📰 BleepingComputer
Tailscale warns of SSH flaws allowing root privilege escalation
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]
#CyberNews #Infosec
Tailscale warns of SSH flaws allowing root privilege escalation
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]
#CyberNews #Infosec
BleepingComputer
Tailscale warns of SSH flaws allowing root privilege escalation
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more.
📰 BleepingComputer
The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention...
#CyberNews #Infosec
The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention...
#CyberNews #Infosec
BleepingComputer
The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack…
🔴 CVE Digest — 27 Oct 2026
4 critical vulnerabilities
🔴 CVE-2026-117603 · CVSS 9.3
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows...
🔴 CVE-2026-117601 · CVSS 9.3
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing...
🔴 CVE-2026-117564 · CVSS 9.8
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge...
🔴 CVE-2026-65145 · CVSS 10.0
NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This...
#CVE #Critical #Vulnerability
4 critical vulnerabilities
🔴 CVE-2026-117603 · CVSS 9.3
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows...
🔴 CVE-2026-117601 · CVSS 9.3
Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing...
🔴 CVE-2026-117564 · CVSS 9.8
nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge...
🔴 CVE-2026-65145 · CVSS 10.0
NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-117603 - Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent…
📰 BleepingComputer
Warp discloses breach exposing AI agent logs, user telemetry data
Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure. [...]
#CyberNews #Infosec
Warp discloses breach exposing AI agent logs, user telemetry data
Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure. [...]
#CyberNews #Infosec
BleepingComputer
Warp discloses breach exposing AI agent logs, user telemetry data
Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure.
📰 Dark Reading
'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants
The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.
#CyberNews #Infosec
'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants
The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.
#CyberNews #Infosec
Dark Reading
'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants
The malware's focus on AI tools expands the infostealer playbook, exposing AI sessions and developer infrastructure from a single compromised endpoint.
☁️ AWS Security Blog
Part 3 – Cybersecurity journeys: The work behind the work
The most important work I’ve done in cybersecurity would make for terrible television. There were no countdown clocks and no frantic typing, just a lot of careful reading, a lot of hard conversations, and the occasional quiet moment where everything finally clicked. That’s the part I want to show...
#AWS #CloudSecurity
Part 3 – Cybersecurity journeys: The work behind the work
The most important work I’ve done in cybersecurity would make for terrible television. There were no countdown clocks and no frantic typing, just a lot of careful reading, a lot of hard conversations, and the occasional quiet moment where everything finally clicked. That’s the part I want to show...
#AWS #CloudSecurity
Amazon
Part 3 – Cybersecurity journeys: The work behind the work | Amazon Web Services
The most important work I’ve done in cybersecurity would make for terrible television. There were no countdown clocks and no frantic typing, just a lot of careful reading, a lot of hard conversations, and the occasional quiet moment where everything finally…
🔴 CVE Digest — 27 Oct 2026
2 critical vulnerabilities
🔴 CVE-2026-116863 · CVSS 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site...
🔴 CVE-2026-103594 · CVSS 9.5
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote...
#CVE #Critical #Vulnerability
2 critical vulnerabilities
🔴 CVE-2026-116863 · CVSS 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site...
🔴 CVE-2026-103594 · CVSS 9.5
A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-116863 - WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.
📰 Dark Reading
Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills
Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.
#CyberNews #Infosec
Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills
Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.
#CyberNews #Infosec
Dark Reading
Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills
Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.
☁️ AWS Security Blog
AWS becomes first CSP to complete the Cloud High profile assessment with 172 services and features in scope
We continue to expand the scope of our assurance programs at Amazon Web Services (AWS) and are pleased to announce the successful completion of our first ever Cloud High (PBHH) security assessment with 172 assessed services and features. Completion of this assessment, effective September 18, 2026,...
#AWS #CloudSecurity
AWS becomes first CSP to complete the Cloud High profile assessment with 172 services and features in scope
We continue to expand the scope of our assurance programs at Amazon Web Services (AWS) and are pleased to announce the successful completion of our first ever Cloud High (PBHH) security assessment with 172 assessed services and features. Completion of this assessment, effective September 18, 2026,...
#AWS #CloudSecurity
Amazon
AWS becomes first CSP to complete the Cloud High profile assessment with 172 services and features in scope | Amazon Web Services
We continue to expand the scope of our assurance programs at Amazon Web Services (AWS) and are pleased to announce the successful completion of our first ever Cloud High (PBHH) security assessment with 172 assessed services and features. Completion of this…
📰 BleepingComputer
Microsoft releases Windows OOB updates to distrust eMudhra certificates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]
#CyberNews #Infosec
Microsoft releases Windows OOB updates to distrust eMudhra certificates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]
#CyberNews #Infosec
BleepingComputer
Microsoft releases Windows OOB updates to distrust eMudhra certificates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.
🔴 CVE Digest — 27 Oct 2026
13 critical vulnerabilities
🔴 CVE-2026-48360 · CVSS 9.6
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could...
🔴 CVE-2026-114595 · CVSS 9.8
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be...
🔴 CVE-2026-108142 · CVSS 9.1
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
🔴 CVE-2026-108015 · CVSS 9.1
Private keys for eight eMudhra intermediate CA certificates have been compromised...
🔴 CVE-2026-108014 · CVSS 9.1
Private keys for eight eMudhra intermediate CA certificates have been compromised...
🔴 CVE-2026-106076 · CVSS 9.0
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of...
🔴 CVE-2026-105781 · CVSS 10.0
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL...
🔴 CVE-2026-105780 · CVSS 9.9
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary...
🔴 CVE-2026-105779 · CVSS 9.1
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL...
🔴 CVE-2026-105489 · CVSS 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL...
🔴 CVE-2026-104354 · CVSS 9.1
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL...
🔴 CVE-2026-104353 · CVSS 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS...
🔴 CVE-2026-104351 · CVSS 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability...
#CVE #Critical #Vulnerability
13 critical vulnerabilities
🔴 CVE-2026-48360 · CVSS 9.6
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could...
🔴 CVE-2026-114595 · CVSS 9.8
In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be...
🔴 CVE-2026-108142 · CVSS 9.1
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
🔴 CVE-2026-108015 · CVSS 9.1
Private keys for eight eMudhra intermediate CA certificates have been compromised...
🔴 CVE-2026-108014 · CVSS 9.1
Private keys for eight eMudhra intermediate CA certificates have been compromised...
🔴 CVE-2026-106076 · CVSS 9.0
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of...
🔴 CVE-2026-105781 · CVSS 10.0
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL...
🔴 CVE-2026-105780 · CVSS 9.9
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary...
🔴 CVE-2026-105779 · CVSS 9.1
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL...
🔴 CVE-2026-105489 · CVSS 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL...
🔴 CVE-2026-104354 · CVSS 9.1
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL...
🔴 CVE-2026-104353 · CVSS 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS...
🔴 CVE-2026-104351 · CVSS 9.9
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-48360 - Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code.…
📰 BleepingComputer
Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]
#CyberNews #Infosec
Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]
#CyberNews #Infosec
BleepingComputer
Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout.
📰 Dark Reading
Email Bombing, External Teams Chats Form Repeatable Access Path
A common mix of impersonation, domain infrastructure, and trusted software is helping attackers scale Microsoft Teams intrusions across organizations.
#CyberNews #Infosec
Email Bombing, External Teams Chats Form Repeatable Access Path
A common mix of impersonation, domain infrastructure, and trusted software is helping attackers scale Microsoft Teams intrusions across organizations.
#CyberNews #Infosec
Dark Reading
External Teams Chats Anchor 15-Minute Malware Delivery
Main bombing sis getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.
🔍 Zero Day Initiative
ZDI-26-811: MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-114552.
#ZeroDay #Vulnerability
ZDI-26-811: MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-114552.
#ZeroDay #Vulnerability
🔍 Zero Day Initiative
ZDI-26-810: MailEnable Auth Cleartext Storage Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-114551.
#ZeroDay #Vulnerability
ZDI-26-810: MailEnable Auth Cleartext Storage Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.9. The following CVEs are assigned: CVE-2026-114551.
#ZeroDay #Vulnerability
🔴 CVE Digest — 27 Oct 2026
1 critical vulnerability
🔴 CVE-2026-112352 · CVSS 9.1
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote...
#CVE #Critical #Vulnerability
1 critical vulnerability
🔴 CVE-2026-112352 · CVSS 9.1
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote...
#CVE #Critical #Vulnerability
cvefeed.io
CVE-2026-112352 - Sunhillo SureLine Authentication Bypass via Session Cookie
Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random…
📰 Dark Reading
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
#CyberNews #Infosec
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
#CyberNews #Infosec
Dark Reading
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
📰 Dark Reading
SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.
#CyberNews #Infosec
SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.
#CyberNews #Infosec
Dark Reading
SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and services to respond to supply chain compromises.
📰 BleepingComputer
OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests
OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems. [...]
#CyberNews #Infosec
OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests
OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems. [...]
#CyberNews #Infosec
BleepingComputer
OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests
OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems.
📰 BleepingComputer
UNM Health ransomware attack disrupts patient care, surgeries
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]
#CyberNews #Infosec
UNM Health ransomware attack disrupts patient care, surgeries
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]
#CyberNews #Infosec
BleepingComputer
UNM Health ransomware attack disrupts patient care, surgeries
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities.