Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks. Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company explained on October 12 when it released security patches to address the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8.
Hackers reportedly hit Ukraine ‘s and Russia ‘s emergency alert apps, sending fake nuclear and attack warnings and raising concerns over public safety. Ukraine and Russia both said on Sunday night that hackers had compromised their emergency alert apps and used them to send fake warnings about air raids and other attacks, including nuclear threats. The BBC reported the incident, but neither side’s claims have been independently confirmed. Shortly before 11 p.m. local time (9 p.m. GMT), Ukraine’s widely used Air Alarm app sent the highest-level air raid warnings across the country. Some people, including residents of Kyiv, also received alerts about possible radiation, chemical attacks and street fighting. A message posted on Telegram said the app had likely been targeted by a cyberattack, confirmed there was no radiation threat and urged people to remain calm. “Shortly before 23:00 local time (21:00 GMT), Ukraine’s widely usedair raid app sent red-level air raid warnings nation-wide, with additional warnings of radiation, chemical attacks, and street fighting sent to some residents in areas including Kyiv.” reports BBC. “The Air Alarm application has probably been subjected to hostile interference. There is no radiation threat! Stay calm and follow our updates on our channel.” an alert on Telegram read. The false alerts started at about 22:47 with a message that a radiation threat had been declared in Kyiv. At 22:48 came a message in Russian saying a nuclear alert would cover all of Ukraine and not to worry because “it’s Oreshnik flying”. Oreshnik is a Russian intermediate-range ballistic missile that can carry nuclear or conventional warheads, and Russia has the world’s biggest nuclear arsenal, with President Vladimir Putin repeatedly hinting he’s open to using every weapon available. Two more alerts arrived at 22:49. One, in Ukrainian, warned of a chemical attack on Kyiv and told people not to go outside, and the other said street fighting was taking place in the city. Red, orange and green messages reached phones, and at 23:53 users got all-clear messages, each declaring one of the Kyiv threats over. A Ukrainian intelligence body, which the BBC calls the Central Intelligence Agency, said there had been a failure in the app and urged people to use other sources of information. It added that the alerts triggered a radiation hazard signal on loudspeakers in the Lviv region, with no real threat. “The Air Alert app is supported by the Ministry of Digital Transformation of Ukraine, and informs users instantly about the beginning and end of defence alerts. The ministry said it temporarily disabled the app for maintenance after it had “apparently been compromised”. states BBC. “While the false alerts were quickly contained, cybersecurity experts suggested it was a new line in apparent Russian cyberattacks.” The temporary shutdown of the Air Alert app also carries significant risks, even if it lasts only a short time. During an outage, users may not receive timely warnings about incoming attacks, leaving them with less time to reach shelters or take protective measures. This is particularly dangerous in a country where missile and drone attacks can happen with little warning. The incident also highlights a difficult security trade-off: disabling a compromised alert system may prevent attackers from spreading false warnings, but it can temporarily remove a critical channel for delivering real emergency information. Any shutdown therefore needs reliable backup channels, such as sirens, official messaging services and other emergency communication systems. Regional leaders tried to calm people. Svitlana Onyshchuk, head of the Ivano-Frankivsk region, said everything was calm, even though the app had shown a red-level alert for her region from 22:50 to 23:57. Natalya Zabolotna, her counterpart in Vinnytsia, confirmed a cyberattack on the app and warned people not to click the link in the message, which could be phishing. Ukraine’s Centre for Countering Disinformation has advice for when the app isn’t working: turn on smartphone notifications, pay attention to sirens, and read only official sources. Oleksander Merezhko, chair of the foreign affairs committee in the Ukrainian parliament and a member of President Zelensky’s Servant of the People party, said the attack caused no panic. Ukrainians, especially in Kyiv, are used to practically non-stop alerts, he told the BBC, and the message in Russian aroused suspicion at once. The attackers picked a language that gave them away. A few hours later, Russia’s ministry of emergency situations said its own app had suffered “a massive cyberattack” that sent fake information to the public. Ukrainian outlet UNN reported that the hack sent fake nuclear threat alerts inside Russia, citing Atesh, a partisan Ukrainian group operating in Russian-held territory. A screenshot Atesh shared on Telegram, described as purported, claimed nuclear warheads mounted on Ukrainian P1-Sun attack drones had been launched at all regions of Russia, opened with a “risk of getting lively” warning and told residents to stock up on three weeks of food and hide. The alert also had profanities. Russia said it was still restoring the app but claimed the hack had not affected its wider alert system. It said people could still receive warnings through sirens, loudspeakers, text messages, TV and radio. The false alerts appeared minutes before a local ceasefire in Ukraine’s Kherson region ended on Sunday night. The truce had allowed civilians to leave Russian-occupied Oleshky. Although the fake warnings were quickly stopped, experts see the attack as a worrying escalation. “I think it’s the first time it’s happened to an official Ukrainian information app, but I suspect it won’t be the last,” Herbert Lin, a senior research scholar for cyber policy and security at Stanford University, told BBC World Service’s Newsday programme. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Ukraine)
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface. CVE-2026-111357 is a high-severity privilege escalation flaw, and CVE-2026-118527 lets authenticated attackers upload files on an unpatched device. When it released patches for CVE-2026-104935 in October, Ivanti urged admins to upgrade as soon as possible since it was aware of "limited exploitation in the wild." "At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," Ivanti added in an advisory updated on Thursday.
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;
The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record. In a security alert published Saturday, the agency attributed the attack to TraderTraitor, a North Korean hacking group also tracked as Lazarus Group, Jade Sleet, and APT38, linked to numerous cryptocurrency thefts. "The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the FBI said. This official attribution follows blockchain intelligence firms TRM Labs and Chainalysis, which had already linked the theft to TraderTraitor.
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity. Investigating alignment failures in AISI’s incident An alignment assessment of the UK AISI cybertesting incident Improving our alignment and security efforts Will AI expose the rickety infrastructure of the internet? Anthropic’s IPO filing reveals its strategy for keeping enterprise customers hooked Alibaba’s Qwen AI caught trying to contact server in China Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC Discovering and exploiting vulnerabilities in critical, real-world software with Claude Invasive Ads: The Unconventional Cyber Surveillance Attack Surface Early progress on accelerating drug development with Claude Putting Claude Code in a box: a sandboxed dev container for Zed How AI tools are used for doxing Gemini 4 Carbon: our next frontier model Tricks from the Past deployed via signed ChatGPT and Claude binaries AI models may be capable of self-replicating without access to a datacenter Load/Mine: A Hugging Face Malware Campaign Returns After Takedown Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps deepveindrilling.com: Magento CMS block loader hits 953 stores CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC Operation FlashHole: Lazarus breaks security, defies control Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace Tricks from the Past deployed via signed ChatGPT and Claude binaries Trezor warns of suspected crypto-theft implant in hardware wallet Load/Mine: A Hugging Face Malware Campaign Returns After Takedown Decoding Maliciousness: LLM-Assisted Semantic Filtering for Scalable Malicious PyPI Package Detection A Two-Stage Selective Deep Learning Framework for Malware Family Classification in Encrypted Network Traffic Silent Blindness: Fault Vulnerability of Hardware Malware Detectors Measuring Duplication, Leakage, and Rendering Dependence in Malware-as-Image Benchmarks Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalogAttackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic BinariesU.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog$6.3 Billion Stolen from Binance in Attack Attributed to North KoreaHow to prioritize remediation after a pentest: a practitioner workflowHacker leaks data on more than 40,000 Homeland Security employeesBinance Investigates Suspicious Crypto Transfers Worth Up to $5.8 BillionUS Probes Suspected Hack Behind Military Base Freezer Failures484,142 Exposed Cloud Buckets Contain 18 Billion FilesU.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalogVolt Typhoon Used Silent Train to Hide Zero-Day AttacksElection Website Security: 42% of US County Sites Still Lack .gov DomainsENGIE Data Breach Exposes Customer Details and Energy ContractsVirtualine Domain Seized, but Allegedly Abusive Website Remains OnlineHive and Nefilim Ransomware Affiliate Gets 70 Months In JailAds or Surveillance? Researchers Flag Suspicious Targeting of Starlink UsersCVE-2026-97631: 16-Year-Old UEFI Flaw Threatens ServersU.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalogThree Japan-Focused Cyberattacks Show How Hackers Use AIItaly ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber MattersAustralia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates HackingU.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalogAttackers Take Control of Dahua Cameras and Video Recorders Via Easy4IPCohere Finds Qwen AI Model Contacting a Server in ChinaMagento Campaign Infects 953 Online Stores Across Five DomainsAI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police SayResearchers Uncover Rentable Android Spyware uCreater Targeting WeChat and TelegramPHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hostsAnthropic reveals how Claude Mythos 5 crossed security testing boundariesOpenAI Paused Frontier AI Training After a Security Incident International Press – Newsletter Cybercrime Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets Police arrest two suspects in AI-powered bank fraud that cost victims €380,000 M365 Token Spray and Replay Campaign Compromises Business Email Accounts Chinese National Extradited for Alleged Role in Multimillion-Dollar Cryptocurrency Scam Targeting U.S. Citizens Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents deepveindrilling.com: Magento CMS block loader hits 953 stores “Bulletproof” website domain seized in international law enforcement operation Trezor warns of suspected crypto-theft implant in hardware wallet Polymarket halts trading after crypto-draining script breach, $2.5M traced Malware uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace Tricks from the Past deployed via signed ChatGPT and Claude binaries Hacking PHP2Shell exploitation observed: packet-to-process RCE evidence CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability Discovering and exploiting vulnerabilities in critical, real-world software with Claude Putting Claude Code in a box: a sandboxed dev container for Zed Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only! Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say GitLab security incident: attempted exploitation of CVE-2026-97229 Intelligence and Information Warfare Alibaba’s Qwen AI caught trying to contact server in China Hackers can gain control of cameras and DVRs through cloud access Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says Operation FlashHole: Lazarus breaks security, defies control Hackers Sympathetic to Russia Are Hitting Utilities and Factories Alleged Israeli spy company heavily targeted Starlink users, sources say Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History Mapping the Political Influencer Industry and the Problems it Causes for Democracy Cybersecurity NIS 2 Italy: Key Deadlines, Board Duties and What ACN Expects From Companies The Two Things CISOs Should Be Thinking About In The Wake Of The PHP Nightmare Code-execution flaw in UEFI firmware affects most servers on planet Earth 2026 County Election Website Security Census: Key Findings Cloud Exposure Index 2026: 484,142 open buckets mapped ENGIE: Data leak via a tool belonging to its business partners Beyond Framework Signatures: Understanding AI-Driven Intrusions I Think The Military Commissary’s Freezers Were Hacked Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning Passkeys Are Better Than Passwords. But They Are Not Enough Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Confirm this action.
Leaving now will discard your changes.