CyberPulse Cybersecurity News, with Source Links
FA

90-day archive

All news

Search by headline, summary or source name. Every item links to its own original page.

11723 news

Page 29 of 391
The Hacker News

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but

Vulnerabilities & Zero-Day Operating Systems
منبع
Rapid7 Blog

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

OverviewOn October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2.An attacker who can supply Brotli data that an application d…

Vulnerabilities & Zero-Day Programming & Languages Operating Systems
منبع
EFF

Lessons Learned From 'AdFection' and What To Do Next

Last week, researchers at Citizen Lab revealed a horrifying new malware campaign, dubbed “AdFection.” It used an ad network to distribute spyware to journalist’s devices to infect them without the target ever needing to click anything. This sort of attack on journalists is dangerous and incredibly concerning, especially since it’s built on the backbone of a technology we already object to: behavioral advertising. Alt…

Malware & Threats Programming & Languages Mobile Development
منبع
Orca Security

PHP2Shell: From the attacker’s perspective

Executive Summary: What are CVE-2026-109618 and CVE-2026-109619? Why PHP vulnerabilities put most of the web at risk When you open a web page, something has to build that page before it reaches you. For roughly seven out of ten websites, the software doing that job is PHP. It sits on the web server, assembles the […]

Vulnerabilities & Zero-Day
منبع
AWS Security Bulletins

CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)

Bulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT Description: The AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could cha…

Vulnerabilities & Zero-Day Databases Cloud Computing
منبع
Flashpoint

AI Threat Report: How Artificial Intelligence Is Used Across Illicit Communities

A monthly analysis of how artificial intelligence is used in illicit communities, based on Flashpoint proprietary intelligence and direct visibility into real threat actor environments. The post AI Threat Report: How Artificial Intelligence Is Used Across Illicit Communities appeared first on Flashpoint.

AI Security Threat Intelligence AI & Machine Learning
منبع
The Hacker News

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT

Malware & Threats Ransomware
منبع
Ubuntu Security Notices

USN-8955-1: nginx vulnerabilities

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could poss…

Vulnerabilities & Zero-Day Botnet & DDoS
منبع
Wordfence Blog

Introducing the Wordfence Threat Response Team: A New Way to Report Active Threats in the WordPress Ecosystem

The Wordfence Threat Response Team is a new small, technically hands-on team responsible for turning rapidly emerging threats into customer protection and clear customer guidance. Spot an active threat? Report it directly to threat-response@wordfence.com The post Introducing the Wordfence Threat Response Team: A New Way to Report Active Threats in the WordPress Ecosystem appeared first on Wordfence.

Vulnerabilities & Zero-Day
منبع
Security Affairs

AI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police Say

Dutch police arrest two men over AI-voiced bank fraud that allegedly used a fake app to steal card data from 170 victims, causing €380,000 in losses. Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card […]

Malware & Threats AI Security AI & Machine Learning
منبع
The Hacker News

⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain

Supply Chain Security
منبع