Threat Wire
BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys

CyberWatch Newsroom Live Intel

Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.

Last Checked: Nov 2, 2026 - 02:28:59 UTC (Hourly Auto-Sync Active)
Newsfeed (/feed) RSS Feed JSON API
All Security Bulletins 5,807 Active Zero-Days (KEV) 608 Microsoft Patch KBs 849 MSRC Live Wire 1,922 CISA Advisories 157 Threat Intel 2,629
Showing 24 of 411 advisories
Page 6 of 18
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams Moderate The Hacker News
2026-10-15 The Hacker News

Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams

A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites w…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks Critical The Hacker News
2026-10-15 The Hacker News

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing Critical The Hacker News
2026-10-15 The Hacker News

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules Critical The Hacker News
2026-10-15 The Hacker News

Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at leas…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early Important The Hacker News
2026-10-15 The Hacker News

Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early

Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed tar…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation Critical CVE-2026-0322 The Hacker News
2026-10-15 The Hacker News

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networ…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Why AI Confidence Is Not Validation Moderate The Hacker News
2026-10-15 The Hacker News

Why AI Confidence Is Not Validation

AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and validation standards in place, that gap compounds and rarely stays c…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 Moderate The Hacker News
2026-10-15 The Hacker News

India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1

The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls. To that end, the Department of Telecommunications has is…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories Moderate The Hacker News
2026-10-15 The Hacker News

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' C…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts Critical CVE-2026-105740 The Hacker News
2026-10-15 The Hacker News

Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches Important CVE-2026-105133 The Hacker News
2026-10-15 The Hacker News

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected sy…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability Critical The Hacker News
2026-10-15 The Hacker News

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App Critical The Hacker News
2026-10-14 The Hacker News

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web serve…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages Important The Hacker News
2026-10-14 The Hacker News

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud Moderate The Hacker News
2026-10-14 The Hacker News

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud

The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies,…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts Critical CVE-2026-104935 The Hacker News
2026-10-14 The Hacker News

CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of au…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution Important The Hacker News
2026-10-14 The Hacker News

curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution

A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a re…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team Moderate The Hacker News
2026-10-14 The Hacker News

How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team

Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake. The call comes in at 4:40 on a Friday. It's the CFO, or it sounds exactly like her, asking the controller to push a supplier payment out before …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days Important The Hacker News
2026-10-14 The Hacker News

Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks Important The Hacker News
2026-10-14 The Hacker News

Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks

Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacement…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part. Critical The Hacker News
2026-10-14 The Hacker News

An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host Important CVE-2026-74580 The Hacker News
2026-10-14 The Hacker News

AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host

A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zh…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave Moderate The Hacker News
2026-10-14 The Hacker News

Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave

Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work w…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug Important The Hacker News
2026-10-14 The Hacker News

Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug

Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
1 ... 4 5 6 7 8 ... 18
Notification