Search
9 stories found
SonicWall disclosed two flaws in its Global Management System on November 3, including CVE-2026-109593, an unauthenticated file-disclosure bug rated CVSS 9.1. GMS reached end of support on September 30, and SonicWall says no fix will be released, so the only remedy is to isolate it and move to NSM.
A CVSS 10 missing-authentication flaw in Siemens' SIMATIC IoT2050 Advanced gateways, CVE-2026-58115, is now being exploited, according to threat-intel firm VulnCheck. The attack is a single request to Node-RED's admin API, so any Node-RED instance left without a password is exposed in the same way.
A misconfigured DNS resolver, chained zero-days and a covert channel built from CPU cache timing — OpenAI's own red team found the paths. Here's what happened and why it matters beyond OpenAI.
An open-source scanner compares your system against ~12,400 published indicators from 25 sources — without sending anything anywhere. What it can find, what it can't, and how to run it in five minutes.
Google has dismantled the XCPE botnet and banned Shenzhen device maker Videostrong, which it says deliberately preloaded a backdoor that turned set-top boxes into proxies and ad-fraud engines. The backdoor reinstalls itself after removal, so for affected boxes the practical fix is replacement.
Attackers chained an authentication bypass with two newer Ivanti Connect Secure flaws to get root on VPN appliances, and CISA's first federal deadline has already passed. Here's which builds fix it and what to check if your box was exposed.
Binarly found that the exploit used to break into nearly 1,000 Zyxel GS1900 switches still worked on firmware patched in June for CVE-2026-7273. Zyxel has now fixed the underlying flaw as CVE-2026-107441, and every GS1900 owner needs the new ".3" firmware.
Synology says attackers are exploiting a DSM flaw it patched in December 2024 to plant C3RB3R ransomware, which also encrypts backups on the same device. Researchers disagree about the entry point, so the safe move is the latest build for your DSM branch plus a few quick checks.
A CVSS 9.8 use-after-free in the kernel's IPv4 TCP handshake code affects kernels back to 4.4, and Anthropic says one of its models wrote a remote-root exploit for it. Red Hat shipped kernels on November 1; Ubuntu users are still waiting. Here's the status by distro and what to do in the meantime.
