Vulnerability | Breaking Cybersecurity News | The Hacker News

Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432 , can be reached by a remote, unauthenticated attacker and can lead to remote code execution,  Red Hat  and  Canonical  said. The Linux kernel's own CVE team rates the flaw 9.8 out of 10 on the CVSS scale. Red Hat, which initially rated it Moderate at 5.9, has raised its score to 9.8 and now calls it Critical. The bug has been present since Linux 4.4, and the upstream fix landed in October. What the Flaw Is When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor still rea...

Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner ® ’s report on exposure prioritization states that fewer than 10% of vulnerabilities are exploited, yet most are treated as urgent. The report also argues that CVSS scores alone do not predict actual exploitation or business impact. Gartner predicts that by 2028, organizations that prioritize exposures using threat intelligence , asset context , exploitability modeling , and security control validation will reduce breach likelihood by at least 70% compared to their peers relying primarily on CVSS-based vulnerability prioritization. Let’s break down how each element works, and how the Picus Platform puts all four into practice. Severity-based prioritization made sense. Then it didn't. Severity-driven prioritization was an entirely r...

A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher Damien Schaeffer said in a report shared with The Hacker News. The activity shares overlaps with a cluster tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) under the moniker UAC-0226 and by Trend Micro as SHADOW-EARTH-066 . Gorbag is known to be active since at least February 2025. A key tool in the threat actor's malware arsenal is GIFTEDCROOK, a C/C++ stealer that facilitates the theft of sensitive data from web browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox, such as cookies, browsing history, and authentication data. Earlier this Ju...

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. "Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," BTCPay Server said . "The attackers used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026." Users who are running versions 2.4.1 or earlier are recommended to move to a fresh server with a new wallet, even in scenarios where users have not noticed a theft. In the event of stolen funds or suspected unauthorized access, it's imperative that users consider the entire machine and all secrets stored on it as compromised and follow the same recovery procedures. It's currently unknown when the attackers behind the campaign first began exploi...

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement released last week. While Synology did not disclose the exact security flaw that's being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities - CVE-2024-10441 (CVSS score: 9.8) - An improper encoding or escaping of output vulnerability in the system plugin daemon of DSM that could lead to remote code execution via unspecified vectors. CVE-2024-50629 (CVSS score: 5.3) - An improper encoding or escaping of output vulnerability in the webapi component of DSM that could allow remote attackers to read limite...