> TODAY'S SUMMARY (12 articles)
Today's cybersecurity news highlights significant threats and vulnerabilities. Alpine Linux faced an attempted remote code execution (RCE) attack, prompting a rebuild of its GitLab server. Android devices are under threat from a new "SMS of Death" vulnerability, where a hidden SMS can crash call services, including emergency calls. A critical CVSS 10.0 flaw in Canonical's LXD and MicroCloud allows attackers to impersonate trusted clients without private keys. Additionally, hackers stole around $2.7 million from Polymarket traders through a hijacked script. The FBI has linked North Korean group TraderTraitor to the record $6.43 billion Binance crypto heist, underscoring ongoing concerns around state-sponsored cybercrime.
|
// AI-powered summary generated at 16:00
Backed by a federal court order, Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man.
The post Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages appeared first on SecurityWeek.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]
Summary North America’s $3 trillion crypto economy remained the most influential in the world, with advancements in agentic commerce, exports…
The post North America: Inside the Growth of Agentic Commerce appeared first on Chainalysis.
The sixth exploited Ivanti bug this year drew attention from the feds and researchers, while a severe Microsoft vulnerability was one of more than 1,400 listed for Patch Tuesday.
The Joint Economic Committee on Tuesday released the results of a year-long investigation into Tinder, Hinge, Match, Plenty of Fish and several other dating sites owned by Match Group.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability.
The security flaw,...
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote
attacker controlling the server could possibly use this issue to write
files to unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd ser...
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine.
The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact kn...
It was discovered that curl, when built with GnuTLS support, had an
out-of-bounds read in the WebSocket send path. An attacker could
possibly use this issue to obtain sensitive information.
(CVE-2026-107928)
Maksim discovered that curl did not correctly include the interface
binding in connection r...
Proton Meet adds new waiting rooms and chat threads features, for greater control and productivity across online calls.
Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake.
The call comes in at 4:40 on a Friday. It's the CFO, or it sounds exactly like her,...
Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran arbitrary commands on the appliances.
“Ivanti initially discovered a portion o...
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]
OpenAI employee charged with planting hidden audio recorders to capture sensitive discussions about AI research and company strategy. On September 30, OpenAI staff found a small audio recording device jammed into a USB port on the back of a television in an executive conference room in their San Fra...
Microsoft’s October updates address a record 1,413 vulnerabilities, including a Windows flaw attackers are already exploiting and two other zero-days.
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said.
Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6...
An interview invitation becomes a trap for your Facebook and Google passwords, even with two-factor authentication turned on.
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud.Â
Dutch mobil...
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days Microsoft’s October 2026 Patch Tuesday addresses a record-breaking 1,411 vulnerabilities, 70 of them rated critical, including one actively exploited zero-day and two that were publicly disclosed. The exploited flaw, CVE-2026-96951,...
I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to th...