The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Suppose an AI agent is asked to sort support tickets and look up account details. A ticket contains instructions that lead the agent to export records to an unfamiliar destination. The agent can make the request because its identity has access to the records and its connected tools allow the action. That kind of scenario raises a response question: what does “stop the agent” actually mean? A team may be able to pause the model while a workflow, credential or existing connection remains active. Those pieces can require separate controls. An October 2026 roundup from the OWASP GenAI Security Project describes evaluation agents reaching beyond their intended scope and recommends testing whether containment can revoke both credentials and network access. The roundup is a selected collection, not an exhaustive survey of incidents. Turning off the model may not stop the work An AI agent is usually part of a larger system. A model may choose an action, but an orchestrator runs the w...

A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan. Enea , a telecom and cybersecurity software company based in Stockholm, found the group's attack sources in at least six Asian countries and named it SilentAir this week. It assessed with high confidence that SilentAir is a state-level actor, but linked its activity to China only with low confidence. The company has told the operators where it found SilentAir sources. It said SilentAir has been disrupted for now but could return. The report does not say whether those operators have cleaned up the hacked equipment. Mobile operators use the SS7 and Diameter protocols to exchange signaling messages that route calls and texts and enable roaming. This traffic crosses a shared network called the IPX , which runs on a high level of trust between operators. SilentAir sent its attacks into the IPX from the hacked equipment. For i...

An international police operation took down servers behind Gootloader , CastleRAT and StealC this week. Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks. Police also seized about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's Federal Criminal Police Office (BKA). Gootloader is a loader: once on a computer, it could download other malware, especially ransomware. It spread through fake legal documents placed on hacked websites, often WordPress sites. Criminals used SEO poisoning to push those sites high in search results. Gootloader has infected at least 25,000 computers worldwide since 2018, the U.S. Justice Department said. Its operators used those computers to infect more computers, then sold access to the new ones to ransomware criminals. In the U.S., Gootloader was used in ransomware attacks against at least 44 victims, resulting in about $28.8 million in losses. G...

An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS  to deploy a backdoor called TSGA . The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave on November 2, 2026, that targeted organizations across multiple countries and sectors. Some of the organizations singled out in the first wave have also been at the receiving end of destructive actions that include the deployment of wiper malware. "PHP2Shell provided initial access, followed by privilege escalation through the DynamicCLI interface, tracked as CVE-2026-123039 ," Check Point said. "The attackers then deployed PHP web shells, the persistent TSGA backdoor, and its embedded TSProxy networking component." "The attackers pivoted from the gateway to a VMw...

N-able on Thursday said it's taking additional precautions in the wake of public disclosure of a new set of flaws tracked as 4EverAble2Shell and Agent2Shell . "We are restricting certain N-central features and integrations," the company said in a Thursday update. "These measures may affect some functionality, but we believe taking additional precautions while remediation is completed is the right action to protect our partners and their customers." The following actions have been applied to Hosted environments - Legacy API is turned off by default in the product. Intune integration has been turned off while additional protections are implemented and validated. Hosted customers are also being recommended to follow N-able's previous guidance to upgrade Agents and Probes on N-central version 2026.4 HF1 and above, as the update introduces changes in how the Probe and Agent communicate. "N-able N-central 2026.4 HF1 updates legacy componen...

Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer: Who or what is behind this activity, and what can they access? A suspicious login might belong to an employee. An unusual API call could come from a machine account. Or an AI agent might be accessing sensitive systems using permissions nobody has reviewed recently. Your SIEM or EDR may catch the activity. But without knowing who owns that identity, what permissions it has, and which systems it can reach, your SOC is missing a critical part of the story. And that missing context can turn a manageable incident into a much bigger problem. Join this expert-led webinar to learn how real-time identity context can help your SOC investigate threats faster, understand what's at risk, and respond with confidence. The Blind Spot Between Identity and Security Operations Here's the problem. Identity and access management (...

A search result isn't always safe. An access request isn't always harmless. And a familiar account doesn't always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week's trouble starts right there. Attackers are using fake websites, stolen access, and trusted tools to get into places they shouldn't be. AI is helping them build attacks faster, while also giving them new systems to target. Some intruders are staying hidden even after security holes are fixed. Others are moving stolen money through a maze of transactions. And researchers keep finding small coding mistakes that can cause much bigger problems. Different stories, but much of the trouble comes down to making something dangerous look normal. There is some good news, too. Criminal servers have been seized, and a few defenses are getting stronger. Still, plenty of things are going wrong in ways that shouldn't be this easy. Here's what turned up this w...

Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver. The proof of concept, called SignDrop , targets a log-authentication feature added to the driver last year. It abuses how clfs.sys creates companion files when a privileged process opens a prepared log, using path redirection to take control of the operation. Microsoft has not confirmed the claimed flaw, assigned a CVE, or released a fix. The researcher behind the exploit, who publishes under the name MSNightmare , released the code and a detailed writeup on GitHub on Tuesday, the same day the company published its November security updates. CLFS is a logging subsystem built into Windows. Its driver has been a frequent target for privilege escalation: 10 CLFS flaws appear in CISA's catalog of vulnerabilities known to have been exploited in attacks, including one used in ransomware campaigns in April 2025. To reduce that expo...

A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository. Quay enables anonymous access by default, and while it is enabled, the attacker needs no account. When it is off, anyone with a valid account can still exploit the flaw, Red Hat said yesterday. The company has released fixed builds for eight Quay 3 branches. The flaw is tracked as CVE-2026-123710 (CVSS score: 9.8). Quay uses keys it trusts to sign the access tokens that allow image pushes and pulls. The flaw lets an attacker add their own key to the keys Quay trusts, with no expiry date. Quay then accepts tokens signed with that key for any repository. With those tokens, an attacker can retrieve private images and any secrets or credentials stored within them. The attacker can also push or overwrite images, and the change propagates to every system that later pulls those images. The planted key survives restarts until someone ...

Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass. The critical vulnerabilities that impact NetScaler ADC and NetScaler Gateway are listed below - CVE-2026-120868 (CVSS score: 9.3) - A memory overflow vulnerability in Packet Processing can lead to unpredictable or erroneous behavior or DoS. (All NetScaler ADC and NetScaler Gateway deployments) CVE-2026-107407 (CVSS score: 9.3) - A memory overflow vulnerability in SMPP traffic can lead to unpredictable or erroneous behavior or DoS. (NetScaler ADC configured with a Load Balancing or Content Switching virtual server of type SMPP) CVE-2026-107408 (CVSS score: 9.3) - A memory corruption vulnerability in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or DoS. (NetScaler ADC configured for DNS load balancing and recursive DNS resolution) C...

Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix -style lures, browser-hijacking malware, and a set of extensions that hijack user searches. This delivery pattern has been codenamed TypoPrompting by Island. "AI-app lookalikes that turn an attempt to reach a familiar tool into a prompt to verify, install or run something else," the cybersecurity company said in a report shared with The Hacker News. In all, the campaign spans 186 bogus domains spanning 27 AI brands, including Anthropic Claude, OpenAI ChatGPT, Google Gemini and Gemini Notebook (formerly NotebookLM), Microsoft Copilot, SpaceXAI Grok, DeepSeek, Mistral, Perplexity, Midjourney, ElevenLabs, Lovable, and Cursor. While one category leads to a ClickFix lure that serves a PowerShell command via a fake Cloudflare verification page, the second route takes unsuspecting users to "Security Check" pages that del...

The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an improper privilege management and missing authorization vulnerability that could allow an attacker to file transfer and execute through an active remote session without authorization or host confirmation. The cybersecurity company confirmed that testing against a fully patched ScreenConnect client successfully prevents execution of the exploit's payload. "Our testing confirmed that the exploit targets CVE-2026-84869 and that the existing patch successfully blocks it," APG researchers Sam Decker and Nevan Beal said. "That's an important finding for security teams....

Google Cloud VMs on AMD Turin chips need a guest OS patch and a stop-and-start to protect against three CPU side-channel flaws, Google said this week. The company has already applied mitigations against attacks between VMs, and between VMs and the host. Inside a VM, the flaws may let an attacker with code on the same processor core infer data from other processes or the kernel. The affected machine series are C4D, N4D, H4D, Z4D,, and G4, including bare-metal instances of C4D and Z4D. Turin is the code name for fifth-generation AMD EPYC processors. All three flaws are Transient Scheduler Attacks (TSA). Two of them, TSA-SQ (CVE-2024-36350) and TSA-L1 (CVE-2024-36357), were first disclosed on July 8, 2025, for earlier EPYC processors. AMD now says its Zen 5 processors, which include Turin, are "impacted differently from previously characterized AMD processors." The third flaw, CVE-2026-0004, is new. It may let an attacker who can run code on a system infer data in the p...

N-able on Thursday said it's investigating a new public disclosure containing claims of additional vulnerabilities in on-premise versions of N-central running version 2026.4.1 HF2. "Based on our initial review, the server issue described depends on a non-default configuration in which the Legacy API is turned on and exposed to the public internet," N-able said in a new advisory. "Legacy API is turned off by default in the product and is not recommended." The company is urging customers to disable Legacy API immediately, if not already. It also noted that hosted environments are not affected by this issue. The incident impacts the following services - N-central On-premise (Americas) N-central On-premise (APAC) N-central On-premise (Europe) The development comes days after N-able released 2026.4.1.26 to address a number of security flaws disclosed by independent security researcher Sean Bales earlier this week. The vulnerabilities are collec...

Since mid-August 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose. The Threat Research team at Material Security spotted the campaign and has since taken down hundreds of attacker domains in an effort the team calls Operation CloudFire. Here’s what the researchers found. The lure: Google Calendar invites The messages show up as Google Calendar invites. Some arrive by BCC, and many come from an organization the recipient has already traded email with. The pretexts are deliberately boring: voicemail notifications, RFP and RFI requests, court summonses, and missed payment notices. Nothing about them stands out in a busy inbox. Most of the links point to Google itself. The usual pattern runs through Google’s own /url redirector, with the real destination tucked into a query parameter. Other waves used share.google and Driv...

PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as CVE-2026-126325 , carries a CVSS v4 score of 9.2 out of a maximum of 10.0. It has been described as a case of improper input validation and deserialization of untrusted data that could result in remote code execution via crafted requests. "A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM," according to a description of the flaw on CVE.org. "The vulnerability may be exploited through the deserialization of untrusted data." The CVE record lists the following versions as affected - PTC Windchill: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0, 13.1.4.0 PTC FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, ...

A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB, the company that makes the database, released fixed versions earlier this week. The affected servers are members of a replica set, a group of MongoDB servers that keep copies of the same data. One member, the primary, serves as the main server and handles all new writes, while the others replicate them. If the primary becomes unavailable, the other members hold an election to pick a new primary. Researchers at Datadog Security Labs reproduced the crash in a lab and published their findings yesterday. On vulnerable versions, turning on authentication does not stop the two requests. An attacker cannot make the targeted member fall behind or win an election, or see when either happens, the researchers said. The fl...

A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections. Fixed versions were released for all three supported lines: 22.23.5, 24.22.3, and 26.13.1. The crash flaw, CVE-2026-123863 , needs only a default HTTP/2 server that replies before the request body has fully arrived. The Node.js project calls that behavior typical. The crash works over both TLS and cleartext connections. The memory flaw, CVE-2026-123866, affects all three lines. From 24.22.0 and 26.9.0 onward, a client alone can trigger it. On 22.x and older 24.x and 26.x builds, it can still be triggered when the server itself closes a stream partway through a response, for example after an idle timeout. A separate flaw in Node.js HTTPS servers, CVE-2026-123864, can allow an unauthenti...

Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected those credentials, the company says. Each attack started with a pull request titled docs: dependency audit notes, opened from a branch named wfx-docs to test whether the account could write to the repository. These test pull requests were opened in 61,764 repositories, and the stealer followed in some of them. In a separate analysis , researchers at SafeDep, which sells software supply chain security tools, counted 8,093 repositories that received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC today. That count covers every repository that received malicious commits, no...

A critical flaw in Apache HTTP Server's HTTP/2 module, mod_http2 , can let a remote attacker run code on the server. Tracked as CVE-2026-119618 , it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux. An attacker who can reach the server needs no authentication to exploit the flaw and could take full control of the server process, the Linux vendor says. It rates the flaw 9.8 out of 10 on the CVSS scale. The vendor's assessment, published yesterday, also says "public research has demonstrated a reliable exploit" against a server in its default configuration with mod_http2 enabled. It does not name or link that research. Security company Wiz said later that day that no exploit was available and that no exploitation in the wild had been reported. HTTP/2 runs only where the Protocols directive turn...

ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access . In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments," it said . "We are continuing to validate this assessment. The initial access method and full scope remain under investigation." ConnectWise has identified about 400 partner environments with at least one of the third-party extensions installed. It also emphasized that the presence of the extensions alone does not indicate or establish compromise. While these extensions provide an API capable of executing remote commands, access to that API is secured by a passphrase c...

Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below - CVE-2026-108186 (CVSS score: 9.6) - An improper input validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via network access. CVE-2026-108187 (CVSS score: 8.1) - An origin validation vulnerability that could allow an unauthenticated user to conduct an escalation of privilege via network access. Successful exploitation of either of the shortcomings could permit remote attackers to escalate privileges without requiring any special permissions or access. While CVE-2026-108187 affects Zoom Workplace for Windows before version 7.1.5, CVE-2026-108186 impacts versions starting from 7.1.0 and before 7.1.8. Earlier this July, the popular videoconferencing platform shipped fixes for another improper ...

Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments. "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments," Arctic Wolf Labs said in a report shared with The Hacker News. The activity has been observed chaining together web exploitation and web shell deployment to facilitate configuration discovery, credential validation, cloud-service enumeration, secret access, and storage operations. AntiFox, available for download from GitHub, has been described as an artificial intelligence (AI)-driven autonomous penetration testing platform that's built atop the "solid foundation" of ARTEX . As of writing, the project...

Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet's CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes. The activity has been found to share some level of overlap with a November 2023 campaign documented by Arctic Wolf in which threat actors linked to the CACTUS ransomware operation likely weaponized then-newly-disclosed flaws in Qlik Sense to obtain initial access to target environments. The vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows -

Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or personal data. The staff apps included a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and an X advertising proposal to a U.S. federal agency marked confidential. SpaceXSI, formerly known as xAI, has since taken down all 24 staff apps but not other users' apps, the researchers said. Besides those staff apps, the open apps contained internal data from 30 other organizations the researchers could identify, across fields ranging from construction and energy to healthcare and defense. Of those, 26 have more than 1,000 employees, and 6 are Fortune 500 co...

We tell customers three things about securing AI agents: they need their own identities, access that fits the job they’re given, and traceability that’s separate from any human’s. That was true for us at Token as well. Then, we built an agent that broke all three by default. This helped us think through how such agents should be defended. When a browser agent acts inside a user’s authenticated session, the application may see the user but not the agent, the delegation, or the task’s intended scope. By creating an agent that breaks all the security rules, Token learned how companies should be using identity to gain control, especially as agent use scales. Standards are coming, but there are steps security teams can take today. The agent we would have flagged The agent we created is named Rehearsal . Its job is to answer questions inside the Token platform by doing rather than telling. It autonomously opens pages in the browser tab, sets filters, and fills in forms. From a secur...

The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script cut each of their keys to one byte, the company said this week. The script also retrieved the RSA keys of the 8 newly revoked CAs from the company's hardware security modules (HSMs). The company says it cannot show that the keys were handled as required by its own rules. It revoked the CAs late last week. The company had called those CAs unaffected. "The RSA issuers went through a different path as per our assessment of the code and are therefore not impacted," it wrote on Mozilla's bug tracker on October 19. Of the 8, 6 were for website (TLS) certificates and 2 for...

Microsoft on Tuesday released patches for a total of 1,259 vulnerabilities spanning its software portfolio, the second consecutive month where the patch volume has exceeded 1,000 flaws. These cover 726 flaws in Windows, 174 in Office, 61 in Developer Tools, 59 in SQL Server, 53 in Developer Tools, and 27 in SharePoint Server. The patches also include 165 non-Microsoft-issued CVE identifiers. More than 500 flaws relate to elevation of privilege, followed by remote code execution and information disclosure bugs. With the latest round of fixes, Microsoft has addressed over 5,100 CVEs this year alone, according to Satnam Narang, senior staff research engineer at Tenable. Of these, a Moderate-severity security flaw in Microsoft Outlook ( CVE-2026-124194 , CVSS score: 6.5) has been flagged as actively exploited by Microsoft.  "Product UI does not warn users of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network," ...

AI provider keys that customers stored on Railway were stolen in an October breach and used to commit an estimated $740,000 in unauthorized spending, the platform-as-a-service provider said yesterday. It has promised to pay those charges itself when an AI provider will not refund them. The company builds and runs apps for its customers and stores their secrets, such as API keys and database credentials, as environment variables. The attacker decrypted variables in at most 1.85% of workspaces, about 100,000, and its database queries looked for AI provider keys. In an October 26 update, the company told customers asking about refunds for unauthorized AI spend that "Railway is unable to refund customers for spend performed with compromised API keys." It encouraged them to contact the AI providers directly and offered to escalate their requests. According to the company's incident report , the decrypted data also included linked-account tokens for 1,852 users: BYOK age...

An AI model can be given a hidden backdoor by editing fewer than 10 of its rarely used neurons, without retraining the model, Microsoft researchers have shown. When a chosen trigger appears, the model outputs an attacker's command, which an agent using that model would run with the agent's own permissions. The attacker must be able to change the model's weights. The team tested the method on three open-weight models in research published this week. Microsoft says it has not seen any threat actors use the technique. The company also published guidance on defending against it. The edited neurons are ones that rarely fire and barely affect the model's answers. They were set to fire only when a trigger string appears, either in a user's request or later in a tool's output. The researchers call the method Lazarus . Each edited neuron forces one token of the command into the model's output, so a command needs about one neuron per token. The new neuron s...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. Details of the vulnerabilities are below - CVE-2026-20320 (CVSS score: 7.5) - An improper restriction of XML external entity reference vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system with the privileges of the Cisco BroadWorks user. (Fixed in August 2026) CVE-2026-111793 (CVSS score: 4.3) - An incorrect resource transfer between spheres vulnerability in Openwave Messaging Webtop Media Transcoder that could allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. (Fixed in October 2026) The addition of C...

A flaw in Git can let a malicious repository run an attacker's code on a computer that clones it recursively, together with its submodules. The Git project fixed it this week in Git 2.56.1, with matching fixes for the 2.50 through 2.55 series in 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1 and 2.55.1. The flaw, tracked as CVE-2026-111760 , is an integer truncation in how Git handles its index. An extremely long path in a repository can pass Git's safety check, but Git then writes it to disk under a shorter name that an attacker can set to .git. This lets an attacker replace a submodule's .git file with a symbolic link to a folder holding malicious hooks or configuration. Hooks are programs Git runs at set points, so once Git uses that folder, the attacker's code can run. Submodules matter here because Git refuses to replace a .git folder with a symbolic link, but in a freshly cloned submodule, .git is a file. The fixed versions, listed in the Git pr...

An attacker exploited a remote code execution flaw in SGLang , an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday. The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE) designed to keep them private even from the company itself. But the TEE "does not protect against a vulnerability in the software running inside the environment," the company said. SGLang runs inside the TEE, which is how the attacker could reach requests there. That access has since been closed, but not before the attacker moved further into the company's systems. The attacker reached an internal system behind Private Chat, a product the company had already deprecated. So far, the company has confirmed that the attacker downloaded account details for about 100 users...

French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062 . "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the XO token provider without requiring a string." "The token collection treats {} as an unfiltered lookup and returns its first token; the provider authenticates as that token's owner if it is unexpired. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs." In other words, the vulnerability can allow an attacker to bypass authentication by sending a specially crafted cookie and perform arbitrary actions with "Admin" privileges, ultimately resulting in arbitrary code execution on managed pools and ...

Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery , OceanGate , and DarkWire . Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow. The entity behind the Sparrow framework has been codenamed CopperDragon , and is assessed to be a digital quartermaster developing tools for China-nexus threat actors, including FamousSparrow , Earth Estries , Tropic Trooper , UAT-9244 , and UAT-8302 . "Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing inf...