Vulnerability News
前往频道在 Telegram
Every day new posts about vulnerabilities and cybersecurity news. Get the latest news about the cyberspace! Group: @VulnerabilityNewsGroup
显示更多5 623
订阅者
+1524 小时
+727 天
+20530 天
正在加载数据
相似频道
标签云
进出提及
---
---
---
---
---
---
吸引订阅者
十月 '2610月 '26
十月 '26
+252
在0个频道中
九月 '26
+219
在0个频道中
Get PRO
八月 '26
+157
在0个频道中
Get PRO
七月 '26
+185
在0个频道中
Get PRO
六月 '26
+156
在0个频道中
Get PRO
五月 '26
+204
在0个频道中
Get PRO
四月 '26
+187
在0个频道中
Get PRO
三月 '26
+254
在0个频道中
Get PRO
二月 '26
+116
在0个频道中
Get PRO
一月 '26
+166
在0个频道中
Get PRO
十二月 '25
+134
在0个频道中
Get PRO
十一月 '25
+139
在0个频道中
Get PRO
十月 '25
+8
在0个频道中
Get PRO
九月 '25
+12
在0个频道中
Get PRO
八月 '25
+13
在0个频道中
Get PRO
七月 '25
+11
在0个频道中
Get PRO
六月 '25
+12
在0个频道中
Get PRO
五月 '25
+18
在1个频道中
Get PRO
四月 '25
+14
在0个频道中
Get PRO
三月 '25
+21
在0个频道中
Get PRO
二月 '25
+17
在0个频道中
Get PRO
一月 '25
+15
在1个频道中
Get PRO
十二月 '24
+262
在1个频道中
Get PRO
十一月 '24
+206
在1个频道中
Get PRO
十月 '24
+166
在0个频道中
Get PRO
九月 '24
+146
在0个频道中
Get PRO
八月 '24
+137
在0个频道中
Get PRO
七月 '24
+96
在1个频道中
Get PRO
六月 '24
+91
在0个频道中
Get PRO
五月 '24
+95
在0个频道中
Get PRO
四月 '24
+104
在0个频道中
Get PRO
三月 '24
+149
在0个频道中
Get PRO
二月 '24
+279
在0个频道中
Get PRO
一月 '24
+395
在0个频道中
Get PRO
十二月 '23
+327
在0个频道中
Get PRO
十一月 '23
+38
在0个频道中
Get PRO
十月 '23
+32
在0个频道中
Get PRO
九月 '23
+47
在0个频道中
Get PRO
八月 '23
+53
在0个频道中
Get PRO
七月 '23
+51
在0个频道中
Get PRO
六月 '23
+42
在0个频道中
Get PRO
五月 '23
+43
在0个频道中
Get PRO
四月 '23
+67
在0个频道中
Get PRO
三月 '23
+65
在0个频道中
Get PRO
二月 '23
+45
在0个频道中
Get PRO
一月 '23
+67
在0个频道中
Get PRO
十二月 '22
+62
在0个频道中
Get PRO
十一月 '22
+71
在0个频道中
Get PRO
十月 '22
+70
在0个频道中
Get PRO
九月 '22
+55
在0个频道中
Get PRO
八月 '22
+44
在0个频道中
Get PRO
七月 '22
+54
在0个频道中
Get PRO
六月 '22
+78
在0个频道中
Get PRO
五月 '22
+46
在0个频道中
Get PRO
四月 '22
+77
在0个频道中
Get PRO
三月 '22
+105
在0个频道中
Get PRO
二月 '22
+48
在0个频道中
Get PRO
一月 '22
+61
在0个频道中
Get PRO
十二月 '21
+99
在0个频道中
Get PRO
十一月 '21
+68
在0个频道中
Get PRO
十月 '21
+170
在0个频道中
Get PRO
九月 '21
+72
在0个频道中
Get PRO
八月 '21
+104
在0个频道中
Get PRO
七月 '21
+72
在0个频道中
Get PRO
六月 '21
+292
在0个频道中
Get PRO
五月 '21
+1 344
在0个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 31 十月 | +8 | |||
| 30 十月 | +17 | |||
| 29 十月 | +9 | |||
| 28 十月 | +11 | |||
| 27 十月 | +10 | |||
| 26 十月 | +11 | |||
| 25 十月 | +10 | |||
| 24 十月 | +10 | |||
| 23 十月 | +9 | |||
| 22 十月 | +17 | |||
| 21 十月 | +9 | |||
| 20 十月 | +10 | |||
| 19 十月 | +7 | |||
| 18 十月 | +8 | |||
| 17 十月 | +6 | |||
| 16 十月 | +10 | |||
| 15 十月 | +4 | |||
| 14 十月 | +6 | |||
| 13 十月 | +5 | |||
| 12 十月 | +3 | |||
| 11 十月 | +7 | |||
| 10 十月 | +8 | |||
| 09 十月 | +6 | |||
| 08 十月 | +9 | |||
| 07 十月 | +7 | |||
| 06 十月 | +7 | |||
| 05 十月 | +7 | |||
| 04 十月 | +4 | |||
| 03 十月 | +4 | |||
| 02 十月 | +6 | |||
| 01 十月 | +7 |
频道帖子
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.
The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44
https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html
| 2 | A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.
The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.
https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html | 12 |
| 3 | Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.
The vulnerabilities are listed below -
CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html | 12 |
| 4 | Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data
American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data.
However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens.
"This month, Chainalysis detected an external actor using offensive agentic
https://thehackernews.com/2026/10/chainalysis-confirms-intrusion-into.html | 9 |
| 5 | Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it.
The post Inside a malicious Claude Code-branded extension and its persistent SSH backdoor appeared first on Microsoft Security Blog.
https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/ | 7 |
| 6 | Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities.
The post Syrian Hacker Gets Prison Time in US After Over a Decade on the Run appeared first on SecurityWeek.
https://www.securityweek.com/syrian-hacker-gets-prison-time-in-us-after-over-a-decade-on-the-run/ | 5 |
| 7 | Chainalysis discloses data breach from "offensive agentic techniques"
Blockchain analytics firm Chainalysis disclosed a data breach after attackers used "offensive agentic techniques" to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. [...]
https://www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques/ | 5 |
| 8 | From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era.
AI-generated vulnerability reports are overwhelming some bug bounty programs, making it harder for aspiring security researchers to know where to start. TryHackMe explains how beginners can build practical cybersecurity skills, use AI responsibly, and produce reproducible findings that stand up to scrutiny. [...]
https://www.bleepingcomputer.com/news/security/from-beginner-to-bug-hunter-learning-cybersecurity-in-the-ai-era/ | 5 |
| 9 | Reddit to lock content behind logins to fight scrapers
Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a "logged-in service," offering limited access to visitors without accounts. [...]
https://www.bleepingcomputer.com/news/security/reddit-to-lock-content-behind-logins-to-fight-scrapers/ | 5 |
| 10 | New Android SMS of Death exploit can remotely crash unpatched phones
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. [...]
https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/ | 7 |
| 11 | Northflank security breach leads to abuse of customers' AI API keys
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. [...]
https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/ | 10 |
| 12 | CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog | 128 |
| 13 | From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.
The post From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths appeared first on Microsoft Security Blog.
https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/ | 90 |
| 14 | $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
Blockchain analysts link the record crypto theft to North Korean hackers, as Binance probes a possibly compromised engineer laptop.
The post $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor appeared first on SecurityWeek.
https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/ | 70 |
| 15 | TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.
The post TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines appeared first on SecurityWeek.
https://www.securityweek.com/teamviewer-flaw-could-let-malicious-hosts-take-over-support-technicians-machines/ | 45 |
| 16 | Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.
The post Max-Severity GitLab Vulnerability Exploited Against Alpine Linux appeared first on SecurityWeek.
https://www.securityweek.com/max-severity-gitlab-vulnerability-exploited-against-alpine-linux/ | 55 |
| 17 | $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.
The post $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack appeared first on SecurityWeek.
https://www.securityweek.com/2-million-drained-from-polymarket-traders-in-new-supply-chain-attack/ | 31 |
| 18 | Drupal Commerce Core Vulnerability Exploited Against Online Stores
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.
The post Drupal Commerce Core Vulnerability Exploited Against Online Stores appeared first on SecurityWeek.
https://www.securityweek.com/drupal-commerce-core-vulnerability-exploited-against-online-stores/ | 27 |
| 19 | Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
The post Fresh WordPress Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.
https://www.securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/ | 28 |
| 20 | Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
It allowed customers to host hack-for-hire services, supported ransomware and infostealer operators, and accepted crypto payments.
The post Bulletproof Host Virtualine Loses Its Domain to FBI Seizure appeared first on SecurityWeek.
https://www.securityweek.com/bulletproof-host-virtualine-loses-its-domain-to-fbi-seizure/ | 28 |
