1. Attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access, and CISA has added two of them to its Known Exploited Vulnerabilities catalog following active exploitation (thehackernews.com).
2. A malicious ChatGPT share link could run attacker code in a logged-in session and read private chats; OpenAI fixed the flaw eight days after it was reported and rated it P1 (thehackernews.com).
3. Cloudflare reported 18.2 million network-layer DDoS attacks in Q3 2026, up 38 percent, with about 8,226 attacks per hour (thehackernews.com).
4. Cloudflare detailed that only four weak keys are needed to break into unpatched connections using eMudhra certificates, and it has patched its own systems (blog.cloudflare.com).
5. Hackers leaked personnel data of over 41,000 US Homeland Security staff, including ICE and border agents (bitdefender.com).
6. Chinese state-sponsored threat actors are using an AI-powered Go-based penetration testing framework called ARTEX to target over 200 organizations worldwide (thehackernews.com).
7. TeamViewer fixed a flaw that lets a compromised host attack the computer that connects to control it, potentially crashing the viewer or running code (thehackernews.com).
8. A WordPress Core remote code execution flaw drew nearly 63,000 attack attempts in just 24 hours after patches were released (thehackernews.com).
9. Trezor warned of a suspected hardware implant in a Safe 5 wallet sold by reseller CryptoBilis that can send recovery phrases over a mobile network (thehackernews.com).
10. A critical Linux kernel flaw allows unauthenticated remote root attacks on servers running Multipath TCP listeners, with an exploit developed by Anthropic researchers (bleepingcomputer.com).
11. A malicious Claude Code extension on Cursor’s marketplace planted SSH backdoors, exposing up to 5,000 developers over about 11 hours (bleepingcomputer.com).
12. CISA said a maximum-severity GitLab flaw, CVE-2026-97229, is now exploited in the wild, and it was added to the KEV catalog (bleepingcomputer.com).
13. Fashion retailer Resolve said hackers stole customer payment card information in a recent breach (therecord.media).
14. Florida warned that 4.9 million people had Social Security numbers leaked in a breach of the Florida Student Financial Aid website (therecord.media).
15. Hackers are actively exploiting a highly critical Drupal Commerce Core authorization bypass flaw, CVE-2026-118539 (thehackernews.com).
16. Binance suffered a security breach impacting about 6.3 billion dollars in assets, linked to a compromised DevOps laptop, with nearly 3 billion frozen (thehackernews.com).
17. The Belarus-linked FrostyNeighbor APT launched a destructive attack in Ukraine, raising concerns about deeper alignment with Russian cyber objectives (darkreading.com).
18. The Syrian Electronic Army hacker Ahmad Umar Agha was sentenced to 42 months in prison for attacks on Western news outlets (thehackernews.com).
Be First to Comment