Eye Security found that revoking sessions or resetting a password leaves Graph, EWS and ActiveSync mail access open for up to 90 minutes; only disabling the account cuts it off immediately.
CVE-2026-97631, a 9.5-rated overflow in EDK II's PXE driver dating to 2010, can let someone on the local network run code before Secure Boot on network-booting machines. Firmware updates are still pending.
Sony Network Communications says an Oct. 19 intrusion exposed 2.59 million So-net and Docomo Hikari customer records, plus 54,401 email addresses with passwords. No card data was taken.
Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted.
ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token.
Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026.
Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.
CrowdStrike says China-nexus Warp Panda used CVE-2026-41709, a VMware ESX insufficient-logging flaw, as a zero-day against US law firms. CISA added it to KEV with a Nov. 11 deadline.
Lumen ties Volt Typhoon's Silent Train covert network to zero-days in N-able, Cisco SD-WAN, VeloCloud and likely Quest KACE, while Cisco Talos details KeyDrift malware stealing SD-WAN keys.
Cisco says attackers are exploiting CVE-2026-76418, an unauthenticated bug in the ASA and FTD SSL VPN that forces the firewall to reboot when secondary authentication is configured.
Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in.
Check Point says the new Aokigahara infostealer has a dedicated module for AI assistant and coding-tool sessions, plus cloud configs, SSH keys, browsers and crypto wallets.
ENGIE says attackers stole French customers' contact details and contract and meter numbers from a partner marketing platform; no banking data, and its own systems weren't hit.
DreamHost is forcing email, FTP and SFTP password resets in an ongoing incident and telling owners to remove unknown forwarding rules, but hasn't said what happened.
Arctic Wolf has seen more than 400 incidents where attackers mail-bomb a user, pose as IT on Microsoft Teams and get remote access via Quick Assist, a path to Black Basta, Cactus and Chaos ransomware.
CERT-UA warns attackers are hijacking Dahua cameras and recorders in Ukraine through Easy4IP P2P access, guessable serials, weak passwords and old auth-bypass bugs.
Australia's ASD broke into an Amadey malware control panel and disconnected it from about 180,000 infected computers. Data already stolen is still out there.
A cybersecurity incident forced UNM Health to divert ambulances from New Mexico's only Level 1 trauma center and cancel appointments at more than 30 clinics. The FBI is assisting.
GMO Internet says an attacker who breached Onamae.com Desktop Cloud used stolen logins to trade in customers' brokerage accounts and is now demanding money. GMO won't pay.
iOS and iPadOS 18.7.11 backport Apple's fix for CVE-2026-86950, a CoreGraphics zero-day Apple says may have been exploited against targeted individuals, to the iPhone XS, XR and older iPads.
The FBI warns of midterm scams promising guaranteed returns on campaign donations, fake PACs that keep the money, merchandise that never ships and fake voter-registration pages.
Cyberdione Labs' Tailworm report says flaws in Tailscale SSH's root-run forwarding let a permitted SSH user reach root-only sockets. Tailscale calls the issues serious and targets a patched client by Oct. 27.
Wiz says the Gheist campaign used stolen GitHub tokens to plant 13,500+ branches across 850+ accounts, each running a workflow that dumps repository secrets into Actions logs and deletes the run.
Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail.
Fortinet patched critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator found by AI-assisted review, but won't publish CVEs until Nov. 10. Australia's ACSC says patch urgently.
Artem Stryzhak, a Ukrainian affiliate who rented Nefilim and Hive ransomware to hit companies, law firms, a dental office and a healthcare provider, was sentenced to 70 months in US prison.
Securonix found JavaScript on hijacked sites that uses a logged-in WordPress admin's session to install a backdoored plugin that persists in mu-plugins and hides from the plugin list.
Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received.
Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.
Enclave's AuthMask bug let any Android app get work-account Microsoft Graph tokens from Authenticator by posing as Teams; Microsoft fixed it in 6.2606.4246 and says it wasn't exploited.
CISA added Adobe Commerce's PolyShell and the Brotli Node2Shell bug to its exploited-vulnerabilities list, due Nov. 10, as ELLIO logged the first Node2Shell exploit traffic.
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
Oracle's out-of-band CVE-2026-91403 fix (CVSS 9.1) stops Java trusting eight eMudhra intermediate certificates with weak keys; a second update, CVE-2026-114820, removes the related roots.
Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker.
Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.
Kaspersky found BlackX, a UEFI bootkit used against Central Asian diplomats that bypasses Secure Boot via Baton Drop because Microsoft's revocation step was never applied. Medium-confidence link to APT41.
Quest Diagnostics says an intruder reached patient records through its Quanum Lab Services Manager platform. It hasn't said how many people are affected.
Wiz says ARTEX AI agents tied to Storm-0940 spent October probing IT and software vendors' Okta, Entra ID and Cognito sign-ins. Most attempts failed.
Eye Security found Time4Popcorn's abandoned updater would run any file as SYSTEM or root, registered its domain and used it to switch the updater off. Android users remain exposed.