VulnerabilitiesCVE-2026-119618CVSS 8.14 min read
Apache HTTP Server 2.4.71 fixes a race condition in mod_http2 that Red Hat scored 9.8, reported independently by Anthropic's OSS Scanner and Google researchers. Only servers with HTTP/2 enabled are affected.
VulnerabilitiesExploitedCVE-2026-18577CVSS 8.24 min read
The vendor shut its hosted environments on November 9 and told on-premises customers to do the same, while it works on a hotfix. It says it hasn't seen exploitation in the wild.
VulnerabilitiesCVE-2026-125883CVSS 9.34 min read
N-able released N-central 2026.4 HF2 for seven flaws disclosed publicly on November 8, after taking hosted environments offline and telling on-premises customers to do the same.
IncidentsAnalysis4 min read
The cloud host says two vulnerabilities let intruders reach decrypted environment variables for at most 1.85% of workspaces, and that the fight lasted roughly 26 hours.
IncidentsBrief1 min read
Apiiro says commands developers approved in Claude Code, secrets included, were saved word-for-word into project settings files that ended up in public repositories.
Threat intelCVE-2026-40217CVSS 8.82 min read
GTIG and Mandiant describe two clusters: one scanning for exposed LLM endpoints, another stealing valid API keys and selling access through "LLM mixers".
Threat intelBrief2 min read
A threat cluster Group-IB calls CyberDakait has used smishing and vishing to push malicious APKs that impersonate Indian banks, harvest banking credentials and mine cryptocurrency on infected phones.
Threat intelBrief1 min read
OpenSourceMalware says the group behind the GhostAction supply chain attack has moved from malicious GitHub Actions workflows to phishing developers with a stealer disguised as a font file.
