Cybersecurity and other IT news aggregator

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory 2026-10-15 at 23:24 By A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel’s live cloud sandboxes, and Vercel confirmed it. The…

Tesla unveils redesigned next-generation Roadster after long-awaited anticipation 2026-10-15 at 23:12 By Fox Business Tesla will unveil its redesigned $200,000 Roadster on Thursday after years of delays, featuring technology built in collaboration with SpaceX. This article is an excerpt from Latest Technology News | New York Post View Original Source

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More 2026-10-15 at 21:49 By Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week’s security stories. The rest gets interesting in…

OpenAI warns employees about foreign ‘honey pots’ offering sex to steal AI secrets 2026-10-15 at 21:24 By Thomas Barrabi The possibility of so-called “honey pot” schemes are just one of several scenarios that OpenAI has used to put its employees on guard against espionage, the Wall Street Journal reported, citing people familiar with the matter.…

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads 2026-10-15 at 19:22 By Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said…

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks 2026-10-15 at 19:22 By The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different…

Healthcare Ransomware Attacks Doubled Since This Time Last Year 2026-10-15 at 19:00 By Healthcare saw an average of 3.33 attacks each day in Q3 2026.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams 2026-10-15 at 18:26 By A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active…

1M Impacted by CenterPoint Energy Data Breach 2026-10-15 at 17:42 By A data breach against CenterPoint Energy has impacted approximately 1 million Texans.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks 2026-10-15 at 17:17 By NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash…

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing 2026-10-15 at 17:17 By Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the…

Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early 2026-10-15 at 15:16 By Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026.  The campaigns also increase operational pressure…

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation 2026-10-15 at 15:16 By Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface.…

Why AI Confidence Is Not Validation 2026-10-15 at 15:16 By AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it.…

Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules 2026-10-15 at 15:07 By Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site’s server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach…

India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 2026-10-15 at 13:42 By The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers’ registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls…

Aoki: Infostealer Targets AI Coding Assistant Credentials 2026-10-15 at 13:20 By Threat Hunter Team Newer versions of a little-documented infostealer steal API keys and tokens from ever-growing number of AI coding assistants, including Claude, Codex, Cursor and Gemini. This article is an excerpt from SECURITY.COM View Original Source

Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts 2026-10-15 at 12:47 By Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company…

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches 2026-10-15 at 12:47 By Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which…

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories 2026-10-15 at 11:45 By The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. “This resulted from compromising the GitHub accounts of about…