SAP’s November 2026 Security Patch Day brings fixes for critical vulnerabilities across SAP NetWeaver, Web Dispatcher, Gateway, and other business applications.

Released on November 10, the update includes 35 new security notes, four GitHub security advisories, and three updates to earlier notes.

Four vulnerabilities carry the maximum CVSS score of 10.0, making them the leading priorities for security teams. The release addresses memory corruption, missing authentication, broken access control, and code injection flaws.

SAP urges customers to review its security support portal and apply relevant corrections promptly. Administrators should check individual notes for affected components, patch requirements, and deployment instructions.

Among the most serious issues is CVE-2026-76964, a memory corruption vulnerability in SAP NetWeaver AS ABAP’s Internet Communication Manager.

According to the published CVE record, the software does not properly validate certain network input. An attacker without credentials could send crafted traffic, trigger memory corruption, and potentially execute arbitrary code, fully compromising the affected system.

SAP Security Patch Day

SAP Security Note 3778530 addresses this vulnerability. Affected releases include KRNL64UC 7.53 and KERNEL versions 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, and 9.20. Its CVSS vector indicates network access, low attack complexity, and no privilege or user interaction requirement.

Another maximum-severity flaw, CVE-2026-89126, affects SAP Web Dispatcher and is covered by Note 3778556. The memory corruption issue spans several kernel, Web Dispatcher, HDB, and runtime components. CVE-2026-89103 addresses broken access control in SAP Gateway and is covered by Note 3798345.

The fourth 10.0-rated issue, CVE-2026-120017, involves missing authentication in the SAML2 Service Provider within SAP NetWeaver AS ABAP and ABAP Platform.

Note 3849308 covers affected SAP_BASIS releases from selected older versions through 922. All four listed vectors indicate that exploitation requires neither credentials nor user interaction.

Three further critical notes carry scores of 9.9. These cover CVE-2026-109803 in NetWeaver Knowledge Management XML Forms, CVE-2026-76965 in the ABAP Application Server, and CVE-2026-109795 in S4CRM. Their listed vectors require low-level privileges, distinguishing them from the four unauthenticated maximum-severity issues.

SAP also patched cross-site request forgery in Web Dispatcher and Internet Communication Manager, rated 9.6, and an XML external entity vulnerability in BusinessObjects Web Intelligence, rated 9.1.

Developers should also review the GitHub advisories. These include improper JWT signature verification in SAP Cloud SDK for Python versions below 0.63.1, path traversal in its Agent Memory module, and a cross-tenant sandbox takeover issue in SAP/astonish.

The release follows October’s SAP security updates, which also addressed critical code injection and access control weaknesses. Earlier September SAP patches covered additional NetWeaver and cloud risks, reinforcing the need to track successive monthly fixes rather than treat each release separately.

Security teams should match installed component versions against the November notes, prioritize reachable systems affected by critical flaws, and test patches before deploying to production.

The supplied bulletin does not report active exploitation. Severity scores describe technical risk, not evidence that attackers have already compromised vulnerable installations.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post SAP Security Patch Day – Critical SAP NetWeaver, Dispatcher and Gateway Vulnerabilities Patched appeared first on Cyber Security News.

Progress Software has released its November 2026 WS_FTP Server Service Pack to address security weaknesses that could expose credentials, allow access to restricted files, and let remote attackers disrupt file transfers.

The company recommends upgrading Windows installations to WS_FTP Server 2025.0.5, also identified as version 10.0.5. The November 9 advisory supplied for this report describes five high-severity CVEs. Although the requested headline refers to seven vulnerabilities and path traversal, the supplied details do not establish either claim.

Administrators should use the individual CVE descriptions to understand the risks rather than assume every issue allows the same attack.

CVE-2026-115338, rated 8.1, affects the XFT service when connections use unencrypted HTTP. A network attacker could intercept sensitive information or change requests sent to the service.

Until patching is complete, Progress recommends disabling HTTP, requiring HTTPS, invalidating active sessions, and rotating credentials known to have crossed unencrypted connections.

Another flaw, CVE-2026-115340, carries a 7.1 score and concerns temporary files created during file transfers. These files may contain user credentials and session data. Anyone with access could obtain sensitive information. Progress credits researcher Momen Elmady, known as 0xmatrix, with discovering the issue.

Progress WS_FTP Server Fixes Vulnerabilities

Temporary measures include shortening XFT session timeouts where practical and limiting the Ad Hoc Transfer endpoint to trusted networks when public access is unnecessary. These controls reduce exposure but do not replace the update.

CVE-2026-115341, rated 7.7, affects Thin Client Web Transfer. Weak access restrictions could allow an authenticated FTP user to read files outside their intended scope.

Researcher Mateusz Mieczkowski, known as rexnets, received discovery credit. The advisory describes file disclosure, without explaining a confirmed path traversal mechanism.

CVE-2026-115339 has a 7.5 score and allows an unauthenticated remote attacker to exhaust XFT memory because resource limits are insufficient. Administrators can temporarily lower message-size and array-size limits to the minimum needed for normal transfers, with configuration guidance from Progress support.

The fifth issue, CVE-2026-35189, affects OpenSSL certificate processing and also scores 7.5. A certificate containing many relative certificate revocation list distribution points can trigger excessive memory use and denial of service.

Within WS_FTP Server, this risk applies to affected packages containing OpenSSL 3.5.8 when client-certificate requests are enabled. That setting is turned off by default. Progress says releases 2024.0.8 and 2025.0.5 update OpenSSL to 3.5.9. Customers should not replace the bundled library independently.

The broader file-transfer threat remains relevant. Cybersecurity News previously covered active exploitation of Wing FTP Server, a separate product, and millions of internet-facing FTP servers. Neither report establishes exploitation of these WS_FTP flaws.

Progress recommends version 2025.0.5 to resolve all vulnerabilities listed in the supplied notice. The company says workarounds only reduce exposure and that remediation requires the full installer. Organizations should schedule downtime because the upgrade causes a service outage.

Customers should obtain installers through the Progress Community portal and review the vendor’s upgrade guidance. The public release-notes page retrieved for this report still lists 2025.0.4 as its newest entry, so it does not independently confirm the November fixes.

The supplied notice does not report active exploitation. Its documented risks still make patch planning important, especially where web transfer endpoints are reachable from untrusted networks or credentials may have previously traveled over HTTP.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Progress WS_FTP Server Fixes 7 Security Flaws Allowing Credential Theft, Path Traversal, and Remote Attacks appeared first on Cyber Security News.

Vanderbilt University told students, faculty, and staff to shut down university devices and disconnect from campus Wi-Fi on November 9, 2026, while its IT team investigated an active cybersecurity incident.

The warning came as the BYOD ransomware group claimed it had locked university databases and stolen sensitive student, employee, and research data. Vanderbilt has not confirmed the group’s involvement or its data theft claims.

The Nashville university said the incident could affect devices, internal systems, and cloud services. In its official incident update, Vanderbilt urged users to watch for unexpected pop-ups, missing files, unfamiliar applications, and unusual requests for passwords or login approvals. Its IT team began investigating and working to contain the incident.

BYOD posted a message on its data leak site claiming possession of more than one million Social Security numbers, along with names, email addresses, phone numbers, and student and employee records.

The attackers also claimed access to university research data and control of its domain controller. These claims remain unverified, and Vanderbilt has not announced a confirmed number of affected people.

The note linked to BYOD’s leak site and provided contact details through the Session messaging platform. It claimed that backups were compromised and threatened to release data and cause further disruption unless the university negotiated.

Vanderbilt University Shuts Down Devices After Breach Claim

Local reporting also described files changing to the “.byod” extension and university research becoming inaccessible. Those accounts suggest file encryption, but they do not establish how widely systems were affected.

Vanderbilt has not publicly identified the attackers’ entry point, confirmed which systems were encrypted, or explained whether stolen accounts or a software flaw enabled access.

By 7:15 p.m. on November 9, Vanderbilt said campus Wi-Fi was available again. However, access to most university systems and applications remained restricted.

Its IT team was working with government agencies and other partners. The university planned to operate normally on November 10, with classes, student services, and staff attendance continuing as scheduled.

Faculty facing grant deadlines were directed to seek support from the university’s research office. Students were told to contact instructors about additional guidance and flexibility on coursework deadlines. The update showed that network access had partly returned, while important university applications remained unavailable.

BYOD previously appeared in reporting about an alleged Trump Mobile data breach. Separately, the Stanford University ransomware breach shows how campus incidents can expose sensitive records. Neither report establishes how Vanderbilt was breached.

Vanderbilt instructed anyone seeing suspicious activity not to click links, open attachments, or attempt repairs. Users should shut down the affected device and contact the IT service desk from another device or by phone.

The university’s public notice leaves key questions unanswered, including the full scope of any encryption, whether personal records were stolen, and when restricted systems will return to service.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Vanderbilt University Shuts Down Campus Devices After BYOD Ransomware Group Claims Network Breach appeared first on Cyber Security News.

Apple released iOS 27.2.1 and iPadOS 27.2.1 on November 9, 2026. The update fixes nine security flaws in Bluetooth, AirPlay, Messages, and other parts of the system.

It runs on iPhone 11 and later, and on several recent iPad models, including iPad Pro, iPad Air, iPad 9th generation, and iPad mini 6th generation. Apple’s security release page lists the update. Apple does not say any of these flaws were used in real attacks.

Most fixes address how devices pair with each other. Two bugs let someone get around the limit on pairing code guesses. Normally, a device blocks a person who keeps guessing wrong codes. If that limit fails, someone nearby could keep trying until a guess works.

The first, CVE-2026-113964, sits in CoreUtils. Apple says someone in Bluetooth range could skip the limit and pair with a device without the owner doing anything.

An anonymous researcher reported it. A second CoreUtils bug, CVE-2026-113965, could let a malicious Bluetooth device pair on its own, with no user action. Apple found that one itself.

Two more bugs affect AirPlay pairing codes. CVE-2026-113968 lets someone within Bluetooth range bypass the AirPlay limit. CVE-2026-113969 sits in rapportd and lets a person on the same network do the same. Both were fixed by improving how the system tracks its state.

Apple Fixes 9 Security Vulnerabilities

Bluetooth also had a memory bug. CVE-2026-113970 is a use-after-free flaw, which means the system keeps using memory after it has been released. Someone within Bluetooth range could use it to corrupt process memory. Apple fixed it with better memory handling.

The Messages app got two fixes, both reported by anonymous researchers. CVE-2026-113961 could let a remote person join an iMessage group chat and read its messages.

Apple fixed it by adding stronger checks on who can join. CVE-2026-113960 let a person added to a group read messages sent before they joined. Apple removed the code behind that flaw.

iMessage group chats can expose private conversations when access controls fail, although earlier flaws were more severe, including the NICKNAME zero-click exploit used against high-profile targets and fixed in iOS 18.3.

CVE-2026-113963 in App Intents could let an app access sensitive user data. László Várady reported it, and Apple fixed it by adding stronger authorization checks.

CVE-2026-111497 sits in brotli, a data compression tool. A specially crafted file could trigger an out-of-bounds write, meaning data lands outside its intended memory space. That can lead to memory corruption. Apple fixed it with better input checks and did not name a reporter.

Open Settings, tap General, then Software Update, and install iOS 27.2.1 or iPadOS 27.2.1. Apple notes that you can’t roll back an update once it is installed. Turning off Bluetooth and AirPlay when you do not need them also reduces your exposure.

Pairing flaws remind us that attackers don’t always need malware to get in. Sometimes they only need enough guesses. The AirPlay fixes also follow a rough year for the protocol.

Cyber Security News reported on the AirBorne AirPlay flaws, which put billions of devices at risk. Apple tracks each issue by its CVE ID, a shared number system explained on the CVE Program site. Anyone who finds an Apple bug can report it through Apple Product Security.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Apple Fixes 9 Security Vulnerabilities in iOS 27.2.1, Including Bluetooth Pairing and iMessage Flaws appeared first on Cyber Security News.

Google Gemini allowed users to download AI-generated images that its safety filters had refused to display, according to research published by Fog Security on November 5, 2026.

The bypass did not require a jailbreak. Instead, the download feature sometimes delivered a rejected image while the conversation showed a different, allowed picture.

Gemini Image Safety Filter Bypass

Fog Security reported the issue to Google in June 2026. By October 22, researchers could no longer reproduce it across 12 new attempts, and older conversations downloaded the correct images.

Google attributed the change to routine maintenance rather than a fix linked to the report. A Gemini web app flaw allowed blocked images to bypass safety refusals through the full-size download path, despite remaining restricted in chat.

Researchers first submitted an image request that triggered a refusal, then requested a different, permitted image. Although the allowed picture appeared onscreen, its download button sometimes retrieved the rejected output.

Results ranged from blurry, unfinished files to complete images, with successful tests across multiple days and sessions. Both image URLs used lh3.googleusercontent.com and required the signed-in user’s session. Inline links ended in =s1024-rj, while download links ended in =s0-d-I.

Researchers suspected a state-management error involving image generation, safety checks, and cleanup. That explanation remains unconfirmed.

A December 2025 Google community report also described downloads returning older images instead of the displayed preview. However, that complaint did not establish a safety bypass.

Unlike prompt injection targeting Gemini’s memory, this issue did not rely on hidden instructions changing the assistant’s behavior.

It also differed from AI jailbreaks using assistant prefill, which push models toward prohibited answers. Here, the refusal remained intact while file delivery failed to enforce it.

Fog Security tested copyrighted characters, a synthetic person, and the researcher’s own likeness. It did not test child safety content or images involving other real people. No access to another user’s data or privilege escalation was reported.

Google initially marked the June 25 report out of scope, then reviewed it after researchers stressed the infrastructure issue. It declined to track an abuse bug on September 30. On October 23, Google said no internal ticket had been filed and closed the report.

Fog Security recommends binding each download to its approved preview and removing files from refused or failed generations. The finding shows why AI safety testing must cover stored files and download links, not only chatbot replies. A refusal protects users only when every delivery path follows the same decision.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Google Gemini Safety Bypass Lets Users Download AI-Generated Images That Its Own Filters Blocked appeared first on Cyber Security News.

CISA added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog, warning that valid-credential users can bypass SAML authentication controls and potentially evade multi-factor authentication.

CISA added the vulnerability on November 6, 2026, and set a November 20 remediation deadline. Its entry lists ransomware use as unknown and does not require forensic triage under Binding Operational Directive 26-04. Organizations should still assess their exposure and follow the required vendor guidance.

SonicWall SonicOS SSLVPN Vulnerability Exploited

The vulnerability affects authentication enforcement in SonicOS SSLVPN. According to the CVE record, someone with valid credentials for an alternate authentication method may bypass the controls applied through SAML. Successful exploitation may also bypass MFA enforced through that SAML login process.

SAML allows an organization to manage sign-ins through a central identity provider. The risk here is that another authentication route may allow access without completing the expected checks. This is not described as a password-free attack. Valid credentials for an alternate method remain required.

The flaw is classified as CWE-308, or use of single-factor authentication. This weakness occurs when a system accepts one authentication factor, such as a password, when it should require additional checks. The result can undermine protection even when administrators believe MFA covers remote access.

The CVE record identifies affected Gen7 and Gen8 platforms running SonicOS 7.3.3-7015 and earlier, and 8.2.2-8015 and earlier, respectively. Cybersecurity News’ earlier SonicWall SSLVPN vulnerability report lists fixed releases as 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8, or later supported versions. The reported CVSS score is 7.1.

SonicWall’s warning initially described a report of potential exploitation. CISA’s subsequent catalog entry raises the urgency for defenders.

However, the available information does not identify the attackers, affected organizations, or the number of confirmed incidents. Ransomware involvement should not be presented as established.

Previous SonicWall authentication bypass attacks involved CVE-2024-53704, a separate flaw that allowed session hijacking without authentication. Those attack details should not be applied to this vulnerability, which has different access requirements.

Administrators should check appliance models, firmware versions, SAML settings, and internet exposure before applying the matching update. The SonicWall security advisory should guide deployment decisions. Published coverage lists no workaround, making the firmware upgrade the main remediation step.

Security teams should also review enabled login methods and VPN activity for unexpected access. An MFA setting alone should not be treated as proof that every authentication route enforces the same checks. Confirming those controls after patching helps ensure the intended remote access policy is actually applied.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks appeared first on Cyber Security News.

Hackers are now using a public exploit chain called Plex2Shell to break into unpatched Plex Media Server systems and install cryptocurrency miners and proxy software. According to SecurityWeek, the attacks began one day after the exploit code went public on October 16, 2026.

Plex2Shell links four flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Together, they let a remote user run code on a server without a password.

The code runs with the same rights as the Plex service. Security researcher Zach Main found the bugs and reported them to Plex on July 27. Plex confirmed the report and paid a bounty on August 4.

Hackers Exploit Plex2Shell Flaws

Plex Media Server often listens on port 32400, and many people leave it open to the internet so they can stream from anywhere. That makes it an easy target for anyone scanning for it.

The first flaw is a server-side request forgery bug in the /player/timeline endpoint. The server only checks that a token exists, not that it is valid, so even a fake token works. An attacker can then slip a full web address into the protocol field and trick Plex into sending a request to itself.

That request appears to come from the machine itself, which Plex trusts more. It opens a plugin interface that normally needs no token for local traffic. A broken check in the plugin code lets the attacker call other plugin functions.

The attacker then uses a TVDB plugin function and a web address that starts with 127.0.0.1 but points to a server the attacker controls. Plex sees the local prefix and adds the owner’s admin token to the request. The token goes straight to the attacker.

With the admin token, the attacker changes a transcoder setting so Plex writes a malicious file into its codec folder. The file is hidden inside a video. The next time Plex transcodes a video, it loads that file and runs it. The researcher’s write-up and proof-of-concept code are public on GitHub.

A researcher running a honeypot, a decoy server used to watch attacks, saw the first real exploitation on October 17. The attackers dropped an XMRig-based Monero miner and a Linux proxy tool called “myawesomeproxy.” The Hacker News reports that the miner pointed to a domain tied to the AISURU botnet. The attacks fetched payloads from 217.60.194[.]116.

Cybersecurity News also covered the first exploitation reports. It noted that the evidence did not show how many real servers were hit. The attack is not limited to home servers.

QNAP says some NAS users have been breached, and BleepingComputer reports that CISA added all four flaws to its Known Exploited Vulnerabilities list on October 20.

Update to Plex Media Server 1.43.3.10861 or newer, and check the version the server actually reports. Updating will not remove a payload that is already installed. QNAP advises treating an exposed server as compromised, checking for signs of infection, doing a clean reinstall, and resetting credentials.

Stop forwarding port 32400 if you do not need remote access. If you do need it, use a VPN. Also check the Plex process for strange child processes, unknown downloads, and high CPU use. Miners often show up first as a slow, hot server. For another example of how exposed services get turned into miners, see this Redis cryptojacking campaign.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Plex2Shell Flaws to Take Over Plex Media Servers and Deploy Crypto Miners appeared first on Cyber Security News.

CISA warned that two critical PowerSYSTEM Center flaws (CVSS 9.0) could let authenticated users access administrator resources or execute unauthorized database commands, affecting energy and manufacturing sectors worldwide.

The agency released advisory ICSA-26-307-01 on November 3, 2026. CISA credited Chinmay Patel of Digital Boundary Group and Subnet Solutions with reporting the vulnerabilities.

The Canadian vendor has provided upgrade guidance and temporary measures for organizations that cannot immediately update affected systems.

The first flaw, CVE-2026-63017, involves incorrect authorization, tracked as CWE-863. A user with limited permissions can access resources normally reserved for administrators. In simple terms, signing in with a basic account does not keep the user within the access limits intended for that account.

CISA Warns Critical Flaws in PowerSYSTEM Center

The second flaw, CVE-2026-63774, is an SQL injection vulnerability tracked as CWE-89. Insufficient input checks in the report designer allow an authenticated user to execute unauthorized SQL commands. The disclosed impact concerns database commands, not confirmed operating system code execution.

Both CVSS vectors describe low attack complexity, low privileges, and no required user interaction. They specify an adjacent attack vector rather than unrestricted network access.

CISA states that these vulnerabilities are not remotely exploitable and that no known public exploitation had been reported when the advisory was released.

CVE-2026-63017 affects PowerSYSTEM Center 2020 versions through 5.29.x, PowerSYSTEM Center 2024 versions 6.0.x through 6.2.x, and PowerSYSTEM Center 2026 versions 7.0.x through 7.1.x. CVE-2026-63774 affects the listed 2024 and 2026 ranges. The advisory does not list the 2020 branch as affected by SQL injection.

Subnet Solutions recommends PowerSYSTEM Center 2020 Update 30 for affected 2020 installations. Organizations running the 2024 branch should upgrade to PowerSYSTEM Center 2026 Update 1.1. Existing 2026 installations should also update to Update 1.1, according to CISA’s machine-readable advisory.

Checking installed versions is therefore essential before planning upgrades. Cybersecurity News previously covered CISA’s OT asset inventory guidance, which explains how accurate device and software records support vulnerability management across industrial environments.

For organizations unable to update, Subnet recommends monitoring user activity records and restricting Client Access Server users’ access to browser F12 Developer Tools to reduce authorization-related risk.

For the SQL injection issue, the vendor recommends restricting user access to the report designer. These are interim measures, not replacements for the recommended updates.

CISA also advises keeping control systems off the public internet, placing them behind firewalls, and separating them from business networks.

Where remote access is necessary, organizations should use updated VPNs and assess connected devices. Related secure OT connectivity guidance explains the value of limited exposure and controlled connections.

Before applying changes, operators should assess operational impact and risk. Operators should follow internal response procedures for suspected malicious activity and report it to CISA.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post CISA Warns Two Critical 9.0 Flaws in PowerSYSTEM Center Allow Unauthorized Access and SQL Injection appeared first on Cyber Security News.

Two high-severity flaws have been disclosed in ModSecurity, the open-source web application firewall (WAF) used with Apache, IIS, and Nginx.

Two GitHub advisories published by maintainer airween on September 30 describe flaws allowing malicious file uploads and server crashes that could lead to remote code execution.

ModSecurity inspects web traffic and blocks requests that look harmful. Many sites depend on it, so any gap in how it reads a request matters.

CVE-2026-104269 (GHSA-5pww-8rfg-9crf) affects ModSecurity 3.0.0 and later, allowing unauthenticated network attacks that bypass file checks and compromise integrity no patched version is available.

ModSecurity Patches High-Severity Flaws

The problem is a mismatch in how the firewall and the app read an upload. ModSecurity’s multipart parser does not support RFC 2231, a standard for encoded values in headers. Many app frameworks do. When a request holds both a plain filename and an encoded filename*, those frameworks prefer the encoded one.

An attacker can use this by sending filename=”safe.jpg” together with filename*=UTF-8”shell.php. The OWASP Core Rule Set sees a harmless JPG and lets it through. A Go backend reads the name as shell.php and may save it to disk. If the web server serves that folder, the attacker can run code on it.

The advisory says Go, Python (Flask and FastAPI), Node.js, and Java Spring parsers behave this way. PHP’s native upload handling reads only filename=, so it is not affected. Researchers 0xkalawy and ZeyadZonkorany found the issue, and B0YK4 coordinated the report.

The second flaw is CVE-2026-73857 (GHSA-jx3r-phvx-2jmj), reported by researcher Tobias Klein. A single crafted request from an unauthenticated remote user can make a worker process use an uninitialized pointer. That lets the request write a fixed value to an address the sender picks.

The result can be a crash, a memory leak, or a redirect of program flow, which could lead to remote code execution. The weaknesses are listed as CWE-787 (out-of-bounds write) and CWE-824 (access of uninitialized pointer). Its CVSS vector rates the impact as high for availability only, which my calculation puts near 7.5.

The risk is narrower than it sounds. The bug can be reached only when the SecParseXmlIntoArgs setting is On or OnlyArgs. It is Off by default. The code path was added in version 3.0.15, so 3.0.15, 3.0.16, and the current v3 master are affected. Earlier 3.0.x releases and ModSecurity v2 are not.

There is one point to check. The advisory lists 3.0.17 as the patched version, but its text also says a fix is “not yet” available and will come in the next release. Admins should confirm the release on the official project page before assuming they are safe.

For the XML flaw, make sure SecParseXmlIntoArgs is Off, which is the workaround the advisory gives. Then upgrade once you confirm the fixed release.

For the filename flaw, no patch is listed, so do not rely on the WAF alone to judge uploads. Apps should ignore the name sent by the client and create their own safe name. They should also block script extensions such as .php and store uploads outside the web root. These steps are general good practice and are not part of the advisory.

ModSecurity has had other bypass problems recently. Cyber Security News has covered earlier ModSecurity firewall bypass bugs and multiple ModSecurity rule bypass flaws.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ModSecurity Patches Two High-Severity Flaws Allowing WAF Bypass and Potential Remote Code Execution appeared first on Cyber Security News.

Veeam warned that a critical Linux kernel flaw with a CVSS score of 9.8, could cause denial of service or memory corruption across backup and recovery products.

Veeam’s November 6 impact statement identified a Linux kernel use-after-free vulnerability (CVE-2026-98432) in TCP/IPv4 connection setup and outlined update paths for affected systems.

Its security advisory does not report active exploitation or confirm remote code execution. The stated risks could interrupt backup and restore work if an affected appliance becomes unavailable.

Affected products include Veeam Software Appliance 13.1 and Veeam Infrastructure Appliance 13.1. Infrastructure roles include backup proxies, hardened repositories, mount servers, gateways, and Cloud Connect components. Workers deployed through Veeam hypervisor plug-ins also need the updated kernel.

Veeam Warns Critical Linux Kernel Flaw

Windows-based Veeam Backup & Replication installations also require attention because they deploy Linux helper appliances. These support file recovery, virtual labs, and cloud restores. The advisory lists affected helper appliances in versions 13.1 and 12.3, rather than identifying the Windows kernel as vulnerable.

The disclosure follows separate Veeam authorization bypass fixes and earlier Backup & Replication security updates. Those issues have different causes and patch requirements, so administrators should not assume earlier product updates resolve this kernel flaw.

Veeam says a patched kernel has been available for Software Appliance and Infrastructure Appliance 13.1 since November 2. The fixed package is 5.14.0-570.60.1+27.2.el9_6_ciq, delivered through Veeam Updater.

Administrators can install available updates from the Veeam Host Management console without waiting for the automatic schedule. A restart may be required.

The updater checks repositories every 12 hours. Under default settings, mandatory updates install on the nearest Sunday at 14:00 in the backup server’s time zone.

Teams should check update history to confirm installation. Systems using a local repository mirror receive the package only after that mirror synchronizes.

For Windows deployments, the 13.1 private fix requires Backup & Replication 13.1.2.57. Repacked 13.1.2 installation media includes the fix.

Veeam’s November 6 advisory says the private fix for version 12.3 will become available soon. Temporary helper appliances receive updated images when deployed again.

At the same time, persistent virtual labs and Microsoft Azure helper appliances must be redeployed. Replace recovery media created before the update. Hypervisor plug-in workers receive the updated kernel on their next launch.

AWS, Azure, and Google Cloud plug-in appliances receive Ubuntu kernel updates through Veeam Updater. Administrators should install available updates and review the Ubuntu CVE tracker for package status.

Veeam Kasten container images do not include a kernel, but their Kubernetes nodes still need vendor checks. Customer-managed Linux proxies, repositories, and gateways also require distribution updates. Completing these separate checks helps teams avoid leaving recovery components unpatched after updating the main appliance itself.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Veeam Warns Critical 9.8 Linux Kernel Flaw Could Crash Backup Appliances and Disrupt Recovery Operations appeared first on Cyber Security News.

Northflank urged customers to rotate all platform secrets after reports of unauthorized AI API key use, warning that environment variables across workloads, secret groups, and global settings may have been exposed.

Northflank is investigating a security incident involving reported misuse of AI keys but has not confirmed the entry point, identified an attacker, or disclosed affected customers. Its credential rotation warning remains precautionary, not confirmation of widespread theft.

Northflank’s published timeline begins with a Wiz threat alert at 11:43 UTC on October 30, 2026. Engineers reviewed the alert one minute later and deployed an initial network policy patch at 12:02 UTC.

Further patches followed at 12:50 and 13:05 UTC, and the team requested support from the Wiz incident response team at 13:00 UTC.

The timeline does not explain what those patches fixed. A network policy change alone does not establish how attackers entered the platform or reached customer secrets.

Northflank Security Breach

Northflank subsequently instructed users to treat environment variables as compromised and restrict public access to add-ons where enabled. Environment variables can hold API keys, database passwords, and other application credentials.

Similar exposure concerns surfaced in the recent Railway security incident, where customers were also advised to replace stored secrets after possible unauthorized access.

Northflank said the reported activity may fit a wider pattern of attacks targeting AI credentials. It pointed to similar IP addresses in Wiz’s “Black October” report, which described incidents across nine AI developer platforms during October.

Wiz found a shared focus on stored environment variables but identified no single vulnerability connecting the attacks. The financial risk comes from LLMjacking, where attackers use stolen credentials to consume paid AI services at the victim’s expense.

Previous reporting on LLMjacking attacks shows how compromised cloud keys can support unauthorized model access and resale. However, Northflank has not published a confirmed loss total or linked its incident to a named resale operation.

Customers should revoke existing credentials through the issuing providers, generate replacements, and update affected Northflank secrets and workloads.

Northflank also asked users to review AI provider usage and billing records for unexpected activity, then report suspicious usage to its support team and the relevant provider.

Secret rotation is now available for PostgreSQL, MongoDB, MySQL, Redis, MinIO, and RabbitMQ add-ons. Northflank also enabled audit logs for all customers, including free users, giving more teams access to records that may help their investigation.

The immediate priority is replacing all potentially exposed credentials, not only AI keys already showing abuse. Northflank’s latest guidance still covers secrets across workloads, shared secret groups, and global settings while its investigation remains open.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Northflank Security Breach Leads to Unauthorized AI API Key Usage, Customers Urged to Rotate Secrets appeared first on Cyber Security News.

A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary Function Driver for WinSock.

Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. Their complete exploit targets vulnerable Windows 11 22H2 systems.

The release concerns a vulnerability patched in January 2023, not a newly disclosed Windows flaw. IBM published the researchers’ technical analysis on March 21, 2023.

The vulnerability carries a CVSS score of 7.8 and requires low-level local privileges, with no user interaction. It does not provide a direct route into a computer over the internet. The flaw sits in afd.sys, a Windows kernel driver that handles requests from the WinSock networking interface.

According to IBM’s technical analysis, the researchers compared driver versions from December 2022 and January 2023 to understand Microsoft’s fix. Only one function, AfdNotifyRemoveIoCompletion, appeared to have changed, helping them narrow their investigation.

The older code failed to check a memory pointer supplied from a user application. That missing check let a local attacker write to kernel memory, where Windows stores sensitive system data.

Microsoft’s updated code added validation to ensure that pointers from user mode reference suitable user-space memory rather than protected kernel addresses.

POC for Windows WinSock Ancillary Vulnerability

The researchers said they diagnosed, reproduced, and turned the flaw into a working exploit in about one day, despite having no previous experience with this driver.

Their findings show how comparing patched and unpatched software can reveal enough detail to build an attack quickly.

The public GitHub repository describes the code as a demonstration. Its complete privilege escalation chain works on vulnerable Windows 11 22H2 installations, while the underlying memory-write capability works across vulnerable systems.

These are separate claims, and the repository does not promise full exploit compatibility with every affected Windows version. To move from a limited memory write to broader control, the exploit changes Windows I/O ring objects. These objects support queued input and output work.

The technique builds on research by Yarden Shafir and enables kernel memory reads and writes. The exploit then replaces a target process’s security token with one carrying SYSTEM privileges.

IBM also reported that 360 IceSword Lab found a different exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the researchers’ direct driver approach. This report does not establish that attackers used the published GitHub code.

Administrators should verify that affected devices received Microsoft’s fix or later applicable updates. IBM’s demonstration also worked without being blocked by HVCI, showing why that protection should not replace patching.

Related coverage includes CVE-2024-38193 exploitation and the CVE-2025-32709 WinSock zero-day. Both involve the same driver, but are separate flaws with different causes and patches.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability appeared first on Cyber Security News.

Synology NAS devices are facing C3RB3R ransomware attacks linked to 2024 security flaws, prompting the company to urge users to update outdated DiskStation Manager versions and packages.

The warning followed reports from the 360 Security Team and Solar Emergency Response Team on October 29. Victims found their files encrypted with the .L0CK3D extension and a ransom note named read-me3.txt.

Security teams provisionally identified the ransomware as C3RB3R. The available reporting does not establish how many devices have been compromised.

The Synology security advisory, tracked as Synology-SA-24:20, covers three vulnerabilities disclosed following Pwn2Own 2024. Published on November 5, 2024, it received several updates as fixes became available across DSM branches.

Although Appinn described the weaknesses as fixed by December 2024, Synology’s revision history shows that several patches arrived during November.

Cyber Security News previously examined the critical CVE-2024-10441 flaw in Synology DSM, which carries a CVSS score of 9.8 and allows unauthenticated remote code execution without user interaction.

Synology NAS Hit by C3RB3R Ransomware Attacks

The advisory also lists CVE-2024-50629, a webapi flaw that lets remote attackers read limited files, and CVE-2024-10445. This update certificate validation flaw lets an adjacent attacker write limited files. These carry scores of 5.3 and 4.3, respectively.

Public reporting has not established which individual vulnerability was used in each ransomware incident or whether attackers combined them.

Early coverage raised concerns because Solar reportedly investigated an affected device running DSM 7.4.1-90080 Update 1. At that stage, researchers were still examining the entry point and had not ruled out an unknown vulnerability.

The later report attributed Synology’s findings to older, patched weaknesses. The published accounts do not explain the apparent mismatch or confirm a new zero-day attack.

Synology NAS devices have faced ransomware threats before. Cyber Security News covered the Diskstation ransomware investigation, involving criminals who targeted Synology storage systems. That separate case provides background on the threat to NAS users. However, the available reports do not establish any connection to C3RB3R.

Synology’s advisory lists fixed releases including DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. These are historical patch thresholds, not a recommendation to stop updating. Administrators should install the latest release supported by their NAS model and update official packages and third-party components.

Appinn’s initial incident report recommends removing direct internet access to DSM management and SSH, using a VPN for remote connections, and checking for unusual logins, unknown administrators, and scheduled tasks.

It also advises enabling two-factor authentication and keeping independent offline or off-site backups. For affected users, those separate backups may provide a route to recover encrypted files. Updating remains necessary, but it does not itself restore files already encrypted by ransomware.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Patched Synology NAS Vulnerabilities to Deploy C3RB3R Ransomware and Encrypt Files appeared first on Cyber Security News.

Google has announced Gemini 4 Carbon, its latest AI model built to find software flaws, test whether attackers could exploit them, and produce fixes.

Unveiled on October 28, 2026, Carbon builds on Gemini 4 Argon and targets complex security and coding work that can take days. Access will begin with selected cyber defenders, not a public launch.

According to Google’s announcement, Carbon combines stronger cybersecurity skills with improved handling of long tasks. Google says internal teams have seen it work through dead ends while tracing subtle bugs across large codebases and low-level systems, then develop patches that address their root cause.

Google reports that Carbon scored 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching.

These tests cover three linked stages of security work: finding a flaw, checking its impact, and fixing the underlying code. Google evaluated these capabilities without guardrails, an important limit when comparing benchmark results with deployed services.

Google Launches Gemini 4 Carbon

Carbon also leads the Artificial Analysis Intelligence Index v5.0 with a score of 59. The index combines nine evaluations across coding, science, knowledge work, and general knowledge. Its overall ranking provides broader context, but does not replace task-specific security testing.

On internal tests, Google says Carbon more than doubled Argon’s success rate for generating secure code. The Chrome team also reported over tenfold better performance in producing quality patches compared with an unnamed rival model. Google did not identify that model in the announcement, limiting outside comparison of this claim.

Google says Carbon uses several safety layers, including misuse checks, prompt injection defenses, and monitoring of its reasoning and actions.

On Gray Swan’s Indirect Prompt Injection benchmark, Carbon recorded a 0.0% attack success rate, compared with Argon’s 0.7%. That result applies to the evaluated attacks, not every possible attack in production.

The risk remains relevant for security teams using AI agents. Previous reporting on Gemini for Workspace prompt injection described how hidden email instructions could cause misleading security warnings in AI summaries.

Separate coverage of Gemini data theft vulnerabilities showed how poisoned content could expose saved information before Google fixed the reported issues.

Google also reports that high-severity misalignment alerts fell by almost 80% in internal coding environments. Unsupported claims dropped by roughly half compared with Argon. At the same time, successful cheating on Terminal-Bench 4.0 fell to zero in the reported evaluation.

Carbon will reach selected defenders first, followed by additional trusted partners through Google’s Fairwind Program. Google is also participating in voluntary U.S. government testing before wider deployment.

Introductory pricing is $2 per million input tokens and $10 per million output tokens, with cached inputs discounted by 95%. Standard rates will later rise to $4 and $20, respectively. Google has not announced a firm date for general availability.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Google Launches Gemini 4 Carbon With State-Of-The-Art Cybersecurity Capabilities appeared first on Cyber Security News.

Security flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could enable code execution, file theft, and address-bar spoofing on developer machines.

The findings published on October 29 show how browser features built into AI assistants can break security boundaries when given extra access to their host apps.

The researchers named the attack class EMBRACE, short for an embedded browser trusted like a real one. These are separate flaws sharing one design problem. Features meant to help assistants preview projects, read pages, and track tabs gave untrusted content powers it should not have.

According to Forever report, Cursor exposed a window.cursorBrowser.send() bridge that allowed any loaded page to send content into the agent’s instruction box without a user gesture.

Embedded Browser Flaws in Popular AI Coding Tools Exploited

Attackers could abuse its element-selected channel to hide instructions inside HTML attributes. The visible item looked harmless, while the agent received command fragments and instructions to join them into an npm installation command.

A single Enter keypress could approve execution. When Cursor’s sandbox blocked installation, the agent independently retried outside it, allowing the package’s preinstall script to launch Calculator.

Success depended on the model and was not guaranteed. The finding adds another browser entry point to risks covered in earlier Cursor prompt injection research.

GitHub Copilot’s browser preview accepted address updates supplied by the page itself. It checked the address format but did not confirm that the reported location matched the page actually loaded.

Researchers made an attacker-controlled page display github.com/login in the preview’s address bar. The agent also received that false location, although the page remained on the attacker’s server. A fake login form could therefore appear beneath a trusted address and mislead both the user and the assistant.

Claude Desktop and VS Code restricted file access on the main page but failed to apply the same checks inside web workers, which run scripts in the background. A malicious local preview could start a worker and read files outside its project folder.

Codex needed no worker bypass. Researchers found that its local pages could fetch files elsewhere on the machine directly. On macOS, the team usedDS_Store metadata to discover filenames and expand the search across folders.

Their test collected SSH keys, .env files, npm tokens, and private documents. The demonstration sent data to a local receiver. An attacker could instead use a remote server.

Delivery required opening a malicious local page, potentially through a link generated by the assistant itself. These findings sit alongside earlier Claude sandbox escape coverage.

Forever Security says Cursor patched its flaw on October 1. GitHub independently fixed the spoofing issue in Copilot 1.1.29 on October 13, after researchers confirmed it in version 1.1.27.

At publication, Codex and VS Code remained unpatched. Microsoft rejected the report on Workspace Trust, while OpenAI did not respond. Anthropic accepted its issue after an initial rejection, but the report gives no clear patch status.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Researchers Hacked Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop Embedded Browsers appeared first on Cyber Security News.

The Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-97229. This GitLab vulnerability could allow code execution without logging in.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29, 2026, confirming evidence of active exploitation and raising the urgency for organizations running affected GitLab servers.

The vulnerability affects GitLab Community Edition and Enterprise Edition. It involves an integer overflow or wraparound caused by insufficient checks on regular expressions inside CI/CD configurations. A specially crafted expression could allow an unauthenticated attacker to execute arbitrary code on the GitLab server.

Cybersecuritynews.com previously covered the technical details in its report on the GitLab code execution vulnerability. Regular expressions are text patterns used to match or filter data. In this case, the dangerous input reaches GitLab’s regular expression compiler through a CI/CD configuration.

These configurations define automated development tasks. Processing a malicious pattern could affect the server itself, not just cause a pipeline task to fail.

GitLab Integer Overflow Vulnerability Exploited

An integer overflow occurs when a calculation produces a number outside the range a program can store. The resulting value can become unexpectedly small or negative. MITRE’s CWE-190 description explains that these errors can cause crashes, memory corruption, or unauthorized code execution, depending on how the software uses the value.

GitLab assigned the flaw a maximum CVSS score of 10.0. Earlier reporting identified affected versions as 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Those branches received fixes on October 12. Administrators should review their installed release and follow the current vendor update guidance.

The supplied catalog entry lists November 1, 2026, as the remediation deadline and marks forensic triage as required under BOD 26-04. It lists ransomware use as unknown. That status does not establish a ransomware link, and CISA’s public alert does not identify attackers, victims, or the scale of exploitation.

CISA’s October 29 alert explains that BOD 26-04 requires federal civilian agencies to prioritize high-risk vulnerabilities on exposed assets.

The directive also requires, where applicable, checks for signs that attackers compromised a system before updates were applied. CISA encourages other organizations to adopt similar risk-based patching practices.

Administrators must also avoid confusing this issue with CVE-2026-110264, a separate GitLab regular expression vulnerability disclosed later in October.

Cybersecuritynews.com’s coverage of that separate GitLab server vulnerability explains that installing the earlier CVE-2026-97229 update does not fix the newer issue.

Reviewing both advisories helps teams choose an update that addresses both vulnerabilities rather than leaving another code execution path open on their GitLab servers.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks appeared first on Cyber Security News.

Attackers are chaining zero-day flaws in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, exposing stored credentials and sensitive Active Directory data.

Ivanti confirmed attacks against a limited number of customers and released additional fixes on October 29, 2026, following its initial October patches.

Volexity tracked UTA0576 activity to October 3 and, during an October 5 investigation, identified a compromised, fully patched Ivanti appliance running version 22.8R2.4 (Build 19097) during an investigation on October 5, highlighting the flaws’ ability to bypass existing protections.

According to Volexity’s technical analysis, the attack began with an authentication bypass in welcome.cgi, the public login script. A mismatch between the requested URL and the X-DSCGI-PATH header let the attacker reach a protected upload handler without signing in.

The upload handler, wu.cgi, wrote incoming content to a predictable temporary location before checking whether it was a valid ZIP file. The attacker uploaded a Perl script and sent parallel requests to execute it before the appliance deleted it. This timing flaw delivered code execution as the appliance’s cgi-server user.

The attacker then abused the privileged dsinvoked service. By changing library code in memory and altering a maintenance task in the DSCache configuration store, UTA0576 caused the service to run attacker-controlled code as root. The payload then restored the changed settings and memory to hide its activity.

Ivanti Connect Secure Zero-Days Exploited

Earlier CybersecurityNews coverage of the Ivanti authentication bypass (CVE-2026-104935) detailed the initial disclosure and affected releases.

Ivanti also tracks CVE-2026-104935 (CVSS 8.6) for authentication bypass and code execution, CVE-2026-111357 (CVSS 8.8) for privilege escalation, and CVE-2026-118527 (CVSS 4.3) for a predictable-filename weakness.

UTA0576 did not install a backdoor or web shell. Instead, it repeated the exploit chain for each command and received results through HTTPS responses. This reduced the need to leave persistent access tools on disk.

After gaining control, the attacker extracted stored domain credentials and used the VPN appliance’s Active Directory service account to query internal systems. Targets included Windows LAPS administrator passwords, BitLocker recovery keys, and password-containing attributes.

The operation also involved password spraying, username collection, and packet analysis to recover credentials from network traffic. Related reporting on Active Directory credential theft details how the compromised gateway became a starting point for wider access. Volexity assessed that these actions prepared the attacker to move into other systems.

The October 29 update supplied for this report identifies 25.1.1.3 and 22.8R2.6 as releases resolving all disclosed vulnerabilities on those branches. Administrators should follow Ivanti’s advisory and select the correct upgrade for their appliance platform.

Detection needs more than a clean integrity check. Volexity found that memory-only changes and restored settings escaped Ivanti’s Integrity Checker.

Defenders should examine unusual welcome.cgi traffic, mismatched request paths and headers, suspicious files in /tmp/, and connections from the VPN into internal systems.

Suspected compromises require memory, disk, and network analysis because the attacker also removed selected debug and audit log entries. A clean check alone cannot rule out this compromise.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access appeared first on Cyber Security News.

Microsoft resolved a Windows 11 issue that blocked non-admin users from connecting via Remote Desktop when Administrator protection was enabled, releasing fixes on October 28, 2026, for connection failures with error 0xC000000D.

The bug appeared after the September 22 non-security preview update, KB5124010, or later updates. Affected users could see the message, “The token that was passed to the function is invalid.”

Microsoft’s release health notice identifies enterprise-managed computers acting as Remote Desktop hosts as the main systems affected.

Microsoft opened its investigation on October 13. As detailed in Cyber Security News’ earlier coverage of the Remote Desktop connection failures, the problem prevented standard users from reaching remote systems where Administrator protection was active. The failure could occur regardless of how administrators enabled that feature.

Microsoft lists Windows 11 versions 24H2, 25H2, 26H1, and 26H2 as affected platforms. Its notice does not list Windows Server as affected by this particular issue. That scope matters because other recent Remote Desktop problems have involved different Windows releases and separate update failures.

Administrator protection limits how applications gain administrator rights. Instead of leaving those rights available throughout a session, it grants temporary access for approved tasks.

Microsoft Fixes Windows 11 Remote Desktop Failures

Cyber Security News’ explanation of Windows 11 Administrator protection describes how this approach helps reduce the risk of malware making unwanted system changes.

The setting may already be active in managed environments. Microsoft says its Windows 11 24H2, 25H2, and 26H2 security baselines enable Administrator protection by default unless an organization changes the policy. Businesses using those baselines should therefore check affected hosts rather than assume the feature was never enabled.

According to Microsoft’s release health advisory, updates released on or after October 28 resolve the issue. Systems running an applicable fixed update no longer need the temporary workaround. Microsoft recommends installing the latest security update available for the device to receive relevant fixes and improvements.

The KB5127936 release notes explicitly confirm the Remote Desktop repair. This non-security preview update applies to Windows 11 25H2 and 26H2, raising their builds to 26200.9818 and 26300.9818, respectively.

Administrators managing other affected versions should check the package offered for their specific Windows release instead of treating KB5127936 as a universal installer.

For affected computers still running older updates, Microsoft allows administrators to temporarily turn off Administrator protection through their existing management tools. The documented workaround involves resetting the “User Account Control Type Of Admin Approval Mode” policy through Microsoft Intune or Group Policy.

Because this workaround turns off a security feature, it should remain temporary. After deploying the appropriate fixed update, IT teams should verify Remote Desktop access using a non-admin account and review any policy changes made during troubleshooting. This confirms remote access works without leaving the earlier workaround in place unnecessarily.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Fixes Remote Desktop Connection Failures Following Recent Updates appeared first on Cyber Security News.

GitHub has launched Copilot Fusion, a system that automatically selects AI models for coding tasks, helping developers balance code quality, speed, and cost.

Instead of choosing a model for every request, users select Fusion and let it decide how to handle the work. It is generally available in Visual Studio Code, Copilot CLI, the GitHub Copilot app, and JetBrains IDEs.

Fusion is a model router and coordinator, not a new standalone model. It checks each request for reasoning, code generation, debugging, and tool needs, then chooses the models and steps needed to produce one final answer. It also considers system health and model availability when making those choices.

Fusion uses three execution patterns. In Single mode, one model completes the task. Cascade starts with an efficient model, then uses a judge to inspect the draft and decide whether a stronger model should take over.

Critique sends a draft to several models for independent reviews before the original model revises its answer using their combined feedback.

These patterns can change within the same conversation. A simple request may use one model, while a difficult follow-up may trigger extra review.

GitHub Launches Copilot Fusion

GitHub says choosing a pattern adds little delay, although Cascade and Critique take longer because they involve additional model calls. Developers can follow progress and inspect which models contributed to the final response.

Fusion Standard selects one model for everyday work. Fusion High supports larger, clearly defined tasks, including difficult bug fixes and changes across several files.

Fusion Max targets work needing deeper reasoning. Fusion Fast serves speed-sensitive requests in Visual Studio Code inline chat and cannot be selected directly by users.

According to GitHub’s documentation, paid Copilot users get a 30% discount on Fusion model costs through November 30, 2026, though High and Max can consume more AI credits than Standard.

Fusion keeps the main conversation on the same model where possible to preserve cached tokens. Supporting models receive only the context they need.

Model selection also follows subscription limits, administrator restrictions, data residency rules, and FedRAMP requirements. Supported local models can participate through Fusion Standard in a public preview.

Extra AI review should not be mistaken for a security guarantee. Earlier reporting on GitHub Copilot prompt injection and the RoguePilot repository takeover flaw shows why untrusted project content remains a concern. Both issues were patched, and neither report establishes a vulnerability in Fusion.

GitHub also warns that discarding a draft does not automatically undo file edits that draft already made. Developers must review workspace changes before committing them. Fusion works separately from subagents and doesn’t launch them, so its role is coordination rather than independent agent management.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post GitHub Launches Copilot Fusion for Smarter and Cheaper AI Coding appeared first on Cyber Security News.

Microsoft urged Entra ID administrators to migrate from SMS and voice authentication in Entra ID to passkeys before retirement begins on February 1, 2027, to reduce phishing risks and prevent sign-in disruptions.

The reminder, published on October 27 under Message Center notice MC1528000, follows July announcements. Retirement covers Worldwide and Government Community Cloud environments and should finish in early February 2027. Administrators should not wait until the change reaches their tenant before preparing affected users.

According to the Microsoft retirement notice, users with another registered sign-in method will use that method. They will not need to register a passkey to continue accessing their accounts. This makes checking existing authentication methods an important first step for administrators.

Users whose only registered method is SMS or voice face a different process. Microsoft says they can use their existing method one final time to verify their identity. They must then register a passkey to keep signing in, making preparation important for organizations with many phone-dependent accounts.

The announcement continues the shift covered in Cybersecuritynews.com’s report on Microsoft making passkeys the default in Entra ID. However, this retirement applies specifically to Microsoft-provided phone authentication, not a complete ban on SMS and voice across Entra ID.

Microsoft Urges Passkey Migration

SMS and voice authentication remain exposed to phishing and SIM-swap attacks. Criminals can trick users into sharing verification codes or take control of an authentication phone number. Moving away from these methods reduces reliance on phone networks and codes that attackers can capture.

As Microsoft’s passkey documentation explains, passkeys use public-key cryptography under FIDO standards. The user’s authenticator keeps the private key, while the service stores the public key. During sign-in, the authenticator signs a challenge after the user unlocks it with a PIN or biometric check.

The credential works only with the website or application it was created for, helping prevent fake login pages from stealing reusable sign-in secrets. Cybersecuritynews.com’s coverage of UNC3944’s SIM-swap attacks shows why reducing dependence on phone-based verification matters.

Administrators should identify users relying on SMS or voice, prioritize accounts without another registered method, and help users adopt passkeys or another supported option. Microsoft also asks organizations to notify employees and helpdesk teams about the deadline and the registration process.

Organizations that need to retain phone authentication can configure a customer-managed telecom provider through the Microsoft Security Store.

Microsoft’s provider guidance says configuration will be available starting October 30, 2026. Customers must review coverage, pricing, support, and contractual terms before deployment.

Existing customer-managed providers are unaffected. Organizations that do not use Microsoft-provided SMS or voice need no action for this retirement. At the same time, affected customers must migrate or configure their provider before February 1.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Urges Entra ID Admins to Migrate from SMS and Voice Authentication to Passkeys appeared first on Cyber Security News.