ls ./category/security --page 2
Breaches, vulnerabilities, malware and the patches that matter.
GitGuardian's update records about 1,900 compromised GitHub accounts and more than 30,000 repositories targeted on 8 and 9 October. The number missing from every headline is how many secrets the campaign actually took, and the one wave with a published answer makes the gap look enormous.
XBOW's six-day, AI-assisted Chrome exploit chain was reported everywhere this week. Google's own issue tracker carries the part that was not: what the Vulnerability Rewards Program paid for each of the three bugs on its own, and which of them never got a CVE at all.
Ahsay has confirmed that the build it shipped for two exploited backup-server flaws did not address them. A hotfix exists and Huntress has verified it. We reported on 12 October that no patch was available, which was already wrong by two days — this is why.
An unauthenticated attacker sends an email to a Cisco Secure Email Gateway, and a path traversal in the malware-scanning path writes arbitrary files and executes commands as root. Scored 9.8, exploited, and there is a fix that needs no reboot.
CVE-2026-0322 is a code injection in the PAN-OS management interface that gives root. It needs valid credentials, which sounds like a barrier until you ask the question the requirement actually raises: who can reach that interface at all.
Progress published 31 MarkLogic vulnerabilities at once, five of them critical, and the theme running through the worst is delegated administrators reaching full control. There is no workaround, the 12.0 line has no fix, and the upgrade notes warn that privileges will disappear.
iVerify found a new variant of the DarkSword iOS chain that steals keychain contents and cryptocurrency wallet data. The original was documented in March as targeted tooling. This one is delivered by malicious ads to whoever visits the page.
Trusted Publishing was the thing everyone was told to adopt because it removes long-lived tokens. It verified publishers by GitHub repository name rather than by the repository's permanent id, so a renamed or deleted repo could be taken over and used to publish to an existing package.
Volexity documented a three-stage zero-day chain against Ivanti Connect Secure. Two stages were patched on 13 October under one identifier. The third, a privilege escalation to root, is still open — and Ivanti's own integrity checker does not see any of it.
October's Patch Tuesday is the largest on record by a wide margin. One flaw is being exploited and carries a three-day federal deadline — and CISA's own catalogue describes it differently from every write-up of it.
SOCRadar tracked a Russian-speaking access broker running Cobalt Strike alongside an AI orchestration layer against Ukrainian infrastructure and WordPress sites worldwide. The research exists because the operator left a directory listing open, including the AI session logs.
GitLab shipped emergency patches for a flaw scored 10.0 in its CI/CD regular expression compiler, reachable without authentication. Self-managed installations are the exposed population — and sources disagree on which 19.3 release actually contains the fix.
Cisco Talos documented a spear-phishing campaign against people at Taiwanese research institutes that steals authenticated Google sessions in real time. The lures came as event invitations, some as QR codes on altered posters. Talos analysed three emails and is careful about what that proves.
ReliaQuest names Qilin and a newer operation called Settra as exploiting a GlobalProtect authentication bypass that Palo Alto disclosed in May. Nothing about the vulnerability is new. What is worth reading is that patching does not close the sessions a forged cookie already opened.
Socket's latest GhostAction wave commits a credential-stealing GitHub Actions workflow straight to default branches. The payload is reusable, but the attackers read each repository's existing workflows first to learn which secret names to ask for. The October variant also sweeps the full git history.
Huntress saw attackers chaining two AhsayCBS flaws into SYSTEM-level code execution on 7 October, three days after NVD published them. There is no patch, every version through 10.3.4 is affected despite earlier reporting, and the remediation advice is to re-image from a trusted backup.
Comparitech's third-quarter ransomware count is the highest it has recorded. Nine out of ten entries in it are unconfirmed claims posted by the gangs themselves, which makes the number a measure of how much they are claiming as much as how much they are doing.
The owner of MonsterCloud, a firm that sold ransomware recovery as an alternative to paying, has been charged with wire fraud. The indictment alleges he paid the attackers 8 million dollars for keys and billed victims 19 million. He has pleaded not guilty.
A critical flaw in LMCache, the key-value cache layer used in front of vLLM inference servers, lets an unauthenticated attacker run code with a single crafted message. There is a public proof of concept, no patched release, and the container images run as root.
Three country-code registries were compromised and unauthorized HTTPS certificates were obtained for Google domains and others. No certificate authority broke a rule. Domain control validation proves control of a name, and for a while the attackers had it.
ESET's samples of MATCHBOIL, a downloader used by the Russia-aligned group UAC-0099 against Ukrainian targets, carry timestamps from April 2024 — more than a year before CERT-UA first documented the tool. Newer builds poll for a fresh payload every two minutes and refuse to run under analysis.
Apiiro counts 17,610 GitHub repositories in the revived FakeGit campaign, more than double July's figure. The scale did not come from mass registration: in about 34 hours the operator re-pointed repos that were already there, and in 97 percent of sampled commits the only thing touched was the README.
Bitdefender found an ad-fraud component shipped inside the firmware of low-cost Android handsets, posing as a core system app with permissions to install and remove software silently. Thousands of devices in more than 150 countries, and no way for the owner to uninstall it.
Double Counter, an anti-abuse bot used across large Discord communities, was breached on 4 October through a publicly reachable Metabase instance on an old host from its previous setup. The attacker forged an admin session, reached a cloud key, and copied records on about 28 million accounts.