Overview of incoming advisories.
2179 results found
A newly identified advanced persistent threat group tracked as UAT-11473 has been observed actively exploiting CVE-2026-20127, an authentication-bypass vulnerability in Cisco Catalyst SD-WAN Controllers. The attackers leverage this flaw to deploy a custom malware framework named KeyDrift. The exploitation targets network infrastructure at the controller level, potentially enabling broad access to SD-WAN environments. The threat actor appears to be sophisticated, consistent with APT-level capabilities. The use of a custom malware framework suggests significant resources and intent behind the campaign. Organizations using Cisco Catalyst SD-WAN Controllers are at risk and should apply patches or mitigations immediately. The incident underscores the ongoing threat to network infrastructure from state-level or well-resourced threat actors.
View original advisory →A critical vulnerability tracked as CVE-2026-98432 has been discovered in the Linux kernel's TCP code, receiving a CVSS score of 9.8 out of 10. The flaw affects major Linux distributions including Ubuntu and Red Hat Enterprise Linux (RHEL). Notably, Anthropic disclosed on October 27 that its AI model was able to write a functional exploit leveraging this vulnerability. The exploit allows a remote, unauthenticated attacker to execute arbitrary commands as root on vulnerable Linux servers. This makes the vulnerability particularly dangerous as it requires no credentials and can be triggered remotely. The Linux kernel's own CVE team confirmed the severity rating. Patches and mitigations are expected to be distributed across affected Linux distributions.
View original advisory →CISA has issued a warning to federal agencies regarding a high-severity Linux kernel privilege escalation vulnerability known as Fragnesia. Attackers are actively chaining this flaw with PHP2Shell vulnerabilities in the wild. The advisory urges federal agencies to patch the Linux kernel bug promptly. The combination of Fragnesia and PHP2Shell represents a chained attack vector that increases the overall severity and risk. CISA's warning indicates active exploitation of these vulnerabilities in real-world attacks. The chaining of these two flaws could allow attackers to gain elevated privileges on vulnerable Linux systems. Federal agencies are directed to remediate these vulnerabilities as part of CISA's Known Exploited Vulnerabilities catalog guidance.
View original advisory →Hitachi Energy has disclosed two high-severity vulnerabilities affecting its TRO600 series products used in the energy sector. CVE-2026-10756 allows an authenticated attacker to bypass network access restrictions via port forwarding, enabling unauthorized access to localhost-bound services and sensitive functionality. CVE-2026-106087 is an arbitrary file read vulnerability exploitable by unauthenticated attackers, allowing reading or downloading of sensitive configuration files and password data. Both vulnerabilities carry CVSS v3.1 scores of 7.5 (HIGH). Affected versions include TRO600 up to 9.2.1.6 and 9.1.1.0. Fixes are available in versions 9.2.2.1 and 9.1.2.0. CISA recommends minimizing network exposure, isolating control systems behind firewalls, and using VPNs for remote access. The advisory was originally published by Hitachi Energy PSIRT and republished by CISA for increased visibility.
View original advisory →CISA has published an advisory regarding two vulnerabilities affecting Hitachi Energy CoreTec4 and CoreTec5 products. CVE-2026-13162 is an OS command injection flaw in the configuration daemon's timezone handler that allows authenticated users to execute arbitrary system commands with full device control. CVE-2026-43284, dubbed 'Dirty Frag', is a Linux kernel IPsec ESP subsystem vulnerability allowing local unprivileged users to escalate privileges to root by crafting malicious packets that cause kernel memory corruption. CoreTec5 versions 3.4.0 and prior are affected by both CVEs, while CoreTec4 versions 3.4.0 and prior are affected by CVE-2026-13162. The CVSS v3.1 scores are 7.5 (HIGH) and 8.8 (HIGH) respectively. Hitachi Energy recommends updating to CoreTec5 version 5.0.0 as the primary fix for both vulnerabilities. General network isolation and firewall mitigation measures are also recommended.
View original advisory →A remote code execution vulnerability was discovered in Telegram for Android by security startup NebuSec. The flaw allows an attacker with only an ordinary Telegram account to execute arbitrary code on a victim's device simply by having the victim answer a voice call. The vulnerability affects all versions of Telegram for Android prior to 12.10.4. Telegram patched the issue in version 12.10.4, released in late September 2026. NebuSec publicly disclosed the vulnerability on October 29, 2026. The attack requires minimal user interaction, making it particularly dangerous as victims only need to answer a call.
View original advisory →Cisco has released security updates to address a zero-day denial-of-service vulnerability affecting its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The flaw is being actively exploited by attackers to remotely crash vulnerable firewall devices. The vulnerability specifically impacts SSL VPN functionality, allowing remote threat actors to trigger a denial-of-service condition without authentication. Cisco confirmed the vulnerability is being exploited in the wild, making it a critical priority for organizations using these firewall products. Administrators are urged to apply the available patches immediately to protect their network perimeter devices.
View original advisory →Cisco has released patches for a high-severity vulnerability tracked as CVE-2026-76418 affecting its Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. The flaw carries a CVSS score of 8.6 and has been confirmed as actively exploited in the wild. Successful exploitation allows an unauthenticated, remote attacker to crash affected firewalls, potentially causing denial-of-service conditions. The vulnerability resides in the VPN component of the affected products. Cisco urges administrators to apply the patches immediately given the active exploitation status. Organizations relying on Cisco ASA or FTD for perimeter security and VPN termination are at elevated risk.
View original advisory →An attacker attempted to exploit a critical GitLab vulnerability (CVE-2026-97229, CVSS 10.0) targeting Alpine Linux's own GitLab server approximately one week after GitLab released a patch. The flaw allows remote code execution via a crafted regular expression embedded in a CI configuration file. Alpine Linux reported the attack but found no evidence of successful exploitation. The vulnerability is rooted in a Ruby-related issue that GitLab left exposed. The incident highlights the narrow window between patch release and active exploitation attempts. This is a maximum-severity vulnerability given its CVSS score of 10.0 and the nature of the exploit vector. Organizations running self-hosted GitLab instances are strongly advised to apply the patch immediately. The attack on Alpine Linux's infrastructure underscores the risk to open-source project hosting environments.
View original advisory →Hackers exploited a critical vulnerability in Cisco Catalyst SD-WAN to deploy custom malware named KeyDrift. The malware is specifically designed to steal encryption keys used to protect traffic between network sites. Cisco Talos disclosed the attacks on October 28, describing them as historical but without specifying exact dates. The vulnerability was patched by Cisco in February. KeyDrift stores the stolen encryption keys for later use, potentially enabling attackers to decrypt sensitive inter-site communications. The incident highlights the risk of delayed patching in critical network infrastructure components.
View original advisory →CISA added CVE-2026-41709, a VMware ESX vulnerability, to its Known Exploited Vulnerabilities catalog following CrowdStrike's disclosure of active exploitation. The threat actor, identified as Warp Panda, a China-nexus group, weaponized the zero-day in attacks targeting the U.S. legal sector. The exploitation was designed to reduce audit trail visibility, hampering forensic and investigative efforts. The vulnerability affects Broadcom VMware ESX hypervisor software. The inclusion in KEV signals urgent remediation requirements for federal agencies and critical infrastructure operators.
View original advisory →Palo Alto Networks has issued a warning that threat actors are actively exploiting PHP2Shell vulnerabilities in publicly-accessible management interfaces. The exploitation targets internet-exposed management interfaces of Palo Alto Networks devices. The company released an advisory update confirming active exploitation is underway. The vulnerabilities were recently patched, but unpatched or internet-exposed systems remain at risk. Organizations are urged to restrict access to management interfaces and apply available patches immediately. This represents a high-severity, actively exploited vulnerability in widely deployed network security infrastructure.
View original advisory →A large-scale investigation reveals 319 malicious browser extensions installed by approximately 13.4 million users that silently hijack browser default search engines and route queries through proxy servers. The extensions capture all user search queries and collect referral payments from Yahoo and Bing via search syndication partner IDs. These extensions are predominantly unlisted from the Chrome Web Store and distributed through paid advertising networks including Google Ads and Bidbrain. The operation has been running for nearly a decade, dating back to 2016, with multiple identified operators including Intango LTD, SecuryBrowse, and others. The proxy-based architecture allows operators to selectively redirect searches to potentially malicious pages, phishing sites, or malware lures. The Chrome Web Store has failed to adequately police this activity, with new extensions and domains appearing rapidly after takedowns. Researchers used Censys, Urlscan, and DecryptAds to systematically identify and attribute these campaigns to specific operators.
View original advisory →A critical vulnerability (CVE-2026-76418) exists in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software involving an unchecked return value leading to a NULL pointer dereference. An unauthenticated, remote attacker can exploit this flaw to cause the affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is related to tunnel processing functionality. CISA has flagged this under BOD 26-04, requiring prioritized security updates based on risk. Forensic triage requirements have also been outlined under BOD 26-04 implementation guidance. The issue is documented in Cisco's Security Advisory cisco-sa-asaftd-tunnel-dos-s6mgkb75 and tracked in the NVD. Organizations using Cisco ASA or FTD software should apply available patches immediately given the high criticality rating.
View original advisory →GitLab Community Edition and Enterprise Edition contain an integer overflow or wraparound vulnerability in the CI/CD regular expression compiler, rooted in the underlying Ruby/Onigmo regex engine. An unauthenticated attacker can exploit this flaw by submitting a specially crafted regular expression in a CI/CD configuration file, potentially leading to arbitrary code execution on the GitLab server. The vulnerability requires no authentication, making it particularly dangerous for publicly accessible GitLab instances. CISA has flagged this under BOD 26-04, indicating it is a priority for remediation. GitLab has released patch version 19.4.2 to address the issue. Other products using Ruby or the Onigmo regex library may also be affected by the same underlying flaw. Ruby's security team has published an advisory with additional details and fixes. Organizations are advised to apply the patch immediately and review forensic triage requirements per CISA guidance. The issue highlights the risks of insufficient input validation in CI/CD pipeline configurations.
View original advisory →The China-linked cyber espionage group Volt Typhoon has been linked to a covert access network called Silent Train, which was used in four zero-day exploitation campaigns. First identified in late 2023, Silent Train relies on rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to maintain stealthy access. The network has since been disrupted. Lumen Technologies Black Lotus Labs published a report attributing this infrastructure to Volt Typhoon. The campaigns focused on strategic access, consistent with Volt Typhoon's known mission of pre-positioning within critical networks. This activity underscores the group's continued use of living-off-the-land techniques and covert proxy infrastructure to evade detection.
View original advisory →Security researcher Orange Tsai of DEVCORE demonstrated a chain of logic flaws—without any memory corruption—that can escape Microsoft Edge's sandbox and execute code on a Windows host. The exploit won $175,000 at Pwn2Own Berlin in May 2026. Microsoft patched the Edge vulnerabilities the day after the contest. The full technical write-up was published by Tsai on October 28, five months after the competition. The attack works by turning a malicious web page into code running outside the browser sandbox on Windows. The achievement is notable because it relied entirely on logic bugs rather than traditional memory corruption techniques, representing a sophisticated and less commonly seen attack methodology.
View original advisory →Cybersecurity researchers disclosed details of an AI-assisted attack campaign attributed to a suspected China-nexus threat actor. The attackers leveraged PHP2Shell vulnerabilities to compromise exposed systems, combining it with a kernel privilege escalation exploit to gain root access. The activity was observed on October 25, 2026, and resulted in the compromise of 25 servers, including systems within a U.S. government-affiliated network. The use of artificial intelligence in orchestrating the attack marks a notable evolution in threat actor tactics. The campaign highlights the risk of exposed PHP-based systems and unpatched kernel vulnerabilities in sensitive environments.
View original advisory →Attackers are actively exploiting vulnerabilities in critical network infrastructure including firewalls, VPNs, and application delivery controllers. The InfraTrust report highlights a class of PHP vulnerabilities dubbed 'PHP2Shell' that target web management interfaces of these appliances. The flaws allow attackers to potentially gain unauthorized access or control over affected devices. The scope of impact is broad, covering multiple types of network security appliances. Active exploitation in the wild makes this a high-severity concern for network administrators. Organizations relying on web-based management interfaces for their network devices are particularly at risk. The report underscores the ongoing targeting of perimeter network devices by threat actors. Patching and mitigation guidance is implied to be necessary for affected infrastructure operators.
View original advisory →Threat actors are actively probing a newly patched critical vulnerability in Oracle E-Business Suite (EBS), tracked as CVE-2026-101767 with a CVSS score of 9.8. The flaw resides in the Oracle Application Object Library component. Oracle patched it as part of its latest Critical Patch Update. Threat intelligence firm Defused Cyber reported the exploitation attempts began shortly after the patch was released. The rapid targeting of this vulnerability highlights the risk of delayed patching in enterprise environments. The high CVSS score indicates the potential for remote code execution without authentication. Organizations running Oracle EBS are urged to apply the patch immediately.
View original advisory →