Latest publishing day: · UTC
The researcher says the flaw lets a local user reach System by making Windows Defender create a signature file at a path they choose. Microsoft hasn't commented, and there's no sign of exploitation in the wild.
VulnerabilitiesAnalysis4 min read
IncidentsAnalysis4 min read
Europol and the US Justice Department say the takedown hit three malware services, cleaned 681 infected websites and handed 6.4 million stolen credentials to breach-notification groups.
IncidentsAnalysis3 min read
Police seized servers behind three criminal tools and about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's BKA.
Threat intelAnalysis4 min read
Enea says SilentAir hijacked mobile network nodes to intercept calls and messages, with Taiwanese subscribers the primary targets. It also reports blocking Liminal Panda's GTPDoor backdoor at operator customers.
IncidentsAnalysis3 min read
Trezor says an extra circuit board inside the wallets copies the recovery phrase off the screen and sends it over the mobile network to an attacker-controlled server.
IncidentsAnalysis4 min read
Law enforcement and industry partners dismantled servers and domains behind Gootloader, CastleRAT and StealC, with the Justice Department putting Gootloader's reach at 25,000 infected devices since 2018.
IncidentsAnalysis4 min read
Trezor says the added circuit board sat between the main board and display, captured recovery words and passphrases, and sent them over a cellular network. No customer has reported lost funds.
VulnerabilitiesExploitedCVE-2026-123039CVSS 7.84 min read
CVE-2026-123039 covers a world-writable local socket on Check Point gateways and management servers. CISA added it to its known exploited vulnerabilities list on 13 November 2026, with a remediation due date of 16 November.
IncidentsExploitedCVE-2026-109618CVSS 9.25 min read
Check Point says attackers chained the PHP2Shell RCE bugs with a local privilege escalation to reach root, then deployed webshells, a backdoor framework and a wiper. It can't say who did it.
VulnerabilitiesCVE-2026-125881CVSS 9.34 min read
N-able says every unauthenticated flaw in the Able2Shell dump is fixed in N-central 2026.4 HF2, and that it has seen scanning but no compromise of hosted servers. The authenticated bugs are still open.
Threat intelExploitedCVE-2026-84869CVSS 9.94 min read
Huntress and Blackpoint Cyber say the worm-like toolkit attempted to exploit a patched ScreenConnect client flaw, but neither has seen that step succeed. The initial access came through a third-party extension, not the CVE.
VulnerabilitiesCVE-2026-119618CVSS 8.14 min read
Apache HTTP Server 2.4.71 fixes a race condition in mod_http2 that Red Hat scored 9.8, reported independently by Anthropic's OSS Scanner and Google researchers. Only servers with HTTP/2 enabled are affected.
IncidentsAnalysis4 min read
Huntress says a campaign compromised at least 6 MSPs and 288 hosts across 48 organizations, with commands reaching endpoints in minutes and no matching logins. ConnectWise disabled five RMM+ family extensions across roughly 400 ScreenConnect environments.
