ls ./category/security
Breaches, vulnerabilities, malware and the patches that matter.
Sekoia found a Russian watering hole campaign serving iOS and Android exploit chains. All ten vulnerabilities it used are in the federal catalogue of exploited flaws, and nine were listed before the research was published.
Xen Security Advisory 523 describes arbitrary cross-domain read and write with no known mitigation, affecting every release since 4.6. The credits name Anthropic using Claude, and a second AI team that reported the same flaw independently.
CVE-2026-109518 gives an on-path attacker root on Debian and Ubuntu machines. It needs a retry setting that has been the default since Debian 12, which means the older releases are the safe ones.
ESET found a China-aligned group hijacking DNS for a Sogou Input Method update host, rewriting the integrity fields to match its own payloads and side-loading an implant. Tencent fixed it in version 16.10.
A High-severity Strong Parameters bypass in Action Pack is an incomplete fix of a 2020 advisory. That advisory corrected three iteration methods and left the fourth delegating to the raw hash.
CVE-2026-98432 is a use-after-free in the IPv4 TCP path, reachable with a SYN packet carrying an IP option almost nobody uses. The only score on the record is the kernel's own, and it comes with a justification for every metric.
CISA added WordPress Core to the exploited catalogue on 3 November with a 6 November deadline. The flaw is in the core upgrade process itself, and it is the third WordPress Core entry this year.
A second wave hit on the night of 1 November. The research underneath it is public and specific: a hidden daily password in a refrigeration controller, and 2,765 of them reachable from the internet.
Two tampered builds of a Claude Code-branded extension were available from the Cursor marketplace for eleven hours. Microsoft took the loader apart, and the most interesting finding is that it mostly did not work.
The notice is four sentences long. No CVE, no versions, no count, no malware name. Meanwhile Synology has never had a single entry in the federal catalogue of exploited vulnerabilities.
BOD 26-04 revoked the policy behind the 21-day remediation window. The catalogue stopped using 21 days in April 2026, two months before the directive, and under the new table a KEV entry can only ever get three days or fourteen.
CVE-2026-41709 is an insufficient logging bug in VMware ESX. VMware scored it 2.7 LOW, NVD never scored it at all, and it is now in the KEV catalogue, reportedly after use by a China-linked group.
CVE-2026-111497 is a 9.8 in the compression library inside every browser. The commit that fixes it was pushed to public master on 27 February and no release carried it for 236 days.
Check Point found fake GitHub projects offering desktop apps for ChatGPT and Claude. The installers inside are genuinely signed. The DLL next to them reads a Telegram profile picture to work out where to call home.
The October release fixed ten CVEs. Three are TLS hostname bypasses, between them naming six non-canonical ways to write 127.0.0.1, and four of the ten say an earlier fix did not hold.
Sony Network Communications published the numbers on 27 October: 2,585,481 member records, four mail services with separate password totals, 16 bank entries and 7 reset letters. The precision is the part worth copying.
GMO Internet Group published its response policy on 28 October. It will not meet the attacker's demands, it has created a one million dollar bounty for information leading to an arrest, and it is paying its own customers.
Enclave published AuthMask on 23 October. A zero-permission Android app could say it was Teams and have Microsoft Authenticator hand over the work account's tokens, including the scopes that create and delete passkeys.
CISA added two more Ivanti Connect Secure flaws on 30 October. Ivanti's advisory says the exploitation it saw used all three chained, and the versions it shipped in October as the fix are listed as affected by the new pair.
Mandiant published its AOMEI investigation on 15 October. The attacker never parked malware on the update server: they edited a config file for five to ten minutes at a time, served whoever polled, and reverted it.
Talos published its Q3 2026 incident response trends on 29 October. Insufficient logging led the weakness list at over 40 percent of engagements, ahead of credential management and MFA gaps, both on 33 percent.
Talos published KeyDrift on 28 October: a framework that hooks the SD-WAN daemon, lifts what it assesses to be AES-256 data-plane key material, and takes its orders over the control plane itself. The way in was patched in February.
CVE-2026-97229 is a 10.0 that CISA listed on 29 October, due 1 November. GitLab patched it on the 12th. The underlying Onigmo overflow produced four GitLab CVEs and no Ruby ones, so GitLab's numbers are the only ones a scanner can match.
Counted from CISA's own feed: 1,762 entries, 278 of them added in 2026, 94 carrying a forensic triage flag that did not exist before June. Arista's VeloCloud Orchestrator holds three of the 94.