VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign

VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign

来源摘录 · CrowdStrike

AI used in Aur0ra ransomware testing and execution

The GOLD OGRE threat group has used AI extensively to develop tools and to orchestrate and execute ransomware operations

来源摘录 · Sophos

Cohere’s Qwen Story: Looks More Like Model Jaggedness

Key findings On October 26, Cohere reported a puzzling incident involving Qwen3.8-Flash-Next, an open-weight model from

来源摘录 · Check Point Research

Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants

Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes

来源摘录 · Cloudflare Blog Security

Chrome for Android Update

Hi, everyone! We've just released Chrome 156 (156.0.8078.79) for Android. It'll become available on Google Play over the

来源摘录 · Google Chrome Releases

Chrome Beta for iOS Update

Hi everyone! We've just released Chrome Beta 158 (158.0.8127.4) for iOS; it'll become available on App Store in the next

来源摘录 · Google Chrome Releases

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the f...

CVE-2026-114444

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its Fi

来源摘录 · NVD / GitHub Advisory

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-fa...

CVE-2026-114443

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the acco

来源摘录 · NVD / GitHub Advisory

zip: AES Entry HMAC Authentication Bypass on Premature EOF

CVE-2026-115906

### Summary An AES-encrypted (AE-x) entry's authentication code is verified only when the reader's byte counter lands e

来源摘录 · GitHub Advisory

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

CVE-2026-9083

### Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulner

来源摘录 · GitHub Advisory

Keycloak allows unauthorized access to resources via uma permission ticket bypass

CVE-2026-9799

### Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access

来源摘录 · GitHub Advisory

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

CVE-2026-9705

### Description A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously i

来源摘录 · GitHub Advisory

Crass: Non-ASCII characters cause superlinear CPU consumption

CVE-2026-61848

### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of m

来源摘录 · GitHub Advisory

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

CVE-2026-61847

### Impact When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comm

来源摘录 · GitHub Advisory

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

CVE-2026-61846

### Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value

来源摘录 · GitHub Advisory

MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow

CVE-2026-55186

### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password a

来源摘录 · GitHub Advisory

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

CVE-2026-115927

### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have

来源摘录 · GitHub Advisory

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

CVE-2026-116577

### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obs

来源摘录 · GitHub Advisory

Amatera: How the prolific infostealer works and spreads

The malware that topped ESET’s infostealer detections in Latin America in the first half of 2026 is an example of how cy

来源摘录 · ESET

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-96203

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

来源摘录 · NVD / GitHub Advisory