Vulnerability News
Открыть в Telegram
Every day new posts about vulnerabilities and cybersecurity news. Get the latest news about the cyberspace! Group: @VulnerabilityNewsGroup
Больше5 493
Подписчики
+1024 часа
+377 дней
+15930 дней
Загружаем данные
Похожие каналы
Облако тегов
Входящие и исходящие упоминания
---
---
---
---
---
---
Привлечение подписчиков
октябрь '26окт. '26
октябрь '26
+103
в 0 каналах
сентябрь '26
+219
в 0 каналах
Get PRO
август '26
+157
в 0 каналах
Get PRO
июль '26
+185
в 0 каналах
Get PRO
июнь '26
+156
в 0 каналах
Get PRO
май '26
+204
в 0 каналах
Get PRO
апрель '26
+187
в 0 каналах
Get PRO
март '26
+254
в 0 каналах
Get PRO
февраль '26
+116
в 0 каналах
Get PRO
январь '26
+166
в 0 каналах
Get PRO
декабрь '25
+134
в 0 каналах
Get PRO
ноябрь '25
+139
в 0 каналах
Get PRO
октябрь '25
+8
в 0 каналах
Get PRO
сентябрь '25
+12
в 0 каналах
Get PRO
август '25
+13
в 0 каналах
Get PRO
июль '25
+11
в 0 каналах
Get PRO
июнь '25
+12
в 0 каналах
Get PRO
май '25
+18
в 1 каналах
Get PRO
апрель '25
+14
в 0 каналах
Get PRO
март '25
+21
в 0 каналах
Get PRO
февраль '25
+17
в 0 каналах
Get PRO
январь '25
+15
в 1 каналах
Get PRO
декабрь '24
+262
в 1 каналах
Get PRO
ноябрь '24
+206
в 1 каналах
Get PRO
октябрь '24
+166
в 0 каналах
Get PRO
сентябрь '24
+146
в 0 каналах
Get PRO
август '24
+137
в 0 каналах
Get PRO
июль '24
+96
в 1 каналах
Get PRO
июнь '24
+91
в 0 каналах
Get PRO
май '24
+95
в 0 каналах
Get PRO
апрель '24
+104
в 0 каналах
Get PRO
март '24
+149
в 0 каналах
Get PRO
февраль '24
+279
в 0 каналах
Get PRO
январь '24
+395
в 0 каналах
Get PRO
декабрь '23
+327
в 0 каналах
Get PRO
ноябрь '23
+38
в 0 каналах
Get PRO
октябрь '23
+32
в 0 каналах
Get PRO
сентябрь '23
+47
в 0 каналах
Get PRO
август '23
+53
в 0 каналах
Get PRO
июль '23
+51
в 0 каналах
Get PRO
июнь '23
+42
в 0 каналах
Get PRO
май '23
+43
в 0 каналах
Get PRO
апрель '23
+67
в 0 каналах
Get PRO
март '23
+65
в 0 каналах
Get PRO
февраль '23
+45
в 0 каналах
Get PRO
январь '23
+67
в 0 каналах
Get PRO
декабрь '22
+62
в 0 каналах
Get PRO
ноябрь '22
+71
в 0 каналах
Get PRO
октябрь '22
+70
в 0 каналах
Get PRO
сентябрь '22
+55
в 0 каналах
Get PRO
август '22
+44
в 0 каналах
Get PRO
июль '22
+54
в 0 каналах
Get PRO
июнь '22
+78
в 0 каналах
Get PRO
май '22
+46
в 0 каналах
Get PRO
апрель '22
+77
в 0 каналах
Get PRO
март '22
+105
в 0 каналах
Get PRO
февраль '22
+48
в 0 каналах
Get PRO
январь '22
+61
в 0 каналах
Get PRO
декабрь '21
+99
в 0 каналах
Get PRO
ноябрь '21
+68
в 0 каналах
Get PRO
октябрь '21
+170
в 0 каналах
Get PRO
сентябрь '21
+72
в 0 каналах
Get PRO
август '21
+104
в 0 каналах
Get PRO
июль '21
+72
в 0 каналах
Get PRO
июнь '21
+292
в 0 каналах
Get PRO
май '21
+1 344
в 0 каналах
| Дата | Привлечение подписчиков | Упоминания | Каналы | |
| 17 октября | +3 | |||
| 16 октября | +10 | |||
| 15 октября | +4 | |||
| 14 октября | +6 | |||
| 13 октября | +5 | |||
| 12 октября | +3 | |||
| 11 октября | +7 | |||
| 10 октября | +8 | |||
| 09 октября | +6 | |||
| 08 октября | +9 | |||
| 07 октября | +7 | |||
| 06 октября | +7 | |||
| 05 октября | +7 | |||
| 04 октября | +4 | |||
| 03 октября | +4 | |||
| 02 октября | +6 | |||
| 01 октября | +7 |
Посты канала
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes.
The activity is being tracked by
https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html
| 2 | Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor.
Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
https://thehackernews.com/2026/10/attackers-tampered-with-aomei.html | 51 |
| 3 | Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped
https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html | 49 |
| 4 | CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.
Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-adds-two-known-exploited-vulnerabilities-catalog | 39 |
| 5 | CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764, affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026.
CISA urges organizations with affected self-hosted Remote Support appliances to immediately take the following actions:
Apply the BT26-05-RS patch, as outlined in BeyondTrust’s Security Advisory BT26-05. Organizations on a self-hosted Remote Support version older than 24.3.1 will need to upgrade to a newer version to apply the patch. Organizations using BeyondTrust-hosted (SaaS) Remote Support deployments have already been patched. Review BeyondTrust’s blog ARMORY CASTLE and BT26-05: What Security Teams Need to Know for detailed information on the vulnerability and recommended response and mitigation actions.
Limit external access to the Remote Support appliance to the services needed to support users and customers. Restrict access to administrative interfaces to trusted networks. Review BeyondTrust’s B Series Appliance on-premises security for additional guidance on securing network connectivity for self-hosted Remote Support appliances.
Organizations with affected self-hosted Remote Support appliances should conduct network and memory forensics to identify evidence of potential compromise. If your organization suspects a compromise, CISA recommends taking the following actions:
Isolate any suspected or confirmed compromised appliances. Collect a snapshot of virtual appliances or forensic image for physical appliances to conduct future forensics, immediately forward appliance syslog and session events to the SIEM, and collect any additional logs, such as web application firewall, reverse-proxy, or perimeter firewall logs for the exposure window. Consult BeyondTrust’s Syslog guide for additional information on forwarding appliance logs and session events.
Conduct network and forensic investigations for evidence of compromise. Additionally, hunt for indicators of threat actor activity, including unrecognized privileged or administrative sessions, unrecognized script files, unexpected gaps in logs or log forwarding, and unauthorized account, permission, or session-policy changes. Consult CISA’s Binding Operational Directive (BOD) 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk to assist with prioritizing vulnerability remediation.
Rebuild from a known-good state and apply the BT26-05-RS patch. Then rotate every credential the appliance stored or injected, revoke all active support sessions, and review new multifactor authentication registrations on privileged accounts.
CISA urges organizations to review the BeyondTrust security advisory and resources noted above and apply necessary updates. CISA also recommends reviewing Mandiant’s blog, ARMORY CASTLE Exploits BeyondTrust, for additional hunt and isolation guidance and detections.
Disclaimer
The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.
https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support | 23 |
| 6 | Managing open-weight model risk in enterprise deployments
New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls.
The post Managing open-weight model risk in enterprise deployments appeared first on Microsoft Security Blog.
https://www.microsoft.com/en-us/security/blog/2026/10/16/managing-open-weight-model-risk-in-enterprise-deployments/ | 13 |
| 7 | Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis
The Thoma Bravo-owned Proofpoint will acquire Varonis in an all-cash transaction and Varonis will become a private company.
The post Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis appeared first on SecurityWeek.
https://www.securityweek.com/proofpoint-inks-6-3-billion-all-cash-deal-to-acquire-varonis/ | 12 |
| 8 | Microsoft Patches Two Dozen RCE Flaws in Office
In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office.
The post Microsoft Patches Two Dozen RCE Flaws in Office appeared first on SecurityWeek.
https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/ | 15 |
| 9 | F5, Juniper Networks Patch Critical Vulnerabilities
Successful exploitation of some of these issues could lead to remote code execution and full device takeover.
The post F5, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.
https://www.securityweek.com/f5-juniper-networks-patch-critical-vulnerabilities/ | 15 |
| 10 | OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks
Left without funds for a coding task, an OpenAI model spent test crypto from a stranger’s wallet and left it out of its report.
The post OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks appeared first on SecurityWeek.
https://www.securityweek.com/openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks/ | 14 |
| 11 | Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.
The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek.
https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/ | 15 |
| 12 | BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts
A cyber incident affecting contractor BAE Systems has knocked out the Bankruptcy Noticing Center, halting notices nationwide for a week.
The post BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts appeared first on SecurityWeek.
https://www.securityweek.com/bae-systems-security-incident-stalls-notices-from-us-bankruptcy-courts/ | 15 |
| 13 | In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow flaw under attack.
The post In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit appeared first on SecurityWeek.
https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/ | 14 |
| 14 | BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/ | 16 |
| 15 | BAE Systems cyberattack disrupts US federal court operations
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]
https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/ | 16 |
| 16 | Microsoft: October Windows update may break Smart App Control
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]
https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/ | 15 |
| 17 | Burger King Japan data breach exposes 11 million customer records
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]
https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/ | 17 |
| 18 | Employees using personal ChatGPT at work? Here's what IT admins need to do
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. [...]
https://www.bleepingcomputer.com/news/security/employees-using-personal-chatgpt-at-work-heres-what-it-admins-need-to-do/ | 20 |
| 19 | Targeted ads installed Candiru spyware in zero-click attacks
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...]
https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/ | 26 |
| 20 | Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]
https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/ | 36 |
