#уязвимости
-
Applebee's app shipped with a database password that exposed customer data
A researcher found hardcoded credentials in Applebee's Android app that allowed anyone to read and modify registered customers' personal data. The flaw has since been fixed.
-
Linode investigates security incident tied to CVE-2026-98432
Linode's status page has posted a customer advisory about a recently disclosed remote code execution vulnerability. Akamai says it is taking mitigation steps and monitoring the platform.
-
Key “4”: Cloudflare measures how much of the Internet still trusts eMudhra’s weak keys
Certificate authority eMudhra issued intermediate keys that can be recovered from public certificates almost instantly. Cloudflare explains how it patched its own systems, what it knows about exploitation attempts, and how many clients remain exposed.
-
WordPress Core Flaw Hit by Tens of Thousands of Attacks a Day Right After Patch Release
Attackers began going after a remote code execution flaw in WordPress Core soon after it was patched. Wordfence says it blocked nearly 63,000 attempts in 24 hours.
-
CISA Adds Exploited GitLab and Cisco Firewall Flaws to KEV Catalog
The U.S. agency CISA has added a critical GitLab flaw enabling remote code execution and a Cisco firewall bug leading to denial of service to its catalog of known exploited vulnerabilities.
-
Attackers exploit critical authorization flaw in Drupal Commerce Core
Drupal warns that an access bypass vulnerability in its Commerce Core component is already being exploited in the wild. Users are urged to update promptly.
-
Linux kernel TCP flaw rated 9.8 still unpatched on Ubuntu and RHEL
A race condition in the Linux kernel's TCP code leads to a use-after-free. Anthropic says its Claude model wrote an exploit for it that gives a remote attacker root.
-
Telegram for Android Flaw Let Attackers Run Code Through a Voice Call
Security startup NebuSec has disclosed a flaw in Telegram for Android: an attacker with an ordinary account only had to call the victim and wait for them to answer. The bug is fixed in version 12.10.4.
-
CISA warns Fragnesia Linux kernel flaw is being chained with PHP2Shell in attacks
The U.S. agency CISA has ordered federal agencies to fix a Linux kernel privilege escalation flaw. Attackers are already pairing it with the PHP2Shell bugs to gain root access to servers.
-
Cisco patches actively exploited zero-day in ASA and FTD firewalls
CVE-2026-76418 lets unauthenticated remote attackers force Cisco firewalls with SSL VPN enabled to reload. The company has already seen attacks and urges customers to update.
-
China-Linked Warp Panda Used VMware ESX Zero-Day to Hide Its Tracks
CISA has added CVE-2026-41709 in VMware ESX to its catalog of exploited vulnerabilities. According to CrowdStrike, the Warp Panda group used it as a zero-day to leave fewer traces in audit logs during attacks on U.S. law firms.
-
Hackers Used a Cisco SD-WAN Flaw to Deploy KeyDrift, Malware Built to Steal Encryption Keys
Cisco Talos has described KeyDrift, malware that attackers planted on Catalyst SD-WAN control systems through the critical CVE-2026-20127 flaw. Its job is to copy the AES keys that encrypt traffic between sites.
-
Alpine Linux rebuilds its GitLab after an attempted exploit of a critical vulnerability
An attacker came close to compromising Alpine Linux's GitLab instance via CVE-2026-97229. No evidence of a breach was found, but the server was rebuilt from scratch and all passwords were reset as a precaution.
-
Attackers scan for unpatched Oracle E-Business Suite systems with critical flaw
A week after Oracle shipped a fix for the critical CVE-2026-101767 vulnerability in E-Business Suite, the first scanning and exploratory exploitation attempts have been observed.
-
CISA adds Adobe Commerce and Brotli flaws to KEV as PolyShell hits hundreds of stores
CISA has confirmed active exploitation of two critical vulnerabilities, one in Adobe Commerce and Magento and one in Google's Brotli decoder library. The first has already been used to breach hundreds of online stores, and the second has prompted emergency updates from dozens of vendors.
-
Oracle PeopleSoft zero-day exploited by ShinyHunters turns out to be three chained flaws
Zero Day Initiative researchers found that the critical CVE-2026-35273 in Oracle PeopleSoft is really three linked bugs across two components. At its core is the product's default trust in its own loopback address.
-
UEFI firmware flaw enables code execution early in the boot process on servers
A critical vulnerability in EDK2 lets attackers run code while a system is still booting. According to Ars Technica, most servers in the world are at risk.
-
Microsoft Authenticator Flaw on Android Let Permissionless Apps Steal Work Account Tokens
Microsoft has fixed CVE-2026-80097 in Authenticator for Android, which let a malicious app with no permissions pose as Teams and obtain tokens for a work account. Users should update to version 6.2606.4246.
-
Apple brings CoreGraphics zero-day fix to older iPhones and iPads
Apple has released patches for older iPhones and iPads that close a zero-day vulnerability in CoreGraphics. According to the company, the flaw was used in "extremely sophisticated" targeted attacks.
-
OpenAI's compaction feature could be abused to extract a model's hidden reasoning
Security firm Xint showed how the mechanism that shrinks long conversations in OpenAI's API could be turned into a way to pull a model's hidden reasoning out in plain text. OpenAI confirmed the issue and fixed it on October 23.
- More