Poland pulls its national services portal offline to stop an attack
Poland took ePUAP offline after blocking an intrusion, cutting off public services while officials insist nothing was compromised.
The Latest
Google Cloud flags three side-channel bugs in AMD Turin servers
Three transient scheduler attacks reach fifth-generation EPYC chips, and one of them is new.
Apache rates an HTTP/2 module bug critical as exploit questions swirl
mod_http2 in versions up to 2.4.70 can hand a remote attacker control of the server process.
Thousands of GitHub accounts were used to poison CI pipelines
Stolen logins planted a secret scraper that harvested cloud keys from repository workflows.
A crafted cookie walked past Xen Orchestra logins and attackers noticed
Vates confirms in-the-wild abuse of an authentication bypass in its virtualization manager.
Two pings can crash a MongoDB replica set at the worst moment
A pre-auth use-after-free lands a segfault on a member just as it wins an election.
Glasswing found nearly 38,000 flaws but few are actually fixed
A researcher says the AI vulnerability programme is overwhelming maintainers with limited results.
A long path trick lets a hostile repo run code on clone
Recursive clones of a hostile repository can run an attacker's hooks through integer truncation.
A jailbroken AI agent ran a two-week intrusion at a European telco
Malbear Labs recovered the operator's whole working directory, including 70 session transcripts from an agent running on DeepSeek Flash.
Maersk traces a data theft claim to one legacy system
The shipping giant says the affected machine came from a previous acquisition and that it sees no sign of sensitive…
BroadWorks and Openwave flaws draw attacks as CISA sets deadlines
Attackers are working a 2021 Openwave bug and an August Cisco BroadWorks flaw that CISA now gives federal agencies until November 24 to close.
A mailing vendor’s breach handed out 2.2 million SEGA addresses
ARARA first told SEGA nothing had been exposed, then confirmed it days later after finding the full extent of an…
Two GitHub accounts pushed a fake audit workflow into thousands of repos
Socket found the credential-stealing workflow sitting in tens of thousands of repositories, including ones left untouched for a decade.
A few rewired neurons turn a helpful agent into a sleeper
Microsoft Research found a payload small enough to fit in a handful of weights, and a trigger that survives every…
Spotlight
Fireworks AI traces its second October breach to a cloud vendor
Billing records, datasets and partial model weights were exposed after attackers reached development systems through a hosting partner.
Fortinet closed nearly 100 holes including one that waits for a click
Eighty-nine advisories appeared in a single day, weeks after Fortinet put frontier AI models to work hunting defects in its own products.
Turla turned a Kazakh mail server into its own command post
ESET found Russia's Cereal toolset harvesting selected email inside two government Exchange servers, with no attacker-owned infrastructure to hunt.
A retired data platform still held the keys to customer clouds
Wiz traced a supply chain intrusion to Qubole's cross-account IAM roles, which stayed trusted long after organizations stopped using the service.
Features
An XML bug in Chrome is the eighth exploited this year
Google's latest desktop release closes a use-after-free in Chrome's XML component that attackers were already using.
Three days to patch two fresh additions to the KEV list
CISA flagged exploited flaws in IBM Aspera Faspex and SignalWire FreeSWITCH, both rated 9.8 and both newly patched.
An AI scanner found a decade old Rust standard library flaw
Microsoft's FORGE Lab used its agentic Hyenas tool to surface memory safety bugs in Rust's standard library, including one dormant…
Campus computers at Vanderbilt played a ransom recording
BYOD claimed the intrusion as university systems stayed restricted and students were told classes would continue as scheduled.
N-able pulled hosted N-central offline after 30 zero-days landed
A researcher published proof-of-concept exploits for more than 30 flaws in N-able's RMM platform, prompting the vendor to shut down…
SonicWall VPN logins that skip the identity provider land on a watchlist
Federal agencies have until November 20 to close an exploited SonicOS flaw that lets a password alone stand in for…