Web Security | Breaking Cybersecurity News | The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a medium-severity security flaw impacting multiple Apple operating systems to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation. The vulnerability in question is CVE-2024-27834 (CVSS score: 5.5), a case of improper authentication that could allow an attacker with arbitrary read and write capability to bypass Pointer Authentication. It was addressed by Apple in May 2024 with improved checks in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5, and Safari 17.5. The vulnerability was demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest held in March that year. The addition of CVE-2024-27834 to the KEV catalog follows a report from Sekoia that threat actors possibly linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver malware capable of harves...

The Russia-linked threat actor known as APT29 is presumed to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and Félix Aime said in a technical report shared with The Hacker News. "Then, the delivery infrastructure delivers a platform-specific N-day exploit chain targeting either iOS or Android." The end goal of the attacks is to serve payloads capable of stealing browser cookies, and in some cases, Wi-Fi passwords or full mobile device data. The activity, codenamed Poisoned Source , was discovered by the French cybersecurity company in mid-October 2026. A defining aspect of the campaign is the use of three infection vectors - Compromise of legitimate websites to inject mal...

A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick . The Rails project disclosed the flaw in  an advisory  and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store uploaded files using Active Storage's Disk service, which stores them on the server's disk. In those apps, an attacker could also read any file the app can read. Those files typically include the app's secret_key_base and its credentials for other systems, according to Rails. Reading them may in turn allow remote code execution or lateral movement into those systems. Rails rates the flaw 9.8 out of 10 on the CVSS scale. It is tracked as GHSA-f3w6-w445-fwh9 and does not yet have a CVE identifier. ImageMagick selects a format handler, which it calls a coder, based on the file's c...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code execution on affected servers. Patches for the flaw were released late last month. "WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window," CISA said. "This is due to predictable, web-accessible staging paths used during full-package core upgrades." Details of the flaw emerged last week when Wordfence said exploiting the vulnerability does not require an account on the site. That said, it does require an attacker to exploit a brief w...

Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3) and CVE-2026-111560 (CVSS score: 8.6), respectively. While CVE-2026-116606 only affects Email Security Gateway, CVE-2026-111560 impacts the following Barracuda products - Email Security Gateway Load Balancer Application Delivery Controller Message Archiver WAF Control Center Web Application Firewall Web Security Gateway "Successful exploitation requires an attacker to have access to the administrative interface of an affected product," Barracuda said . "If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization co...

An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory . In a later disclosure , OPSSHIELD said about 2,950 customer servers ran the script, which sent the files it collected back to the attacker. OPSSHIELD first named cPGuard 5.88.25 as the fix. Its later disclosure says version 5.88.26 removes the backdoor, and a follow-up update removes a scheduled task the script also left. Admins should install the latest version and then check that those files are gone. Credentials the script copied may still work after the update, so any server that may have run the script also needs new passwords and keys. At 02:06 UTC, the attacker, who has not been identified, used compromised credentials to get into cPGuard's update system. ...

Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract sensitive data, including stored wallet credentials. "The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext," according to a description of the flaw on the NIST National Vulnerability Database (NVD). The vulnerability affects versions 1.2.1 through 1.2.2, which is the latest version. There are n...

Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says  it is refunding about $2.7 million to 726 affected wallets.  Blockchain records  show crypto worth about $2.64 million reached the hackers' wallet in under an hour. The replaced script came from DebugBear, whose real user monitoring (RUM) tool measures how fast web pages load for real visitors. Researchers at Hudson Rock  downloaded the malicious file on October 29 from the address Polymarket's site used to load the DebugBear script. They also found a change in Polymarket's site code that removed the DebugBear script. DebugBear's DNS records were compromised through its domain registrar, the company said on X. Its early findings indicate the attack targeted one customer's website. It has seen no sign...

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through  OpenAI's bug bounty program  on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category. The trap was an ordinary ChatGPT conversation shared via its public link. It could be sent the same way as any real shared chat: by email, as a chat message, as a support ticket, or as a social post. The victim did not have to install anything, join a workspace, or sign in through the attacker. In the most reliable version of the attack, they opened the link and clicked ChatGPT's Preview button once. In a later version, Parameter set the page to open Preview on its own, so opening the link was the only step. What the Attacker Could Do Once the link opened, the attacker's code ran ins...

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability , which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October 28, 2026. "This is due to predictable, web-accessible staging paths used during full-package core upgrades," Wordfence said . "This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window." The WordPress security company noted that successful exploitation requires an "attacker to hit a very narrow window while WordPress is unpacking a complete Core update." The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under "wp-c...

Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," Drupal said in an advisory. "The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." The open-source content-management framework acknowledged that the vulnerability is being "actively exploited in the wild," but provided no specifics about the nature of the activity or the extent of the campaign. Users are being recommended to update to the latest version - Version 3.x - Upgrade to Commerc...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities ( KEV ), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation. CVE-2026-76418 (CVSS score: 8.6) - An unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. The devel...

An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab  released a fix , Alpine Linux  said  on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine found no evidence that the attack worked but cannot rule it out, so it rebuilt the server from scratch and reset every account's password. GitLab's fix  is a set of patches to the Ruby that GitLab ships in its own packages and container images. Alpine's GitLab image used standard Ruby, so upgrading the server to GitLab 19.3.6 on 22 October did not fix the flaw. For anyone running GitLab on their own Ruby, built from source or in their own container image, "upgrading GitLab is not enough," Alpine said. Those servers also need  Ruby 3.3.13, 3.4.12, 4.0.9 or later , and users of Alpine's alpinelinux/gitlab image...

Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the network security company said in an update to its advisory. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP. The issues were patched upstream by the PHP Foundation on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The development comes days after Israeli cybersecurity company Dream said it observed a suspected China-nexus threat actor weaponizing the flaws in conjunction with a local privilege escalation bug in the Linux kernel, tracked as Fragnesia (CVE-2026-46300, CVSS score: 7.8), to root 25 servers across t...

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the  Pwn2Own Berlin contest  in May. Microsoft fixed the Edge bugs the day after the contest, so an up-to-date browser is not at risk. A browser sandbox is the wall that keeps a web page's code inside the browser and off the rest of the computer. Breaking out of it, and then running a program, is what turns a web bug into full control of the machine. Browser escapes like this almost always rely on memory corruption. This one used none. In his  write-up , Tsai describes a chain built solely from logic errors in how Edge and Windows handle ordinary features, and he says the whole exploit is under 100 lines of code. The result is a universal cross-site scripting (UXSS) primit...

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root 25 servers, including three systems in a U.S. government-affiliated environment. "The affected devices run specific versions of a large vendor's firewall software," cybersecurity firm Dream said . "The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration." The name of the affected vendor was not disclosed, but the Israeli company said it notified the entity. The attack chain essentially brings together two sets of vulnerabilities impacting PHP and the Linux kernel - PHP2Shell , ...

Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update . Security researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai have been credited with discovering and reporting the flaw to Oracle on July 24, 2026. "Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, October 27," Defused Cyber said in an X post. In an advisory for the vulnerability, Horizon3.ai described it as an unauthenticated SQL injection vulnerability that could be chaine...

Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution. CVE-2026-104353 (CVSS score: 9.9) - An operating system code injection vulnerability that could lead to arbitrary code execution. CVE-2026-105780 (CVSS score: 9.9) - An incorrect authorization vulnerability that could lead to arbitrary code execution. CVE-2026-105489 (CVSS score: 9.9) - An SQL injection vulnerability that could lead to security feature bypass. CVE-2026-105781 (CVSS score: 9.8) - An SQL injection vulnerability that could lead to security feature bypass. CVE-2026-104350 (CVSS score: 9.3) - A reflected cross-site scripting vulnerability that could lead to privilege escalation....

An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks. Anthropic's Frontier Red Team described five chains in a research post. The strongest claim is not any single bug, but that one model found several separate flaws and combined them into a working exploit, something the company says has until now been the work of a few specialist teams. That capability claim rests on Anthropic's own account. The patches and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes can be verified with...

The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine . The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually explicit images of minors, the intentional disclosure of nonconsensual intimate visual depictions of adults and minors, and international money laundering designed to conceal and promote criminal conduct," the DoJ said . Visitors to the "virtualine[.]net" domain are now greeted by a message that states it has been seized by the U.S. Federal Bureau of Investigation as part of a coordinated operation between international law enforcement agencies and private sector entities, including the Hessen State Police, the National Police Corps of the Netherlands, the U.K. National Crime Agency, OverRIPE, and Lumen Technologies. According to court documents, Virtualine, which a...