Russian Hackers Deploy Exploit Chains Against Mobile Devices Through Compromised Websites
PremiumRussia-linked group used watering-hole exploit chains to infect iOS and Android devices, targeting Ukraine and Western entities.
Friday, November 6
DreamHost Data Breach Compromises FTP and Webmail Security
PremiumDreamHost confirms months-long breach exposing customer FTP/SFTP credentials and webmail sessions, requiring customer mitigation steps.
Critical Flaw in OpenSSH Allows Authentication Bypass on Some Linux Servers
PremiumCritical OpenSSH flaw allowed oversized-password authentication bypass on some Linux builds; emergency fixes released for affected distros.
Cyberattacks Targeting Industrial Refrigeration Systems Raise Global Concerns
PremiumMass attacks manipulated industrial refrigeration and blood-storage systems across Europe, prompting FBI/CISA warnings to harden cooling systems.
Zyxel GS1900 Switches Vulnerable to New Exploit Despite Previous Patch
PremiumActive zero-day in Zyxel GS1900 switches allowed remote command execution; vendor released revised firmware to correct earlier patch.
Wednesday, November 4
Russian Cyber Spies Target Ukraine's Critical Infrastructure and Investigations
Russia-linked spybots exfiltrate documents and credentials from Ukrainian organizations supporting war crimes investigations and logistics.
Gorbag Hackers Exploit WinRAR Vulnerability to Target Ukrainian Entities
Gorbag group exploits WinRAR flaw to deploy information-stealer malware against Ukrainian law enforcement and defense targets.
Urgent Update Advised for Synology NAS Devices Amid Ransomware Exploits
Threat actors exploit an older, patched Synology DSM vulnerability to deploy ransomware and encrypt NAS data.
UK Warned of Imminent Surge in Cyberattacks Due to Exploited Vulnerabilities
NCSC chief warns increasing exploitability of tolerated vulnerabilities will raise UK cyberattack volume in coming months.
Langflow Vulnerabilities Demand Urgent Updates to Prevent Unauthorized Code Execution
Two critical Langflow vulnerabilities allow unauthenticated code execution; update to 1.13.0 required to remediate.
Hackers Exploit Microsoft Teams and AD CS Vulnerabilities to Breach Corporate Data
Threat actors used Teams social engineering and insecure AD CS to obtain privileged login certificates and compromise domain controllers.
Critical Security Flaw in LXD and Incus Allows Unauthorized Control Over Linux Systems
Critical certificate validation bug in LXD/Incus lets attackers bypass login checks and take control of clusters and VMs.
Frontline Education Data Breach Exposes Sensitive Information of Millions
Hackers exploited a third-party flaw to steal personal data of more than 1.3 million school staff and students.
Polymarket to Reimburse $3.9 Million After Cybersecurity Breach
Polymarket commits $3.9M restitution to users after compromise, detailing remediation and reimbursements.
UK School Ransomware Attack Shows Hybrid AI Tactics
3AM ransomware affiliate used model-generated command loops during breach, suggesting semi-automated playbooks in school attack.
Massive Data Breach at Harvard: 851,000 Accounts Compromised
Breach of Harvard Alumni Affairs exposed data tied to 851,000 accounts, including personal information.
Chainstack Cyber Attack Exposes Customer Data Amid Rising AI Threats
Chainstack discloses breach of production systems, exposing customer data and password hashes tied to AI-powered campaign.
BlackX UEFI Bootkit Exploits Secure Boot Flaw on Patched Windows Systems
BlackX UEFI bootkit infected patched Windows machines, exploiting Secure Boot ambiguities to persist at firmware level.
Outdated BTCPay Server Vulnerability Exploited to Drain Cryptocurrency Wallets
Outdated BTCPay Server instances were exploited to drain hot wallets, with attackers stealing Bitcoin and Litecoin.
UK Warns of AI-Driven Cyber Threats to Critical Infrastructure by 2028
NCSC warns AI-powered malware will likely target UK critical infrastructure by 2028, urging resilience investments.
Get these articles delivered to your inbox.
Subscribe free