Topic
What attackers are exploiting right now, which version fixes it, and the research that tracks the groups doing it.
Bank Rakyat websites were defaced late on 6 November by an attacker calling itself Marlanwg, which claims internal access. The Malaysian bank has confirmed only an access problem.
An OpenSSH password authentication bypass lets attackers into Alpine Linux servers running sshd without PAM through accounts with no password set. Fixed packages shipped on 5 November; no CVE has been assigned.
Zyxel GS1900 switches patched in June are still open to unauthenticated command execution. The new flaw, CVE-2026-107441, is fixed in 2.90 Patch 3 firmware.
CERT-In warns Indian banks, NBFCs, fintechs and crypto exchanges that the Crafty Falcon campaign is using AI attack tools and their own payment APIs to move money out.
A flaw in APT, the package manager behind Debian and Ubuntu, lets an attacker on the network path replace a verified package and run code as root. Debian has fixed it; Ubuntu hasn't yet.
CISA lists WordPress core flaw CVE-2026-119977 as exploited. A race during full-package core updates can give an unauthenticated attacker code execution; 7.1.4 and backports fix it.
Binance's first incident report traces the 29 October theft to a fake job interview, a tampered Homebrew install and a compromised internal AI tool, ending in abuse of Ethereum's EIP-7702. About $2.85bn is frozen.
People's Party leader Natthaphong Ruengpanyawut and Democrat leader Abhisit Vejjajiva say Apple warned them of spyware attacks on their iPhones. The digital economy minister says Pegasus isn't confirmed and will raise it at the National Security Council.
The n0n ransomware group listed 38 maritime and logistics firms on 12 October, among them Singapore's ONE and Apical, Indonesia's ILCS Pelindo, Vietnam's Nam Dinh Vu Port and India's NCT Kandla. None has confirmed a breach.
An unauthenticated WordPress pingback can make the server decode attacker-supplied Brotli data, reaching CVE-2026-111497. Code execution is shown on one Docker image; the fix is a patched libbrotli, not a WordPress update.
Ransomware is encrypting Synology NAS boxes and renaming files .L0CK3D. Synology says attackers exploit a flaw patched in December 2024; Qihoo 360 points to two September 2026 bugs. Which DSM builds fix both.
SEBI's 30 October order fines CDSL ₹1 crore after an FY 2023-24 inspection found unpatched vulnerabilities, endpoints outside DLP, a narrow VAPT and pledge lapses. It's CDSL's second ₹1 crore penalty this year.
