FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
News

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s activities by arresting two suspects, indicting 14 people, and confiscating nearly 187 laptops used in North Korean remote IT worker schemes. Famous Chollima (also known as WageMole) is widely identified as a North Korean threat actor linked to fraudulent IT-worker schemes that bring in revenue for the DPRK regime. Due to North Korea’s extensive international sanctions, its operatives pursue technology jobs at companies around the world, frequently relying on stolen, rented, or fabricated identities. In certain cases, they also try to breach employers’ networks to steal confidential information, install malware, or acquire cryptocurrency and other assets. During a Texas operation codenamed “Lone...
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
News

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Singapore-based Ahsay Backup has rolled out security updates to address two security flaws in AhsayCBS that have been abused by malicious actors to deliver web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134 that can be chained together to bypass authentication and execute arbitrary commands on the affected systems. In a report published earlier this month, Huntress said it detected threat actors combining the two flaws to achieve unauthenticated remote code execution and deploy web shells and cryptocurrency miners on the compromised systems. While the vulnerabilities were believed to be fixed in AhsayCBS versions 9.15.2.59 and 10.3.4.0 released in August 2026, the software company has confirmed that the patches did ...
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
News

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks released security updates for a high-severity vulnerability in PAN-OS software that has been actively exploited on Wednesday. CVE-2026-0322 (CVSS score: 8.6) is a remote code execution vulnerability in the management interface. A vulnerability that allows remote code execution (RCE) in the management interface of Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall, Palo Alto Networks said. The vulnerability affects PAN-OS software on PA-Series and VM-Series firewalls, as well as on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted by the vulnerability. Palo Alto Networks stated that no special configuration is required to exploit t...
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
News

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Attackers are exploiting a critical zero-day flaw in Cisco Secure Email Gateway that allows a sender without login credentials to write files to the appliance's operating system, Cisco reported in an advisory on Wednesday. The intruder sends an email with a crafted attachment to the gateway and, if successful, could further execute commands as root. The appliance filters an organization's email of spam, malware, and other threats, and the only gateways that are vulnerable are those with the File Reputation service enabled and a Content Scanner Tools package lower than version 25.3.0.5525. The fix has been shipping since September 14 in AsyncOS 15.5.5-014 and 16.5.0-780, the builds Cisco listed as fixed in a hardening release that day, which the company later claims covered this flaw...
Ghostscript flaw lets hackers hijack servers via PDF uploads
News

Ghostscript flaw lets hackers hijack servers via PDF uploads

A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine has been found, and it could allow remote code execution by using specially crafted PDF files. The issue was discovered on 23rd of August by researchers at Defiant's platform Wordfence who were using their Argus AI-powered system. Ghostscript is a PostScript and PDF interpreter which can render PDFs into images, create thumbnails for previewing content in web interfaces, and optimize PDF files by compressing embedded images and removing unnecessary font data. When generating a PDF thumbnail, WordPress uses the PHP Imagick extension to call the ImageMagick, which activates Ghostscript. A specially crafted PDF file that contains a JPEG 2000 image can corrupt the mem...
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
News

Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub, the registry where container images are published and downloaded, allowed one user to push, pull, or delete images as another user. The vulnerability was fixed by Docker on September 30, and the company said it found no evidence that it had been exploited. The problem was in the functionality to convert a personal account to an organization, announced the security advisory on October 12, issued by Docker. Converted accounts passed the personal access tokens (PATs) of the account to the user who was designated as the owner of the organization. The token is used instead of a password in the registry, and the user who created each token retains access to it. The token's access was limited to the registry: It could not access the Docker Hub web interface and could ...
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
News

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has decided to expire unvalidated npm trusted publishing configurations 48 hours after creation, after finding that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. Your configuration is validated and exempt from expiry after the first successful publish, the Microsoft-owned subsidiary said. To change the repository or project identity is to require a new trust relationship with a fresh 48 hour validation window, while edits to it won't restart the deadline. The change includes the risk of trusting a repository or project name, changing ownership, as GitHub said, while also that npm also reject trusted publishing tokens from GitHub Actions issue_comment events going forward, as well as the Existing p...
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
News

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

Microsoft's advertising division Xandr was fined €8.6 million ($9.62 million) by the Norwegian Data Protection Authority (DPA) for unlawfully sending sensitive information about Grindr users to marketers. The data protection watchdog claimed that the case warranted a significant fine due to the "very serious" nature of the violation, resulting in the biggest administrative penalty ever. The violations took place between July 2018 and April 2020. According to a statement from the Data Protection Authority, Xandr served as a middleman that sent thousands of other businesses the personal information of Grindr users in Norway, including information on sexual orientation. According to the data protection authority, its inquiry revealed that Xandr and Grindr were joint controllers, mea...
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
News

Norway fines Microsoft ad firm $9.6 million over Grindr data sharing

Norway’s data protection authority has fined Microsoft-owned advertising company Xandr $9.6M (NOK 92 million) for its unlawful processing and dissemination of sensitive data of Grindr users in the country. The data protection authority said that this is the largest fine ever issued. We have imposed such a significant penalty in this case because the violations found were of a particularly serious nature, said Line Coll, Director General of Datatilsynet. Thousands of users in Norway have suffered unlawful dissemination of their sensitive data. According to the authority’s findings, between July 2018 and April 2020, Xandr managed real-time advertising auctions inside Grindr that potentially exposed users’ data, including sensitive sexual orientation information, to thousands of compan...
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
News

Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

Threat actors have been seen already exploiting a recently discovered critical vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of the public disclosure of the issue. The flaw, tracked as CVE-2026-102255 (CVSS score: 10.0) is a pre-authenticated server-side request forgery (SSRF), which could be leveraged by a remote attacker to "direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." Patches for the vulnerability were released by SonicWall on October 6th, 2026, in versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix). The vulnerability has started to see active exploitation attempts, with initial signs first being noticed by threat intelligence firms Defuse...