hype
3
Substance
7
Brief · Security
Hackers exploit a Collabora flaw in Nextcloud to plant backdoors
Attackers are exploiting CVE-2026-110447, a critical command execution flaw in the Collabora Online CODE app for Nextcloud, to backdoor servers.
Topics
#cybersecurity
60 items · Page 3 of 5
hype
3
Substance
6
Brief · Security
Targeted ads were used to deliver 0-click exploits for mercenary spyware
Ars Technica reports that targeted ads delivered 0-click exploits that installed mercenary malware. It calls this the first confirmed case of such spyware delivered through ads.
Analysis · Security
Container Registry Tokens and Digest Pinning: How to Verify Image Provenance Beyond the Tag
A tag is a label anyone with push rights can rewrite. Here is how to pin by digest, verify signatures, and audit registry tokens after the Docker Hub flaw CVE-2026-105445.
Analysis · Security
Patch Tuesday Triage: How to Rank Hundreds of CVEs With KEV, EPSS and Exposure
A repeatable method for ranking Patch Tuesday CVEs by known exploitation, exploit likelihood and asset exposure, worked through October 2026's record batch.
hype
2
Substance
7
Brief · Tech
Fridge hack hits 700 supermarkets, causing fires and multimillion-dollar losses
An attack on refrigeration controllers at about 700 supermarkets cost millions and started fires. Ars Technica says outdated devices exposed to the internet were exploited.
hype
3
Substance
7
Brief · Security
Palo Alto Networks patches PAN-OS RCE zero-day exploited in attacks
Palo Alto Networks released fixes for CVE-2026-0322, a high-severity PAN-OS remote code execution flaw. BleepingComputer reports it is being exploited against firewalls.
hype
2
Substance
5
Brief · Security
FBI and DOJ disrupt North Korean IT worker laptop farms in Texas
The US Justice Department arrested two suspects, charged 14 people and seized nearly 187 laptops tied to North Korean remote IT worker schemes. The Famous Chollima group is named.
Analysis · Security
Processing Untrusted PDFs Safely: Sandboxing Ghostscript and Document Converters
Ghostscript’s CVE-2026-39919 is the trigger. The lasting question: what SAFER, permit lists, containers, resource limits and patching each stop in a PDF converter, and what they miss.
hype
3
Substance
6
Brief · Security
Cisco patches a second actively exploited Secure Email Gateway zero-day
Cisco has patched another zero-day in its Secure Email Gateway that is being exploited. It allows unauthenticated remote command execution as root.
hype
4
Substance
6
Brief · Security
Microsoft's October Patch Tuesday fixes more than 1,400 flaws
Microsoft issued fixes for more than 1,400 security vulnerabilities across Windows and other software. Krebs says the batch dwarfs September's record of nearly 1,000.
hype
5
Substance
6
Brief · Security
CISA urges immediate patch for Ivanti Connect Secure zero-day
CISA urged administrators to patch an Ivanti Connect Secure flaw exploited as a zero-day since at least October 1. The item does not give the flaw identifier.
hype
4
Substance
5
Brief · Security
Global takedown disrupts network behind 1 billion phishing messages
Law enforcement agencies and partners disrupted a cybercriminal network linked to more than a billion malicious messages. The network targeted over 75,000 organizations in 150 countries.