Search
14 stories found
Sekoia says APT29 used compromised sites, lookalike domains and a hijacked Plerdy analytics script to push zero-click exploit chains at visitors on outdated iOS and Android. Every bug was already patched, so up-to-date phones were safe. CISA has now added one of the iOS flaws to its exploited list.
Attackers chained an authentication bypass with two newer Ivanti Connect Secure flaws to get root on VPN appliances, and CISA's first federal deadline has already passed. Here's which builds fix it and what to check if your box was exposed.
Carbon tops the Artificial Analysis Intelligence Index and posts big security benchmark numbers. Google is rolling it out to vetted defenders before anyone else. Here's what's in it and what it costs.
Attackers are using a flaw in Cisco's Secure Firewall remote-access SSL VPN to reboot firewalls without logging in. Only devices with secondary authentication on a tunnel group are exposed, so a two-minute config check tells you how urgent this is.
Floorplan, a free MIT-licensed plugin, scans your repo locally and has your coding agent label every part, producing a browsable map with a security health check. It was one of GitHub's top trending repos on November 2.
A CVSS 10 missing-authentication flaw in Siemens' SIMATIC IoT2050 Advanced gateways, CVE-2026-58115, is now being exploited, according to threat-intel firm VulnCheck. The attack is a single request to Node-RED's admin API, so any Node-RED instance left without a password is exposed in the same way.
SonicWall disclosed two flaws in its Global Management System on November 3, including CVE-2026-109593, an unauthenticated file-disclosure bug rated CVSS 9.1. GMS reached end of support on September 30, and SonicWall says no fix will be released, so the only remedy is to isolate it and move to NSM.
Binarly found that the exploit used to break into nearly 1,000 Zyxel GS1900 switches still worked on firmware patched in June for CVE-2026-7273. Zyxel has now fixed the underlying flaw as CVE-2026-107441, and every GS1900 owner needs the new ".3" firmware.
A misconfigured DNS resolver, chained zero-days and a covert channel built from CPU cache timing — OpenAI's own red team found the paths. Here's what happened and why it matters beyond OpenAI.
CISA added CVE-2026-119977, a race condition in WordPress core's own updater, to its Known Exploited Vulnerabilities catalog on November 3. It affects WordPress 4.7 through 7.1.3 and can give an unauthenticated attacker code execution during a core update, so every self-hosted site should confirm it is on 7.1.4 or its branch's latest release.
OccupySaaS describes itself as a group of laid-off engineers who use AI agents to clone paid SaaS from public docs. Its Auth0-compatible identity server reached release candidate 1 on November 4. It's Apache-2.0 and written in Go, and it already works with Auth0's own SDKs. The project says it isn't production-ready, and it isn't yet.
Google has dismantled the XCPE botnet and banned Shenzhen device maker Videostrong, which it says deliberately preloaded a backdoor that turned set-top boxes into proxies and ad-fraud engines. The backdoor reinstalls itself after removal, so for affected boxes the practical fix is replacement.
OmniDiff, an AGPL-licensed terminal diff tool, parses your code to show what changed instead of which lines moved. It can also compare pictures, fonts and the members of an archive. Version 0.3.0 shipped November 1 and drew more than 300 points on Hacker News. Its speed numbers are impressive, but its own README says accuracy targets aren't met yet.
CISA has added CVE-2026-97229 to its exploited-vulnerabilities list after an attack on Alpine Linux's GitLab server. The flaw lives in Ruby's regex engine, so self-built and custom GitLab images can stay vulnerable even on a "fixed" version number.
