Overview of incoming advisories.
2186 results found
Plex Media Server versions v1.43.2 and earlier contain an external control of file name or path vulnerability (CVE-2026-96656) that allows an admin user to write arbitrary files which may be executed on load. This vulnerability is part of a chain that includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. The vulnerability was disclosed via the Plex forums and listed by CISA. It is subject to BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements are also outlined under BOD 26-04 implementation guidance. The chaining of these CVEs increases the overall risk and potential impact significantly. Affected users are urged to update to a patched version of Plex Media Server immediately.
View original advisory →EG Secure Solutions SiteGuard Server Edition contains a critical OS command injection vulnerability tracked as CVE-2026-106931. The flaw allows attackers to execute arbitrary OS commands with root or SYSTEM-level privileges on affected systems. This vulnerability poses a severe risk as successful exploitation grants full administrative control over the host system. The vulnerability has been flagged by CISA and is subject to BOD 26-04 prioritization requirements. EG Secure Solutions has published an advisory with remediation guidance. Organizations running SiteGuard Server Edition are urged to apply security updates immediately. The vulnerability is also documented in the NVD database.
View original advisory →Nikkei Inc. disclosed a third data breach within approximately one month, exposing 1.83 million personal information records. This represents a pattern of repeated security incidents at the Japanese media conglomerate in a short timeframe. The scale of exposure, nearly 1.83 million records, indicates a significant compromise of personal data. The repeated nature of the breaches suggests systemic security weaknesses within Nikkei's infrastructure. This incident highlights the challenges organizations face in fully remediating breaches and preventing subsequent incidents. The disclosure follows two prior breaches within the same month, raising concerns about the company's incident response and security posture.
View original advisory →The Rank Math PRO WordPress SEO plugin was compromised in a supply-chain attack, with malicious downloads distributed directly from the vendor's official website. The malware planted hidden backdoors on affected WordPress sites. This represents a significant supply-chain risk as the plugin is widely used across many WordPress installations. The attack was discovered last week and highlights ongoing threats targeting WordPress plugin ecosystems. Website administrators using Rank Math PRO are advised to verify their installations and check for signs of compromise.
View original advisory →Hackers compromised AOMEI's update servers to distribute malware through a built-in promotional feature in AOMEI's backup software. The attackers tampered with configuration files to push malicious content to users, then restored the files to their original state to conceal the attack. This represents a supply chain attack leveraging trusted software update infrastructure. Users of AOMEI backup products who received updates during the compromise window may have been exposed to malware. The stealthy nature of the attack, with files being restored after tampering, suggests a sophisticated threat actor attempting to minimize detection. The incident highlights risks associated with software update mechanisms and promotional features embedded in applications.
View original advisory →Threat actors are actively exploiting a chain of four vulnerabilities in Plex Media Server, collectively dubbed Plex2Shell, to deploy cryptocurrency miners and reverse proxy backdoor software on affected systems. The exploitation began just one day after a public proof-of-concept (PoC) was released by a researcher known as boredhackerblog. The attack chain involves chaining four distinct vulnerabilities together to achieve code execution and persistence. The deployment of crypto miners indicates financial motivation, while the Linux proxy backdoor suggests the attackers may also be building infrastructure for further malicious activity. The rapid exploitation following PoC release underscores the urgency for Plex Media Server users to apply patches immediately. This campaign highlights the ongoing risk posed by media server software exposed to the internet.
View original advisory →The popular WordPress SEO plugin Rank Math PRO was compromised in a supply chain attack. Malicious copies were distributed via the official rankmath.com website and as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. The tampered plugin versions contained malware designed to install a self-restoring backdoor on affected WordPress sites. Any site that installed and activated one of the compromised versions should be treated as fully compromised. Rank Math issued a security notice on October 16 disclosing the incident. The self-restoring nature of the backdoor makes remediation particularly challenging, as simply removing the plugin may not fully clean the infection.
View original advisory →Wiz explores the critical gap between when supply chain zero-days occur and when they are officially detected or assigned CVEs. The article highlights how malicious code injected into trusted packages can rapidly propagate through developer environments and beyond. Wiz introduces its supply chain pipeline capability that monitors and identifies compromised packages at the point of publication, enabling security teams to detect zero-day supply chain compromises proactively. The solution integrates with Wiz Defend to provide early warning before a CVE is formally published. This approach addresses a significant blind spot in traditional vulnerability management, where teams typically rely on CVE publication as a trigger for response. By closing the detection gap, organizations can reduce their exposure window to supply chain attacks significantly.
View original advisory →This weekly cybersecurity recap covers a broad range of high-impact incidents and vulnerabilities. Key highlights include 98 zero-day vulnerabilities, rogue AI agents being weaponized, a $100 million cryptocurrency theft, and a supply chain attack affecting 700 supermarkets. The article emphasizes that threats often arrive through trusted services, hardware, and overlooked systems. Old vulnerabilities are finding new victims, and hardware security is increasingly a concern. The recap underscores the pervasive and stealthy nature of modern cyber threats across multiple sectors.
View original advisory →The GhostAction threat actor has expanded its supply chain attack campaign beyond injecting malicious GitHub Actions workflows. The group is now targeting open-source developers by phishing them and delivering credential-stealing malware disguised as a fake font file. The campaign has been observed across 94 GitHub repositories. Research from OpenSourceMalware indicates the attackers are actively evolving their tactics in response to detection and mitigation efforts. The shift from workflow injection to font-disguised stealers represents a notable refinement in their operational approach. This campaign poses a significant risk to open-source developers and the broader software supply chain.
View original advisory →Wiz's Cloud Incident Response Team (CIRT) investigated real-world AI-driven attacks targeting cloud environments, Kubernetes clusters, CI/CD pipelines, and identity systems. The attacks were characterized as loud, fast, and widespread, leveraging AI to accelerate and broaden attack scope. The article provides an anatomical breakdown of how these attacks behave across multiple infrastructure layers. Key focus areas include detection strategies for AI-assisted threat actors operating in cloud-native environments. The incidents highlight the growing risk of AI being weaponized to conduct sophisticated, multi-vector cloud intrusions. Organizations are advised to strengthen detection capabilities across cloud, container, and identity planes to counter these emerging threats.
View original advisory →A fake Web3 accelerator campaign has been discovered distributing information-stealing malware and backdoors targeting both Windows and macOS systems. The attackers used malicious npm packages as the delivery mechanism, luring victims with promises of free AI credits for Anthropic Claude and Google Gemini, coding tools, and security audits. The malware delivered included information stealers and backdoors capable of hijacking AI agent traffic. The campaign was identified and reported by Elastic security researchers. This represents a supply chain attack leveraging the npm ecosystem combined with social engineering around AI and Web3 themes to increase credibility. The use of legitimate AI brand names (Claude, Gemini) as bait indicates sophisticated targeting of developers and tech-savvy users. Both major desktop operating systems are affected, broadening the potential victim pool significantly.
View original advisory →A critical unpatched vulnerability in Broadcom's Wi-Fi setup software allows an attacker within radio range to execute arbitrary code as root on affected routers. No network password or pairing step is required to exploit the flaw. Security researcher Quentin Kaiser disclosed the vulnerability on October 16, demonstrating successful attacks against home gateways from three Belgian internet providers. In at least one case, the attacker was able to read the Wi-Fi password directly off the device. The vulnerability poses a significant risk to home and small office users relying on Broadcom-based routers. No patch has been released at the time of disclosure, leaving affected devices exposed. The attack is proximity-based, requiring the attacker to be within Wi-Fi radio range of the target device.
View original advisory →On the night of October 16, an intruder accessed a legacy system at OpenCode, potentially exposing third-party AI provider API keys stored by users in OpenCode Console. OpenCode Console is an optional hosted service that allows workspaces to store their OpenAI, Anthropic, or Google API keys, enabling team members to access AI models through a shared interface. The breach may have compromised sensitive credentials that users had saved within the platform. The incident raises concerns about the security of API key storage in third-party hosted services. Affected users may face risks of unauthorized usage of their AI provider accounts, potential cost exposure, and data privacy implications if the keys are misused.
View original advisory →OpenCode reported a security breach targeting Console users who had linked AI providers to their accounts. The attack involved a distillation attack technique, which likely involved extracting or manipulating AI model outputs or credentials. The breach specifically affected developer environments where OpenCode was installed. StepSecurity published guidance on how to detect OpenCode installations on developer machines and how to respond to the incident. The article provides both vendor-reported information and practical remediation steps for security teams. This incident highlights supply chain and AI integration risks in developer tooling environments.
View original advisory →Attackers are actively exploiting an OS command injection vulnerability in SiteGuard Server Edition, a web application firewall product. The flaw allows threat actors to execute arbitrary commands with root or SYSTEM-level privileges on affected servers. This represents a critical security risk as the WAF product, designed to protect web servers, is itself being weaponized against the systems it defends. The vulnerability enables full system compromise due to the elevated privilege level of command execution. Organizations running SiteGuard Server Edition are urged to apply patches or mitigations immediately. The active exploitation in the wild increases the urgency of remediation efforts.
View original advisory →ConnectWise has suspended its Cloud Backup service after unknown threat actors gained unauthorized access to ConnectWise application identities. The attackers used these compromised identities to access and compromise Microsoft 365 tenants belonging to ConnectWise customers. ConnectWise responded by disabling seven application identities, including ConnectWise Cloud Backup (506e08f9-6e9a-4da4-942b-a099a03644ae). An investigation is ongoing to determine the full scope of the incident. The suspension of the cloud backup service impacts customers relying on ConnectWise for Microsoft 365 data protection. The incident highlights risks associated with third-party application identities having access to cloud tenants.
View original advisory →ConnectWise has shut down customer access to its Cloud Backup service, formerly known as SkyKick Cloud Backup, following a security incident in which hackers accessed application identities. The attackers leveraged this access to compromise Microsoft 365 tenants belonging to ConnectWise customers. The incident is classified as a supply-chain attack, as the breach originated through ConnectWise's own infrastructure and affected downstream customers. ConnectWise took the service offline as a containment measure. The attack highlights the risks of third-party cloud backup and management tools having broad access to enterprise Microsoft 365 environments. Organizations using ConnectWise Cloud Backup are advised to review their Microsoft 365 tenant for signs of unauthorized access and review delegated application permissions.
View original advisory →Drupal has released patches for two critical remote code execution (RCE) vulnerabilities affecting all supported versions of the popular content management system. The vulnerabilities could allow attackers to execute arbitrary code remotely on affected websites. Drupal has warned that exploits may emerge soon following the disclosure, urging administrators to apply patches immediately. The flaws affect any supported version of Drupal, making the scope of potential impact significant given Drupal's widespread use across enterprise and government websites. No specific CVE identifiers were mentioned in the article summary, but the critical severity rating and RCE nature of the flaws make them high-priority targets for threat actors. Website administrators running Drupal are strongly advised to update to the patched versions as soon as possible to mitigate the risk of exploitation.
View original advisory →Cybersecurity researchers have identified a malicious npm package named 'imgdecode' as part of the MALFEX software supply chain attack campaign. The package was uploaded to the npm registry on September 30, 2026, by a user named 'malfexteste8'. It has been downloaded approximately 979 times and remains available on npm. The package hides a shellcode loader within a Windows native addon, making it particularly dangerous as it can execute arbitrary code on victim machines. This discovery highlights the ongoing risks associated with software supply chain attacks targeting the npm ecosystem. The campaign name MALFEX suggests a coordinated effort to distribute malware through legitimate package registries.
View original advisory →