Cloud security, container security, network security, service outages, infrastructure incidents
RSS feed for this categoryF5 and Juniper Networks have released patches for critical vulnerabilities affecting their network devices. Successful exploitation of these flaws could allow attackers to achieve remote code execution and gain full control over compromised devices.
Microsoft has reported that the October Windows 11 security update (KB5127648) may prevent users from enabling Smart App Control. This issue affects some users and could impact their ability to utilize this built-in security feature.
BAE Systems, a government contractor, has been the victim of a cyberattack that has disrupted the notice system for US federal bankruptcy courts. The Administrative Office of the US Courts confirmed the incident, which has impacted the ability of these courts to send out notifications.
Threat actors are exploiting a critical remote command execution vulnerability, CVE-2026-110447, in the Collabora Online app for Nextcloud. This allows attackers to backdoor Nextcloud servers, potentially leading to further compromise.
A critical vulnerability, dubbed PwnEscape (CVE-2026-99999), has been discovered in the Linux kernel that allows code running within a virtual machine to read memory from the host system. A researcher successfully demonstrated this exploit against Vercel's cloud sandboxes, and the company has confirmed the issue.
Hackers have launched a proxyjacking campaign that has affected D-Link and Ubiquiti devices in 34 countries. The campaign hijacks victims' internet connections to resell their bandwidth through a commercial residential proxy network, effectively monetizing the stolen access.
Bank of America enlisted 1,000 contractors in the second quarter to address numerous bugs identified by Mythos. These contractors are still actively involved in the patching process.
Microsoft has announced that Windows Server 2022 has reached the end of its mainstream support phase. The operating system will continue to receive extended support, including security updates, until October 2031.
NGINX has released updates (versions 1.30.6 and 1.31.7) to address five vulnerabilities. Among these are three memory bugs that could lead to worker process crashes or potential remote code execution, and a TLS bug that might bypass client certificate checks.
A cyberattack targeting supermarket refrigeration systems in France has expanded to affect Copeland and Dixell controllers. Approximately 700 French supermarkets were impacted by these attacks, with no group yet claiming responsibility.
Cisco has issued a warning about a critical vulnerability in its Secure Email Gateway product, tracked as CVE-2026-76519. The flaw allows attackers to write arbitrary files to the underlying operating system and execute commands with root privileges, and is actively being exploited in the wild. Cisco has released software updates to address the issue, but no workarounds are available.
Next.js has released an out-of-band security update to address two critical remote code execution (RCE) vulnerabilities. One flaw exists in React Server Components, and the other is in the librsvg library used for SVG image processing.
Thermo Fisher Torrent Suite Software versions less than or equal to 5.18 are affected by a path traversal vulnerability. Successful exploitation allows an authenticated attacker to read arbitrary files on the Torrent Server.
Multiple vulnerabilities have been identified in Guangzhou Juan IoT Technology's EseeCloud App and Firmware, specifically versions <=4.9.6 and <=4.9.86.0, respectively. Successful exploitation of these vulnerabilities, including the use of hard-coded credentials, could allow an attacker to gain control over affected IP cameras.
Multiple vulnerabilities have been identified in J4Care dcm4chee-arc-light versions prior to 5.35.2, potentially allowing attackers to delete medical images, expose patient data, and inject forged studies. Successful exploitation could lead to significant data compromise and service disruption within healthcare systems worldwide. J4Care has released version 5.35.2 to address these security flaws.
CISA has issued an alert regarding multiple vulnerabilities in Eclipse Foundation's Eclipse Milo software, specifically versions 0.6.0 through 1.1.4. Successful exploitation could lead to data deletion, credential theft, or denial-of-service conditions.
CISA has identified multiple vulnerabilities in CISA Malcolm, specifically affecting versions prior to v26.08.0. These vulnerabilities include authentication bypass, SSRF, and CSRF, which could allow unauthenticated attackers to access sensitive data or execute unauthorized actions. A patch is available in Malcolm Version v26.08.0.
Attackers are actively exploiting a critical vulnerability (CVE-2026-0322) in Palo Alto Networks' PAN-OS software, allowing for arbitrary code execution with root privileges. The US Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch it by October 17, with requirements for forensic triage to detect prior compromise.
Microsoft has released a fix for a bug that caused black screens, desktop loading problems, and Windows Explorer crashes on Windows 11 systems. The issue emerged after updates installed since August, impacting user experience and system stability. The company has now addressed the problem with a subsequent patch.
Hundreds of European grocery stores experienced significant financial losses due to unpatched firmware in their refrigeration systems. These outdated Operational Technology (OT) systems were managed by third-party providers, highlighting a critical security oversight.
Palo Alto Networks has released a patch for a zero-day vulnerability in its PAN-OS software that was being actively exploited by attackers. The vulnerability allows for remote code execution on customer firewalls, and the company has provided indicators of compromise (IoCs) to help customers detect exploitation.
Palo Alto Networks has released security updates for a critical remote code execution (RCE) vulnerability in its PAN-OS software. The flaw, identified as CVE-2026-0322, has a CVSS score of 8.6 and is actively being exploited by attackers. The vulnerability allows for code execution through the management interface.
Atlassian products, including Bitbucket, Confluence, and Jira, are affected by a vulnerability that allows unauthenticated attackers to access specific files within the web application root directory. This flaw could expose sensitive information to external parties.
Palo Alto Networks has issued a warning about a critical zero-day vulnerability in their PAN-OS software, identified as CVE-2026-0322. This remote code execution (RCE) flaw is being actively exploited in attacks against their firewalls.
A security vulnerability in refrigerators has led to significant financial losses and sparked fires across 700 supermarkets. The incident was caused by outdated devices that were improperly exposed to the internet.
A zero-day vulnerability, CVE-2026-104935, in Ivanti products allowed for authentication bypass and remote code execution. Threat actors exploited this vulnerability, which was only partially patched in July, highlighting challenges in vendor patching processes for industrial control systems (ICS).
An audit by the DHS Office of Inspector General found that the TSA is not properly safeguarding passenger facial recognition data. A vendor was able to access and extract sensitive passenger information during system troubleshooting without TSA's knowledge, and TSA lacked clear policies for data handling, tracking, and deletion.
Cisco has issued a warning about active attacks exploiting a critical vulnerability in their Secure Email Gateway. This flaw allows an unauthenticated attacker to write files to the appliance's operating system by sending a crafted email attachment. Successful exploitation could enable attackers to execute commands with root privileges.
Ledger has instructed its resellers and distributors across several Asian countries to halt sales of its hardware wallets and remove them from shelves. This action is in response to an ongoing investigation into potential device tampering within the supply chain.
Attackers have exploited a critical vulnerability in the Collabora Online - Built-in CODE Server app, an optional component for Nextcloud, to gain unauthorized access and install web shells on affected servers. The first reported attack occurred on September 10th, and the vulnerability allows attackers to execute commands with the privileges of the web server account.
Cisco has released a patch for a critical zero-day vulnerability in its Secure Email Gateway (SEG). This flaw allows unauthenticated remote attackers to execute commands with root privileges on vulnerable systems.
Ivanti has released a patch for a zero-day vulnerability in its Connect Secure product, which had been confirmed to be exploited in the wild. The company also stated that a fix for a separate privilege-escalation flaw will be available in the coming weeks.
Siemens has released 17 new security advisories as part of its latest ICS Patch Tuesday updates. Additionally, Rockwell has issued a fix for a critical vulnerability affecting its ArmorBlock devices that could allow for unauthorized takeover.
Microsoft has released a fix for a known issue that caused problems with Always On VPN connections after users installed the September 2026 Windows 11 security updates. The update resolves the connectivity problems that arose from the previous patches.
CISA has issued a warning to administrators, urging them to immediately patch a vulnerability in Ivanti Connect Secure (ICS). This flaw has been actively exploited in zero-day attacks since at least October 1st.
CISA has issued an urgent directive for organizations to update their Ivanti Connect Secure appliances due to an actively exploited authentication bypass vulnerability. The flaw, identified as CVE-2026-104935 with a CVSS score of 8.6, has already been observed in 105 exploit attempts logged by honeypots.
On October 11, 2026, hundreds of supermarket refrigerators and freezers across France were intentionally warmed up, leading to significant food spoilage. This incident affected multiple major retailers including Intermarché, Netto, Carrefour Market, and Monoprix, with E.Leclerc also reporting issues. The Paris prosecutor has reported associated fires.
Attackers are exploiting an authentication bypass vulnerability (CVE-2026-104935) in Ivanti Connect Secure appliances, allowing them to gain access without legitimate accounts. The flaw enables arbitrary command execution on compromised devices, and CISA has added it to its Known Exploited Vulnerabilities catalog.
Microsoft has confirmed that recent Windows updates may cause Remote Desktop connection failures for non-administrator users when the "Administrator protection" feature is enabled. This issue prevents users from establishing Remote Desktop sessions to devices.
French supermarkets were warned by CERT-FR to disconnect internet-connected refrigeration control systems following a cyberattack that ruined chilled food stocks. The advisory recommends reconnecting via a secure VPN and verifying configurations, with temporary measures including IP address filtering.
A flaw in Linux's vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local users to read and write kernel memory, granting them root privileges. In virtualization environments, this vulnerability can enable an untrusted virtual machine to access and manipulate the host's memory, potentially hijacking the virtual machine's execution program.
Mozilla has released Firefox Enterprise, a version tailored for organizations with stringent compliance, governance, and security needs. Concurrently, updates for both Chrome and Firefox have been issued to address 114 security vulnerabilities.
SAP has released patches for critical vulnerabilities in its NetWeaver and S/4HANA platforms. These bugs could allow attackers to invoke internal operations and execute code, leading to complete system compromise.
Security researchers have successfully executed their own code within a Windows VBS (Virtualization-based Security) enclave, a protected memory region designed to safeguard sensitive information. The specific enclave targeted by the researchers is responsible for handling passwords for Windows' anti-phishing feature, SmartScreen. This was achieved through the exploitation of a four-byte write and a timing bug.
A spyware chip has been discovered in Ledger crypto-wallets. In unrelated news, a cyberattack caused widespread outages at Ahold Delhaize supermarkets, defrosting fridges, and the EU is proposing regulations for smart glasses to indicate recording.
Cisco Secure Email Gateway has a relative path traversal vulnerability, identified as CVE-2026-76519. This flaw allows unauthenticated remote attackers to write arbitrary files to the operating system.
Palo Alto Networks PAN-OS has a code injection vulnerability (CVE-2026-0322) allowing authenticated attackers with network access to execute arbitrary code with root privileges on firewalls. Organizations must apply vendor-provided mitigations and comply with CISA's guidance on prioritizing security updates.
Anthropic has issued a warning that small, self-replicating AI models could soon spread to consumer IoT devices, creating distributed botnets. These botnets would be capable of running AI workloads without the need for traditional data centers.
Microsoft has released the Windows 10 KB5126657 extended security update, containing the October 2026 Patch Tuesday fixes along with other bug fixes and changes. This update addresses security vulnerabilities and improves the stability of the operating system.
Microsoft released patches for 1,417 vulnerabilities on October 13, 2026. Of these, 76 are rated critical, with 7 requiring no customer action. One vulnerability was publicly disclosed before the patch release, and another is already being exploited.
