Hidden Behind NAT, Still Hijacked: Dahua Cameras Hit in Ukraine
CERT-UA warns attackers are hijacking Dahua cameras and recorders in Ukraine through Easy4IP P2P access, guessable serials, weak passwords and old auth-bypass bugs.
The Roundup
Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
4 stories match your filters.
China-Linked Hackers Used a VMware ESX Bug to Work Without Logs
CrowdStrike says China-nexus Warp Panda used CVE-2026-41709, a VMware ESX insufficient-logging flaw, as a zero-day against US law firms. CISA added it to KEV with a Nov. 11 deadline.
Node2Shell: Crafted Brotli Data Runs Code on a Stock Node.js Build
Imperva ran attacker code on an official Node.js 24.22.0 image by feeding it crafted Brotli data, through fetch() responses or Express 5 body parsers. Patch Node.js and rebuild images.
Node.js Patches a Brotli Bug That Squeezes Past Its Own Buffer
Node.js fixed an out-of-bounds write in its bundled Brotli decoder (CVE-2026-111497) that it says could allow remote code execution on 22.x, 24.x and 26.x. End-of-life versions get no patch.