Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
18 stories match your filters.
Volexity caught UTA0576 chaining three Ivanti Connect Secure zero-days into unauthenticated root on a fully patched VPN, then pulling LAPS passwords and BitLocker keys. Ivanti's Oct. 29 update closes the last bug.
CloudSEK says the Doorway botnet compromised 11,363 routers, cameras and servers in a month, mostly via blank or default passwords on MikroTik routers plus old RouterOS and Openfire bugs.
Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in.
Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.
CISA added Adobe Commerce's PolyShell and the Brotli Node2Shell bug to its exploited-vulnerabilities list, due Nov. 10, as ELLIO logged the first Node2Shell exploit traffic.
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
Group-IB and NyxLab say actor k0t exploited exposed FortiWeb, FortiGate and GlobalProtect devices through 2026, reached domain admin, and stole more than 70,000 credentials, likely as an initial access broker.
Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.
Eye Security found Time4Popcorn's abandoned updater would run any file as SYSTEM or root, registered its domain and used it to switch the updater off. Android users remain exposed.
Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.
A joint FBI, CISA and USSS advisory says SafePay ransomware has hit at least 600 victims since August 2024, getting in through stolen or guessed VPN logins and old Cisco ASA, SonicWall and Veeam flaws, then wiping backups before it encrypts.
Hunt.io found the PaperCut mass-exploitation crew's AI agent prompts, exploit variants, credential stealers and victim access kits on an open server, plus a second RCE route through the XML-RPC API.
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys.
Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.
Unit 42 says a cluster it calls CL-UNK-1211 spent six months in government Linux servers using AI-generated scripts, a new Go RAT and fake red-team markers, going after databases, mailboxes and linked social media accounts.