SonicWall has warned of two vulnerabilities impacting end-of-life Global Management System (GMS) systems that it said will not be patched. Details of the security flaws, which affect SonicWall GMS 9.5.2 and earlier versions, are below - CVE-2026-109593 (CVSS score: 9.1) - An unauthenticated file read vulnerability that could allow an attacker with network access to read internal GMS files,
The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store
Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permissions and manages the others. Patches are out, and there is no known mitigation, the Xen Project said in an advisory on November 3. All Xen versions from 4.6 onward are vulnerable,
Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time. The promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns. Most agents never touch one. One recent case shows what that gap looks like in practice. An employee asked an AI assistant to trigger a mass-email automation. The automation
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016. The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. OpsShield, the cPGuard developer, published an alert earlier today saying the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19. The vendor says that it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions. Although the company could not confirm, it said that some servers may have not received and run the malicious script due to update checks occurring at specific intervals. The attacker leveraged legitimate credentials to gain initial access, although it remains unclear how they were obtained. “On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield’s update distribution infrastructure (CDN),” OpsShield said.
Cryptocurrency exchange Binance says North Korean hackers used a fake job interview to trick an employee into installing malware that ultimately let them compromise the company's wallet infrastructure and steal about $6.34 billion in digital assets. This new information was shared in an incident report published today, which details how the attackers used social engineering, malicious software, and compromised internal systems to carry out the October 29 crypto theft. As previously reported by BleepingComputer, the FBI attributed the attack to North Korean state-sponsored hackers known as TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38. Binance says the attack began in September when a software engineer was contacted through a legitimate job-hunting platform by someone impersonating a Project Director at a fictitious company.
Confirm this action.
Leaving now will discard your changes.