نبض سایبری اخبار امنیت سایبری، با ذکر منبع

آرشیو ۹۰ روزه

همهٔ اخبار

جست‌وجو در عنوان، خلاصه یا نام منبع. هر خبر به صفحهٔ اصلی خودش لینک دارد.

دسته: سیستم‌عامل پاک کردن فیلترها

۹۶۵ خبر

صفحهٔ ۱ از ۳۳
CSO Online

Node2Shell puts Microsoft and Node.js on Brotli patch duty

A vulnerability in Google’s Brotli compression library could allow attackers to execute arbitrary code in applications that use an affected Brotli decoder to process compressed data. Tracked as CVE-2026-111497, the high-severity flaw was first flagged in the Brotli decoder bundled with Node.js. The issue stems from an out-of-bounds write that can corrupt process memory, potentially leading to remote code execution (R…

آسیب‌پذیری و روز صفر بات‌نت و DDoS امنیت ابری
منبع
NCSC Netherlands

NCSC-2026-0455 [1.00] [M/H] Kwetsbaarheden verholpen in Apple MacOS

Apple heeft meerdere kwetsbaarheden verholpen in macOS, met name in de versies Golden Gate 27.2, Sequoia 15.8.2, Tahoe 26.7.2 en Monterey 12.4. De kwetsbaarheden betroffen diverse beveiligingsaspecten binnen macOS, waaronder onvoldoende validatie van symbolische links (symlinks), onjuiste permissiecontroles, onvolledige autorisatiemechanismen, en fouten in geheugenbeheer zoals out-of-bounds reads en writes, use-after…

سیستم‌عامل
منبع
Tenable Blog

Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows.Key TakeawaysCVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Goog…

آسیب‌پذیری و روز صفر نشت داده بات‌نت و DDoS
منبع
Doyensec

ElectroNG is now open source!

ElectroNG is now free and open source! Today we are releasing both the desktop application and its core analysis engine under the Apache License 2.0, opening up years of Doyensec’s work on Electron application security to the community. Why we are open-sourcing ElectroNG We launched ElectroNG in September 2022 as a commercial static application security testing (SAST) tool for Electron applications. It grew out of ou…

آسیب‌پذیری و روز صفر برنامه‌نویسی و زبان‌ها پایگاه داده
منبع
Tenable Blog

Discover and remediate PHP2Shell exposure with Tenable

Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster.Key takeawaysThe PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they’re affected and u…

آسیب‌پذیری و روز صفر امنیت ابری برنامه‌نویسی و زبان‌ها
منبع
The Hacker News

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but

آسیب‌پذیری و روز صفر سیستم‌عامل
منبع
Rapid7 Blog

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

OverviewOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2.An attacker who can supply Brotli data that an application d…

آسیب‌پذیری و روز صفر برنامه‌نویسی و زبان‌ها سیستم‌عامل
منبع
EFF

Lessons Learned From 'AdFection' and What To Do Next

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly concerning, especially since it’s built on the backbone of a technology we already object to: behavioral advertising. Alt…

بدافزار و آلودگی برنامه‌نویسی و زبان‌ها توسعه موبایل
منبع