 2026, fixing 353 vulnerabilities, six of them critical (gbhackers.com, securityweek.com). The critical flaws are five memory corruption bugs and one use-after-free in Accessibility. Most of the 353 are memory safety issues: 163 memory corruption b…
Threat actors are abusing the open source AI platform Cairn, an agent-coordination engine usable as an autonomous penetration testing tool, to automate attacks on hundreds of websites worldwide. AI security firm Norforge found the activity after threat actors left their Cairn panels exposed, following a Gambit Security report on attackers…
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…
Paradigm Healthcare Services, a San Francisco-based billing processor for Medi-Cal (California's Medicaid program) under a data use agreement with the California DHCS, told the US HHS that a breach affected more than 970,000 people. The company detected unauthorized access to its local network on October 13, 2025. It determined only on Au…
An unauthorized party used a compromised login credential to access a file transfer (SFTP) site belonging to Educational Testing Service (ETS) and copy files containing California public school student data, according to the California Department of Education (CDE). ETS supports the state's CAASPP and ELPAC assessment programs. Access occ…
Siemens disclosed on Monday that threat actors exploited CVE-2026-110936, a DLL search-path vulnerability in Siemens Software Center, in a malware campaign. The attackers bundled a legitimately signed copy of the Siemens program with their own malicious DLLs, which the program loaded from its own folder at startup. Siemens links the activ…
