News · via Infosecurity Magazine
Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report
Exploit
Coverage tagged "Exploit".
News · via Rapid7
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
OverviewIn early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation…
News · via HIPAA Journal
Boston Children’s Health Physicians; XTIUM Settle Alleged HIPAA Violations for $2.7M
Boston Children’s Health Physicians (BCHP) and the managed IT service provider XTIUM have agreed to settle an investigation by the New York and Connecticut Attorneys General into a 2024 data breach…
News · via Rapid7
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
OverviewOn October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as…
News · via SOCRadar
Drupal Patches Critical RCEs: CVE-2026-108097 & 108099
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. The first flaw, tracked CVE-2026-108097, affects the core…
News · via Dark Reading
OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's…
News · via SOCRadar
ConnectWise Cloud Backup Breach: What We Know
ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick, after researchers detected the applications authenticating into customer…
News · via Canadian Centre for Cyber Security
Redis security advisory (AV26-423) - Update 1
Serial number: AV26-423 Date: May 5, 2026 Updated: October 19, 2026 On May 5, 2026, Redis published a security advisory to address vulnerabilities in the following products: Redis Software – multiple…
News · via Cloudflare
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application…
News · via SecurityWeek
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Threat actors have been observed delivering cryptocurrency miners and proxy software.
News · via SecurityWeek
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
The persistent, stealthy FortiGate implant was deployed against a telecommunications organization.
News · via Security Affairs
Big Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel Flaw
OpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available. Cybersecurity firm Calif published a full exploit…
News · via CyberScoop
Spyware found on devices belonging to prominent Serbian critics as elections loom
Spyware has been detected on devices used by some of Serbia’s most prominent figures connected to the country’s political upheaval, according to researchers who announced their findings Monday.
News · via Security Affairs
Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited
Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS…
News · via arXiv cs.CR
When Core-Network Elements Become Reachable: Field-Level Exploitability Analysis in Diameter
arXiv:2610.22943v1 Announce Type: new Abstract: The increasing exposure of cellular core-network elements to public networks has turned Diameter signaling interfaces into a practical attack surface.
News · via arXiv cs.CR
Aspire: Practical Batch Queries on Dynamic Encrypted Database with Full Leakage Suppression
arXiv:2610.23057v1 Announce Type: new Abstract: Leakage-abuse attacks against encrypted database systems exploit semantic leakage and pose a severe threat to the confidentiality of plaintext data and…
News · via Security Affairs
16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a Password
A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. Researcher Quentin Kaiser presented a talk at Hexacon in…
News · via BleepingComputer
Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers.
News · via Security Affairs
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 119
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter IronChain Ransomware Threatens Businesses with…
News · via BleepingComputer
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.