Cybersecurity

Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale.

Windows 11 KB5127936 update released with 41 changes and fixes

Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements.

Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls

A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account.

Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload.

Also: BleepingComputer

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys

Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network.

Also: BleepingComputer

OffSec Launches Free PHP2Shell Lab Following Critical Vulnerability Discovery

New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery.

Police seize Virtualine bulletproof service tied to ransowmare, cybercrime

U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities.

Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

Attackers probe another EBS bug, and ShinyHunters' PeopleSoft 0-day turns out to involve three vulns

Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background.

Sony ISP subsidiary data breach exposes 2.5 million customer records

Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information.

Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown.

PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed…

Volt Typhoon hides zero-day attacks using 'Silent Train' framework

Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems.

Also: The Hacker News

Microsoft urges Entra ID admins to migrate users to passkeys

Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027.

Barcelona Cybersecurity Congress to address the impact of AI on cybersecurity

The seventh Barcelona Cybersecurity Congress, from 3 to 5 November at Fira Gran Via, brings 150 international speakers and 111 exhibitors together to address how AI is reshaping cyber threats.

Trusty to lead deployment of US Cyber Trust Mark Program

FCC Commissioner Olivia Trusty will lead the rollout and implementation of the Cyber Trust Mark Program, used to identify connected products that meet the program's security requirements. #pressrelease

InfraTrust report warns of exploited flaws in critical network infrastructure

Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at…

Hackers now scanning systems for recently-patched Oracle flaw

Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.

Cisco open sources tool for detecting AI agents on hacking sprees

Project Quarry aims to provide a 'shared language' for evaluating agent behavior

123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus

Company chiefs believe the attackers could be the same as those who used ARTEX to breach South Korea’s financial giants

Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass

Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation.

CISA warns of hackers now exploiting critical Node2Shell flaw

On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell.

Also: TechCrunch

Nefilim and Hive ransomware affiliate gets 70 months in prison

A Ukrainian national was sentenced to 70 months in prison for his role in ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.

Also: SecurityWeek, The Register