What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
Cisco Talos · Research ·
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Cisco Talos reports new UAT-6275 espionage activity.
Cisco Talos and Recorded Future's Insikt Group say UAT-6275 targets government and critical infrastructure across the Commonwealth of Independent States. The threat actor uses custom reverse shells and exploits a WinRAR vulnerability. Researchers gained visibility into the threat actor's infrastructure and malware development due to operational security lapses. UAT-6275 is evolving its tradecraft and preparing to expand its reach into Linux hosts.
Recommended by the publisher: Defenders should monitor for unexpected PowerShell activity and payload downloads from public services like GitHub and ensure archive utilities are fully patched.
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Candiru spyware infected Al Jazeera devices via ads.
Citizen Lab researchers say Candiru spyware infected Al Jazeera devices through online ads. The attack code ran when an ad loaded, sometimes in the background. The Citizen Lab reports this needed no user action.
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx targets CIS governments.
The Hacker News reports Silent Lynx attacks CIS government organizations. The attacks use macro documents and crafted WinRAR archives. The activity was observed from June 2025 to August 2026.
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
Help TDS affects 20,000+ Cloudflare Pages domains.
The Hacker News reports Help TDS is linked to Hotejka, a Russian-language affiliate program. It has been active since at least 2017. Compromised websites are used to direct users to tech support scams.
ARMORY CASTLE exploits BeyondTrust Remote Support vulnerability CVE-2026-102764.
Google Threat Intelligence reports that ARMORY CASTLE, a suspected PRC-nexus espionage threat actor, exploited the vulnerability as a zero-day in late August 2026. The exploitation results in the arbitrary upload of files. Mandiant identified evidence of exploitation and observed the threat actor establish a foothold and escalate privileges. The vulnerability affects BeyondTrust Remote Support appliances.
Recommended by the publisher: Google Threat Intelligence recommends that affected organizations immediately apply the security patches provided by BeyondTrust to remediate the vulnerability.
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX fixes five vulnerabilities.
The Hacker News reports NGINX released versions 1.30.6 and 1.31.7 to fix five vulnerabilities, one of them present since May 2005. F5 says three memory bugs could crash a worker process or possibly let an attacker run code. A fourth bug lets an attacker forge a TLS session.
Recommended by the publisher: Update to versions 1.30.6 or 1.31.7.
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js fixes two critical RCE flaws.
The Hacker News reports Next.js released a security update fixing two critical flaws allowing unauthenticated remote code execution. One flaw is in React Server Components and the other in librsvg. The fixes address high-severity denial-of-service flaws as well.
Recommended by the publisher: The Hacker News says Next.js shipped an out-of-band patch.
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal patches critical Field UI flaw.
The Hacker News reports a critical flaw in Drupal's Field UI module allows code execution on the site's server. The Drupal Security Team says an attacker cannot reach the flaw through core alone. Several exploit paths exist through contributed modules, with at least one path needing no login. Fixes were shipped in Drupal 11.4.10, 11.3.19, and 10.6.19.
Recommended by the publisher: Update to Drupal 11.4.10, 11.3.19, or 10.6.19.
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers impersonate AI products.
The Hacker News reports attackers impersonate AI products to distribute malware and steal sessions. ANY.RUN linked 1,258 analyses to fake AI campaigns. US businesses are targeted.
Recommended by the publisher: MSSPs can stop incidents early.
Palo Alto Networks patches PAN-OS flaw under active exploitation.
The Hacker News reports a high-severity flaw in PAN-OS software is being actively exploited. The vulnerability, tracked as CVE-2026-0322, allows remote code execution in the management interface. Palo Alto Networks issued security updates for the flaw.
Recommended by the publisher: The Hacker News does not recommend any actions.
The Hacker News reports AI tools are used in digital forensics and incident response, their output is not reliably verified, this gap can spread beyond a workstation.
Google Threat Intelligence reports a software supply chain compromise targeting AOMEI Technology.
The threat actor, attributed to UNC7017, conducted repeated short-burst configuration tampering against AOMEI's update infrastructure. The campaign delivered a multi-stage payload chain involving the CROSSROAD downloader and SHINYROAD backdoor. Impacted organizations spanned diverse sectors in multiple countries. The campaign was identified through collaborative research with the ManageEngine Threat Analysis Lab.
Recommended by the publisher: GTIG notified potentially affected organizations and shared technical findings with AOMEI Technology, which took corrective action to secure their distribution servers.
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1
India mandates caller name display on 4G networks.
The Hacker News reports the Indian government directed telecom service providers to display callers' registered names for incoming calls from November 1, 2026, to tackle spam calls. This applies to 4G and newer networks. The Department of Telecommunications issued a circular to service providers. The goal is to help people identify unknown calls.
Recommended by the publisher: The Hacker News does not recommend any action.
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction compromises 1,900 GitHub accounts.
The Hacker News reports GhostAction targets over 30,000 repositories. GitGuardian observed the spike on October 8 and 9, 2026. It attempted to extract secrets from public repositories' CI.
The Hacker News reports that threat actors are exploiting a critical security flaw in Langflow, according to Previdian. The vulnerability is CVE-2026-105740 with a CVSS score of 9.9. Langflow is an open-source platform for building AI applications. The flaw allows for authenticated RCE.
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
AhsayCBS flaws exploited to deploy web shells.
The Hacker News reports AhsayCBS has two security flaws, CVE-2026-105133 and CVE-2026-105134, that can be chained to execute arbitrary commands. Ahsay Backup released security updates to address these flaws. The vulnerabilities were exploited to drop web shells and XMRig cryptocurrency miners.
Recommended by the publisher: Ahsay Backup released security updates to address these flaws.
The Hacker News reports attackers are exploiting a critical flaw in Cisco Secure Email Gateway. The attacker sends an email with a crafted attachment through the gateway and could run commands as root. Cisco said this in an advisory.
Recommended by the publisher: The Hacker News reports no recommended actions.
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Hackers backdoor Nextcloud servers through Collabora flaw.
The Hacker News reports attackers exploited a flaw in Collabora Online to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub. A web shell executes any command an attacker sends via a web request.
Recommended by the publisher: No recommended action is given.
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft disrupts 3 phishing kits.
The Hacker News reports Microsoft and partners disrupted CoGUI, Haozi, and Iron Man System kits. These kits sent over 1 billion scam messages since January 2026. The kits were linked to threat actors.