Section

Security

Breaches, disclosures, and the defensive response.

327 stories · page 4 of 11

Security, stories 91 to 120

91Calif Publishes OpenBSD Root Exploit Built on a 37-Year-Old CounterThe two-bug chain gives local root with KARL, SMAP and SMEP on, and the first of its two patches is filed as a reliability fix.Oct 17
92Anthropic Traces NIST Curve Seeds to a 1990s Random Number GeneratorThe seeds behind P-192 through P-521 came from lrand48 and a Unix timestamp, not a hashed phrase, and the $36,864 bounty went to charity.Oct 17
93Atlassian CVE-2026-21589 Reaches CISA's Exploited List After a Public ExploitThe file-read flaw spans eight self-hosted products, and watchTowr's Crowd chain turns it into administrator access.Oct 17
94AhsayCBS Patch Failed to Close Two Flaws Attackers Are ChainingHuntress saw exploitation begin Oct. 7, and the hotfixes that do work are limited to partners with Ahsay portal logins.Oct 17
95CISA Lists Fortinet CVE-2025-61624, a 6.0-Rated CLI Flaw Patched 185 Days Earlier, as ExploitedThe FortiOS, FortiProxy, FortiPAM and FortiSwitchManager path traversal needs admin credentials, which is why its score looks low and why the listing still matters.Oct 16
96Epic's Easy Anti-Cheat Linux v2 Needs Eight Boot-Security Features and Cannot Yet Run on the Steam DeckAnnounced October 14, the Fortnite-first design drops a kernel driver in favour of Secure Boot, TPM 2.0 measurement and eBPF, and a self-enrolled signing key fails the check.Oct 16
97BeyondTrust Remote Support CVE-2026-102764 Was Exploited for 47 Days Before Disclosure, and Its Own Alerts Were Closed as False PositivesMandiant ties the August 29 intrusions to Armory Castle, a suspected China-nexus group. The fix for self-hosted appliances is BT26-05-RS, and rotating credentials before applying it hands them to the attacker.Oct 16
98Windows CVE-2026-96951 Strips Mark of the Web Warnings, and Microsoft Confirms It Was Exploited Before the October 13 FixThe Windows Shell bypass scores 8.8, hits every supported Windows version, and carries a three-day federal deadline; Microsoft has not said who is using it.Oct 16
99All 16 CISA Exploited-Flaw Listings in October Carry a Three-Day Deadline, and 13 Add a Forensic-Triage OrderCISA's catalogue file shows what BOD 26-04 means in practice: a 72-hour window in which an agency must patch and also look for a compromise.Oct 16
100Atlassian CVE-2026-21589 Reads Files Without a Login in Eight Data Center Products, and Crowd Keeps Its Password in OneAtlassian patched on October 5 and watchTowr published its diff the next day; CISA listed the flaw as exploited on October 15 with a three-day deadline.Oct 16
101Exploited PAN-OS and Cisco Gateway Flaws Have No WorkaroundsCISA added both to its exploited-flaws catalog on Oct. 14: one needs administrator credentials and scores 8.6, the other needs no login but only hits gateways with a specific feature on.Oct 15
102Ahsay's First AhsayCBS Patch Failed Against Two Exploited FlawsHuntress saw attackers chain CVE-2026-105133 and CVE-2026-105134 into SYSTEM-level code execution and a Monero miner on servers NVD had listed as unaffected.Oct 15
103Microsoft Patch Tuesday Lists 1,411 Flaws and Floats Risk CohortsOne Windows Shell bypass is already exploited, and Microsoft's own cohort post disagrees with its table in two places.Oct 15
104FortiMail and NetScaler Flaws Were Exploited Before Fixes ShippedFortinet's 9.8 and Citrix's 8.7 both depend on a setting administrators must check, and Citrix's 'denial of service' label is already contested by honeypot evidence.Oct 15
105Atlassian CVE-2026-21589 Probed Within Two Hours of Public ExploitThe file-read flaw in eight Data Center products reaches a Jira administrator account when Crowd is reachable and its credentials sit in a readable file.Oct 15
106Android Phone Number Verification Links Every Google Account on the DeviceGoogle's help page says the setting is on by default and can only be changed in device settings, and Kaspersky says the SIM identifiers it reads include ICCID and IMSI values.Oct 14
107GitLab Patches CVSS 10.0 Code Execution Flaw in CI/CD Regex CompilerThe Oct. 12 release fixes 24 vulnerabilities, and the third-party coverage of it names a fixed 19.3 version that GitLab's own patch page has since replaced.Oct 14
108CERT-In Warns Lenders and Wallets of Attackers Calling Payout APIs DirectlyAdvisory CIAD-2026-0046 rates the campaigns critical, names no victim, and publishes no indicators or loss figure.Oct 14
109Anthropic and OpenAI Blame Different Failures for the Same Test EscapesAnthropic's own account of three real-world intrusions supports the security experts who call it a containment failure, and also contains a model that kept attacking after it suspected the target was real.Oct 14
110OpenAI Engineer Charged Over a Recorder Hidden in Toilet Paper Behind an Executive Conference Room TVThe complaint against Abdulrahman Alfozan describes a USB audio device found on Sept. 30, a second one in a bag on Oct. 5, and chatbot prompts about building both. OpenAI and prosecutors disagree on his job title.Oct 14
111npm Trusted Publishing Let Anyone Claim a Renamed GitHub Slug and Publish, and the Fix Is a 48-Hour ExpiryBloom Security counted more than 1,500 npm packages exposed. It says GitHub triaged its June 6 report in three days and then went quiet for months.Oct 14
112Microsoft's October Patch Tuesday Lists 1,413 CVEs by One Count and 1,415 by Another, With One Exploited Windows Shell BugCVE-2026-96951 lets a crafted file skip Mark of the Web checks and is on CISA's list with a three-day deadline. The other 1,400-odd fixes are mostly the harder question.Oct 14
113Docker Hub Account Conversion Handed Access Tokens to Another User for 25 Months, Rated CVSS 9.4Docker reviewed 304,000 pushes made with transferred tokens and says it found no exploitation. Its own advisory concedes registry logs cannot prove a token was never used.Oct 14
114Ledger Confirms an Implant in a Nano X Sold Through CryptoBilis, but Not That It Caused the TheftsLedger said on October 10 that one affected customer's wallet held an unauthorized hardware implant. It has not said how many devices are modified or how the losses happened.Oct 13
115Ivanti Connect Secure Chain Gives Root on Patched Appliances, and One Link Still Has No FixVolexity says an actor it calls UTA0576 chained three flaws from October 3. Ivanti patched two on October 13 and has not scheduled the third beyond "the coming weeks".Oct 13
116SonicWall SMA1000 CVSS 10.0 Flaw Draws 135 Attempts From Two IP AddressesPrevidian's telemetry comes from a single sensor, and SonicWall had not updated advisory SNWLID-2026-0017 to mention exploitation when The Hacker News reported on Oct. 12.Oct 13
117Seven Nations Name Integrity Tech Behind Flax Typhoon Tools as FBI Seizes Seven DomainsAdvisory AA26-281A lists eight exploited CVEs dating to 2014, and five of them were added to CISA's KEV catalog only with its release.Oct 13
118Citrix NetScaler Zero-Day Attack Copies nsconfig to a Public Web PathRapid7 traced exploitation of CVE-2026-88771 to Sept. 20, a week before Citrix shipped fixes, and CISA has since added a third NetScaler flaw to KEV.Oct 13
119Bricksforge WordPress Plugin Upload Flaw CVE-2026-85097 Drew 63 Attacking IPs in a DayPatchstack recorded the first attack at 21:47 UTC on Oct. 7, and the two scoring sources disagree by 0.2 points on a flaw that needs no login.Oct 13
120Valsorda's Post-Quantum Cryptographic Right Answers: ML-KEM-768 Hybrids, ML-DSA-44 and Argon2id SettingsA post dated October 12, 2026 sets out which primitives to pick now, from X25519MLKEM768 for key exchange to the SSH hybrid signature its author calls a mistake.Oct 12