Tag: update
-
(g+) Sicherheitslücke in der Firmware: PHP2Shell bleibt in Firewalls und Industriegeräten gefährlich
Bei Firewalls, Routern und Industrieanlagen können Admins verwundbares PHP oft nicht selbst patchen. Selbst nach einem Update bleibt deshalb Handlungsbedarf. First seen on golem.de Jump to article: www.golem.de/news/sicherheitsluecke-in-der-firmware-php2shell-bleibt-in-firewalls-und-industriegeraeten-gefaehrlich-2611-214898.html
-
Java unter Beschuss: 53 Schwachstellen und zwei Notfall-Patches innerhalb von 5 Tagen
53 Java-Sicherheitslücken und zwei Notfall-Patches in fünf Tagen: Warum KI-Angriffe das Patch-Management verändern und Security-only-Updates wichtiger werden. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/java-unter-beschuss-53-schwachstellen-und-zwei-notfall-patches-innerhalb-von-5-tagen/a47036/
-
WorkOS Confirms Data Breach After ARTEX AI Agent Escapes Security Researcher’s Sandbox
WorkOS confirmed that an ARTEX security agent escaped a researcher’s isolated testing environment and accessed an internal application, exposing customer business information. In its November 6 update, the company attributed the incident to unintended activity during cybersecurity benchmark evaluations, rather than a malicious operation. WorkOS accepted responsibility and cooperated with investigators. The incident highlights the…
-
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/
-
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.The update that installs the fix still unpacks its files using the site’s old, unpatched code, so an attacker who strikes at the right moment can run code…
-
QNAP says hackers breaching NAS devices in Plex2Shell attacks
QNAP urges users to update Plex Media Server to the latest version available in the QNAP App Center, as hackers are exploiting the Plex2Shell vulnerability chain. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/qnap-says-hackers-breaching-nas-devices-in-plex2shell-attacks/
-
Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.The flaw is an out-of-bounds read that could…
-
Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.The flaw is an out-of-bounds read that could…
-
Microsoft Paint RCE Fix Now Available, but Windows Update Won’t Deliver It
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates.The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.The flaw is an out-of-bounds read that could…
-
The Flood is Coming And The Pipes Were Already Full
Tags: updateAn update on Athena, and some unsolicited predictions on what’s coming nextOn Saturday, Dario Amodei published We Must Pace the Frontier. I agree with him. Go read it if you haven’t. I’ve spent the summer looking at what these models find, and the gap he describes between what they can do and what the rest…
-
Android SMS of Death Flaw: How to Check If Your Phone Is Patched
Google’s November security update fixes a critical Android vulnerability that can interrupt cellular calls through a hidden message. Here’s how to check your device. The post Android SMS of Death Flaw: How to Check If Your Phone Is Patched appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-android-sms-of-death-cve-2026-58882-patch/
-
Huntress turns real-world attack intelligence into fleet-wide ‘herd immunity’ with new platform capabilities
Huntress has announced a wave of new capabilities across its Agentic Security Platform, designed to turn intelligence gathered from live attacks into proactive defences for every customer, rather than leaving each incident as one organisation’s problem. The updates span Managed ITDR, Managed EDR, Managed SIEM, Managed SAT and Managed ISPM. They draw on the company’s…
-
Sicherheitslücke in der Firmware: PHP2Shell bleibt in Firewalls und Industriegeräten gefährlich
Bei Firewalls, Routern und Industrieanlagen können Admins verwundbares PHP oft nicht selbst patchen. Selbst nach einem Update bleibt deshalb Handlungsbedarf. First seen on golem.de Jump to article: www.golem.de/news/sicherheitsluecke-in-der-firmware-php2shell-bleibt-in-firewalls-und-industriegeraeten-gefaehrlich-2611-214898.html
-
Alpine Linux SSH Flaw Lets Attackers Log In Without a Password
Administrators running sshd on Alpine Linux servers are being told to update openssh and restart sshd right away, since upgrading the package alone leaves the old daemon running. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/alpine-linux-servers-openssh-server/
-
November 2026 Patch Tuesday forecast: Old software continues to bite
How did you enjoy October 2026 Patch Tuesday? Were there enough CVEs reported to keep you busy for the rest of the year or are you finished and ready for another round next … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/06/november-2026-patch-tuesday-forecast/
-
10 Security Ratings Services: The 2026 Buyer’s Verdict Guide
Security ratings grade organizations from the outside exposed services, patch cadence, breach signals and the scores now move real money: insurance pricing, vendor tiers, board dashboards. The buyer’s duty is knowing what a score can and can’t see, and this roster needs two honesty notes up front: NormShield is Black Kite’s former name (one company,…
-
Breach Roundup: Hybrid Warfare in Europe Heats Up
Also: Norway Aid Agency Breach, Europe and Germany Target Online Scams. This week: Ukraine hacked back, Norway aid agency cyberattack, Harvard breach, 3AM used hybrid AI tactics. Sageworks went offline. European cops seized scam servers, cPGuard updates hijacked, ‘hello’ chats hid Flowise attacks, a Red Hat flaw, Synology NAS ransomware and Canonical fixed a flaw.…
-
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks
Zyxel’s June GS1900 patch did not block the exploit used against 996 switches, Binarly found First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/zyxel-gs1900-patch-missed-flaw/
-
Kein Patch verfügbar: Gefährliche Android-Lücke kann Smartphones unbrauchbar machen
Forscher haben eine gefährliche Android-Lücke aufgedeckt, mit der sich das System dauerhaft in eine Bootschleife versetzen lässt. Es droht Datenverlust. First seen on golem.de Jump to article: www.golem.de/news/kein-start-noetig-blosse-app-installation-kann-android-geraete-unbrauchbar-machen-2611-214896.html
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
OpenAI’s upcoming AI model built 948 working Linux root exploits in a single run
An automated system running on an upcoming AI model turned hundreds of Linux kernel bugs into working exploits that give an ordinary user root access, and wrote a patch for … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/05/openai-linux-kernel-root-exploits/
-
Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts
Citrix has released security updates for XenServer versions 8.4 and 9 to address a critical vulnerability. This flaw could allow an unauthenticated attacker on the management network to compromise virtualization hosts. The Cloud Software Group published a bulletin (CTX697256) on November 3, 2026, classifying the issue as Critical. The bulletin covers nine CVEs. Citrix XenServer…
-
Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts
Citrix has released security updates for XenServer versions 8.4 and 9 to address a critical vulnerability. This flaw could allow an unauthenticated attacker on the management network to compromise virtualization hosts. The Cloud Software Group published a bulletin (CTX697256) on November 3, 2026, classifying the issue as Critical. The bulletin covers nine CVEs. Citrix XenServer…
-
Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution
Zyxel GS1900 network switches that received the vendor’s earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found.The exploit lets anyone who can reach a switch’s web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that…
-
Hacker manipulieren Kühlanlagen: Warum veraltete OT-Systeme zum Sicherheitsrisiko werden
Cyberangriffe auf Supermärkte zeigen gravierende OT-Sicherheitslücken. Wie Netzwerksegmentierung, Virtual Patching und sichere Fernwartung schützen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/hacker-manipulieren-kuehlanlagen-warum-veraltete-ot-systeme-zum-sicherheitsrisiko-werden/a47006/
-
Schadcode-Attacken möglich: In Microsoft Paint klafft eine Zero-Click-Lücke
Angreifer können über Microsoft Paint Schadcode auf Windows-11-Systeme schleusen. Es gibt zwar einen Patch, aber der kommt bei vielen noch nicht an. First seen on golem.de Jump to article: www.golem.de/news/schadcode-attacken-moeglich-in-microsoft-paint-klafft-eine-zero-click-luecke-2611-214873.html
-
Google Chrome 157 Released With 213 Security Fixes, Including 7 Critical Vulnerabilities
Google has released Chrome 157 for Windows, macOS, and Linux, fixing 213 security vulnerabilities, seven of which are classified as critical. This update, announced on November 3, 2026, addresses issues related to graphics, rendering, JavaScript execution, permissions, and browser infrastructure. Google noted that it will continue distributing this update over the coming days and weeks.…
-
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
OpenAI on Wednesday detailed a pipeline that employed an upcoming cyber-focused artificial intelligence (AI) model to validate and patch 948 local privilege escalation vulnerabilities in Linux for $1.2 million in API costs.”Our prototype identified and analyzed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities, and produced 948 local privilege escalation (LPE) First seen on…
-
SonicWall Won’t Patch EoL GMS Flaws That Could Expose Files, Alter Database Records
SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched.Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below – CVE-2026-109593 (CVSS score: 9.1) – An unauthenticated file read vulnerability that could allow an attacker with network access to read…