Palo Alto confirms PAN-OS Brotli vulnerability CVE-2026-111497, a CVSS 9.2 buffer overflow in PAN-OS 12.2, 12.1 and 11.2. Install the hotfixes now.

Related Posts:

• Apple iOS 27.2 Update Fixes 160 Security Flaws
• CISA Adds PHP2Shell to KEV as Confirmed RCE Attacks and Suspected DPRK Scanning Surface
• Apple Backports Fix for Exploited CoreGraphics Zero-Day CVE-2026-86950 to Older iPhones

The post Palo Alto Networks Confirms Critical Brotli Flaw CVE-2026-111497 Affects PAN-OS appeared first on Daily CyberSecurity.

Palo Alto confirms PAN-OS PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 affect the firewall management interface. Restrict access and patch.

Related Posts:

• PHP Warns of New Session Upload Progress Flaw CVE-2026-115560, Urges Mitigation
• LiteSpeed Cache Flaws Expose 7 Million WordPress Sites to Stored XSS
• Oracle Issues Java Security Alert to Distrust Compromised eMudhra Certificates

The post Palo Alto Networks Confirms PHP2Shell Flaws Affect PAN-OS and Panorama appeared first on Daily CyberSecurity.

A New Mexico judge ordered Meta to pay $25 billion for misleading users about privacy, setting a record penalty. Meta plans to appeal.

This week a New Mexico judge ordered Meta to pay the state $25 billion. The order follows a jury finding that the company deceived Facebook users about their privacy, and it’s the biggest fine ever imposed on Meta. State District Court Judge Francis J. Mathew wrote that Facebook’s deception was intentional and that executives consistently misled users about how the platform worked.

“Facebook promised users that they (the users) controlled their data. This was false,” he said, as reported by the Associated Press.

This is a case about promises, not about a breach. Jurors found in September that Meta committed over 43 million violations of New Mexico consumer protection laws by making misleading public statements about how it handled users’ personal data. The case grew out of the Cambridge Analytica scandal, in which a political consulting firm harvested Facebook data to build targeted political ads for the 2016 election.

New Mexico had asked the court to fine Meta between $35 billion and $40 billion, arguing that only a large penalty would push the company to change its behavior. Meta’s lawyers said the fine should not exceed $3.4 billion and argued that any higher amount would be unconstitutional. The jury found more than 43 million violations, including 2.1 million under specific claims. Each violation can carry a fine of up to $5,000.

New Mexico Attorney General Raúl Torrez said the ruling sends a clear warning to technology companies that they must follow the law. Under the state’s constitution, fines for consumer protection violations go toward education. However, the money may remain tied up while Meta appeals the decision.

Meta plans to appeal the $25 billion ruling. The company argues that the decision and the way New Mexico is enforcing consumer protection laws make it almost impossible to operate in the state. Meta’s chief legal officer, C.J. Mahoney, says the case is an attempt to restrict free speech and impose new rules on what people can say online. The company says it is confident it will win the appeal. Meta’s lawyers also argued that the state failed to prove that residents had actually seen the misleading statements or suffered harm as a result.

Meta is worth $1.8 trillion and brought in more than $200 billion in revenue last year, and its shares rose 2% after the announcement, with earnings due that day. A nonprofit director called $25 billion a drop in the bucket for Meta, though he said it shows people want accountability. Both can be true: the company says doing business in New Mexico is all but impossible, and Wall Street shrugged.

The history explains why the number is so large. Cambridge Analytica got data through a personality quiz app that around 300,000 people took, and the app also pulled data on their friends, building a dataset of 87 million profiles. Meta banned the app in 2015 and asked Cambridge Analytica to delete the data, and the firm shut down in May 2018. The company later agreed to pay $725 million in December 2022 to settle a class action over sharing with Cambridge Analytica, and the FTC fined it $5 billion in 2019, a fifth of today’s award.

New Mexico was not part of the $18 billion settlement Meta reached in August with almost all other US states and territories. The deal includes stronger child-safety measures and $459 million related to the Cambridge Analytica scandal. This is Meta’s second legal defeat in New Mexico in six months. In March, a jury ordered the company to pay $375 million for misleading users about children’s safety.

Meta’s appeal could reduce the $25 billion fine if a court lowers the number of violations. The case also sends a warning to companies: privacy promises have legal consequences. As the judge stated, Facebook told users they controlled their data, but this was not true.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cambridge Analytica Scandal)

Meta wants the right to scrape your website for AI training. If you have a business account, that includes you.

At the end of the month, Meta plans to change its commercial terms in a way that matters to every company advertising or selling through its platforms. The new language takes effect on October 30, 2026. It lets Meta collect content from websites associated with business customers and use it to train AI models or otherwise improve its products, according to The Register.

Meta defines “business customer” broadly. It includes anyone who uses ads or marketing messages, sells or lists products, develops apps, uses a product catalog, manages a Page, runs a Group for business purposes, or uses tools such as Ads Manager or Meta Business Suite. At least one million businesses already use Meta’s AI agents in WhatsApp and Messenger. Nieman Lab also points out that almost every news publisher has at least one Meta business account.

The contract clearly explains which tools Meta can use. By accepting the terms, you allow Meta, or anyone working on its behalf, to use automated tools such as web scrapers, bots, spiders and crawlers to access and index your websites, pages and URLs. These tools can also revisit your sites regularly to collect updates.

“You authorise us (or any entity acting on our behalf) to use automated software (such as web scrapers, bots, robots, spiders, crawlers and user agents) and create test credentials to access, index, cache, analyse, collect, retrieve or crawl the domains, web pages or URLs (and any content available through them) that are associated with your products or services, or that are made available through your or users’ use of Meta Company Products and services, and to periodically pull updates from such domains, web pages or URLs.” states Meta’s commercial terms. “Meta may use any content from such domains, web pages or URLs to provide, develop, improve, research, train and maintain the integrity of, the Meta Company Products, services and features provided under these Commercial Terms and any other applicable supplemental terms.”

Then comes the use clause. The company may use any content from those domains to provide, develop, improve, research, train and maintain the integrity of its products, services and features. The contract lists scrapers, bots, robots, spiders, crawlers and user agents, which is a lot of ways to say visitor you didn’t invite.

The News/Media Alliance says there’s no way out. Business accounts have no option to opt out of the terms, and the only alternative is to stop using Meta’s products.

““Meta’s new commercial terms of use are outrageous and probably illegal. The company’s decision to withhold access to its audience unless businesses allow Meta to scrape content from their websites is an appalling, bad-faith policy, and a clear abuse of the company’s market power. It cannot be allowed to be implemented on October 30.” states Media Alliance. “The text is so far reaching that any business with intellectual property online and a Meta business account could have their copyrighted material taken from them.”

Danielle Coffey, President and CEO of the News/Media Alliance also pushed the point beyond news sites. Her questions were whether Taylor Swift’s Meta business account would give Meta access to copyrighted media on her website, and whether Shutterstock’s would let Meta scrape its images. The Alliance’s argument is that any business with intellectual property online and a Meta account could be affected, not just publishers.

There is also a problem with robots.txt. News reports say the social network giant plans to let businesses control how its crawlers access their websites through robots.txt files, but the contract makes no such promise. The law does not always require companies to follow these instructions, so businesses must rely on Meta to respect their preferences.

The company didn’t respond to The Register’s request for comment.

If you run a Meta business account, someone should read the terms before October 30 and check what your own robots.txt actually says.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

Review the latest Juniper security bulletin to patch critical Junos OS vulnerabilities, including RCE flaws CVE-2026-102182 and CVE-2026-101954.

Related Posts:

• Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update
• Citrix Patches XenServer Host Escape Risks and UniconOS Privilege Escalation Flaws
• SiteGuard Server Edition Flaw CVE-2026-106931 Exploited in the Wild for Root Access

The post Juniper Networks Patches Critical Junos OS Vulnerabilities Across Core Platforms appeared first on Daily CyberSecurity.

Attackers are actively exploiting CVE-2026-0322, a high-severity Palo Alto PAN-OS RCE vulnerability in the management interface. Apply patches right now.

Related Posts:

• Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update
• Citrix Patches XenServer Host Escape Risks and UniconOS Privilege Escalation Flaws
• SiteGuard Server Edition Flaw CVE-2026-106931 Exploited in the Wild for Root Access

The post Palo Alto PAN-OS RCE Vulnerability CVE-2026-0322 Actively Exploited in the Wild appeared first on Daily CyberSecurity.

An exploited F5 BIG-IP RCE vulnerability (CVE-2026-94127) is under active attack. Discover how the PoC works and patch your APM proxies immediately.

Related Posts:

• Critical ViewSonic vCast Vulnerabilities Enable Device Takeover
• MongoDB Driver Vulnerabilities Fixed Across Ecosystem
• High-Severity Apache Qpid Broker-J Vulnerabilities Fixed

The post Exploited F5 BIG-IP RCE Vulnerability Details and PoC Disclosed appeared first on Daily CyberSecurity.

An exploited VeloCloud vulnerability with a 10.0 CVSS score hits Arista appliances. Patch the critical VeloCloud vulnerability to stop active attacks.

Related Posts:

• Actively Exploited Veeam Agent Vulnerability PoC Disclosed
• D-Link DIR-822A Vulnerabilities Details and PoC Disclosed
• Pega Platform SAML Authentication Bypass: Critical 9.5 Flaw Patched

The post Exploited VeloCloud Vulnerability CVE-2026-93952 Hits 10 appeared first on Daily CyberSecurity.

Storm-2945 Uses Hospitality Networks to Target Travelers 

Credential Theft and Malware Deployment 

AI-Assisted Malware and Centralized Control

Microsoft's Defensive Guidance

A Telstra software defect disrupted mobile services, rail communications, payments, and emergency calls across Australia, exposing infrastructure risks.

The post Massive Telstra Outage Hits Mobile Networks, Rail, and Payments in Australia appeared first on TechRepublic.

A Danish court ordered the state to compensate TDC NET after the removal of Huawei fiber-network equipment, raising questions about telecom security costs.

The post Denmark Ordered to Pay $12M Over Huawei Equipment Removal appeared first on TechRepublic.

A group of unauthorized users reportedly has gained access to Anthropic’s controversial Claude Mythos Preview AI frontier model despite the AI vendor’s efforts to keep it out of public hands by limiting the organizations that can use it. Bloomberg reported that the unnamed group had tried multiple ways to gain access to the AI model..

The post Unauthorized Users Reportedly Gain Access to Anthropic’s Mythos AI Model appeared first on Security Boulevard.

Researchers are warning about the risks posed by a low-cost device that can give insiders and hackers unusually broad powers in compromising networks.

The devices, which typically sell for $30 to $100, are known as IP KVMs. Administrators often use them to remotely access machines on networks. The devices, not much bigger than a deck of cards, allow the machines to be accessed at the BIOS/UEFI level, the firmware that runs before the loading of the operating system.

This provides power and convenience to admins, but in the wrong hands, the capabilities can often torpedo what might otherwise be a secure network. Risks are posed when the devices—which are exposed to the Internet—are deployed with weak security configurations or surreptitiously connected to by insiders. Firmware vulnerabilities also leave them open to remote takeover.

Read full article

Comments