Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 9:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $
A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the
Latest
Wednesday, October 14
Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead. There are two autonomous system numbers ( ASNs ) associated with Yandex: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services. Using Cloudflare Radar and Bot Management data, we analyzed how these two ASNs were affected — and while both saw drops in traffic, they saw differing impact. Yandex Search (AS13238) : The drop in traffic consisted almost entirely of verified search crawlers indexing web pages, images, and site resources. Yandex.Cloud (AS200350): There was a decline in malicious activities like vulnerability scanning and probing, but high-volume automation did not vanish — it simply migrated to other hosting providers. While malicious traffic may originate from a particular provider, it does not necessarily tell us who is responsible for the traffic. Understanding why the strikes had little lasting effect on malicious traffic requires analyzing request behavior, rather than just overall traffic patterns. What happened: the effect of the strikes and pre-event baseline Between October 7 and 11, reported Ukrainian drone strikes hit three Yandex facilities in Russia, progressively knocking data centers and network capacity offline. As seen on Cloudflare Radar , this culminated in a near-total collapse of the Yandex network on October 11 when traffic plummeted to 99% below baseline for Yandex Search (AS1323
Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here. All the reports and research below were published between October 5th - October 11th. You can get the below into your inbox every week if you want: [https://www.cybersecstats.com/cybersecstatsnewsletter/](https://www.cybersecstats.com/cybersecstatsnewsletter/) # Ransomware **GRIT Q3 2026 Ransomware & Cyber Threat Insights Report (GuidePoint Security)** Q3’s ransomware activity, including the most active groups, who they’re targeting, and changing ransom payment trends. **Key stats:** * Observed ransomware victim volume reached a record 2,760 in Q3 2026, up 21% from Q2 and 75% from Q3 2025. * Ransomware payment rates fell by more than half year over year. * Average ransom payments among organizations that paid rose 34% year over year. *Read the full report* [*here*](https://www.cybersecstats.com/r/9bff5635?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* **Ransomware Roundup: Q3 2026 Stats on Attacks, Ransoms, and Active Gangs (Comparitech)** Another look at the quarter’s ransomware activity, with breakdowns by sector, country, and group. Its totals include both confirmed attacks and unconfirmed claims. **Key stats:** * Comparitech recorded 2,627 ransomware attacks and claims in Q3 2026, up 29% from Q2. * Of those, 247 were confirmed attacks and 2,380 were unconfirmed. * Qilin and The Gentlemen had the most confirmed attacks out of their claims, with 27 and 26 confirmed attacks, respectively. *Read the full analysis* [*here*](https://www.cybersecstats.com/r/a44c72dc?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Security Architecture **2026 SASE Platform Evolution Report (Versa)** Why organizations are consolidating SASE and network security tools, the challenges they face, and what they hope to gain. **Key stats:** * 92% of organizations are looking to consolidate cybersecurity functions through a single-vendor or platform-oriented Secure Access Service Edge (SASE) strategy. * Nearly seven in 10 IT and security professionals use four or more management consoles for SASE, Security Service Edge, and network security. * 58% expect consolidation to reduce operational complexity. *Read the full report* [*here*](https://www.cybersecstats.com/r/c1cf28af?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # AI Security **Path to the Autonomous Workplace (TeamViewer)** An interesting report on what workers are willing to hand over to AI, where they feel less confident, and what would make them more comfortable letting it act independently. **Key stats:** * 73% of workers are more likely to trust AI when it shows what it is doing and why. * 70% are comfortable with AI taking action as long as they can step in when needed. * 51% say they do not always know when to trust AI and when to verify its output. *Read the full report* [*here*](https://www.cybersecstats.com/r/c8ed632e?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Vulnerability Management **Beyond the Human Horizon (Cogent Security)** Looking beyond individual vulnerabilities to the attack paths they create. **Key stats:** * 7% of critical attack paths are created entirely by chaining low- and medium-severity vulnerabilities. * 64% of attack paths cross security domains that no single tool can see. * 83% of machine-viable attack paths persist for more than 30 days, compared with 55% of human-viable paths. *Read the full report* [*here*](https://www.cybersecstats.com/r/2f06f6e5?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* **Managing Exposure at AI Scale (ArmorCode)** More code and more findings mean more decisions about what needs fixing first. **Key stats:** * 40% of senior security and technology leaders say the volume of AI-generated code requiring human review is a significant security challenge. * 44% say their biggest transformation need is a tiered approach to AI-assisted vulnerability discovery that prioritizes findings by urgency. * 39% say improving remediation coordination between security and development is their leading security goal. *Read the full report* [*here*](https://www.cybersecstats.com/r/8b4fcc69?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Identity and Authentication **2026 Global State of Authentication Report (Yubico & Okta)** Workplace authentication habits, emerging AI threats, and attitudes toward AI agents acting independently. **Key stats:** * 43% of cybersecurity and IT professionals rely on passwords at work. * 52% inherit passwords on day one during onboarding. * 91% want a human approval step before autonomous AI agents execute critical actions. *Read the full report* [*here*](https://www.cybersecstats.com/r/39721439?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Small Business Security **Cyberattacks Are Common. Here’s How Small Businesses Recover (Clutch)** How secure do small businesses feel (and what happens when they’re attacked)? **Key stats:** * 95% of US small businesses believe they have sufficient security measures in place. * 68% have experienced a cyberattack or security breach. * Among small businesses that have experienced an attack, 70% report operational downtime or service disruption. *Read the full analysis* [*here*](https://www.cybersecstats.com/r/3b75565a?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Operational Security **The Global State of Operational Security 2026 (Claroty)** What cyber incidents mean for organizations managing cyber-physical systems. **Key stats:** * 58% of cyber-physical system operators experienced a cyberattack that impacted operational environments in the last 12 months. * Average operational downtime from a cyber incident is three days. * Average financial loss from an incident impacting operations is $1.04 million. **Read the full report** [**here**](https://www.cybersecstats.com/r/fcf3b256?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)**.** **State of Critical Infrastructure Cybersecurity Report (Palo Alto Networks)** Protecting critical infrastructure gets harder when teams can’t see everything connected to their networks. **Key stats:** * 42% of organizations name legacy, unpatchable operational technology (OT) assets as their single biggest cybersecurity risk. * 68% do not have complete, real-time visibility of all assets connected to their OT networks. * 74% have not fully integrated IT and OT security operations across their organization. *Read the full report* [*here*](https://www.cybersecstats.com/r/2142f32e?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Enterprise Perspective **Authority Without Oversight: The 2026 Agentic Enterprise Report (Optro)** AI agents are getting more authority. **Key stats:** * 38% of enterprises authorize AI agents to approve or reject transactions. * 34% of organizations have experienced an inaccurate AI agent decision or output that was acted upon. * Only 9% of GRC and audit leaders have redesigned workflows to safely accommodate AI agents. *Read the full report* [*here*](https://www.cybersecstats.com/r/7bbde726?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* **Who Governs Enterprise AI? Global CIO Survey 2026 (Thoughtworks)** More AI, scattered budgets, more responsibility for CIOs. **Key stats:** * 91% of CIOs say AI adoption within their organization is happening faster than governance structures can adapt. * 92% agree that central IT will ultimately be held responsible for security breaches or compliance failures caused by AI tools purchased independently by business units. * 32% feel accountable for regulatory or compliance failures without sufficient authority. *Read the full report* [*here*](https://www.cybersecstats.com/r/b826c433?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* # Industry-Specific **Closing the AI Governance Gap: The 2026 Healthcare AI Security and Governance Benchmark (Clearwater Security & Compliance)** AI use in healthcare, from in-house tools to outside suppliers. **Key stats:** * 91% of healthcare organizations cannot verify what AI is actually running in their environments. * 74% are already exploring or running agentic systems. * Only 14.3% fully validate their vendors’ AI controls. *Read the full report* [*here*](https://www.cybersecstats.com/r/4837156a?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.* **PQC in Healthcare: From Data Risk to Migration Readiness (Forescout)** A look at exposed healthcare systems and whether the technology they use can support a move to post-quantum cryptography. **Key stats:** * More than 5,500 internet-exposed healthcare systems host sensitive healthcare data, including electronic medical records and medical imaging systems. * Only 31% of internet-exposed healthcare systems support TLS 1.3, the only TLS version capable of supporting standardized post-quantum cryptography. * Only 6% of Internet of Medical Things devices use SSH implementations that support post-quantum cryptography, compared with 50% of traditional IT devices. *Read the full analysis* [*here*](https://www.cybersecstats.com/r/c3f58654?m=50f43416-1146-4a3d-a1e1-5afc95e09a39)*.*
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money
Overview Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined. Description Name Constraints limit the names a subordinate certificate authority may issue. The reports concern how BoringSSL applies those limits to certain SAN (Subject Alternative Name) forms. The records do not share one status, and they do not all affect the same validation path. VU#410595.8 ( Fixed 2026-03-04 ): A wildcard DNS name may not be treated as covering a specifically excluded host. VU#410595.9 ( Accepted ): A URI with a colon before @ may cause the wrong host to be used when matching URI constraints. VU#410595.10 ( Disputed ): The finding concerns first-@ domain extraction in rfc822Name constraint matching. How consuming mail applications interpret the submitted multi-@ input, and whether that creates deployment exploitation, was not established. VU#410595.11 ( Rejected ): Trailing-dot handling in rfc822Name domains. The BoringSSL team declined this on 2026-02-28 as below its security threshold. VU#410595.12 ( Fixed 2026-03-04 ): Trailing-dot DNS names were not always normalized on the legacy validation path. Using BoringSSL in a product does not mean that product invokes an affected path or name form.
Overview This note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a constrained name may be accepted by one library and rejected by another. Some are fixed, some remain under review, and some were not accepted as security issues. Description Name Constraints are meant to keep a subordinate CA inside an allowed namespace. The records cover several name forms and do not all have the same classification. VU#948176.7 does not exist. DNS case-sensitivity and wildcards. While RFC 5280 requires case-insensitive DNS matching, it does not explicitly define wildcard Subject Alternative Name (SAN) matching, leading to varied implementation behaviors. For instance, GnuTLS was found to perform case-sensitive comparisons on certain names (CVE-2026-3833, fixed in 3.8.13). Similar discrepancies regarding case handling in wildcard parent-constraint lookups were reported in Go, as well as wildcard inconsistencies in LibreSSL and wolfSSL. Additionally, pyca/cryptography was identified to check DNS Name Constraints against certificate SANs but failed to validate them against the requested peer name (CVE-2026-34073, fixed in 46.0.6). IP addresses. Some libraries treat IPv4 and IPv4-mapped IPv6 forms as different when matching constraints. The Go security team determined that report did not meet its security bar; similar reports exist for Apple's Security.framework and Mozilla NSS and are included as comparative evidence. URIs. Libraries can differ on which host they extract from a URI SAN. OpenSSL merged PR #30319 for an @ in the path, que
The United Kingdom has issued economic sanctions against Cryptomus , a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it is not affiliated with Cryptomus. Image: Richard Sanders. On October 8, the U.K. issued sanctions (PDF) against Cryptomus — previously known as Certa Payments and Xeltox Enterprises — for processing payments that benefit the Russian government and its financial institutions. The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise. Also targeted in these sanctions were the virtual payment platforms VexPay , TokenSpot , and the Tsunami Payments service . As explained in our December 2024 investigation, “
Hyperdrive support for MySQL is now generally available (GA). Hyperdrive , Cloudflare’s database connection pooler for Workers, initially only supported Postgres. Since we announced the beta for MySQL protocol support last year, we have been working on making our MySQL handling as reliable as our Postgres support. We’ve learned some things from building and running a MySQL connection pooler on Cloudflare’s network. It turns out that the difference between beta and GA is just 20 bug fixes in a trenchcoat. During the beta, our goal was to validate that real-world customer usage hit our production availability target of 99.99%. We knew there were gaps in our reliability since we track how often client connections from a Worker end in an error related to Hyperdrive. In addition, we had feedback from customers in the beta that led to the discovery of a rare and subtle bug in our production environment. To convey the complexity of this particular bug, we first need to explain how Hyperdrive works. What is Hyperdrive? Hyperdrive is a distributed database connection pooler that connects Cloudflare Workers to SQL databases. Hyperdrive holds warm SQL connections open on our global network and shares these connections across many Worker requests. In addition to connection pooling, Hyperdrive can also cache common queries in our global CDN cache, reducing latency and load on the origin database. Establishing a connection to a SQL database is expensive, taking a minimum of five network round trips. On a serverless compute platform like Workers, establishing a connection for each request would be impractical, both because of the amount of latency added to each request, but also because
Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability that exposes cross-user workflow data; and prior to version 2.5.0, authenticated attackers could perform cross-user LLM credential abuse and data disclosure due to missing service-layer access checks. Together, these flaws could allow unauthenticated attackers to gain administrative control while enabling authenticated users access to sensitive data and hardcoded credentials. Description Bisheng is an open-source Large Language Model (LLM) application DevOps platform, developed by DataElement, designed to assist in building, managing, and scaling LLMs. CVE-2026-96679 (Legacy SSO Bypass) A vulnerability resides in the legacy SSO endpoint ( POST /user/sso ). The application processes incoming JSON payloads containing arbitrary usernames and issues a valid JSON Web Token (JWT) without enforcing any form of caller authentication, such as signature verification, shared secrets, or network allowlisting. Furthermore, if the provided username does not exist, the system automatically registers the account. If this newly generated account matches the configured administrative username or is the first user in the system, it is automatically granted super-administrator privileges. CVE-2026-96681 (IDOR Workflow Exposure) There are missing authorization controls across multiple version retrieval endpoints. The underlying source code retrieves flow and workflow version records based on user-supplied parameters without performing any data ownership or permission validation. Any authenticated user can query and read the complete Domain-Specific Language (DSL) configurati
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake. The call comes in at 4:40 on a Friday. It's the CFO, or it sounds exactly like her, asking the controller to push a supplier payment out before the weekend because a deal closes
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it
I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat. Of the 25 package managers reviewed 1 , fewer than half used lockfiles that checked for tampering by default, and only two verified the integrity of every package they downloaded. Supply-chain attacks caused by developer compromise are a common story, but imagine what happens if ongoing mitigation attempts, including work by Trail of Bits 2 , are successful. If developers of popular packages are no longer the easiest targets, attackers will shift their focus to the next weakest link in the system: the package repositories that serve the code. The cryptographic answers to this problem are more subtle than they appear, and many implementations fall short due to deliberate design choices, resource prioritization, or the complexity of developer-friendly solutions. One natural answer is to include a cryptographic hash of a package’s contents in a lockfile and compare hashes after downloading the package. This automatic verification was the default behavior in about half of the package managers I tested, but others required extra configuration to include or verify these hashes, used hashes in a cryptographically insecure way, or lacked hashes entirely. This is summarized in the following table.
Black-box Modbus RE of a 5-in-1 water-quality controller: AI-assisted reset discovery and a 401 ms reply trap
A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the
Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of
⚠️ URGENT WARNING: Fake "VRChat-DLSS5-Cam" GitHub repository is a dangerous Infostealer Malware (SmartLoader)
**Hi everyone,** I want to issue an urgent security warning regarding a trending YouTube campaign promoting a tool called **"VRChat-DLSS5-Cam"** hosted on GitHub (under the user `seefn1000-afk`). [https://github.com/seefn1000-afk/VRChat-DLSS5-Cam](https://github.com/seefn1000-afk/VRChat-DLSS5-Cam) **THIS IS A SOPHISTICATED MALWARE TRAP. DO NOT DOWNLOAD OR RUN IT.** https://preview.redd.it/7fooqrtg4dvh1.png?width=1419&format=png&auto=webp&s=116efd93c29662dc9cb782cfc800c30b2873ffab Here is the breakdown of the technical evidence proving this is a scam, including how the hacker bypassed automated security filters to trick users: 1. The Ultimate Proof: Globally Blacklisted by URLhaus This is not a guess; it is verified by global threat intelligence. The exact download link embedded in the repository's README (`.../resources/VR-DLS-Cam-Chat-v3.3.zip`) has been officially investigated and blacklisted by [**Abuse.ch**](http://Abuse.ch) **URLhaus (Database ID: 3931216)**. [https://urlhaus.abuse.ch/url/3931216/](https://urlhaus.abuse.ch/url/3931216/) https://preview.redd.it/h3hsewii4dvh1.png?width=1172&format=png&auto=webp&s=58e61a3e7a953fa4999d99e4c7fbe1a211ebb7dd * **Threat Type:** Malware download (`SmartLoader` / `LuaJIT-loader`). * **Behavior:** Once clicked, it silently drops a malicious payload containing `Application.bat` and `cli.exe` into your system to steal browser passwords, active session cookies, Steam configurations, and Discord tokens. 2. The GitDiagram Illusion (How they fooled advanced users) https://preview.redd.it/17yfdd6j4dvh1.png?width=1136&format=png&auto=webp&s=53eb7db310b96d28f3c28bffc08024c7ff7034b0 The hacker went out of their way to make the project look professional by uploading non-functional, stolen C++ files (`main.cpp`, `App.cpp`, `DlssnrFeature.cpp`) so that tools like **GitDiagram** would generate a massive, highly detailed system architecture map. * **The Reality:** The system diagram shows fake components like `NvOpticalFlow.cpp` and `DepthEstimator.cpp` claiming to calculate depth maps externally via a "Spout Capture". Physically, a 2D Spout video feed cannot mathematically calculate Unity's 3D game engine depth buffer from the outside without native engine integration. * **The Trap:** Automated repository scanners only checked the clean, text-based C++ placeholder files, giving it a **"LOW RISK"** score based on only **2% file coverage**. The remaining 98% of the data—the actual virus—is hidden inside the un-scanned `.zip` archive. 3. The Technical Lies * **DLSS 5 Does Not Exist:** NVIDIA’s current commercial technology is DLSS 3, with active AI research moving into DLSS 4 branches. There is absolutely no official "DLSS 5" on the market. * **GTX 1060 Hardware Impossibility:** The repository claims to run "DLSS Neural Rendering" on a GTX 1060. GTX cards physically lack **Tensor Cores**, making it architecturally impossible for them to compute neural network rendering models. Current Action Taken This repository has been officially reported to GitHub Trust & Safety under the **Article 16 Digital Services Act (DSA)** regulatory framework for immediate removal. If you see YouTube videos pushing this "DLSS 5 camera mod" with beautiful visual demonstrations, **please report the video and do not click the link**. Kicking off an executable file with admin rights will compromise your accounts in less than 3 seconds. If you want realistic photography in VRChat, please stay safe and stick to trusted, avatar-based camera prefabs like **VRCLens** or **VirtualLens2** on BOOTH.pm!
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code
I made a assembly line to reverse apks smoothly and gracefully,based on opencode and other mcp tools
A Saudi national and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. He was arrested by
Tuesday, October 13
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch batch dwarfs September’s record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond. Just one of the weaknesses patched this week is considered a “zero day,” or already exploited in the wild. CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions. Windows 10 users might be wondering if they can still expect security updates after this month. Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback. A few months ago, Microsoft quietly extended that support for another year (until October 2027). At least 78 of the flaws fixed this month are rated “critical,” meaning they could be exploited with little or no action by the user, and most of those critical bugs allow an attacker to execute code of their choice on the vulnerable system. While Microsoft said there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (
Overview Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execute arbitrary commands as root on the underlying host, enabling persistent compromise of infrastructure. Description Komodo is an open-source server and deployment manager, maintained by mogh.tech, widely used in self-hosted and Docker multi-server environments. Periphery is an agent service installed on servers to give Komodo control over Docker environments. In vulnerable versions of Komodo, Periphery does not properly validate user-supplied Docker container names before those values are interpolated into shell commands used by the agent. Two operations exhibit this vulnerability: container destruction ( DestroyContainer / RemoveContainer ) and container log searches ( SearchContainerLog / GetContainerLogSearch ). Through both avenues, raw container names are directly inserted into sh -c command lines without any shell escaping or validation. These commands then run with Periphery's root privileges on the host OS and Docker socket. Impact An authenticated non-admin user can escalate privileges through OS command injection via a maliciously crafted container name. Successful exploitation enables arbitrary command execution as root on a target server within a Komodo deployment. Ultimately, this enables an attacker to establish persistence, achieve lateral movement, and completely compromise
VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753 Lowcoder is an open-source low-code platform that allows individuals with minimal coding experience to build web applications through a visual drag-and-drop interface. Each Lowcoder project contains a centralized Query Library which stores the workspace’s data queries and sources for quick reuse; however, the LibraryQuery API service layer lacks organization-scope checks at two endpoints: metadata retrieval and query execution. While the application features a role-based access mechanism (requires admin or dev ), it only checks the role’s validity against the user’s own organization. The vulnerable endpoints do not validate whether the requested resource belongs to the requester's organization. Impact Any authenticated attacker with an admin or dev role in any organization on a multi-tenant Lowcoder instance can access other tenants’ Query Libraries. Note that these roles are granted by default for any self-signup account when LOWCODER_EMAIL_SIGNUP_ENABLED and LOWCODER_CREATE_WORKSPACE_ON_SIGNUP are TRUE . This allows an attacker to do the following: Read the full Domain Specific Language (DSL) of any other organization’s library queries, including complete query configura
VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation
Overview This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior that RFC 5280 does not fully specify. Description The observed differences concern DNS name comparison, IP address handling, URI-authority parsing, and wildcard matching. These include both implementation defects and behavior not fully specified by RFC 5280. DNS-name comparison. RFC 5280 requires case-insensitive matching for DNS names. GnuTLS compared some names' case-sensitivity at the time of reporting (CVE-2026-3833, later fixed in 3.8.13). A distinct Go report concerns case handling in wildcard parent-constraint lookup, not ordinary hostname comparison. IP address handling. RFC 5280 defines separate IPv4 and IPv6 encodings and does not say whether IPv4-mapped IPv6 addresses should be treated as IPv4. Some libraries treat the two forms as different, so a constraint written for one form may not apply to the other. URI-authority parsing. RFC 3986 allows optional userinfo before the host. Implementations differ on which host they extract when @ , a colon, or a query or fragment is present. OpenSSL merged PR #30319 for an @ in the path, query, or fragment; a separate userinfo-colon report is not covered by that confirmation. Related differences have been reported in other libraries. A well-formed single @ is handled per RFC 3986 by most implementations. Wildcard matching. RFC 5280 does not define wildcard SAN semantics. Wildcard-related reports include LibreSSL and
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are "challenging to shut down," since "there's no centralized point to shut off."
Overview Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It provides merchants with customizable product pages, administrative interfaces, plugin functionality, and a media management system that allows users to upload and serve files. CVE-2026-104937 In affected versions, Shopware’s media upload API accepts HTML files that are later served as text/html without effective Content-Security-Policy or X-Content-Type-Options security headers. An attacker with access to the media upload capability can therefore upload an HTML file with malicious embedded JavaScript, and if an administrator opens the corresponding media URL, the attacker can exfiltrate the administrator's authentication token and use it to gain unauthorized access to the Shopware Administration API. Impact Successful exploitation of this vulnerability could allow an attacker with media creation/upload access to execute arbitrary JavaScript in the administrator browser context, steal valid administrator authentication tokens, and gain privileged access to the Shopware Administration API. If the affected administrator account possesses extension management privileges, an attacker could upload, install, and activate malicious plugins to achieve arbitrary PHP code execution on the underlying OS with the privileges of the Shopware process. Solution Unfortunately, the CERT/CC was unable to reach Shopware to coordinate this vulnerability. Until a patch
Continuous penetration testing runs against your live attack surface on an ongoing basis. Annual penetration testing gives you a deep, point-in-time snapshot once a year. Neither model is universally correct. The right choice depends on release velocity, attack surface volatility, and which compliance framework is driving the requirement. Enterprises shipping code weekly typically outgrow annual testing alone. The post Continuous Penetration Testing vs. Annual Pentests: What Enterprises Need to Know appeared first on Synack .
Traditional database architecture assumes you have one or two big database clusters per application, usually accompanied by a connection pooling solution. AI-assisted development and vibe coding platforms turn this model inside out and are driving applications toward many small databases: one per user, application, preview environment, or tenant. That model fits D1 particularly well. D1 is Cloudflare's managed, serverless database based on SQLite. It allows you to create millions of databases and only pay for what you use. The question becomes: how do you scale the control plane for millions of databases without making every query slower by sending it through centralized bottlenecks? We made a lot of architectural changes to scale out D1 to support platforms with millions of created databases, hundreds of thousands of which are active at any point. This post is a behind-the-scenes deep dive into how the D1 control plane works. Many of the architectural patterns we will describe can be used by anyone building on top of Cloudflare’s Developer Platform. The post also gives a glimpse into how we build our own control planes. Growth in numbers There was already a steady growth in D1 usage when we started planning these changes, but we knew we would need to support a much bigger scale once large platforms started building with D1. Here is how things have played out so far. D1 has seen a 15x growth in the number of live non-deleted databases over the past one year , and a 65x growth over the past 2 years (as of October 8, 2026). We have also seen 18x growth in the number of daily active databases over the past year (as of October 8, 2026). A database is considered active if it executed at least one query during that day. Established and successful platforms are already building with D1, using the same tools available to all Cloudflare users.
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary
More than 20% of the web sits behind Cloudflare’s network, and our team, the Data team, owns the data pipeline responsible for plumbing that data (and more) from our global network to applicable central data centers. The Cloudflare network is a globally distributed system supporting tens of thousands of servers. Data that power Cloudflare Logs , SQL API , observability , internal analytics, and more flow through this network and use our data pipeline to serve customers. In May of this year, we were providing data delivery at roughly two billion events per second. This includes customer traffic as well as data sent from internal teams. Year after year, we tackle the same problem — exponential traffic growth against linear hardware growth. We have to react to this increase in order to keep resource costs under control. Over the past five years, we’ve made various improvements to compensate for the data volume increase in comparison to hardware allocation, equivalent to deferring two and a half years of hardware expansion. This post details those changes: breaking up our monolithic data schema in 2022, adjusting compression in 2024, rearchitecting pipeline replication in spring 2026, decentralizing sampling in summer 2026, and introducing aggregations into the pipeline in fall 2026. Background Our pipeline starts with an internal service called Logfwdr, where we collect from highly distributed data sources (think: Workers, FL ). We then feed this data to a set
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements
Presently sponsored by: Where are your AI agents? Origin's sensor finds every install on your fleet, grouped by owner, including the ones your MDM never sees. I remember the name of that AI doco now - The AI Doc: Or How I Became an Apocaloptimist . I was watching it on the long-haul flight home the other day, and what I found particularly engrossing was the polar-opposite opinions from a bunch of people: "it's gonna kill us all" versus "it's gonna make us all rich", and so on. But to some extent, I can understand the gap between opinions when we're all just speculating about the future. I have much less understanding for why people infatuate with hyping AI as a data breach monster when the evidence to date is quite the opposite. In fact, I've enjoyed sharing example after example of recent breaches perpetrated by kids with a telephone (vishing), while pointing out I haven't seen a single one orchestrated by AI. Speaking of AI, a big thanks to this week's sponsor who's doing gtreat things in the agent observability space, Origin . The machines may not be dumping data that lands in HIBP (yet), but they do go off-script and Origin will help trace back precisely what happened when it all goes wrong.
Doyensec discovered multiple vulnerabilities in `SFAPE.dll`, a VBS enclave shipped with Windows, and chained them to gain code execution within the enclave in Windows Isolated User Mode (VTL1). The post explores how VBS enclaves work and how memory corruption can undermine their isolation guarantees. Microsoft addressed the reported issue in the September 2026 bulletin under [CVE-2026-83498](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83498).
Hayabusa-Bulk-Runner: run Hayabusa across a whole folder of per-host KAPE collections and get one cross-host triage view
Built this in my free time and figured this crowd might get some use out of it, or at least tell me what I've got wrong. Hayabusa, by Yamato Security, is excellent on a single host. You point it at a directory of event logs and get fast Sigma-based detections with an HTML summary. The snag for me is what an engagement actually looks like: a folder of KAPE collections, one per host, some loose and some as VHD/VHDX. I end up mounting each image, running Hayabusa on each host one at a time, then stitching the results together by hand. Hayabusa-Bulk-Runner does that part. Point it at a folder with one entry per host and it mounts each image and runs Hayabusa on every host, then rolls the lot into a single cross-host triage dashboard showing which hosts are worst and which rules fired where, alongside the per-host reports and timelines. It is not a detection engine and not a replacement. Every detection is still Hayabusa's. It just does the batching and the triage view on top. Evidence handling, since it matters here: it only ever reads the evidence. Disk images are never mounted directly. It creates a read-only differencing child over the image and mounts that, and it hashes the source before and after to show it was untouched. Upfront: I built it with Claude Code, partly to see how far I could get on something I'd actually use. So treat it like any tool you didn't write yourself. The code is there to read, it has a Pester suite and CI across PowerShell 5.1 and 7, and I've run it against KAPE output, but verify results before you lean on it for casework. It's early and will have rough edges. MIT licensed. Hayabusa is AGPL and called as a separate program, I don't bundle it or its rules, you bring your own. Repo: https://github.com/rorywag/Hayabusa-Bulk-Runner Hayabusa: https://github.com/Yamato-Security/hayabusa Happy to take bug reports, feature ideas, or a straight "this is wrong because". That's mostly why I'm posting.
Monday, October 12
Can someone reverse engineer BlueStacks 5? And make a version where games doesn't detect it's a emulator.
Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side and client-side attack surfaces. Description Thelia is an open-source e-commerce platform designed to provide merchants with customizable online storefronts, product management workflows, and administrative functionalities. It utilizes the Smarty template engine and provides administrators with broad control over templates, content, and modules. CVE-2026-103521 In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server. CVE-2026-103522 In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client-supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server. CVE-2026-103523 Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the "Add New Address" form, the application redirects them to the URL specified in the
Logpush delivers logs in batches as quickly as possible, enabling Cloudflare to provide information almost in real time. During our recent Birthday Week , we made Logpush available on all self-serve plans and Transformers generally available. Those changes were among eight major updates to Cloudflare Observability and reflect our commitment to make every Cloudflare feature available to everyone . This post takes a deeper look at how Transformers work inside Logpush's export pipeline. Observability teams use Logpush to export Cloudflare logs to security information and event management systems (SIEMs), analytics platforms, and object storage. Before those logs reach their destination, teams may need to remove health checks, omit sensitive fields, or reshape records for dashboards and investigations. Today, this often requires a separate processing service that teams must deploy, scale, monitor, and maintain. For example, a team that collects logs from multiple CDNs can add a static provider field to normalize records before they reach its analytics platform. Teams also pay to export, ingest, and store records they discard as soon as they arrive, so filtering them before delivery can reduce downstream data volume and cost. With Transformers, that processing moves into the Logpush export workflow.Teams define a SQL query to filter records, redact sensitive data, and r
Kanishka Narayan, concerned by Australian incident, says British cyber defences could be bypassed by artificial intelligence agent UK politics live – latest updates An AI-driven cyber-attack similar to the OpenAI breach of Australia’s healthcare system is likely, “if not inevitable”, in the UK, according to a senior minister. Kanishka Narayan, the UK AI minister, indicated that the British government’s own cyber defences would be bypassed by a technology that has developed highly sophisticated skills in cybersecurity. Continue reading...
Investigators also sought permission to use an invasive surveillance tool called a cell-site simulators against journalist Georgia Fort and a Minnesota state Senate candidate.
An exploit chain was found in LG webOS, leading to root command execution. The chain starts with a client-key issuance bypass, progresses through service-level access, and ultimately leads to root command execution.
Writeup: getting MAXIO's MXMPTool to exclude a bad die on a MAP1202 SSD (two bugs in its die-exclusion path)
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Sunday, October 11
Researchers at Apiiro identified 17,610 malicious GitHub repositories associated with a campaign called FakeGit.
Researchers at Apiiro identified 17,610 malicious GitHub repositories associated with a campaign called FakeGit. The repositories are designed to resemble legitimate software projects. Many contain convincing documentation and download buttons. However, the downloads can deliver SmartLoader, a malware loader associated with the StealC information stealer. StealC is designed to steal sensitive information such as credentials and browser session data. Researchers discovered that attackers were repeatedly updating existing repositories rather than constantly creating new ones. This allowed the campaign to reuse established repositories and redirect visitors toward fresh malicious downloads. Some repositories were associated with accounts that appeared to belong to legitimate developers. Original security research published October 6, with subsequent reporting. The 17,610 figure represents the researchers' observed campaign inventory, not a verified count of repositories still active today. This directly affects people who download privacy software, cybersecurity utilities, cryptocurrency tools, and other open-source applications. A project being hosted on GitHub does not automatically make it trustworthy. Attackers can create convincing repositories or compromise legitimate developer accounts.
Hey everyone, While analyzing modern loaders and crypters, I kept running into cases where naive, section-wide Shannon entropy ($H > 7.2$) failed to flag suspicious binaries: 1. **Averaging dilution:** Stashing a 20 KB encrypted shellcode blob inside a 1 MB `.rdata` section padded with nulls keeps the global entropy below 5.5. 2. **Artificial dilution:** Padding ciphertext with repeated non-null bytes (like NOP sleds or repeated delimiters) artificially compresses entropy down to benign code levels. 3. **String-based staging:** Staging payloads as UUID or IPv4 tables (`UuidFromStringA`, `RtlIpv4StringToAddressA`) keeps disk entropy around 4.0 until runtime reassembly in memory. Most quick-triage tools calculate entropy across the entire file or whole sections, which washes out these localized spikes. To solve this, I wrote **EntropyStrip**, an open-source Python CLI designed for fast PE structural triage. ### What it does differently: * **Dual-Resolution Sliding Windows:** Scans sections and overlays in 1024-byte and 256-byte windows with a 50% step to catch concentrated cryptographic stagers regardless of total section size. * **Dilution Defense & Chi-Square:** Analyzes modal byte distributions and opcode frequency curves to flag artificially flattened ciphertext. * **String Staging Primitives:** Flags `UuidFromString*` and `RtlIpv4StringToAddress*` staging patterns and detects formatted UUID payload clusters. * **False Positive Reduction:** Validates `WIN_CERTIFICATE` Authenticode tables and NSIS header signatures (`0xdeadbeef`) so digitally signed binaries and legitimate installers are not falsely scored as malware droppers. * **Payload Carving:** Includes `--dump` to carve out anomalous sections or trailing overlays straight to disk for Ghidra or x64dbg. * **Directory Triage:** `--dir` walks entire folders and ranks binaries on a risk leaderboard with MITRE ATT&CK mapping (T1027, T1055, etc.). ### Quick install: ```bash pip install entropystrip ``` Edit: Fixed Markdown
Saturday, October 10
Anti-cybercrime initiatives are increasingly using AI to scam the scammers by tricking them into talking to lifelike bots that they think are real victims.
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters. The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel . One source close to the investigation told KrebsOnSecurity the Canadian person arrested this week was visiting Pennsylvania for a cyber insurance conference, and that the suspect’s company specialized in handling ransomware negotiations with cybercrime groups. Another shared that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas. An online search reveals the Cyber Risk Summit was held at the Loews Philadelphia Hotel between Oct. 5 and Oct. 7. The conference had several sponsors, but according to the summit’s website its biggest sponsor was a Canadian security company called Cypfer . According to LinkedIn, one of Cypfer’s “ex-founders” was Edward Dubrovsky , who is now associated with another Canadian security firm and sponsor
Friday, October 9
Following last week’s release of Clef and Clef-flash , Cloudflare’s open-weight decision models, we decided to bring forth more gifts. Today, we’re releasing Clef-omni, which takes in audio and video input alongside text and image. We also cut the price of Clef-flash so it is now cheaper than Jev, and we made Clef faster. Although the model game is still early for Cloudflare, innovation and iteration is in our DNA, and we apply these principles to everything we do. In fact, the story of Clef came together over the course of less than a week. We decided we wanted to do something in the decision model space on a Friday evening, trained the model over the weekend, and launched it on Thursday. Even with such a short timeline, we were able to ship performant, high-quality, open-weight models for the community — imagine what more we can do in the future. For today, we’re excited to keep up the momentum with new additions and improvements to our Clef family of models. This is just the beginning, and we’ll continue to get better, faster, cheaper, and more innovative. Clef-omni takes audio, video, image, and text input Our new Clef-omni model is able to take audio, video, image, and text input. This changes the paradigm for decision models, which have been largely text-only since the debut of Jev from TypeSafe. With Clef, we supported images and video frame arrays, but Clef-omni is able to take in audio (wav or mp3) and video (mp4 or webm) alongside text and images. Instead of setting up cascading pipelines of models that transcribe speech-to-text, or splitting audio and image channels from video, you can just call one model to make decisions across any modality. We are now one step closer to a model that is able to interact with the world as we experience it — through audio, visual, and textual communication, all in one. Chec
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. Paper! It still exists. We have to admit it - so much is happening right now (F1, GTA6, breakfast) that we barely have time to lovingly tease our most favoritest vendors. On Thursday, 27 August 2026, PaperCut published an advisory claiming that a mysterious vulnerability was being exploited in-the-wild, leading to system compromise. The watchTowr Intel team has documented the in-the-wild exploitation that our global honeypot network, Attacker Eye, captured here . To add insult to injury, when PaperCut released their advisory, they did so without a patch. Unlike other vendors that struggle to communicate at all, PaperCut provided IOCs in the form of log snippets related to exploitation and temporary mitigations, enabling their customers to take a
Block Kit alerts, threaded conversations with Marcus, and every action tied to a verified Guard identity. The alert that matters usually lands in Slack. Someone sees it, someone else asks what it affects, and a third person opens another tab to find out. Every context switch is time an attacker spends inside the window you are trying to close. Worse, the integrations that bring security data into chat tend to trust whoever is typing. An email address that matches is treated as proof of identity. That is not authorization, and attackers know it. The Guard’s Slack integration used to be a one-way webhook. Marcus replaces it with a real Slack app that delivers alerts, runs conversations in your channels, and ties every request to an authenticated Guard user. Here’s what changed. Install it like a Slack app, not a webhook A Guard admin clicks Add to Slack, completes OAuth v2, picks the target channels, and the app is live. It is a multi-tenant install, so there is no webhook URL to paste into a form and nothing to rotate when someone leaves the team. Channel management is explicit. You map specific Slack channels to your Guard tenant, and a confirmation step runs before the connection is established. You can view every connected channel with its tenant mapping on a per-row basis, and disconnect any of them through a confirmation-gated flow. Nothing quietly starts posting findings into a channel nobody meant to include. Alerts that carry st
Understanding why an application is using more resources than expected, whether that is CPU or memory, can be challenging. Logs and aggregate metrics can only get you so far. Thankfully there is a better way: CPU or memory profiling can show you the exact function where your application is using CPU or allocating memory. Today we are happy to announce support for CPU and memory profiling of Workers and Durable Objects. From the Workers Observability page, you can now request an on-demand CPU or memory profile of an active Worker, inspect it as an interactive flamegraph, and download the profile file for further analysis. This method of profiling gives you a useful perspective into what your code is doing and how you can improve it in a real-world setting. That’s because the best way to understand your application is to profile it in production. To try this on one of your Workers, you have a choice of using the CLI or the Cloudflare Dashboard. To use the CLI, make sure you have the cf package installed , then simply run: cf workers versions profile latest \ --worker-id "$WORKER_ID_OR_NAME" \ --duration-ms 5000 \ --profile-type cpu > worker-cpu.pprof To use the dashboard, head to the Cloudflare dashboard and then access the list of Workers on your account by navigating through Build → Compute → Workers & Pages. Select your Worker and navigate to its Observability tab. You can then use the drop down to select “Flamegraph”: You can then request both CPU and memory profiles for your Worker on this page. The duration determines how long the profiler should run for on your Worker. You can also select different versions of your Worker to
The Deno team is joining Cloudflare to radically simplify self-hosting Workers and Durable Objects so developers can use the same primitives in more places. For what this means and how it came about, here’s the story from Ryan Dahl and Kenton Varda.
Hello, I was trying to download a game from [www.ziperto.com](http://www.ziperto.com) and after downloading a file I accidentally run a \~600 Kb .exe (I know, I wanted to hit backspace to delete the folder, instead I hastily pressed enter). I then got a message that the executable was not compatible with Windows. The morning after I've got a notification from my bank about a purchase I didn't make on PayPal, and hundreds of emails in my inbox. I flagged the purchase, changed my passwords, and blocked my card. It seems a strange coincidence with the .exe. I now ran MalwareBytes and Defender deep scan, nothing was found, but I am still paranoid that something is running on my PC. I checked and couldn't find any browser-proxy installed or any strange service or executable, but I am still paranoid. I don't have 2FA on PayPal as I have never use it but I am wondering how they got into my PayPal account from another device, even with the password I usually have to confirm the access from a secondary email. My PC was turned off when the purchase happened. Any idea how this could have happened and what should I check on my PC? I would like to avoid wiping the whole Windows 10 installation.
Brenden Cuni, an ICE supervisor, has been accused of excessive force and tackling a pregnant woman to the ground. Several of his arrests were later found to be unlawful in federal court.
Thursday, October 8
**TL;DR:** NVIDIA DCGM Exporter is a widely used monitoring tool that collects GPU metrics like utilization, memory, temperature, and power consumption from AI servers. We discovered that thousands of these monitoring endpoints are exposed to the public internet, allowing anyone to inspect GPU infrastructure. Worse, we found a **high-severity vulnerability (CVE-2026-47483, CVSS 8.2)** that lets unauthenticated attackers exhaust server resources, crash GPU monitoring, and potentially disrupt AI workloads remotely. **A few other interesting findings:** **2,100+ exposed GPU servers**, revealing telemetry from **12,000+ GPUs worth \~$100M**, including H100s, H200s, and Blackwell GPUs. **60% of exposed GPUs reported 0% utilization** across our scans. **12,096 additional servers** exposed infrastructure details, including OS, firmware, and networking information. NVIDIA fixed the vulnerability following our responsible disclosure. Full research: [https://lava.security/research/cve-2026-47483-nvidia-dcgm-exporter-vulnerability](https://lava.security/research/cve-2026-47483-nvidia-dcgm-exporter-vulnerability)
Blackpoint is a well-regarded provider of managed detection and response services to the MSP sector. Founded by former NSA employees, their autonomous containment model is highly effective and helps block attacks fast. But the company’s offerings and approach have certain limitations. If you’re exploring Blackpoint alternatives, this guide is for you. We’ll be looking at […] The post 6 alternatives to Blackpoint for your shortlist appeared first on Heimdal Security Blog .
Radar provides a real-time view into global Internet trends, powered by Cloudflare’s global network. We support Cloudflare’s mission to help build a better Internet by making web data visible, clear, and actionable for everyone. Since launching in 2020 , Radar has found a natural audience amongst expert users with technical backgrounds, such as network operators and academic researchers who rely on Radar data to observe industry trends and global events. But Radar also has the potential to be a more regular, self-serve resource for journalists, human rights advocates and policymakers, and everyday users. Making Radar accessible to a wider audience is a core part of our vision, so we knew it was time to reevaluate the user experience: How could we make Radar more approachable to broader audiences, while preserving the depth and rigor that we currently have? In this blog post, we’ll introduce the redesigned Radar, share our design process, and outline our broader vision for the platform’s future. Challenges with the previous design While the previous landing page was successful at showing the breadth of Radar’s data, the way that information was presented made it difficult to parse. The bento box layout gave everything similar visual weight, the vertical cards disrupted natural reading patterns, and the styling felt disconnected from Cloudflare’s broader brand. We heard this from users. One external user mentioned that one of his biggest frustrations with Radar was that it was difficult to show to his students. That feedback reinforced the problem that Radar could feel intimidating to people encountering it for t
Hello all We have a couple of Windows devices in the past that either had Bitlocker suspended or "Waiting for Activation". The latter is often the case with freshly shipped Windows 11 devices. In those cases, the the volume is encrypted using a clear key protector, see: [https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/planning-guide#bitlocker-provisioning](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/planning-guide#bitlocker-provisioning) There is no active key protector (i.e. no recovery key, no password or anything) that could be extracted. In those cases, we can image the device with for example FTK Imager, but when opening the image, FTK cannot read it. However, when we for example mount it in Windows as a volume in FTK Imager, the whole disk is readable. Does anyone know how to avoid this issue, which tools (e.g. Encase, X-Ways, Autopsy,...) have no issue with reading the E01 or how you typically deal with this? We want to of course avoid changing any setting on the device before acquiring the disk and we would like to directly work on the physical acquisition / E01.
With no accurate Big Tech mapping app to help him, Anas Hattab launched a Telegram group to get himself home at night. Now nearly 350,000 Palestinians rely on it to navigate the occupied West Bank.
It turns out you can overwrite the Error.prepareStackTrace method with the function constructor. Then, using prototype pollution, you can inject valid JavaScript code to generate arbitrary functions and invoke it using the usual tricks.
For months, GreyNoise recorded almost no Hikvision camera exploit attempts against Ukraine. On Sept 21 activity surged for nine days during Russian strikes, almost all from four IPs, then stopped. We can't say if the two are linked.