Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
21 stories match your filters.
Volexity caught UTA0576 chaining three Ivanti Connect Secure zero-days into unauthenticated root on a fully patched VPN, then pulling LAPS passwords and BitLocker keys. Ivanti's Oct. 29 update closes the last bug.
An attacker went after Alpine Linux's GitLab with CVE-2026-97229, the CVSS 10 Ruby regex bug, and CISA added it to KEV (due Nov. 1). Alpine found no tampering but rebuilt anyway. Self-built Ruby needs its own upgrade.
Drupal says attackers are exploiting CVE-2026-118539, a 'Highly critical' access bypass in Commerce Core that can hit store owners financially. Fixed in 3.3.13 and 8.x-2.41; audit your orders.
CVE-2026-98432, a 9.8-rated race in Linux's IPv4 TCP handshake dating to 4.4, can give a remote attacker root; Anthropic says Claude wrote a working exploit. Debian, Oracle, SUSE and Amazon have fixes; Ubuntu and RHEL are pending.
Binance traces the $6.3 billion Oct. 29 theft to a compromised DevOps engineer's laptop. TRM Labs and Chainalysis blame North Korea's TraderTraitor; about $2.7 billion is frozen and Binance says users are covered.
Lumen ties Volt Typhoon's Silent Train covert network to zero-days in N-able, Cisco SD-WAN, VeloCloud and likely Quest KACE, while Cisco Talos details KeyDrift malware stealing SD-WAN keys.
CVE-2026-97631, a 9.5-rated overflow in EDK II's PXE driver dating to 2010, can let someone on the local network run code before Secure Boot on network-booting machines. Firmware updates are still pending.
iOS and iPadOS 18.7.11 backport Apple's fix for CVE-2026-86950, a CoreGraphics zero-day Apple says may have been exploited against targeted individuals, to the iPhone XS, XR and older iPads.
Cisco says attackers are exploiting CVE-2026-76418, an unauthenticated bug in the ASA and FTD SSL VPN that forces the firewall to reboot when secondary authentication is configured.
CISA added Adobe Commerce's PolyShell and the Brotli Node2Shell bug to its exploited-vulnerabilities list, due Nov. 10, as ELLIO logged the first Node2Shell exploit traffic.
Hunt.io combed about ten attacker open directories full of PHP2Shell tooling and a Mirai-style botnet, and published attempt signatures and indicators defenders can search for today.
CYFIRMA says Korean-speaking operators are quietly scanning 216 unpatched PHP hosts at governments, banks and logistics firms, with a moderate-confidence Lazarus link.
Oracle's out-of-band CVE-2026-91403 fix (CVSS 9.1) stops Java trusting eight eMudhra intermediate certificates with weak keys; a second update, CVE-2026-114820, removes the related roots.
Amazon says a PHP2Shell exploit hit its MadPot honeypots on Oct. 17, four days before PHP disclosed CVE-2026-109618 and CVE-2026-109619. It now calls exploitation broad.
Microsoft ties the ConnectWise Cloud Backup supply-chain attack to China-aligned Storm-0940, which used ARTEX AI agents to try sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 a minute.
GitLab fixed CVE-2026-110264, a CVSS 10.0 flaw in its bundled Ruby regex engine that could let unauthenticated attackers run code on self-managed servers as old as version 7.0. No exploitation seen yet, and no workaround.
Unit 42 says the Qilin and INC ransomware groups are using CVE-2026-0257, a GlobalProtect authentication bypass patched in May, to open VPN sessions without MFA and then move on to vCenter, ESXi and Veeam.
Attackers are chaining four Plex Media Server bugs, now on CISA's exploited list, to drop a cryptominer and a traffic-relay proxy on servers that never got September's fix.
Rapid7 details intrusions where attackers chained CVE-2026-88771 and CVE-2026-88779 to get root on NetScaler ADC and Gateway, then planted HA-aware persistence and stole the appliance's credentials and keys.
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21 to fix two critical bugs nicknamed php2shell, after details leaked early. Updated Oct. 25: Amazon says both bugs are now broadly exploited.
Google and Mandiant say suspected Chinese espionage group ARMORY CASTLE has exploited a BeyondTrust Remote Support zero-day since late August. Once inside, it took root, dumped stored credentials and used the support tool to reach internal machines.