Overview of incoming advisories.
2179 results found
CISA published an ICS advisory (ICSA-26-300-02) detailing four vulnerabilities in Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz products. CVE-2023-4863 is a critical out-of-bounds write vulnerability (CWE-787) in the libwebp component affecting GENESIS64 and ICONICS Suite versions 10.97 through 10.97.2, with CVSS v4.0 score of 9.3. CVE-2026-16436 is a weak password recovery mechanism (CWE-640) allowing remote attackers to bypass authentication using a fixed common challenge response, scoring 9.2 on CVSS v4.0. CVE-2026-16437 is a related authentication bypass via local file tampering of the challenge response management file, scoring 7.1 on CVSS v4.0. CVE-2026-16438 is an incorrect privilege assignment (CWE-266) vulnerability allowing DCOM object abuse, with a critical CVSS v4.0 score of 9.4. Successful exploitation could lead to arbitrary code execution, authentication bypass, information disclosure, data tampering, or denial-of-service. No fixes are planned for legacy products MC Works64, GENESIS32, and BizViz; vendors recommend replacement with newer products.
View original advisory →An attacker gained access to Keystone's website and stole the cryptographic key used by Keystone hardware wallets to verify their authenticity. This key is used in an online verification process that allows owners to confirm their device is genuine. With this key, an attacker could create counterfeit Keystone hardware wallets that pass the legitimacy check, potentially tricking buyers into trusting fake devices. If a user trusts a counterfeit device, their cryptocurrency could be stolen. In response, Keystone announced it will destroy all 18,835 affected hardware wallets. The incident highlights the risk of supply-chain and device-integrity attacks targeting cryptocurrency hardware wallet manufacturers.
View original advisory →The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign called Operation FlashHole targeting at least three South Korean organizations in construction, software, and wire-communication equipment manufacturing sectors. The campaign has been active since at least July 2025 and was identified by Kaspersky. A notable characteristic of this campaign is the abuse of legitimate South Korean security software to deploy malware. The malware deployed uses post-quantum encryption, representing an advanced and forward-looking operational security measure by the threat actor. This campaign reflects Lazarus Group's continued focus on South Korean targets across multiple industry verticals.
View original advisory →Apple has backported security patches to older iPhones and iPads, addressing a zero-day vulnerability in the CoreGraphics framework. The flaw was originally patched last month for newer devices. The vulnerability was reportedly exploited in 'extremely sophisticated' targeted attacks against iOS devices. By backporting the fix, Apple aims to protect users on older hardware who cannot upgrade to the latest iOS versions. This highlights the ongoing risk of targeted zero-day exploitation against Apple mobile devices and the importance of patch coverage across legacy device ecosystems.
View original advisory →The Australian Signals Directorate (ASD) successfully infiltrated the backend infrastructure of an Amadey malware operation. The agency cut off a criminal operator's access to approximately 180,000 infected computers worldwide, including some located in Australia. By gaining access to the malware's command-and-control backend, ASD effectively severed the connection between the attacker and all compromised machines. This action prevented further data theft or malicious activity from being conducted through the Amadey controller. The operation represents a significant proactive cyber defense action by an Australian government agency against a widespread malware campaign.
View original advisory →CISA has added PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies have been ordered to patch their systems by Thursday to mitigate the risk. The advisory underscores the urgency of addressing these flaws, which are being actively leveraged by threat actors. PHP2Shell vulnerabilities pose a significant risk to web-facing systems that rely on PHP-based environments. The move is part of CISA's ongoing effort to compel timely remediation of critical security issues across government infrastructure. Organizations beyond the federal sector are also encouraged to prioritize patching these vulnerabilities given their active exploitation status.
View original advisory →CERT-UA has issued an alert about unauthorized remote access to Dahua IP cameras and DVRs across Ukraine. Attackers are exploiting P2P access features and authentication weaknesses to compromise surveillance systems. Incidents include unauthorized access to video streams, device configuration changes, and creation of rogue third-party accounts. The State Special Communications Service of Ukraine (SSSCIP) confirmed the recorded cases. The attacks target video surveillance infrastructure, posing significant risks to physical security monitoring, particularly in a wartime context. The campaign highlights the dangers of insecure IoT devices deployed in critical environments.
View original advisory →CISA has added two critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Both vulnerabilities are rated 9.2 on the CVSS scoring system and allow unauthenticated remote code execution on affected deployments. One of the identified flaws is CVE-2026-109618, described as an out-of-memory vulnerability. The flaws were recently patched but are already being actively exploited. CISA's inclusion in the KEV catalog signals urgent action is required by federal agencies and organizations using affected PHP2Shell deployments. The high CVSS scores and unauthenticated nature of the exploit make these vulnerabilities particularly dangerous. Organizations are advised to apply patches immediately to mitigate the risk of compromise.
View original advisory →CVE-2026-111497 is a high-severity vulnerability in Google Brotli, an open-source compression library. The flaw involves an unchecked return value that can be exploited by a remote unauthenticated attacker via a crafted Brotli-compressed stream. Successful exploitation can lead to corruption of adjacent decoder state memory, disclosure of sensitive memory contents, denial of service, or potentially arbitrary code execution. Because Brotli is a widely used open-source component and third-party library, many products may be affected. CISA has flagged this vulnerability and references it under BOD 26-04, which prioritizes security updates based on risk. A patched version (v1.2.1) has been released by Google on GitHub. Organizations using Brotli in any capacity are urged to update to the latest version immediately. The vulnerability is tracked at NVD and has been assigned a High criticality rating.
View original advisory →CVE-2026-48356 affects Adobe Commerce and Magento platforms, involving an unrestricted upload of file with dangerous type vulnerability. Successful exploitation could allow arbitrary code execution in the context of the current user. This may lead to elevated access or full control over the victim's account or session. The vulnerability is tracked by CISA and is subject to BOD 26-04, which mandates prioritizing security updates based on risk. Adobe has published an advisory (APSB26-73) with guidance and patches. CISA also provides forensic triage requirements for affected organizations. The vulnerability is catalogued in the NVD and rated High severity. Organizations running Adobe Commerce or Magento are strongly advised to apply available patches immediately.
View original advisory →In October 2026, two significant security issues emerged simultaneously: eMudhra intermediate CA private keys were found to be trivially weak (fitting in 8 bits instead of 384 bits), and a memory corruption vulnerability (CVE-2026-111497) was discovered in the Brotli compression library. Chrome and Firefox rapidly pushed certificate blocks for eMudhra, while Node.js addressed both issues in its October 21 release. The article highlights the complexity of patching such vulnerabilities across the software ecosystem, as Brotli is bundled into many runtimes and applications including Bun, Python requests, and .NET. Certificate trust issues similarly affect multiple stores and verifiers differently across browsers, CLI tools, and system utilities. Go required a toolchain update and application rebuild to incorporate the eMudhra fix. The article emphasizes that updating one component is rarely sufficient and that organizations must track bundled dependencies, automate rebuild pipelines, and verify fixes are actually deployed in running artifacts.
View original advisory →South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country. The attackers leveraged ARTEX AI, a pentesting framework, as the primary tool in most of the attacks. The operation resulted in the theft of approximately 8.2 million data records. A former pentester is among the suspects identified in the investigation. The scale of the breach and the number of affected organizations highlight the significant misuse of legitimate security tools for criminal purposes. The use of AI-assisted pentesting frameworks by threat actors represents a growing concern for cybersecurity professionals.
View original advisory →An unknown threat actor has compromised 953 online stores, predominantly running Magento, as part of a campaign active since July 2025. The attackers inject a small piece of malicious code into store pages that serves JavaScript loader code via Magento CMS blocks when visited by users. The campaign was uncovered by Dutch e-commerce security firm Sansec. The malicious JavaScript is designed to evade common scanners, making detection difficult. The attack targets Magento-based e-commerce platforms, putting customer payment data and personal information at risk. The scale and duration of the campaign suggest a sophisticated and organized threat actor.
View original advisory →PHP has released rebuilt Windows packages for PHP 8.2 through 8.5 to address CVE-2026-111497, a critical vulnerability in the Brotli compression library bundled with the packages. The flaw allows attackers to corrupt memory and potentially execute arbitrary code. The vulnerability is reachable via the cURL extension when it automatically decompresses HTTP responses, though this behavior is disabled by default. This is the second Windows-specific security update PHP has issued within five days, indicating ongoing scrutiny of third-party library dependencies. The fix involved rebuilding official Windows binaries rather than a simple patch. Users running PHP on Windows with the affected versions should update immediately. The issue highlights risks associated with bundled third-party libraries in language runtimes. Organizations using PHP on Windows in web-facing environments are most at risk.
View original advisory →A critical vulnerability nicknamed 'HTTP2Shell' has been discovered in Brotli, the C decoder library embedded within Node.js. The flaw enables attackers to corrupt memory and potentially access sensitive data on affected systems. The severity of the vulnerability has prompted emergency patch releases. Brotli is widely used for compression and is deeply integrated into Node.js, making the attack surface significant. Organizations relying on Node.js-based applications are urged to apply patches immediately. The vulnerability poses risks of remote code execution or data exfiltration depending on the attack scenario. The emergency nature of the patches underscores the critical risk level associated with this flaw.
View original advisory →Cybersecurity researchers have identified a recurring social engineering pattern across hundreds of incidents where threat actors exploit Microsoft Teams' external chat creation feature to conduct impersonation scams and deliver malware. Attackers consistently use throwaway tenants to pose as IT support personnel, tricking users into granting access or executing malicious payloads. The campaign has been linked to ransomware deployment as well as general malware distribution. The pattern suggests an organized and scalable attack methodology leveraging legitimate collaboration platform features. Organizations relying on Microsoft Teams for internal communication are particularly at risk if external messaging is not properly restricted.
View original advisory →litellm version 1.107.0 distributed via PyPI and Docker was found to contain malicious code in the form of a .pth file that acts as a credential stealer and an hourly remote code loader. The malware exfiltrates stolen credentials to litellm.dev, a domain controlled by the attacker. Both PyPI wheels and Docker images were affected, making this a significant supply chain compromise. The backdoor loads remote code on an hourly basis, enabling persistent and evolving malicious activity. StepSecurity published an analysis including indicators of compromise (IOCs) and remediation guidance. This incident highlights the ongoing risk of supply chain attacks targeting popular open-source AI/ML tooling packages. Users of litellm 1.107.0 are urged to update immediately and audit their environments for signs of compromise.
View original advisory →This weekly cybersecurity recap highlights a surge in critical remote code execution (RCE) vulnerabilities being discovered across multiple products and platforms. Attackers are actively scanning for vulnerable targets, and some flaws are already being exploited in real-world attacks. Security teams are struggling to keep up with the volume of urgent patches required. The article also touches on a software supply chain incident triggered by a leaked key. Additional topics include rogue AI threats and broader supply chain disruptions, suggesting a wide-ranging threat landscape for the week covered.
View original advisory →Two critical vulnerabilities have been discovered in Wasmtime, a widely-used WebAssembly runtime that can be embedded in other software. These flaws could allow a malicious WebAssembly module to escape the sandbox designed to isolate and contain it. An attacker would need to control a module compiled by a vulnerable Wasmtime build to exploit these issues. One of the two flaws is specific to ARM64 architecture systems. The Wasmtime project maintainers have acknowledged the vulnerabilities and released fixed versions to address them. The severity is considered critical due to the sandbox escape nature, which undermines a core security guarantee of the WebAssembly runtime model. Organizations using Wasmtime in their software stack, especially on ARM64, are advised to update immediately.
View original advisory →A rentable Android spyware kit named uCreator has been discovered targeting users of Telegram and WeChat by embedding malicious code inside trojanized versions of these popular apps. The spyware spreads through unofficial app stores or via a custom container app created by the kit's developers. Once installed, uCreator can steal Telegram two-factor authentication passwords and clone WeChat accounts. The kit's Telegram-targeting component has been linked to a known backdoor called Baohuo, previously documented by Doctor Web. The campaign represents a significant threat to users who sideload applications outside official marketplaces. The modular, rentable nature of the kit suggests a malware-as-a-service model, lowering the barrier for threat actors to deploy sophisticated mobile espionage tools.
View original advisory →