HOTNEWS 2026 January(174) February(168) March(221) April(222) May(261) June(255) July(464) August(446) September(518) October(442) November(96) December(0) | ARCHIVE
|
DATE |
NAME |
INFO |
CATEGORY |
SUBCATE |
| 8.11.26 | Joint Factsheet USG Partners Urge Hardening Industrial Refrigeration Cold Chain Monitoring Systems | The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Health and Human Services (HHS), U.S. Department of Agriculture (USDA), and the Department of Transportation (DoT)—hereafter referred to as “the authoring organizations”—are aware of malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally. | IC3 | IC3 INDUSTRY |
| 8.11.26 | SMS of Death | A single malformed WAP Push SMS crashes com.android.phone on Android, dropping active calls (including emergency calls), with zero interaction from the victim. | EXPLOIT | EXPLOIT |
| 8.11.26 | CVE-2026-19868 | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability: SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. | ECV | ECV |
| 8.11.26 | Marsalek - a Malware-as-a-Service operation | Marsalek emerged as a wide-reaching malware-as-a-service (MaaS) platform identified by McAfee Labs. Sharing a Telegram support handle and final payloads with the parallel WeedHack operation, Marsalek went beyond Minecraft by masquerading as legitimate utilities, cryptocurrency apps, and cheats for popular video games. | ALERTS | VIRUS |
| 8.11.26 | PSK Agent RAT deployed in recent StyleSmuggler campaign | Security researchers at Imperva uncovered an automated cyberattack targeting vulnerable Adobe Commerce and Magento platforms across Europe, North America, and the Asia-Pacific region. The perpetrators exploited the "StyleSmuggler" security flaw (CVE-2026-75650), a two-step vulnerability that tricks the platform's template system into storing malicious PHP code within error logs and subsequently executing it via GraphQL requests. The campaign has been observed to install a multi-stage malware toolkit. | ALERTS | VIRUS |
| 8.11.26 | New Lindnor Backdoor and Glut of Security Killers Used in Ransomware Attack on U.S. Org | Attackers using the Anubis ransomware, which is developed by a group Symantec tracks as Hawkmoth, deployed a previously undocumented custom backdoor and an unusually large number of security software-disabling tools in an October 2026 attack on an organization in the U.S. Hawkmoth runs a ransomware-as-a-service (RaaS) operation that emerged in December 2024 as a rebrand of the Sphinx ransomware. | ALERTS | VIRUS |
| 8.11.26 | CVE-2026-19868 | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | KEV | KEV |
| 7.11.26 | BAD CONNECTION | Uncovering Global Telecom Exploitation by Covert Surveillance Actors | PAPERS | PAPERS |
| 7.11.26 | SolanaCry | SolanaCry: Malware in the wild steals crypto wallets from web-browsing AI agents | MALWARE | CRYPTO |
| 7.11.26 | RATHat | RATHat's Android malware remained largely static from late 2025 to September 2026, while its Command-and-Control (C2) panel was replaced entirely and went through three generations in six months, rebranded from BlackCat to Panda Workshop. | MALWARE | RAT |
| 7.11.26 | TonRAT | Since early 2026, Windows shortcut files (LNK) with names with the same pattern have been consistently identified by VirusTotal. The LNK files are disguised as image and video files, and when executed, they receive and execute a PowerShell script from the attacker's server, download NodeJS, and ultimately execute the TonRAT malware written in JavaScript. | MALWARE | RAT |
| 7.11.26 | MrHex | Online personas calling themselves MrHex, @Mr8ex, MrDarkRoot, and Darku3er, have been creating and advertising domains on the darknet and clearnet. These personas and their created domains form a hack-and-leak ecosystem that has evolved from commercial data brokerage into politically motivated disclosure activity and cyber-physical operations on behalf of Iran. | HACKING | HACKING |
| 7.11.26 | EByte Ransomware | A Go ransomware kit advertised on 20 October 2026 reuses Prince ransomware code for its encryption, decryption and file walking. We examine its one-in-three byte encryption, its launch-reporting panel, and why the builder makes the matching decryptor the strongest recovery lead. | RANSOM | RANSOM |
| 7.11.26 | Matryoshka | Russia-aligned influence operation Matryoshka is adapting to target the 2026 U.S. midterms. Its operations rely on cheap text-over-video clips with impersonated logos of trusted outlets like CNN, ABC News, and The Washington Post, not costly deepfakes. | CAMPAIGN | CAMPAIGN |
| 7.11.26 | PolinRider Loader | All 12 releases contain loaders designed to decode payload-server IP addresses from Ethereum transactions sent by the same hard-coded wallet previously reported in PolinRider activity, then retrieve, XOR-decode, and execute JavaScript. Six conceal the loader in eval(atob(...)); six use a character-permutation bootstrap and the JavaScript Function constructor. | MALWARE | LOADER |
| 7.11.26 | CITRIX 0-DAY EXPLOITS | NOTE: This is an analysis of the artifacts and samples found during the hunt of SLAPSHOT, WHIPSHOT which is a Python tunneler used to proxy traffic into internal networks. The analysis is done using various AI Models and if you find any irrelevancy, please do report directly. This article is intended for Network Defenders, Threat Analysts, SOC and IT Administrators. | EXPLOIT | EXPLOIT |
| 7.11.26 | MR ROBOT | A new Android malware operation called MR ROBOT is turning banking fraud into a subscription business. CloudSEK’s investigation reveals how cybercriminals rent customised banking trojans to steal OTPs, card details, UPI PINs and credentials while secretly forwarding calls to bypass security checks. | MALWARE | ANDROID |
| 7.11.26 | Doorway Botnet | Thousands of routers, surveillance cameras, and enterprise servers are being exploited in a global botnet operation known as Doorway. CloudSEK’s investigation uncovered 41 GB of exposed operational data, revealing 59 exploit modules, automated credential attacks, and sophisticated malware delivery mechanisms. | BOTNET | BOTNET |
| 7.11.26 | StealC | Four months after Operation Endgame took it down, StealC's seller returns with Stadia, a remote access trojan that shares StealC's code byte for byte. | MALWARE | TROJAN |
| 7.11.26 | Nova Ransomware | Nova is a ransomware group that operates a Ransomware-as-a-Service (RaaS) model to extort organizations through file encryption and data theft. Nova equips affiliates with a Rust-based encryptor and threatens to publish stolen information on a dedicated Dark Web leak site. | RANSOM | RANSOM |
| 7.11.26 | CWP2Shell | Today VulnCheck is disclosing ten vulnerabilities in Control Web Panel (CWP, formerly CentOS Web Panel), the hosting control panel that ships on a large number of internet-facing servers. They are being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy, and all ten carry allocated IDs through the VulnCheck CNA. | VULNEREBILITY | VULNEREBILITY |
| 7.11.26 | PolinRider | OX Security researchers identified malicious releases of legitimate npm packages compromised in a campaign linked to the PolinRider malware family. | MALWARE | PYTHON |
| 7.11.26 | PapRAT | BITTER is a suspected South Asian cyberespionage group active since at least 2013, with a history of targeting the government, energy, and engineering sectors. Over the past several months, FortiGuard Labs has tracked a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan (RAT), which we call PapRAT, to establish persistent access to victim environments. | MALWARE | RAT |
| 7.11.26 | PhantomDOM | ZeroBEC detected and stopped a targeted Browser-in-the-Middle (BitM) phishing attempt that exposed PhantomDOM, a custom DOM-mirroring operation built to hijack Microsoft 365 sessions. | PHISHING | PHISHING |
| 7.11.26 | PSK Agent RAT | TL;DR: Between September 9 and September 13, 2026, we detected a coordinated campaign exploiting Magento and Adobe Commerce stores across Western Europe, North America, and the Asia-Pacific region. | MALWARE | RAT |
| 7.11.26 | APT29 | Sekoia TDR investigates a large-scale APT29 watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply-chain attack. Discover how n-day exploits were used to steal cookies, Wi-Fi passwords, and device data. | APT | APT |
| 7.11.26 | Mirax | Discover how the Mirax Android malware campaign uses streaming app lures, server-side C2, and Accessibility Service abuse for device takeover targeting financial institutions in the META region. | MALWARE | ANDROID |
| 7.11.26 | Marsalek | Malware-as-a-service (MaaS) is becoming increasingly accessible within online gaming communities and across the internet. Sophisticated malware that once required technical expertise to develop can now be obtained for free, giving aspiring hackers the tools to target unsuspecting victims. | MALWARE | MAAS |
| 7.11.26 | Lindnor Backdoor | Attackers using the Anubis ransomware deployed a new custom backdoor and a large set of Bring Your Own Vulnerable Driver (BYOVD) tools, but attack was thwarted before encryption phase could begin. | MALWARE | BACKDOOR |
| 7.11.26 | SlippyNunchucks | ESET Research analyzes a DNS hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method | HACKING | HACKING |
| 7.11.26 | Gorbag | ESET researchers uncover Gorbag, a Russia-aligned group using simple infostealers to harvest data from Ukrainian organizations near the front line | GROUPS | GROUPS |
| 6.11.26 | CVE-2026-123158 | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. | VULNEREBILITY | VULNEREBILITY |
| 6.11.26 | ThisBash Escape | A Claude Dispatch flaw let a browser extension escape the browser and run code on the OS through Claude Desktop, even on another computer. Dispatch is being retired, but the design flaw behind it runs through other parts of the Claude suite. | VULNEREBILITY | VULNEREBILITY |
| 6.11.26 | Inference Providers as the Prize: Platform-Chain Campaigns Against AIServing | Security Implications and Guidance for Platforms That Hold AI Provider Credentials | REPORT | REPORT |
| 6.11.26 | CWPdoor | CWPdoor: The Invisible Backdoor Living Inside Control Web Panel | MALWARE | BACKDOOR |
| 6.11.26 | OpenSSH 10.6p2 | Recently the OpenSSH team have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance. While many AI reports are determined not to have security impact when considered in the context of a realistic threat model, we very much welcome these reports, especially when combined with human triage, analysis, test-cases and particularly when accompanied by proposed fixes. | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | PapRAT malware leveraged by the BITTER threat group | Security researchers at FortiGuard Labs recently documented a cyberespionage operation aimed at South Asian institutions. The operation is attributed to BITTER, a regional threat actor active since 2013 that historically infiltrates state, power, and engineering organizations. By leveraging PowerShell alongside a bespoke remote access trojan dubbed PapRAT, the perpetrators secure long-term footholds inside compromised networks. | ALERTS | VIRUS |
| 5.11.26 | CVE-2026-46300 - Linux Kernel Missing Initialization of a Variable Vulnerability (Fragnesia) | CVE-2026-46300 (nicknamed Fragnesia) is a high-severity local privilege escalation vulnerability in the Linux kernel (CVSS score of 7.8). If successfully exploited the flaw might allow unprivileged local attacker to corrupt and write arbitrary bytes into read-only system files stored in the memory page cache, leading them to elevate privileges to root. | ALERTS | VULNEREBILITY |
| 5.11.26 | Prime ReverseShell - a new tool in the portfolio of the Gorbag threat group | Cybersecurity analysts at ESET detailed the operations of Gorbag, a hacking syndicate active since at least early 2025. This threat actor concentrates exclusively on Ukrainian institutions, striking defense organizations, judicial and policing bodies, frontline municipalities, and a vital transit center for international defense assistance. | ALERTS | APT |
| 5.11.26 | Kairos - a Go-based Linux botnet variant | Security researchers at Nozomi discovered Kairos, a novel Go-based Linux malware designed exclusively to enlist compromised systems into a distributed denial-of-service (DDoS) network. Rather than employing complex capabilities this lightweight tool focuses solely on resource depletion. When instructed by its controller, the malware initiates massive volumes of simultaneous TCP connections against a designated victim. | ALERTS | BOTNET |
| 5.11.26 | VOLTA infostealer leverages AI for victim assessment | VOLTA-AUTODOXER is an advanced Windows information stealer that operates without proprietary attacker infrastructure. It pioneers a modern cybercrime strategy: indiscriminately harvesting massive amounts of data and utilizing artificial intelligence for post-theft triage. | ALERTS | VIRUS |
| 5.11.26 | CVE-2026-97229 - GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability | CVE-2026-97229 is a critical (CVSS score 10.0) remote code execution (RCE) affecting GitLab Community Edition (CE) and Enterprise Edition (EE). If successfully exploited the flaw might allow an unauthenticated remote attacker to execute arbitrary code on an affected GitLab server by committing a specially crafted files. | ALERTS | VULNEREBILITY |
| 5.11.26 | Overlord RAT spread via WhatsApp lures | In a recent write-up, NetbyteSEC details a WhatsApp phishing campaign aimed at Malaysian finance and business users that installs Overlord, a Go-based remote access agent controlled from a panel branded TankRat. The lure is an account-statement themed ZIP archive holding a genuine Microsoft-signed executable, renamed as a notice file, which side-loads an unsigned DLL placed beside it. | ALERTS | VIRUS |
| 5.11.26 | Amatera infostealer remains prevalent in Latin America | As reported by researchers from ESET, Amatera, a C++ Windows threat operating as malware-as-a-service (MaaS) remains a prevalent threat in Latin America while affecting a large numbers of users globally. Amatera first appeared in 2024 as an apparent rebrand of ACR Stealer. | ALERTS | VIRUS |
| 5.11.26 | ARTEX Backdoor | ARTEX Backdoor: 7,946 Pulls of a Trojanized Docker Image Handing Out Root Shells | MALWARE | BACKDOOR |
| 5.11.26 | CVE-2026-7273 | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | CVE-2024-27834 | Apple Multiple Products Improper Authentication Vulnerability | KEV | KEV |
| 5.11.26 | LLM-based Vulnerability Discovery through the Lens of Code | Large language models (LLMs) excel in many tasks of software engineering, yet progress in leveraging them for vulnerability discovery has stalled in recent years. To understand this phenomenon, we investigate LLMs through the lens of classic code metrics. Surprisingly, we find that a classifier trained solely on these metrics performs on par with state-of-the-art LLMs for vulnerability discovery | PAPERS | PAPERS |
| 5.11.26 | CVE-2026-109518 | Max Justicz discovered a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root. | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | CVE-2026-109594 | Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database. | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | CVE-2026-109593 | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information. | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | Prompt Adware hidden in Jailbreak Bundles | Check Point Research analyzed the Haiou jailbreak bundle, a prompt package targeting OpenAI Codex. Such jailbreaks are designed to weaken model guardrails and enable tasks related to hacking, software cracking, and information security. | HACKING | AI |
| 5.11.26 | Small Business Cybersecurity | NIST Cybersecurity White Paper NIST CSWP 50 | Security guidance | Security guidance |
| 5.11.26 | Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026 | On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | Cisco UCS Central Software Remote Code Execution Vulnerability | A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device.This vulnerability is due | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | Cisco Identity Services Engine Authorization Bypass Vulnerability | A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate.This vulnerability is due to improper authorization | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | Cisco Unified Communications Manager Cross-Site Scripting Vulnerability | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | Cisco Secure Email Gateway SQL Injection Vulnerability | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.This vulnerability is due to insufficient | VULNEREBILITY | VULNEREBILITY |
| 5.11.26 | BaseChat – Audio Dating App, Android version 9.8.1, contains multiple vulnerabilities | Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and activity. | ALERT | ALERT |
| 4.11.26 | CVE-2026-119977 | WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability: WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. | ECV | ECV |
| 4.11.26 | CVE-2026-119977 | WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | KEV | KEV |
| 4.11.26 | APT29 | Poisoned Source: APT29 watering holes target mobile devices with n-day exploits | APT | APT |
| 4.11.26 | GHSA-f3w6-w445-fwh9 | Possible arbitrary file write and read in Active Storage image analysis | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | GHSA-v924-7rp8-4mxh | Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | DeadTag | DeadTag: How Forgotten Website Tags Became a Delivery Network for iPhone Spyware | EXPLOIT | EXPLOIT |
| 4.11.26 | CVE-2026-102704 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | CVE-2026-102703 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | Gray Rabbits | Gray Rabbits and the Tale of a One-Click Backdoor | MALWARE | BACKDOOR |
| 4.11.26 | SlippyNunchucks | SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware | OPERATION | OPERATION |
| 4.11.26 | CVE-2026-58868 | In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | CVE-2026-119977 | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | CVE-2026-111560 | Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | CVE-2026-116606 | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | RHSA-2026:93414 | The kernel packages contain the Linux kernel, the core of any Linux operating system. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | RHSA-2026:93413 | The kernel packages contain the Linux kernel, the core of any Linux operating system. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | RHSA-2026:93412 | The kernel packages contain the Linux kernel, the core of any Linux operating system. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | CVE-2026-98432 | We have received several questions about CVE-2026-98432, a flaw in how the Linux kernel sets up IPv4 TCP connections, present in Linux kernel versions 4.4 and later. | VULNEREBILITY | VULNEREBILITY |
| 4.11.26 | Gorbag | Gorbag: Orcs at the border harvesting intelligence from Ukraine | MALWARE | INFOSTEALER |
| 3.11.26 | Android Security Bulletin—November 2026 | This Android Security Bulletin contains details of security vulnerabilities that affect Android devices. Security patch levels of 2026-11-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. | VULNEREBILITY | SOFTWARE PATCH REPORTS |
| 3.11.26 | INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities | INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remediated the issues in System Manager versions 3.0.12.3 and 3.0.12.5. | ALERT | ALERT |
| 3.11.26 | Vulnerabilities in Node.js Affecting Cisco Products: October 2026 | On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2024-10441 | Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2024-10445 | Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to write limited files via unspecified vectors. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2024-50629 | Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to read limited files via unspecified vectors. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2026-58115 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Node-RED installed). | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2026-81648 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | Authentication and authorization bypass through unverified client certificate chains | The HTTPS listener requests client certificates without verifying them, so the TLS handshake only proves that the client holds the private key of the first certificate in the chain it presents. The remaining certificates are entirely client controlled. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | The Internals of a Badbox Operation |
This report was produced in partnership with the Motion
Picture Association (MPA) and in coordination with Google, Plume, Trend
Micro, Lumen, and HUMAN Security, as part of Synthient’s ongoing investigation into BadBox-type devices. This report focuses on MECOOL, a pre-infected set-top box that has dominated the consumer market since early 2020. |
REPORT | REPORT |
| 3.11.26 | The X.CPE Botnet | From Device Management to Monetization Framework | REPORT | REPORT |
| 3.11.26 | Badbox Operation | This report was produced in partnership with the Motion Picture Association (MPA) and in coordination with Google, Plume, Trend Micro, Lumen, and HUMAN Security, as part of Synthient’s ongoing investigation into BadBox-type devices. This report focuses on MECOOL, a pre-infected set-top box that has dominated the consumer market since early 2020. | OPERATION | OPERATION |
| 3.11.26 | Prince of Persia | Prince of Persia: Threat Group Hiding in Plain Sight | GROUPS | GROUPS |
| 3.11.26 | DarkBlinders | DarkBlinders earned its place on the 2026 list not through the size of its victim list, but through the precision of its targeting and the speed of its evolution. Active since September 2024, this group has concentrated every operation on two sectors that sit at the center of Arabian Gulf strategic interest: aviation infrastructure and telecommunications — in the UAE and Iraq specifically. | CAMPAIGN | CAMPAIGN |
| 3.11.26 | CVE-2026-110192 | Langflow OSS could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2026-84365 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2026-84364 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2026-84363 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2026-110186 | Langflow OSS could allow a remote attacker to execute arbitrary code due to improper control of code generation. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2026-110193 | Langflow OSS could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server. | VULNEREBILITY | VULNEREBILITY |
| 3.11.26 | CVE-2026-93680 | Langflow OSS could allow a remote attacker to bypass security restrictions due to improper authentication. | VULNEREBILITY | VULNEREBILITY |
| 2.11.26 | XCPE botnet | Shutting the Door on the XCPE Botnet | BOTNET | BOTNET |
| 2.11.26 | VOLTA | Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer | MALWARE | INFOSTEALER |
| 2.11.26 | TraderTraitor | Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware | GROUPS | GROUPS |
| 2.11.26 | CVE-2026-112816 | Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain. | VULNEREBILITY | VULNEREBILITY |
| 2.11.26 | NetamLoader | Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia | MALWARE | LOADER |