Hackers have launched more than 240,000 exploit attempts against a WordPress Core vulnerability that can allow attackers to run malicious code without logging in. According to the supplied Wordfence report, attacks began on October 28, 2026, the same day WordPress released a security update addressing the flaw.

Tracked as CVE-2026-119977, the vulnerability carries a high severity CVSS score of 8.1. It affects unpatched WordPress branches from 4.7 through 7.1.3. Researcher Umut Bayram reported the weakness, which involves predictable, publicly accessible folders created during full WordPress Core upgrades.

WordPress addressed the issue in its October 28 security release, alongside several other security fixes. Older branches also received backported patches. Cybersecuritynews.com’s earlier coverage of WordPress 7.1.4 security fixes explained how the update changes temporary folder handling to reduce exposure during upgrades.

240,000 WordPress Exploit Attempts

During a full upgrade, WordPress extracts installation files into a temporary folder beneath /wp-content/upgrade/. On vulnerable installations, predictable folder names can let attackers find this separate installer through a web request while the update remains in progress. No existing WordPress account or user interaction is required.

The attack depends on a race condition, meaning the attacker must reach those files at the right moment. The temporary installer must remain accessible long enough to complete the attack before cleanup removes it. This timing requirement makes successful exploitation difficult, even when attackers repeatedly probe known paths.

The official WordPress release announcement confirms that the upgrade weakness can lead to remote code execution. The CVE record classifies it as a time-of-check, time-of-use race condition, with high potential impact on data confidentiality, integrity, and availability.

According to the supplied Wordfence analysis, attackers reaching the exposed installer could complete a staged installation, create an administrator account, and upload malicious PHP code. That access could support backdoors, content changes, or data theft. Observed requests targeted installer files inside predictable upgrade directories.

Wordfence’s supplied figures show attack traffic peaked on October 30, when its firewall blocked more than 74,000 requests. Activity was highest between October 29 and November 1. These figures describe blocked requests, not confirmed infections, successful code execution, or the number of individual websites affected.

Earlier reporting on 60,000 WordPress attack attempts made the same distinction. Repeated automated requests can increase the chance of finding an exposed installer, but request totals alone cannot establish whether attackers completed the required steps or gained lasting access.

Administrators should install WordPress 7.1.4 or the corresponding patched release for their branch. Automatic background updates may have installed the fix, but owners should verify completion. WordPress recommends immediate updating and notes that only its latest release receives active support.

Updating from a vulnerable version still uses its existing upgrade process once. The supplied Wordfence guidance recommends blocking public access to PHP files beneath /wp-content/upgrade/ before updating. Its protection requires Extended Protection mode because staged PHP files run outside normal WordPress loading.

Indicators of Compromise

Indicator	Type
103.59.160[.]171	IPv4 address
2001:df1:e8c0[::]106b	IPv6 address
51.89.103[.]78	IPv4 address
185.177.72[.]61	IPv4 address
195.3.220[.]7	IPv4 address
96.62.218[.]148	IPv4 address
20.217.186[.]29	IPv4 address
87.58.197[.]83	IPv4 address
154.26.238[.]8	IPv4 address
20.46.43[.]126	IPv4 address
/wp-content/upgrade/	URL path
setup-config.php	PHP filename
/wp-content/upgrade/wordpress-6.9.11/wp-admin/setup-config.php	Example request path

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Launch 240,000 Attempts to Exploit a WordPress Core Flaw That Allows Remote Code Execution appeared first on Cyber Security News.

A flaw in ChatGPT let attackers slip past Lockdown Mode, the safety setting meant to stop data leaks. Check Point Research found that a hidden pop-up trick could copy a user’s full chat history, show fake windows, and push malware. In the ChatGPT Classic desktop app, simply chatting was enough to trigger the leak. OpenAI has fixed the bug.

OpenAI launched Lockdown Mode on February 13, 2026, first for business plans. On June 4, it reached personal accounts, where users can turn it on under Settings > Security. The setting limits web browsing to cached pages and turns off live web access, image support in replies, Deep Research, Agent Mode, Canvas networking, live connectors, and file downloads.

OpenAI says it is built for high-risk users, such as executives and security teams, and is not needed by most people. Our earlier story on the ChatGPT Lockdown Mode release covers the basics.

The goal is to stop prompt injection, where hidden text tricks the AI into following an attacker’s orders. A common trick is to make the AI load a link like attacker.example/collect?data= followed by private details. The data then shows up in the attacker’s server logs and the chat looks normal.

ChatGPT Lockdown Mode Bypass

This is not the first hidden exit path Check Point has found. In March, the team showed that DNS tunneling in ChatGPT’s code runtime could send chat data to an outside server. We covered that bug in ChatGPT Vulnerability Let Attackers Silently Exfiltrate User Prompts. The new flaw shows how closing one path does not protect the others.

In February 2026, OpenAI added an HTML preview to ChatGPT code blocks, so users can view a page right in the chat. That page runs inside two nested iframes, which are small boxed-in web pages. The box blocks outside images, scripts, and links, and it asks the user before anything leaves.

Researcher Alexey Bukhteyev spotted a weak point. The boxes allowed popups through two settings, allow-popups and allow-popups-to-escape-sandbox. ChatGPT guarded popups by swapping out the window.open function. A page could skip that guard by adding one more iframe and calling that iframe’s own window.open.

The popup then opened with no prompt, even in Lockdown Mode. Since the second setting was on, code in the popup ran outside the box.

The first risk was fake update windows. The popup kept the ChatGPT icon, while the attacker chose the title. That made a malware download look like a real app update. In a browser, downloads are not blocked, so a shared chat link was enough, and the victim did not even need an account. In the desktop app, the user still had to click the download link.

The second risk was silent data theft. In ChatGPT Classic, built on Electron, window.open worked without any user click. A malicious prompt, a malicious custom GPT, or a shared chat could then send the whole conversation, and uploaded files, to the attacker’s server.

The third risk was stolen logins. The team also reloaded the main ChatGPT window and signed the user out. A fake login page could then capture the password when the user signed back in.

Check Point reported the problem to OpenAI. On September 18, 2026, OpenAI said it removed both popup permissions from the outer preview iframe. Check Point retested and confirmed the trick no longer works. Check Point published its report on November 5.

No user action is needed for this specific bug, but a few habits lower the risk of similar ones. Do not click buttons, previews, or “update” prompts inside shared chats. Skip prompts copied from unknown sites and avoid custom GPTs from unknown builders.

Check the address bar or sign-in page before typing a password, especially after an unexpected logout. Keep the desktop app updated, and avoid pasting medical, financial, or work secrets into any chat unless needed.

Even OpenAI says its safeguards reduce risk but give no full guarantee. As AI tools run code and show web content, each new feature adds a new way in. Careful habits remain a necessary layer of protection.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Could Bypass ChatGPT Lockdown Mode to Steal Conversations Without Users Knowing appeared first on Cyber Security News.

Microsoft’s Windows Paint vulnerability, CVE-2026-83844, could allow an unauthenticated attacker to execute code over a network without user interaction.

The flaw carries a CVSS score of 8.1, placing it in the High severity category rather than Critical. However, confusion over the corrected Paint version has complicated patch checks for Windows administrators.

The vulnerability stems from an out-of-bounds read, a memory error in which software reads beyond its intended boundary.

Microsoft published the advisory on October 13, 2026. Its assessment lists a network attack vector, no required privileges, and high attack complexity, meaning successful exploitation depends on conditions that make an attack harder to carry out.

Windows 0-Click Paint RCE Vulnerability

The disclosure formed part of the October update cycle, covered in Cybersecurity News’ Microsoft October Patch Tuesday report. For administrators, the immediate concern is not simply whether an update exists, but whether the corrected application build has actually reached managed devices.

Microsoft initially listed Paint version 11.2605.91.0 as the fixed release. Administrators reported that Microsoft Store continued offering 11.2605.81.0, even after update checks and Store cache resets.

Microsoft’s advisory listed 11.2609.401.0 as the fix, suggesting the earlier version reference may have been incorrect. Microsoft has not confirmed that explanation.

Update availability also appears inconsistent. Some administrators reported difficulty obtaining a corrected build, while one participant in the Reddit discussion said the update had become available through Microsoft Store. These individual reports do not establish a universal rollout status. Claims that availability depends on region also remain unverified.

A crafted image could trigger the flaw, but Microsoft’s quoted guidance describes a crafted network packet sent to an affected service. The Hacker News discussion highlights the missing detail: neither the exposed service nor the complete attack path is identified. Suggestions involving Copilot or other components are speculation.

Administrators should check the installed Paint version rather than trust an “up to date” message alone. Neowin recommends following Microsoft’s current advisory and considering temporary removal where Paint is unnecessary. Restricting untrusted images may reduce general exposure, but it is not a confirmed fix for this specific network attack path.

Cybersecurity News’ separate PNG vulnerability coverage provides related context on image software security. Those flaws are separate from this Paint vulnerability.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Paint 0-Click Vulnerability Could Allow Hackers to Take Control of Windows PCs appeared first on Cyber Security News.

A flaw in Zyxel GS1900 switches was already being used by hackers, and the patch meant to fix it did not work. Researchers at Binarly found that a public exploit hit a different bug than the one Zyxel had patched. Zyxel has now confirmed it as a new flaw, tracked as CVE-2026-107441.

Zyxel published its fix for CVE-2026-7273 on June 16, 2026. After GreyNoise reported real attacks in September, Binarly tested all ten fixed firmware releases on September 28 and found every one still open. Zyxel confirmed the new bug on October 11, shipped a fix on October 22, and published its advisory on November 3.

The flaw sits in the dispatcher.cgi web program. It carries a 9.8 critical score, and an attacker can run commands as root without logging in. The same weak code also exists in httprestorecfg.cgi and httpupload.cgi.

Zyxel GS1900 Zero-Day Exploited

The switch web page stores request parameters in a fixed memory block of 140 slots. Each slot holds 1,024 bytes. The code copies the data first and checks the count afterward. A long value in slot 139 spills over and overwrites the counter itself.

An attacker can set the counter to a negative number and write to memory before the block. This lets them overwrite function pointers and run their own commands. Zyxel’s patch added a count check, but the bad copy still happens before that check runs.

Binarly also says Zyxel described the bug wrongly. The flaw lives in global memory, not on the stack. It also works over normal HTTP from any network that can reach the switch, so Binarly rates it higher than the 8.8 score Zyxel gave.

GreyNoise says one actor hit 996 GS1900 switches in 48 countries around August 17. The actor stole device settings, hashed root passwords, and network details. A total of 564 of those switches still used factory default logins. Italy, the United States, and Taiwan had the most victims.

The exploit was a Python script hidden with PyArmor. It pulled a collector script from the attacker’s server using TFTP, then copied the stolen data to a web-readable folder. GreyNoise ties the actor to the Gitea campaign that Acronis called Red Heron, based on shared servers and malware.

That campaign used JITTERLY, a Linux backdoor with more than 30 commands. It hides a rootkit called SIXZUT inside itself, which can conceal files, processes, and network links. Binarly found its samples while checking this server for Binarly Transparency Platform detections.

CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities list on September 21. Our earlier report on the CISA warning for Zyxel GS1900 switches covers that step. Binarly now says either Zyxel’s first patch was wrong, or the attacks hit a different bug than CISA named. Either way, the flaw in Binarly’s advisory is present in the ten releases sold as fixes.

The same actor also broke into WordPress sites, as our story on hackers exploiting WordPress flaws to steal government records shows. GreyNoise counted more than 18,000 stolen records in one case.

Update every GS1900 switch to the October 22 fix or newer from Zyxel. Take web management pages off the internet and limit them to trusted admin networks. Change all default passwords right away.

CISA also tells teams to check devices for odd admin activity, changed settings, and strange web requests. Because attackers took hashed root credentials, treat any exposed switch as possibly stolen and rotate its passwords.

Indicators of Compromise

Malware	Type	SHA-256
JITTERLY	Backdoor	0f6e757e82c4d91df5bd249f775b9970b59dee42cc0dfe40f879d77fc16821c6
JITTERLY	Backdoor	663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c
JITTERLY	Backdoor	82d072ab03d90c0131b06a576eadf2c986a51f0de986d50db4e49be01bf125cb
SIXZUT	Rootkit	295133156b6a7d95b9c92f832f49e35235f1fbd3906e75c9202ef4cd65d1018c
SIXZUT	Rootkit	64677002011bc2e4bc642a4154a20fdb95620ebd0144b98fc60f917901ec8b92
SIXZUT	Rootkit	728810b07e911b235f6450e784391e39f68819a0a5d209662162916ffea25146

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Zyxel GS1900 Zero-Day in the Wild to Hijack Network Switches appeared first on Cyber Security News.

Google has released its November 2026 Android security update, addressing more than 200 vulnerabilities across the operating system, kernel, and hardware components.

Published on November 2, the bulletin includes critical remote code execution flaws that require no user interaction. Devices with security patch level 2026-11-05 or later receive all applicable fixes.

The most serious Framework issue, CVE-2026-58868, could allow remote code execution without additional execution privileges. Google lists fixes for Android 14, 15, 16, 16 QPR2, and 17. The lack of required user interaction makes this a zero-click threat, removing the need to persuade someone to open malicious content.

Two other critical remote code execution vulnerabilities, CVE-2026-58876 and CVE-2026-58936, affect the System component across those same Android releases.

Google describes the most severe System issue as requiring neither additional privileges nor user interaction. However, the bulletin does not provide enough technical detail to establish the precise delivery method for each flaw.

These findings follow earlier Android updates addressing remote attack risks, including the September 2026 Android security update. The November bulletin does not state that its newly listed flaws are being exploited. A zero-click vulnerability describes the interaction required for an attack, not proof that attackers have already used it against users.

The update also covers high-severity information disclosure, privilege escalation, and denial-of-service bugs. Android runtime flaw CVE-2026-58988 could expose information locally without additional execution privileges or user interaction.

Other Framework and System entries could allow attackers to gain greater access, expose protected data, or interrupt services, depending on the specific vulnerability.

Android 0-Click Remote Code Execution Flaws

According to Google’s November Android Security Bulletin, the kernel fixes include critical issues affecting Bluetooth, Human Interface Device support, and protected Kernel-based Virtual Machine components.

Google says the most severe kernel vulnerability could enable remote privilege escalation without additional privileges or user interaction, making these fixes important alongside the platform patches.

Hardware coverage extends to Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm components. MediaTek’s entries include eight critical modem vulnerabilities, while Qualcomm’s closed-source section contains another critical issue. These findings do not mean every Android phone contains every affected component. Exposure depends on the device’s hardware, software version, and the fixes supplied by its manufacturer.

The bulletin separates fixes into November 1 and November 5 patch levels. The earlier level covers the listed platform issues, while November 5 includes all applicable fixes from both groups and previous bulletins.

Cybersecurity News’ Android security patch guide explains why checking the patch date matters more than simply checking the Android version.

Users should install available manufacturer updates and check Google Play system updates separately. Google lists several affected Mainline components, including Media Codecs, MediaProvider, Telephonycore, and WiFi. Google’s update guidance explains how Pixel owners can check for software updates. Availability varies by device and carrier, so publication does not guarantee immediate delivery to every supported phone.

Google Play Protect remains useful, particularly for detecting harmful apps, but it does not replace operating system patches. Google’s severity ratings also assume platform protections are disabled or successfully bypassed, rather than guaranteeing exploitation on every device. For administrators, the practical priority is confirming supported devices receive the complete applicable November security update.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Google Patches Over 200 Android Vulnerabilities, Including Critical Zero-Click RCE Flaws appeared first on Cyber Security News.

A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary Function Driver for WinSock.

Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. Their complete exploit targets vulnerable Windows 11 22H2 systems.

The release concerns a vulnerability patched in January 2023, not a newly disclosed Windows flaw. IBM published the researchers’ technical analysis on March 21, 2023.

The vulnerability carries a CVSS score of 7.8 and requires low-level local privileges, with no user interaction. It does not provide a direct route into a computer over the internet. The flaw sits in afd.sys, a Windows kernel driver that handles requests from the WinSock networking interface.

According to IBM’s technical analysis, the researchers compared driver versions from December 2022 and January 2023 to understand Microsoft’s fix. Only one function, AfdNotifyRemoveIoCompletion, appeared to have changed, helping them narrow their investigation.

The older code failed to check a memory pointer supplied from a user application. That missing check let a local attacker write to kernel memory, where Windows stores sensitive system data.

Microsoft’s updated code added validation to ensure that pointers from user mode reference suitable user-space memory rather than protected kernel addresses.

POC for Windows WinSock Ancillary Vulnerability

The researchers said they diagnosed, reproduced, and turned the flaw into a working exploit in about one day, despite having no previous experience with this driver.

Their findings show how comparing patched and unpatched software can reveal enough detail to build an attack quickly.

The public GitHub repository describes the code as a demonstration. Its complete privilege escalation chain works on vulnerable Windows 11 22H2 installations, while the underlying memory-write capability works across vulnerable systems.

These are separate claims, and the repository does not promise full exploit compatibility with every affected Windows version. To move from a limited memory write to broader control, the exploit changes Windows I/O ring objects. These objects support queued input and output work.

The technique builds on research by Yarden Shafir and enables kernel memory reads and writes. The exploit then replaces a target process’s security token with one carrying SYSTEM privileges.

IBM also reported that 360 IceSword Lab found a different exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the researchers’ direct driver approach. This report does not establish that attackers used the published GitHub code.

Administrators should verify that affected devices received Microsoft’s fix or later applicable updates. IBM’s demonstration also worked without being blocked by HVCI, showing why that protection should not replace patching.

Related coverage includes CVE-2024-38193 exploitation and the CVE-2025-32709 WinSock zero-day. Both involve the same driver, but are separate flaws with different causes and patches.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability appeared first on Cyber Security News.

Synology NAS devices are facing C3RB3R ransomware attacks linked to 2024 security flaws, prompting the company to urge users to update outdated DiskStation Manager versions and packages.

The warning followed reports from the 360 Security Team and Solar Emergency Response Team on October 29. Victims found their files encrypted with the .L0CK3D extension and a ransom note named read-me3.txt.

Security teams provisionally identified the ransomware as C3RB3R. The available reporting does not establish how many devices have been compromised.

The Synology security advisory, tracked as Synology-SA-24:20, covers three vulnerabilities disclosed following Pwn2Own 2024. Published on November 5, 2024, it received several updates as fixes became available across DSM branches.

Although Appinn described the weaknesses as fixed by December 2024, Synology’s revision history shows that several patches arrived during November.

Cyber Security News previously examined the critical CVE-2024-10441 flaw in Synology DSM, which carries a CVSS score of 9.8 and allows unauthenticated remote code execution without user interaction.

Synology NAS Hit by C3RB3R Ransomware Attacks

The advisory also lists CVE-2024-50629, a webapi flaw that lets remote attackers read limited files, and CVE-2024-10445. This update certificate validation flaw lets an adjacent attacker write limited files. These carry scores of 5.3 and 4.3, respectively.

Public reporting has not established which individual vulnerability was used in each ransomware incident or whether attackers combined them.

Early coverage raised concerns because Solar reportedly investigated an affected device running DSM 7.4.1-90080 Update 1. At that stage, researchers were still examining the entry point and had not ruled out an unknown vulnerability.

The later report attributed Synology’s findings to older, patched weaknesses. The published accounts do not explain the apparent mismatch or confirm a new zero-day attack.

Synology NAS devices have faced ransomware threats before. Cyber Security News covered the Diskstation ransomware investigation, involving criminals who targeted Synology storage systems. That separate case provides background on the threat to NAS users. However, the available reports do not establish any connection to C3RB3R.

Synology’s advisory lists fixed releases including DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, and 6.2.4-25556-8. These are historical patch thresholds, not a recommendation to stop updating. Administrators should install the latest release supported by their NAS model and update official packages and third-party components.

Appinn’s initial incident report recommends removing direct internet access to DSM management and SSH, using a VPN for remote connections, and checking for unusual logins, unknown administrators, and scheduled tasks.

It also advises enabling two-factor authentication and keeping independent offline or off-site backups. For affected users, those separate backups may provide a route to recover encrypted files. Updating remains necessary, but it does not itself restore files already encrypted by ransomware.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Patched Synology NAS Vulnerabilities to Deploy C3RB3R Ransomware and Encrypt Files appeared first on Cyber Security News.

A newly disclosed TeamViewer vulnerability could let an attacker turn a routine remote support session against the technician providing help. Tracked as CVE-2026-111585, the flaw allows a malicious remote computer to crash the viewer application and potentially run code on the technician’s machine. TeamViewer rates it High, with a CVSS score of 8.8.

Remedio researcher Omri Dar published the technical findings on October 29, following a fix released on October 27. The attack requires the victim to establish a remote session with an attacker-controlled or compromised host. After that connection, no further click or stolen password is needed, according to Remedio.

TeamViewer Security Vulnerability

TeamViewer separates a session into a host sharing its screen and a viewer displaying it. Here, the host attacks the viewer by sending crafted screen data through the same connection used for support. This reverses the expected risk, placing the technician’s computer in danger.

The host sends a DisplayParams message containing screen width, height, and color depth. The viewer uses these values to reserve memory for incoming pixels inside an object called CBitmapBuffer. A malicious host can force this processing path by refusing AV1 and H.264 video options, making the viewer use bitmap updates instead.

The findings expand on the TeamViewer remote desktop vulnerabilities previously reported, but identify the precise calculation error behind this attack. The buffer size is calculated using 32-bit arithmetic. Oversized screen dimensions make that calculation wrap around, leaving much less memory than the viewer expects.

In Remedio’s example, a screen measuring 32,768 by 32,768 pixels at 32 bits per pixel should require more than 4.29 billion bytes after padding. Instead, the calculation reserves roughly four megabytes. The viewer still treats that small buffer as large enough for the announced screen.

The decoder checks incoming image rectangles against the declared screen dimensions, not the actual memory allocation. A rectangle can therefore pass validation while its pixels spill beyond the buffer. These writes damage nearby heap memory, causing a repeatable crash and creating a route toward code execution.

Remedio reported running chosen code on Windows while bypassing Control Flow Guard and Data Execution Prevention. However, its demonstration used a host-side hook to place the corrupting bytes, standing in for the network payload and heap preparation. That detail matters when assessing how complete the demonstrated attack was.

Affected Versions and Available Fixes

TeamViewer’s security bulletin TV-2026-1011 lists affected Full Client versions before 15.83 on Windows, Linux, and macOS, Windows Portable, and Android Remote Control. Code execution depends on the platform and runs with the viewer process’s permissions. It does not automatically mean SYSTEM or root access.

Administrators should install version 15.83 or the latest available release. Legacy deployments need the matching fixed maintenance build listed in the bulletin. This update follows earlier TeamViewer security patches, making checks important across support workstations, portable copies, and older installations that might remain outside normal update routines.

TeamViewer reported no known active exploitation when its bulletin was published. Remedio disclosed the issue on August 14. For support teams, the immediate priority is updating the viewer before connecting to untrusted computers, rather than relying on session approval alone.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post TeamViewer Security Flaw Could Turn Remote Support Sessions Into Computer Takeovers appeared first on Cyber Security News.

Palo Alto Networks has confirmed that attackers are actively exploiting PHP2Shell vulnerabilities against PAN-OS management interfaces exposed to the internet. In its October 29, 2026, update, Unit 42 said it independently verified attacker tools used to combine the PHP flaws with a Linux kernel vulnerability and gain root access.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a critical CVSS 4.0 score of 9.2. They can allow remote code execution without a login. Palo Alto said roughly 0.02% of its global installed base had public management interfaces configured and was impacted. Its teams have contacted those customers individually, according to the Unit 42 threat brief.

The confirmation updates the earlier picture covered in Cyber Security News’ report on PHP vulnerabilities affecting PAN-OS, when the vendor had not reported malicious exploitation against its products.

PHP2Shell Enables Remote Code Execution

Both flaws involve unsafe memory handling when PHP stops processing a request after an error. CVE-2026-109618 affects out-of-memory handling through longjmp(), a function that jumps out of the current operation. That sudden exit can leave request data partly initialized. Cleanup routines may then read or act on that invalid data, creating a path to code execution.

CVE-2026-109619 leaves shared internal state pointing to memory that PHP has already freed. A later request handled by the same worker can reach those stale references before normal setup resets them. Attackers can use this condition to make the process execute their code.

The PHP Group’s security advisory identifies PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed deployments as exposed. Fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Unit 42 counted more than 22.6 million exposed instances potentially vulnerable worldwide. That figure describes possible PHP exposure, not confirmed breaches or affected Palo Alto firewalls.

Dream Research reported finding campaign artifacts showing 25 compromised PAN-OS firewall and management servers across the United States, Japan, Taiwan, and South Korea. The count included three systems in a US government-affiliated environment.

The attacker used a custom PHP2Shell implementation aimed at the PAN-OS management web server. Crafted upload requests created memory pressure, leaked an address, and manipulated memory structures to execute commands as the restricted nobody user. A separate Linux kernel flaw, Fragnesia, tracked as CVE-2026-46300, then enabled root access.

Cyber Security News’ report on the 25-server campaign explains the wider impact. Dream found evidence of webshell placement, internal tunneling, LDAP credential extraction, and Active Directory enumeration. However, it could not confirm whether later password spraying or attempts to create backdoor accounts succeeded.

This confirmation should not be confused with Unit 42’s retracted October 23 update. That earlier account linked activity at a European government agency to PHP2Shell, but investigators could not establish that these specific flaws provided initial access. The October 29 update separately confirms the PAN-OS campaign.

PAN-OS Patches and Immediate Protection

Palo Alto’s security advisory limits the affected surface to the management HTTPS interface and XML API. PA-Series and VM-Series firewalls and Panorama are covered. GlobalProtect portals, gateways, Clientless VPN and Captive Portal are not affected by these PHP flaws. A dataplane interface is exposed only when a management profile is attached.

Administrators should immediately remove public management access, allow only trusted internal IP addresses, and install the correct PAN-OS hotfix. Fixed options include 12.2.4-h1, 12.1.10-h3, 11.2.16-h1, 11.1.16-h4 and 10.2.18-h13, with additional fixes for other maintenance releases. Palo Alto says these updates address both PHP vulnerabilities and interrupt the observed chain.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces appeared first on Cyber Security News.

The Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-97229. This GitLab vulnerability could allow code execution without logging in.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29, 2026, confirming evidence of active exploitation and raising the urgency for organizations running affected GitLab servers.

The vulnerability affects GitLab Community Edition and Enterprise Edition. It involves an integer overflow or wraparound caused by insufficient checks on regular expressions inside CI/CD configurations. A specially crafted expression could allow an unauthenticated attacker to execute arbitrary code on the GitLab server.

Cybersecuritynews.com previously covered the technical details in its report on the GitLab code execution vulnerability. Regular expressions are text patterns used to match or filter data. In this case, the dangerous input reaches GitLab’s regular expression compiler through a CI/CD configuration.

These configurations define automated development tasks. Processing a malicious pattern could affect the server itself, not just cause a pipeline task to fail.

GitLab Integer Overflow Vulnerability Exploited

An integer overflow occurs when a calculation produces a number outside the range a program can store. The resulting value can become unexpectedly small or negative. MITRE’s CWE-190 description explains that these errors can cause crashes, memory corruption, or unauthorized code execution, depending on how the software uses the value.

GitLab assigned the flaw a maximum CVSS score of 10.0. Earlier reporting identified affected versions as 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Those branches received fixes on October 12. Administrators should review their installed release and follow the current vendor update guidance.

The supplied catalog entry lists November 1, 2026, as the remediation deadline and marks forensic triage as required under BOD 26-04. It lists ransomware use as unknown. That status does not establish a ransomware link, and CISA’s public alert does not identify attackers, victims, or the scale of exploitation.

CISA’s October 29 alert explains that BOD 26-04 requires federal civilian agencies to prioritize high-risk vulnerabilities on exposed assets.

The directive also requires, where applicable, checks for signs that attackers compromised a system before updates were applied. CISA encourages other organizations to adopt similar risk-based patching practices.

Administrators must also avoid confusing this issue with CVE-2026-110264, a separate GitLab regular expression vulnerability disclosed later in October.

Cybersecuritynews.com’s coverage of that separate GitLab server vulnerability explains that installing the earlier CVE-2026-97229 update does not fix the newer issue.

Reviewing both advisories helps teams choose an update that addresses both vulnerabilities rather than leaving another code execution path open on their GitLab servers.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks appeared first on Cyber Security News.

Attackers are chaining zero-day flaws in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, exposing stored credentials and sensitive Active Directory data.

Ivanti confirmed attacks against a limited number of customers and released additional fixes on October 29, 2026, following its initial October patches.

Volexity tracked UTA0576 activity to October 3 and, during an October 5 investigation, identified a compromised, fully patched Ivanti appliance running version 22.8R2.4 (Build 19097) during an investigation on October 5, highlighting the flaws’ ability to bypass existing protections.

According to Volexity’s technical analysis, the attack began with an authentication bypass in welcome.cgi, the public login script. A mismatch between the requested URL and the X-DSCGI-PATH header let the attacker reach a protected upload handler without signing in.

The upload handler, wu.cgi, wrote incoming content to a predictable temporary location before checking whether it was a valid ZIP file. The attacker uploaded a Perl script and sent parallel requests to execute it before the appliance deleted it. This timing flaw delivered code execution as the appliance’s cgi-server user.

The attacker then abused the privileged dsinvoked service. By changing library code in memory and altering a maintenance task in the DSCache configuration store, UTA0576 caused the service to run attacker-controlled code as root. The payload then restored the changed settings and memory to hide its activity.

Ivanti Connect Secure Zero-Days Exploited

Earlier CybersecurityNews coverage of the Ivanti authentication bypass (CVE-2026-104935) detailed the initial disclosure and affected releases.

Ivanti also tracks CVE-2026-104935 (CVSS 8.6) for authentication bypass and code execution, CVE-2026-111357 (CVSS 8.8) for privilege escalation, and CVE-2026-118527 (CVSS 4.3) for a predictable-filename weakness.

UTA0576 did not install a backdoor or web shell. Instead, it repeated the exploit chain for each command and received results through HTTPS responses. This reduced the need to leave persistent access tools on disk.

After gaining control, the attacker extracted stored domain credentials and used the VPN appliance’s Active Directory service account to query internal systems. Targets included Windows LAPS administrator passwords, BitLocker recovery keys, and password-containing attributes.

The operation also involved password spraying, username collection, and packet analysis to recover credentials from network traffic. Related reporting on Active Directory credential theft details how the compromised gateway became a starting point for wider access. Volexity assessed that these actions prepared the attacker to move into other systems.

The October 29 update supplied for this report identifies 25.1.1.3 and 22.8R2.6 as releases resolving all disclosed vulnerabilities on those branches. Administrators should follow Ivanti’s advisory and select the correct upgrade for their appliance platform.

Detection needs more than a clean integrity check. Volexity found that memory-only changes and restored settings escaped Ivanti’s Integrity Checker.

Defenders should examine unusual welcome.cgi traffic, mismatched request paths and headers, suspicious files in /tmp/, and connections from the VPN into internal systems.

Suspected compromises require memory, disk, and network analysis because the attacker also removed selected debug and audit log entries. A clean check alone cannot rule out this compromise.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access appeared first on Cyber Security News.

Microsoft resolved a Windows 11 issue that blocked non-admin users from connecting via Remote Desktop when Administrator protection was enabled, releasing fixes on October 28, 2026, for connection failures with error 0xC000000D.

The bug appeared after the September 22 non-security preview update, KB5124010, or later updates. Affected users could see the message, “The token that was passed to the function is invalid.”

Microsoft’s release health notice identifies enterprise-managed computers acting as Remote Desktop hosts as the main systems affected.

Microsoft opened its investigation on October 13. As detailed in Cyber Security News’ earlier coverage of the Remote Desktop connection failures, the problem prevented standard users from reaching remote systems where Administrator protection was active. The failure could occur regardless of how administrators enabled that feature.

Microsoft lists Windows 11 versions 24H2, 25H2, 26H1, and 26H2 as affected platforms. Its notice does not list Windows Server as affected by this particular issue. That scope matters because other recent Remote Desktop problems have involved different Windows releases and separate update failures.

Administrator protection limits how applications gain administrator rights. Instead of leaving those rights available throughout a session, it grants temporary access for approved tasks.

Microsoft Fixes Windows 11 Remote Desktop Failures

Cyber Security News’ explanation of Windows 11 Administrator protection describes how this approach helps reduce the risk of malware making unwanted system changes.

The setting may already be active in managed environments. Microsoft says its Windows 11 24H2, 25H2, and 26H2 security baselines enable Administrator protection by default unless an organization changes the policy. Businesses using those baselines should therefore check affected hosts rather than assume the feature was never enabled.

According to Microsoft’s release health advisory, updates released on or after October 28 resolve the issue. Systems running an applicable fixed update no longer need the temporary workaround. Microsoft recommends installing the latest security update available for the device to receive relevant fixes and improvements.

The KB5127936 release notes explicitly confirm the Remote Desktop repair. This non-security preview update applies to Windows 11 25H2 and 26H2, raising their builds to 26200.9818 and 26300.9818, respectively.

Administrators managing other affected versions should check the package offered for their specific Windows release instead of treating KB5127936 as a universal installer.

For affected computers still running older updates, Microsoft allows administrators to temporarily turn off Administrator protection through their existing management tools. The documented workaround involves resetting the “User Account Control Type Of Admin Approval Mode” policy through Microsoft Intune or Group Policy.

Because this workaround turns off a security feature, it should remain temporary. After deploying the appropriate fixed update, IT teams should verify Remote Desktop access using a non-admin account and review any policy changes made during troubleshooting. This confirms remote access works without leaving the earlier workaround in place unnecessarily.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Fixes Remote Desktop Connection Failures Following Recent Updates appeared first on Cyber Security News.

Veeam released security fixes for a critical authorization bypass vulnerability in Veeam Backup & Replication that lets an attacker without login credentials bypass access checks on the CDP Coordinator Service.

Tracked as CVE-2026-108142, the flaw carries a CVSS v4.0 score of 9.1 and affects both Windows-based deployments and the Veeam Software Appliance.

The company disclosed the issue on October 27, 2026, in its security advisory KB4948. The advisory also covers two medium-severity file-write vulnerabilities in Backup & Replication and a high-severity local privilege escalation flaw in Veeam Agent for Linux. HackerOne reported all four issues.

CVE-2026-108142 affects Veeam Backup & Replication 13.1.1.18 and earlier builds in the 13.1 branch, along with 13.0.2.29 and earlier builds in the 13.0 branch. Veeam identifies version 12.x as unaffected by this issue.

The flaw concerns authorization, the checks that decide which actions a caller can perform. Veeam says an unauthenticated attacker can bypass those checks on the CDP Coordinator Service.

However, the advisory does not describe the attack sequence or state that the vulnerability enables remote code execution. It also does not report active exploitation.

Veeam Patches Backup & Replication Vulnerability

Veeam lists the first fixed releases as Backup & Replication 13.1.2, build 13.1.2.57, and Backup & Replication 13.0.3, build 13.0.3.63. Administrators should match their installed version against these build numbers rather than checking only the main product version.

The update also addresses CVE-2026-108140 and CVE-2026-108141, each rated medium severity with a CVSS v4.0 score of 5.9. Both require an authenticated user with the Restore Operator role who also controls the contents of a backed-up network-attached storage (NAS) share.

Under those conditions, an attacker can use relative path traversal to write attacker-controlled files to an arbitrary path on the backup server. In simple terms, the file path can escape its intended folder. Veeam lists the same affected Backup & Replication builds and fixed releases for both vulnerabilities.

The separate Linux issue, CVE-2026-105477, has a high-severity score of 7.3. It allows local privilege escalation and affects only Veeam Agent for Linux installations managed by Backup & Replication. Affected releases include 13.1.1.4 and earlier 13.1 builds. The fix starts with version 13.1.2, build 13.1.2.11.

Cyber Security News previously reported attackers exploiting CVE-2024-40711 in Veeam to deploy Frag ransomware, highlighting backup security risks, though this separate vulnerability does not confirm exploitation of the newly disclosed authorization bypass.

The publication also reported Veeam’s October security update for version 12.3.2, noting that different product branches may require different patches.

Administrators can check their installed Backup & Replication build through Help > About in the console. Veeam’s release information page provides update guidance.

The company warns that attackers may study released patches to find ways into unpatched systems, making timely installation important across affected backup servers and managed Linux agents.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability appeared first on Cyber Security News.

HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes namespace.

Tracked as CVE-2026-110720, the flaw affects deployments using automated system access control list management. HashiCorp disclosed the issue on October 26, 2026, and identified Consul-k8s 2.1.0 and 1.8.18 as patched releases.

The official security advisory lists the affected range as versions 0.42.0 through 2.0.4, with 1.8.18 available as a fixed release.

Although this article’s headline describes the vulnerability as critical, the bulletin does not provide a severity rating or CVSS score. The weakness sits in the component ACL binding rules that connect Kubernetes identities to Consul permissions.

When system ACL management is enabled, Consul-k8s sets up Kubernetes authentication and binding rules so its components can obtain Consul tokens.

Those rules should link each component’s Kubernetes ServiceAccount to its corresponding Consul role. However, the affected rules did not consistently limit authentication to ServiceAccounts inside the Kubernetes namespace hosting the Consul deployment.

This missing restriction could allow an identity from another namespace to authenticate as a Consul component and receive that component’s privileges. The result is a path across an intended access boundary, rather than a simple failure to check whether a token exists.

Exploitation requires specific access. An attacker must have Kubernetes permissions to create a ServiceAccount and obtain its token in another namespace.

The attacker must also have network access to the Consul API. The bulletin therefore does not describe an attack that any unauthenticated internet user can carry out against every Consul deployment.

The privileges gained would depend on the Consul component being impersonated. HashiCorp says an attacker may obtain the component’s associated privileges.

HashiCorp Patches Consul-k8s Security Flaw

According to the HCSEC-2026-50 advisory, successful exploitation does not necessarily grant full administrative access, and no exploit code or confirmed exploitation details were provided.

The key setting is global.acls.manageSystemACLs=true. HashiCorp explicitly states that deployments with system ACL management disabled are not vulnerable to this issue.

Teams should check both their installed Consul-k8s version and this configuration setting when deciding whether their environment is affected. Version checks alone do not establish exposure.

The issue differs from earlier attacks against misconfigured DevOps servers, which included Consul among targeted platforms. Here, HashiCorp identifies a flaw in generated authorization rules, not merely an openly exposed service. Both cases show why API reachability matters when assessing infrastructure risk.

Related reporting on Kubernetes token theft and permission abuse also shows why service account access matters. For this vulnerability, however, defenders should follow the specific prerequisites in HashiCorp’s bulletin rather than assume that unrelated attack activity proves exploitation.

HashiCorp advises customers to evaluate their risk and upgrade to Consul-k8s 2.1.0 or 1.8.18. The company credits security researcher Elias Hasas, known on GitHub as zer0d4y5, with reporting the flaw. The bulletin does not specify additional post-upgrade cleanup requirements.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges appeared first on Cyber Security News.

Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a CoreGraphics zero-day vulnerability that attackers may have used in targeted attacks.

Released on October 26, 2026, the updates bring security fixes to older devices, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad, according to Apple’s security releases page.

Tracked as CVE-2026-86950, the CoreGraphics flaw can allow attackers to run code when a device processes a specially crafted file. Apple credits Meta Product Security with reporting the issue.

The company says it is aware of a report that the flaw “may have been exploited in an extremely sophisticated attack against specific targeted individuals” using iOS versions before iOS 27.

The vulnerability is an out-of-bounds write in CoreGraphics, an Apple component that handles graphics and documents. This bug occurs when software writes data beyond the memory space it’s allocated.

Apple Fix for CoreGraphics 0-Day Flaw

A crafted file can trigger that error and potentially let an attacker run code within the affected process. Apple fixed the issue by adding stronger bounds checks.

The latest release extends protection to older hardware. Cybersecurity News previously covered Apple’s CoreGraphics zero-day patch for newer iPhones, reporting that iOS 26.7.1 and iPadOS 26.7.1 addressed the same CVE in September. Owners of older models now have a security update available on the iOS 18 branch.

Apple’s warning points to targeted exploitation, but the supplied advisory does not name the attackers, identify victims, or explain how the malicious file reached their devices.

It also does not say whether exploitation required user interaction. The available information therefore does not establish a zero-click attack or a wider campaign against ordinary users.

The update also addresses CVE-2026-65339 in the Audio component. Apple says an app could use this logic flaw to leak sensitive user information. The company added improved checks and credited Mustafa Calap (@ordinal0 of dbg. re, and Nik Tsytsarkin of Meta Red Team X.

A third issue, CVE-2026-86990, affects CoreMedia and could allow a malicious app to access the camera without user permission. Apple tightened access restrictions to fix the problem and credited Mustafa Calap. Unlike the CoreGraphics entry, neither of these entries includes an exploitation warning in the supplied advisory.

Apple has previously patched exploited vulnerabilities on older devices, including the iOS 12.5.7 update for an exploited WebKit flaw. These releases show why users should continue checking for security patches even when their devices no longer receive major iOS upgrades.

Users can check for the patch in Settings > General> Software Update. Apple recommends backing up the device, connecting it to power, and using Wi-Fi before installation.

Follow Apple’s update instructions and confirm the installed version afterward. For affected devices, installing this release addresses the disclosed flaws. However, patching alone does not determine whether a device was previously compromised.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones appeared first on Cyber Security News.

The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads.

The findings show that checking Node.js versions alone can leave other exposed software unnoticed. In research published on October 25, JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan traced CVE-2026-111497 through several software stacks.

Their findings describe crashes, memory corruption, and an endless decoding loop, depending on how each application uses the affected library.

First disclosed in Node.js security updates on October 21, the vulnerability sits in Google’s Brotli decoder rather than HTTP itself. An invalid block switch can be mistaken for a request for more input.

Processing then continues with broken decoder state, allowing a write beyond the intended memory buffer. Affected upstream releases include Brotli 1.0.3 through versions before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1.

Projects may apply the fix without changing to these upstream versions, so teams must check vendor patch records rather than relying on version numbers alone.

HTTP2Shell Vulnerability

In FFmpeg, researchers reached the decoder through libjxl, which processes JPEG XL images. A crafted image carried malformed Brotli data inside a compressed metadata box. When libjxl decoded that data, memory corruption caused a crash during cleanup.

The test showed attacker control over a corrupted pointer value. However, it did not establish a complete remote code execution exploit for FFmpeg.

This file-based route adds to concerns covered in earlier reporting on FFmpeg media-file vulnerabilities and other FFmpeg memory-corruption flaws. Those reports concern separate vulnerabilities.

JFrog also triggered a native crash through .NET’s Brotli decompression APIs. A two-stage stream left the decoder in an invalid state before a memory operation moved outside valid heap data. Unlike a normal managed exception, the resulting segmentation fault terminated the process.

The demonstration used a local console application. However, related decoder paths can serve HttpClient response decompression and ASP.NET Core request-decompression middleware. Microsoft announced on October 25 that it was rolling out updates for supported runtimes and SDKs.

ClickHouse failed after receiving one crafted HTTP request with a 23 MB Brotli-compressed body. Decoder corruption caused a crash during cleanup, stopping the tested server and interrupting active queries. JFrog reported that a fix had been merged, but no patched release had shipped when its research appeared.

Apache Arrow showed a different failure. A 534-byte input sent through pyarrow’s Brotli decoding path caused an endless loop that consumed CPU and blocked completion. Brotli 1.2.1 rejected the same input in under a second. Arrow’s tracking issue remained open at publication.

According to the Sysdig Threat Research Team, Node.js fixes were released in versions 22.23.4, 24.22.1, and 26.12.1, with the 24.22.1 release notes confirming the Brotli patch. Other applications require their own updated builds or library packages.

Teams should trace untrusted files, buffers, requests, and responses into decompression code. JFrog’s scanner helps identify potential paths, but a match alone does not prove remote exploitability.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow appeared first on Cyber Security News.

Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component.

Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account.

Enclave researchers found that an untrusted app could pretend to be a trusted Microsoft application, such as Microsoft Teams, and ask Authenticator to issue delegated tokens for that identity.

The request did not need user approval, account credentials, or Android permissions beyond being installed on the device. At the center of the bug was an exported Android activity named com.microsoft.identity.client.AccountChooserActivity.

Other apps can start exported activities on the same device. In this case, the activity accepted a broker request from the calling app. It returned the authentication result after processing it.

The key problem was how Authenticator verified the requesting application. The broker request included the claimed app package name, client ID, redirect URI, requested scopes, and even a caller UID value.

Microsoft Authenticator Flaw

Enclave researchers reported that the malicious application could supply these fields rather than having them tied to the app that actually launched the request.

Authenticator did perform a signature-related redirect URI validation. However, the check focused on the app identity claimed in the request.

If the attacker claimed to be Teams, the vulnerable logic checked whether the redirect URI matched the real installed Teams package. Because Teams was legitimately installed, the attacker could build a valid redirect URI from its public package signature and pass the check.

In short, the app verified whether the claimed identity looked valid, but did not confirm that the real caller was the app it claimed to be. The vulnerable activity could identify the package that launched it, according to the research. However, it did not use that information to control trust.

Successful requests returned token data through the activity result bundle. The tokens could include access tokens, refresh tokens, ID tokens, and client information.

Depending on the impersonated Microsoft client and requested permissions, the impact could extend to Microsoft Graph resources such as mailboxes, calendars, OneDrive files, SharePoint content, and Teams-related services.

The researchers demonstrated the risk by impersonating multiple Microsoft apps. A Teams identity requesting Microsoft Graph access could receive delegated permissions that let it read and write mail, send messages, access files, and modify calendars. This flaw is especially important for organizations that use Android devices to access Microsoft 365 workloads.

Microsoft fixed the issue in Microsoft Authenticator for Android version 6.2606.4246, which was released in July 2026. Organizations and individual users should update the app through Google Play as soon as possible and verify that managed devices are running a current release.

Microsoft’s advisory describes the issue as improper authentication that could let an unauthorized local attacker elevate privileges.

The flaw also highlights why mobile identity brokers must validate the real calling application, including its package identity, UID, and signing certificate, rather than relying on app-controlled values in an intent.

The incident highlights Microsoft’s ongoing efforts to protect Entra credentials on rooted Android and jailbroken iOS devices, where malware and weakened security controls increase enterprise identity risks.

Organizations should review mobile application controls, enforce timely app updates through MDM or EMM platforms, and restrict sideloaded applications where possible.

Security teams should also monitor unusual Microsoft Graph activity, unexpected consent behavior, and token use from unfamiliar Android devices. Microsoft’s official CVE-2026-80097 advisory should be used for ongoing remediation guidance.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions appeared first on Cyber Security News.

Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console.

Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when the Admin Console processes specially formatted configuration values.

An attacker with administrative access can use those values to trigger command execution under the OAG service account. The disclosure does not describe an unauthenticated attack.

The flaw sits where administrative configuration input reaches processing functions inside the gateway. Instead of treating the supplied values strictly as configuration data, the affected software can allow crafted input to lead to system command execution.

Okta Access Gateway Flaw

Okta classifies the issue under CWE-94, improper control of code generation, and CWE-20, improper input validation. The required access is an important limit. An attacker must first gain administrative access to the OAG Admin Console.

A regular application account alone does not meet the stated conditions, and the advisory does not identify an authentication bypass that removes this requirement.

Successful exploitation runs commands with the permissions of the OAG service account. That is not the same as confirmed root access. The potential damage depends on what that account can read, change, or run, making its actual permissions important when assessing exposure.

The supplied CVSS v3.1 vector describes a network attack with low complexity, high required privileges, and no user interaction. It also assigns high impact to confidentiality, integrity, and availability, with changed scope.

Organizations running Okta Access Gateway versions before 2026.10.2 should upgrade to version 2026.10.2 or later. The supplied disclosure identifies that release as the fix and does not provide a separate workaround.

The patch follows earlier Okta Access Gateway and Auth0 security fixes covering authorization bypass, SQL injection, and stored cross-site scripting.

Those September issues had different requirements and fixes, so the earlier Access Gateway 2026.9.1 update does not meet this advisory’s minimum patched version.

Administrators should also review who can reach the management console and investigate unexpected configuration changes. Previous reporting on Okta administrator session abuse at 1Password shows why protecting privileged sessions matters, although that incident is separate from this vulnerability.

The supplied advisory does not report active exploitation, publish attack payloads, or identify the affected configuration field. Those gaps do not prove exploitation is impossible. Teams should prioritize the appliance upgrade and check Okta’s security advisory portal for further guidance as details become available.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands appeared first on Cyber Security News.

Researchers has demonstrated Node2Shell, a working exploit that lets an attacker run code inside a Node.js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory flaw in the Brotli decoder bundled with Node.js.

The Node.js security advisory, published on October 21, 2026, confirms that the flaw can allow remote code execution and affects the 22.x, 24.x, and 26.x release lines. Fixes are available across all three branches.

New Node2Shell Node.js RCE Exploit

According to the supplied Imperva research, its standalone proof of concept worked against the official Node.js 24.22.0 Linux arm64 image without a debugger or modified binary. The code delivered with the compressed data created a marker file that the test application was not instructed to produce.

Execution required multiple attempts in the tested setup. The results establish exploitation on that specific build and application configuration, not reliable execution across every Node.js platform.

The flaw appears when the decoder encounters an invalid transition between block types within a Brotli stream. Instead of rejecting the broken stream, the vulnerable code treats the condition as a need for more input and continues processing with an invalid internal state.

Imperva’s separate memory-sanitizer test showed that this behavior could write beyond an intended buffer. That out-of-bounds write provides the underlying memory corruption behind the demonstrated code execution.

The patched decoder returns a format error for the invalid transition. Node.js 24.22.1 release notes confirm the inclusion of the Brotli security fix. In Imperva’s application tests, that release rejected the same malicious inputs without creating the marker file.

Imperva tested compressed HTTP responses consumed through Node.js’s built-in fetch() function and incoming request bodies decoded by configured Express and body-parser middleware.

The tested setups included Express 5.0.0 with body-parser 2.0.1, Express 5.3.0 with body-parser 2.3.0, and standalone body-parser 2.0.0. Both raw() and json() parser paths allowed execution in the tested vulnerable environments.

These packages provide routes into the affected decoder rather than containing the underlying flaw. A bare Node.js HTTP server does not automatically decompress incoming Brotli bodies.

Cybersecurity News previously covered the affected branches in its report on Node.js security updates. Its October 21 security roundup also highlights the need to rebuild container images with the updated runtime.

Administrators should deploy Node.js 22.23.4, 24.22.1, or 26.12.1, or newer fixed versions in those branches. The official advisory lists these releases as the security updates addressing the flaw.

Teams should check the actual Node.js binary inside deployed containers and hosts, then review where services decode untrusted compressed requests or responses.

Imperva says it added WAF rules covering reproduced exploitation attempts. Those controls provide temporary protection, but replacing the vulnerable runtime remains essential. Decoder errors and unexpected process exits may support investigation, but neither alone proves successful exploitation.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data appeared first on Cyber Security News.

Hackers are actively exploiting a critical SQL injection flaw in VeloCloud Orchestrator (VCO) that allows logged-in users to gain superuser operator access.

Arista Networks disclosed the vulnerability on October 22, 2026, warning that successful attacks could compromise the orchestrator, its host, and the data it manages. Arista has already patched hosted deployments, including Dedicated instances.

Tracked as CVE-2026-114625, the vulnerability carries a CVSS v3.1 score of 9.9 and a CVSS v4.0 score of 9.4. Arista discovered the issue and confirmed active exploitation.

Security Advisory 0199 identifies the weakness as CWE-89 (SQL injection) and tracks it internally as BUG2043622. Exploitation requires network access to the VCO web interface and a valid authenticated portal session. However, attackers do not need an administrator account.

Enterprise Read Only, the lowest built-in tenant role, provides enough access to exploit the flaw. The attack requires no user interaction and is low complexity.

A successful attacker can gain operator privileges and impersonate a local “superuser operator” account. This opens access to internal functions that should not be available remotely.

Arista warns that exploitation can affect the confidentiality, integrity, and availability of both the orchestrator and its managed data.

The login requirement is important. This is not an unauthenticated attack, but a limited account can become a route to much broader control.

Hackers Exploiting VeloCloud Orchestrator Flaw

Arista says VCO is exposed by default and no product configuration removes the exposure. Restricting network access is a temporary safeguard, not a fix. The disclosure follows earlier VeloCloud Orchestrator exploitation involving a separate command injection vulnerability.

Another related report covered SonicWall SQL injection flaws that could turn read-only access into administrator control. Those cases involve different vulnerabilities and should not be confused with this issue.

Affected on-premises deployments include VCO 5.2.x releases before 5.2.3.18, VCO 6.1.x releases before 6.1.3.10, and VCO 6.4.x releases before 6.4.2.12. Administrators should upgrade to the fixed version in their release train or a later release. Arista has not assessed software that has reached end of support.

VeloCloud Gateway and VeloCloud Edge are not affected. Arista also lists its EOS-based products and other named platforms as unaffected. Operators should check the affected software list first instead of assuming that every Arista or VeloCloud product needs the same update.

Arista identified 74.82.197.86 and 38.54.50.151 as source IP addresses observed conducting attacks. Security teams should block these addresses and search historical logs for related activity.

Investigators should also examine unusual URL-like paths, encoded characters, references to local or internal services, and unusually high request rates.

Where feasible, teams should preserve web access, backend application, system, and database logs, along with relevant file timestamps, before remediation.

Arista also recommends restricting web access to trusted administrative networks, checking unexpected outbound connections, reviewing administrator changes, and monitoring for backdoor services or webshells.

Customers outside supported release trains should contact Arista Technical Assistance Center about upgrade options. These interim controls reduce exposure, but installing a fixed release remains the recommended resolution.

Because exploitation is already confirmed, affected organizations should prioritize patching alongside a review for signs of compromise rather than treating the upgrade as routine maintenance.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Actively Exploiting Critical VeloCloud Orchestrator Flaw to Gain Superuser Access appeared first on Cyber Security News.