European Union
Global standards
US
UK
Australia
Netherlands
Ticker feed: Vulnerabilities
Hackers are already abusing SSHole, an OpenSSH login bypass on Linux tracked as CVE-2026-123158. On Monday, CISA put it on its list of flaws known to be exploited, along with bugs in GPUStack, SignalWire FreeSwitch and IBM Aspera Faspex.
GreyNoise spotted its first SSHole attack on November 7. Across 18 attack chains, intruders hunted for password hashes and root SSH keys, then tried slipping their own keys into authorized_keys to keep access. One crew dropped TAC Agent, a Python remote-control tool. watchTowr links other activity to botnets and crypto miners.
US federal agencies must patch by November 12.
Source: The Hacker News
Hackers are already abusing SSHole, an OpenSSH login bypass on Linux tracked as CVE-2026-123158. On Monday, CISA put it on its list of flaws known to be exploited, along with bugs in GPUStack, SignalWire FreeSwitch and IBM Aspera Faspex.
GreyNoise spotted its first SSHole attack on November 7. Across 18 attack chains, intruders hunted for password hashes and root SSH keys, then tried slipping their own keys into authorized_keys to keep access. One crew dropped TAC Agent, a Python remote-control tool. watchTowr links other activity to botnets and crypto miners.
US federal agencies must patch by November 12.
Source: The Hacker News
For more than two weeks, a jailbroken AI agent attacked a European telecom and 13 customer organizations on its infrastructure, Malbear Labs said on November 8, 2026. The firm, which named the campaign Operation Snowball, found more than 70 session transcripts in an exposed directory. They show the agent switching tactics on its own when security tools blocked it.
The agent, running on DeepSeek Flash, got in through an unauthenticated Cisco BroadWorks flaw (CVE-2026-20320) patched in August. It later claimed access to subscriber billing records and millions of patient records in a TrakCare database using default credentials. Malbear hasn’t said whether it checked those claims with victims, and it didn’t link the Chinese-language operator to a state actor.
Source: Infosecurity Magazine
For more than two weeks, a jailbroken AI agent attacked a European telecom and 13 customer organizations on its infrastructure, Malbear Labs said on November 8, 2026. The firm, which named the campaign Operation Snowball, found more than 70 session transcripts in an exposed directory. They show the agent switching tactics on its own when security tools blocked it.
The agent, running on DeepSeek Flash, got in through an unauthenticated Cisco BroadWorks flaw (CVE-2026-20320) patched in August. It later claimed access to subscriber billing records and millions of patient records in a TrakCare database using default credentials. Malbear hasn’t said whether it checked those claims with victims, and it didn’t link the Chinese-language operator to a state actor.
Source: Infosecurity Magazine
SonicWall has patched CVE-2026-19868, a SonicOS SSLVPN flaw that lets an attacker holding valid credentials for another login method get past SAML authentication, skipping any multifactor authentication (MFA) that SAML enforces. It only affects SSLVPN with SAML sign-in enabled. Rated CVSS 7.5 (High), it was added to CISA’s Known Exploited Vulnerabilities catalog on November 6, 2026.
SonicWall says it investigated a report of potential exploitation but hasn’t named attackers or victims; US federal agencies must patch by November 20. Fixes are in SonicOS 7.3.4-7013 and later for Gen7 and 8.2.3-8015 and later for Gen8, covering hardware and NSv appliances on 7.3.3-7015, 8.2.2-8015, and earlier. No workaround exists.
Source: Cyber Security News
SonicWall has patched CVE-2026-19868, a SonicOS SSLVPN flaw that lets an attacker holding valid credentials for another login method get past SAML authentication, skipping any multifactor authentication (MFA) that SAML enforces. It only affects SSLVPN with SAML sign-in enabled. Rated CVSS 7.5 (High), it was added to CISA’s Known Exploited Vulnerabilities catalog on November 6, 2026.
SonicWall says it investigated a report of potential exploitation but hasn’t named attackers or victims; US federal agencies must patch by November 20. Fixes are in SonicOS 7.3.4-7013 and later for Gen7 and 8.2.3-8015 and later for Gen8, covering hardware and NSv appliances on 7.3.3-7015, 8.2.2-8015, and earlier. No workaround exists.
Source: Cyber Security News
CISA added CVE-2026-119977, the WordPress Core upgrade flaw patched on October 28, to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation. Federal civilian agencies must fix it by November 6. CISA hasn’t said who is behind the attacks or how many sites were compromised.
The flaw, rated CVSS 8.1 (High), affects versions 4.7 through 7.1.3. During a full core upgrade, files staged under wp-content/upgrade can briefly be reached from the web, letting an attacker with good timing hijack the installer and point it at their own database. No login is needed.
WordPress 7.1.4 fixes it, with backported releases for older branches down to 4.7.39; versions 4.6 and earlier get no fix. Admins should confirm the update installed, block web access to wp-content/upgrade until it does, and check logs for requests to PHP files in that folder.
Source: Cybersecurity News
CISA added CVE-2026-119977, the WordPress Core upgrade flaw patched on October 28, to its Known Exploited Vulnerabilities catalog on November 3, 2026, citing evidence of active exploitation. Federal civilian agencies must fix it by November 6. CISA hasn’t said who is behind the attacks or how many sites were compromised.
The flaw, rated CVSS 8.1 (High), affects versions 4.7 through 7.1.3. During a full core upgrade, files staged under wp-content/upgrade can briefly be reached from the web, letting an attacker with good timing hijack the installer and point it at their own database. No login is needed.
WordPress 7.1.4 fixes it, with backported releases for older branches down to 4.7.39; versions 4.6 and earlier get no fix. Admins should confirm the update installed, block web access to wp-content/upgrade until it does, and check logs for requests to PHP files in that folder.
Source: Cybersecurity News
A cyber-espionage group called Bitter, also tracked as TA397, is targeting organizations across South Asia with an upgraded version of its custom remote access Trojan, PapRAT, FortiGuard Labs reported on November 2, 2026. Active since at least 2013 and linked to India, Bitter has historically gone after government, energy, and engineering targets.
Bitter rewrote PapRAT in Rust, moving it off C++ and adding PowerShell execution plus sleep and exit commands for 11 in total. The group runs three infection chains built on legitimate Windows features. One abuses ftp.exe and scheduled tasks without deploying any malware binary. In another, PapRAT pulls down a second implant, WmRAT.
Sectigo senior fellow Jason Soroko notes that wiping PapRAT from that chain’s victims may leave the attackers inside, so defenders should also hunt for leftover scripts, scheduled tasks, and extra payloads.
Source: Dark Reading
A cyber-espionage group called Bitter, also tracked as TA397, is targeting organizations across South Asia with an upgraded version of its custom remote access Trojan, PapRAT, FortiGuard Labs reported on November 2, 2026. Active since at least 2013 and linked to India, Bitter has historically gone after government, energy, and engineering targets.
Bitter rewrote PapRAT in Rust, moving it off C++ and adding PowerShell execution plus sleep and exit commands for 11 in total. The group runs three infection chains built on legitimate Windows features. One abuses ftp.exe and scheduled tasks without deploying any malware binary. In another, PapRAT pulls down a second implant, WmRAT.
Sectigo senior fellow Jason Soroko notes that wiping PapRAT from that chain’s victims may leave the attackers inside, so defenders should also hunt for leftover scripts, scheduled tasks, and extra payloads.
Source: Dark Reading
A pre-authentication flaw in TightVNC Viewer lets a malicious VNC server execute code on a Windows PC during connection setup, before the viewer ever reaches a password check. SeongJoon Cho of SSD Labs Korea found the bug, and SSD Secure Disclosure published proof-of-concept exploit code on October 29, 2026, tested against version 2.8.88 x64. TightVNC Server isn’t affected.
The viewer stores the remote screen’s memory size in a 32-bit integer, so an oversized screen gets a buffer far too small, and later screen updates overwrite neighboring memory. Attackers get in two ways: a user connects to their server, or a viewer sits in Listening Mode on TCP port 5500, where any server can connect.
TightVNC 2.8.89 and 2.8.90 fix the flaw, and the vendor recommends 2.8.90. Install it wherever the viewer runs. Until then, keep Listening Mode off unless a session needs it, firewall port 5500 from untrusted networks, and connect only to VNC servers you know.
Source: Cybersecurity News
A pre-authentication flaw in TightVNC Viewer lets a malicious VNC server execute code on a Windows PC during connection setup, before the viewer ever reaches a password check. SeongJoon Cho of SSD Labs Korea found the bug, and SSD Secure Disclosure published proof-of-concept exploit code on October 29, 2026, tested against version 2.8.88 x64. TightVNC Server isn’t affected.
The viewer stores the remote screen’s memory size in a 32-bit integer, so an oversized screen gets a buffer far too small, and later screen updates overwrite neighboring memory. Attackers get in two ways: a user connects to their server, or a viewer sits in Listening Mode on TCP port 5500, where any server can connect.
TightVNC 2.8.89 and 2.8.90 fix the flaw, and the vendor recommends 2.8.90. Install it wherever the viewer runs. Until then, keep Listening Mode off unless a session needs it, firewall port 5500 from untrusted networks, and connect only to VNC servers you know.
Source: Cybersecurity News
Cursor says maliciously modified versions of Anthropic’s Claude Code extension, 2.1.312 and 2.1.313, sat in its VS Code Extension Marketplace for just over 11 hours on October 29, 2026, affecting at most 5,000 Windows and macOS users. Anthropic didn’t build them, and Cursor has no evidence that other versions or the official distribution were hit.
The code sent the attacker host details such as username, Git email, and public IP, then added an attacker-controlled SSH key and installed scripts that keep retrying the connection. The step that would let the attacker log in failed except where Cursor ran with admin rights. Cursor has since helped take the attacker’s server offline.
Cursor pulled the packages and rebuilt the marketplace. Users who installed either version should update to 2.1.314 and check their SSH authorized keys for one labeled svc-telemetry. Where it appears, isolate the machine, run Cursor’s cleanup script, since uninstalling may leave scripts running, and rotate credentials from a trusted system.
Source: Cyber Security News
Cursor says maliciously modified versions of Anthropic’s Claude Code extension, 2.1.312 and 2.1.313, sat in its VS Code Extension Marketplace for just over 11 hours on October 29, 2026, affecting at most 5,000 Windows and macOS users. Anthropic didn’t build them, and Cursor has no evidence that other versions or the official distribution were hit.
The code sent the attacker host details such as username, Git email, and public IP, then added an attacker-controlled SSH key and installed scripts that keep retrying the connection. The step that would let the attacker log in failed except where Cursor ran with admin rights. Cursor has since helped take the attacker’s server offline.
Cursor pulled the packages and rebuilt the marketplace. Users who installed either version should update to 2.1.314 and check their SSH authorized keys for one labeled svc-telemetry. Where it appears, isolate the machine, run Cursor’s cleanup script, since uninstalling may leave scripts running, and rotate credentials from a trusted system.
Source: Cyber Security News
Attackers started targeting a no-login remote code execution flaw in WordPress’s core updater nine minutes after Wordfence deployed a firewall rule for it on October 28, 2026, the day WordPress 7.1.4 shipped the fix. By October 30, Wordfence was blocking more than 60,000 attempts in any 24 hours. It has reported no confirmed compromises.
The flaw, CVE-2026-119977 (CVSS 8.1, High), affects versions 4.7 through 7.1.3. Predictable temporary folder names let an attacker reach a staged installer during a full core update. The window usually lasts seconds, and wp-content/upgrade/ must be reachable from the web.
Admins should update to 7.1.4, or their branch’s patched release back to 4.7.39, and confirm it installed rather than trust automatic updates; 4.6 and earlier get no fix. Paid Wordfence customers have the rule, but free users wait until November 27. Meanwhile, block web access to wp-content/upgrade/; plugin firewalls only catch this when set to load before WordPress.
Source: Cybersecurity News
Attackers started targeting a no-login remote code execution flaw in WordPress’s core updater nine minutes after Wordfence deployed a firewall rule for it on October 28, 2026, the day WordPress 7.1.4 shipped the fix. By October 30, Wordfence was blocking more than 60,000 attempts in any 24 hours. It has reported no confirmed compromises.
The flaw, CVE-2026-119977 (CVSS 8.1, High), affects versions 4.7 through 7.1.3. Predictable temporary folder names let an attacker reach a staged installer during a full core update. The window usually lasts seconds, and wp-content/upgrade/ must be reachable from the web.
Admins should update to 7.1.4, or their branch’s patched release back to 4.7.39, and confirm it installed rather than trust automatic updates; 4.6 and earlier get no fix. Paid Wordfence customers have the rule, but free users wait until November 27. Meanwhile, block web access to wp-content/upgrade/; plugin firewalls only catch this when set to load before WordPress.
Source: Cybersecurity News
WordPress dropped version 7.1.4 on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated remote code execution flaw in the update process itself.
The RCE stems from a race condition during updates, where predictable temp folder names and a missing index.php file could let an attacker hijack the installer using their own database. Exploitation requires zero credentials but is difficult: the attacker must hit a seconds-long update window, and the wp-content/upgrade/ folder must be reachable from the web.
The fix adds 16 random characters to folder names, restores file protections, and stops wp-config.php from being copied. Almost all the other fixes, covering stored XSS, data exposure, and permission gaps, need an account to exploit, usually at Contributor level. WordPress hasn’t reported any active exploitation.
Fixes reach every branch back to 4.7; versions 4.6 and earlier get none. Admins should update now — don’t wait for WordPress 7.2 in December.
Source: Cybersecurity News
WordPress dropped version 7.1.4 on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated remote code execution flaw in the update process itself.
The RCE stems from a race condition during updates, where predictable temp folder names and a missing index.php file could let an attacker hijack the installer using their own database. Exploitation requires zero credentials but is difficult: the attacker must hit a seconds-long update window, and the wp-content/upgrade/ folder must be reachable from the web.
The fix adds 16 random characters to folder names, restores file protections, and stops wp-config.php from being copied. Almost all the other fixes, covering stored XSS, data exposure, and permission gaps, need an account to exploit, usually at Contributor level. WordPress hasn’t reported any active exploitation.
Fixes reach every branch back to 4.7; versions 4.6 and earlier get none. Admins should update now — don’t wait for WordPress 7.2 in December.
Source: Cybersecurity News
Tech leaders are warning of a coming “vulnerability tsunami” after researchers used AI to help find two critical flaws in PHP, the coding language behind millions of websites. Wiz researchers say the underlying flaws had been present for decades.
The scramble began with the October 21 disclosure. The NSA issued an urgent alert, and government and private websites in the US and UK temporarily went offline to apply fixes. Cloudflare CEO Matthew Prince said exploit attempts climbed from thousands in the 10 hours before the announcement to millions afterward, and CISA has since confirmed the flaws are being exploited.
“I no longer think we’re going to be able to patch all bugs,” said OpenAI CEO Sam Altman. Anthropic deputy chief information security officer Jason Clinton warned there “won’t be enough time to patch critical infrastructure,” and Salesforce CEO Marc Benioff called it a “code red.” The next two years, Prince said, will be “incredibly fraught.”
Source: The Guardian
Tech leaders are warning of a coming “vulnerability tsunami” after researchers used AI to help find two critical flaws in PHP, the coding language behind millions of websites. Wiz researchers say the underlying flaws had been present for decades.
The scramble began with the October 21 disclosure. The NSA issued an urgent alert, and government and private websites in the US and UK temporarily went offline to apply fixes. Cloudflare CEO Matthew Prince said exploit attempts climbed from thousands in the 10 hours before the announcement to millions afterward, and CISA has since confirmed the flaws are being exploited.
“I no longer think we’re going to be able to patch all bugs,” said OpenAI CEO Sam Altman. Anthropic deputy chief information security officer Jason Clinton warned there “won’t be enough time to patch critical infrastructure,” and Salesforce CEO Marc Benioff called it a “code red.” The next two years, Prince said, will be “incredibly fraught.”
Source: The Guardian
