Help Net Security دوشنبه ۱۱ آبان ۱۴۰۵ · ۱۹:۲۸

CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)

CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws. Three flaws chained to gain a foothold CVE-2026-111357, a missing authentication for a critical function vulnerability that allows a local authenticated attacker to escalate their privileges…

Vulnerabilities & Zero-Day Identity & Access Security

Read the full article at Help Net Security Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

AWS Security Bulletins دوشنبه ۱۱ آبان ۱۴۰۵ · ۲۰:۱۰

CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

Bulletin ID: 2026-161-AWS Publication Date: 11/02/2026 08:30 AM PST Description: We are aware of CVE-2026-119301 in the Apache Iceberg write component, where improper neutralization of quoting syntax in SQL identifier construction could allow an authenticated user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table tha…

Vulnerabilities & Zero-Day Databases Cloud Computing

Source

آی‌تی‌رسان دوشنبه ۱۱ آبان ۱۴۰۵ · ۱۹:۳۰

کشف یک مسیر نفوذ به سرورهای لینوکسی با کمک هوش مصنوعی آنتروپیک

مدل آزمایشی و منتشرنشده آنتروپیک توانسته است یک آسیب‌پذیری امنیتی با شدت بحرانی در کرنل لینوکس شناسایی کند؛ نقصی که […] نوشته کشف یک مسیر نفوذ به سرورهای لینوکسی با کمک هوش مصنوعی آنتروپیک اولین بار در آی‌ تی‌ رسان منتشر شد.

Vulnerabilities & Zero-Day AI Security AI & Machine Learning

Source

Help Net Security دوشنبه ۱۱ آبان ۱۴۰۵ · ۱۹:۲۰

Google disrupts XCPE botnet, bans the company behind it

Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes. Google’s Threat Intelligence Group attributes the operation with high confidence to Videostrong Technology, the company that manufactured many of those boxes. More than 1.3 million devices were enrolled. XCPE malware overview (Source: Google) Access The business model was access. Researchers say the company sold e…

Malware & Threats Botnet & DDoS IoT & OT Security

Source

Wordfence Blog دوشنبه ۱۱ آبان ۱۴۰۵ · ۱۹:۱۸

HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. The post HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites appeared first on Wordfence.

Vulnerabilities & Zero-Day

Source