Archive
A race during WordPress core updates can let an unauthenticated attacker run code. WordPress 7.1.4 and backports fix it; Wordfence says it blocked 62,969 attempts in a day.
Attackers chained two newly disclosed Ivanti Connect Secure flaws with the October zero-day CVE-2026-104935. Ivanti's fixes are 25.1.1.3 and 22.8R2.6; the integrity checker can miss a compromise.
Binance puts the 29 October theft at about $6.3 billion and traces it to a compromised DevOps engineer's laptop. TRM Labs and Chainalysis attribute it to North Korea's TraderTraitor.
An attacker chained PHP2Shell with the Fragnesia kernel bug to get root on 24 Palo Alto firewalls and a management server. Palo Alto confirms it. Fixed PAN-OS versions inside.
The Supreme Court says RBI's new rules must make banks compensate digital arrest and cyber fraud victims in full where due diligence failed. RBI has to notify them by 30 November.
Amnesty International names five Cambodian security companies at scam compounds and links more than 20 soldiers and police to them. The firms deny it; Cambodia says 77 officers were disciplined.
A People's Party MP, citing NCSA figures, says 1,246 of 14,828 Thai government systems support multi-factor authentication, two months after leaked passwords forced a clean-up.
A Singapore petrochemical firm paid US$12.8 million to a scammer's account in Cambodia after a fake change of bank details. Police, OCBC and Cambodian police got it all back.
Trackers saw billions in crypto leave Binance's hot wallets on 29 October. Binance calls it a security incident, has paused withdrawals on several networks and says $2.54 billion is frozen.
Apple confirms curl, git and python3 on macOS still accept the compromised eMudhra certificates. What Apple, Microsoft, Cisco and Google tell admins to do.
A use-after-free in the Linux kernel's IPv4 TCP handshake, scored 9.8. Red Hat shipped RHEL 8, 9 and 10 fixes on 1 November; Ubuntu kernels are still pending. Status by distribution.
CISA added a CVSS 10 GitLab code-execution bug and a Cisco ASA/FTD SSL VPN crash bug to its exploited list on 29 October. Fixed versions and mitigations.
