Stories with indicators of compromise: attacker IPs, domains, URLs and file hashes to hunt for and block.
2 stories match your filters.
Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.