Chinese bootkit defeats Secure Boot via skipped revocation
Diplomatic targets in Central Asia were infected by a firmware implant that exploits an unblocklisted certificate most admins never revoked.
The Latest
Ransomware brokers ran their intrusions through an AI kill chain framework
An exposed server laid bare 133 sessions of AI-assisted break-ins with a human approving each step.
Ransomware crews keep walking through an old Palo Alto MFA bypass
Months after the PAN-OS fix shipped, Qilin and Inc affiliates still log in with stolen sessions and then encrypt the…
Oracle’s October update carries 1,295 fixes and six top-severity holes
Unauthenticated attackers can take over E-Business Suite, SOA Suite, Access Manager and JD Edwards across a single quarter's patch batch.
Dead updater disabled on millions of PCs nobody owned
An abandoned Popcorn Time updater ran as SYSTEM and fetched code over plain HTTP, making it a ready-made botnet for…
Ruby patched three regex bugs behind GitLab’s four critical CVEs
Any application that compiles a regular expression from untrusted input is exposed, not just GitLab.
Linux SMB patch lagged two 9.0 flaws already public
KSMBD remote code execution bugs were posted to open mailing lists with no patches, and one needs no login at…
A Russian crew hid its command server inside a peer-to-peer mesh network
ESET caught a previously undocumented backdoor tunnelling through Yggdrasil before Sandworm wiped a Ukrainian logistics firm.
Atlassian’s October cleanup patches 75 flaws drawn from third-party components
October's bulletin addresses 75 unique CVEs inherited from bundled components across Data Center and Server products, pushing admins through another…
Quest Diagnostics joins the growing list of breached labs
The laboratory giant said it found an intrusion in one of its systems this week and that patient records were…
An Iranian crew parked its servers on US hosting again
Iran's dissident-tracking espionage crew is back online and running a control server from American commercial hosting for the first time in a decade.
A read-only tenant login is enough to own VeloCloud
Arista patched an exploited SQL injection in VeloCloud Orchestrator that lets the lowest-privilege account become a superuser operator.
Britain drafts 14-year terms for cutting cables at sea
A 12-week consultation proposes prison time, unlimited fines and new security duties for operators of the cables carrying 99 percent…
Capcom resets 196 accounts after 11.7 million ID records spill
Attackers took email addresses and login metadata for 11,774,247 CAPCOM ID records, then quietly changed passwords on 196 accounts.
Spotlight
A filename, not an image, trips Pillow into running commands
Pillow 13.0.0 closes a Ghostscript path where the name of an uploaded EPS file decides whether a server runs someone else's commands.
A regex overflow puts every GitLab version back in scope
CVE-2026-110264 scores 10.0, reaches back to 2014 and lands one patch above the update admins applied nine days ago.
Small header batches blow up HTTP/3 servers in memory
Seven of ten HTTP/3 stacks cap compressed headers but not the unpacked result, so a slim request can eat gigabytes of memory.
Node’s bundled Brotli decoder takes a hostile input path
Node bundled a Google library with an out-of-bounds write, and version 20 and older will never see the fix.
Features
A Signal call keeps listening when the queue will not stop
A critical RingRTC bug lets the other party flood the call's event queue so a hang-up never lands, leaving the…
OpenCode shipped the fix but left scanners with nothing to see
Builds 1.0.137 through 1.18.32 can run a command from a malicious MCP server at sign-in, and no CVE was filed…
LiteLLM’s release pipeline leaked its way into a backdoor
A stolen GitHub token rewrote LiteLLM's release workflow, and version 1.107.0 ran a credential stealer the moment Python started.
Behind the ConnectWise breach, an AI toolkit ran the intrusion
Microsoft tied the ConnectWise Cloud Backup break-in to a China-state crew that drove reconnaissance and credential attacks with an agentic…
Curl sends low-severity security reports straight to GitHub
From October 26 most reports go straight into the public repository, because maintainers can no longer keep up.
OpenAI’s own agents weakened the monitors watching them
Two internal October incidents show coding agents reading instructions as permission to strip safeguards.