ls ./category/security
Breaches, vulnerabilities, malware and the patches that matter.
Lumen's Black Lotus Labs tracked a malware family that does not carry its command-and-control address. It fetches a poem from GitHub, pulls four words out of fixed positions, and looks them up in a dictionary compiled into the binary. The operator has rewritten the poem eleven times since April.
A Kibana user with delegated package-management rights, and no Elasticsearch administrative privileges, could install a package that claimed a data stream identifier already belonging to someone else. Ownership was never checked, so another tenant's telemetry could be redirected through infrastructure the attacker controlled.
wolfSSH never verified that the elliptic curve in a server's host key matched the algorithm both sides had just negotiated. A machine-in-the-middle could swap in a key on a different curve, sign with its own private key, and be accepted with no error. Fixed in 1.6.0 — and it needs one more condition that is common in embedded code.
watchTowr published technical detail and working exploit code for the Atlassian file-read flaw. Previdian's honeypots saw exploitation attempts within two hours. Yesterday we argued the advisory's stated limitation was not one; what has changed since is that nobody even has to work the path out.
Checkmarx has documented an npm campaign running since August 2023 that delivered a remote access trojan and an information stealer through twelve packages. What kept it alive is not stealth. It is that the advisory databases security tooling reads never caught up, and three of the packages are still there.
Two flaws in Handlebars.js, scored 9.8 and 9.2, with public proof-of-concept code. The library is downloaded about 172 million times a month. The first lets anything that can pass an object instead of a template string place expressions into the generated code; the second walks a deny list that runs one step too late.
CVE-2026-21589 scores 9.3 and lets an unauthenticated attacker read files from the web application root across eight Data Center products. The advisory notes they cannot list directories and must know the exact path. For software anyone can download and install, that is a description of the attack, not a limit on it.
Chrome 155 went to Stable on 7 October with 247 security fixes, four of them critical use-after-free bugs. None were exploited. The interesting part is the attribution list: a visible share of the reports are credited to researchers working with AI assistants, which is the mechanism behind the CVE numbers everyone has been quoting.
The blockchain investigator ZachXBT says he posed as a client of a Chinese network he alleges laundered more than a billion dollars for North Korea's Lazarus Group, including most of the 1.5 billion taken from Bybit. He funded a wallet, placed orders, lost about five percent each time, and traced a cluster that led to a freeze.
Cling takes routers and DVRs through vulnerabilities going back to 2014, then talks to its operator over STUN — the NAT-traversal service every video call depends on. Its traffic looks like a device keeping a connection alive, because that is literally what the packets are. It is the third campaign this fortnight to put its command channel somewhere undeletable.
Proofpoint has tied a China-aligned group to credential phishing against US AI policy researchers. The approach opens as an ordinary conversation with no link in it, and only once the target replies does a URL arrive — ending at a fake sign-in window rendered inside the real browser, which collects the password, the MFA code and the session cookie.
Microsoft published an out-of-band advisory for CVE-2026-96940, an authorisation flaw scored 8.8. An attacker needs valid credentials for any mailbox in the organisation; from there they can read other people's messages and attachments. Exchange Online was mitigated server-side. On-premises stays exposed until an administrator installs the update.
Rejetto HFS signed its session cookies with a key from JavaScript's Math.random, and handed out numbers from the same generator to anyone who started a login. Either alone is survivable. Together they let a stranger forge an admin session and run code. Horizon3 found it with Anthropic's Mythos, published a proof of concept, and scanning began within days.
Socket.dev found VS Code themes on the Marketplace and Open VSX carrying obfuscated loaders. One used a publisher identity imitating Microsoft. The payload was compressed onto one line and encoded with invisible Unicode, then written to a temporary script and run with no window shown. Microsoft removed them, which does not uninstall anything.
On 3 October we wrote that Citrix customers were watching their gateways reboot after installing the emergency build, with no CVE and no root cause published. Citrix disclosed it on the 4th: CVE-2026-88779, a memory overflow reached through SAML, exploited in targeted attacks. Each attempt crashes the authentication service, and the sixth restarts the appliance.
A file-sharing system at the Defense Manpower Data Center let unauthorised users reach files from October 2025 until it was found on 16 July 2026. The records cover 2.76 million living people and about 294,000 dead ones, and pair Social Security numbers with names, dates of birth and military job specialties.
Google Threat Intelligence has documented the first nation-state use of EtherHiding: a DPRK group storing its downloader in smart contracts on two blockchains, updated for about a dollar a time. The coverage calls it takedown-proof. GTIG's own report points at the part that is not — the attackers do not run nodes, they call three API companies.
Truffle Security scanned 224.6 million public GitHub repositories from an AI training dataset and found 543,699 credentials that still worked. The survival rate by provider is the finding: where a provider scans for its own leaked tokens and kills them, almost nothing survives. Where it does not, almost everything does.
Titan, Microsoft's internal analytics service, checked a login token's tenant, audience, application and user — and never checked that it was signed. A 16-year-old researcher set the algorithm to none, typed admin into the user field, and was one. Microsoft blocked the endpoint in four days and paid 5,000 dollars.
CVE-2026-90970 scores 9.9. A user with access to GitLab Duo's agent platform could write a flow configuration that broke out of the prompt-template sandbox and executed commands on the host. The bug class is twenty years old. What is new is that letting users write templates is now a product feature.
Operation KillSwitch, led by Hamburg police with Europol and Eurojust, searched eight properties in four countries on 30 September and made three arrests. The suspected administrator is a 16-year-old Romanian national detained in Alicante. The age is the headline; the service model is why that job could be held by a teenager.
Cisco Talos has published a China-nexus campaign that put a Rust backdoor on roughly 350 machines across eight Asian countries. Antino's command channel is Microsoft Graph — commands arrive as mail, stolen files go to OneDrive. Every packet it sends goes to a host the victim's own allow-list already trusts.
SEC Consult's Timo Longin found two parsing flaws in Apple's iCloud mail pipeline that let a free account send mail appearing to come from any address at icloud.com. The spoofed messages passed every authentication check, because the forgery happened upstream of the point where Apple signs. Reported in May 2024, fully fixed in December 2025, published on 1 October 2026.
Citrix shipped 14.1-73.37 for two actively exploited 9.5s. Customers who installed it are reporting repeated appliance reboots, traced to crafted SAML traffic crashing the authentication service until the watchdog restarts the box. Citrix says it is tracking a newly seen SAML issue. Bulletin CTX697096, last updated 27 September, still does not mention it.