Supply-chain news — Is It Dead Yet?

Follow these headlines in your RSS/Atom reader. Included with Free; a verified account is required. Set up your feed → · Your profile →

Up to 50 matching topic groups, latest coverage first. Clear search

Recent headlines · 50

Last completed feed check: 2026-11-05T23:28:43.156Z.

2 sources could not be refreshed

Infostealers, CERT-FR. They will be retried on the next poll.

News topics ordered by latest coverage; first recorded report, key topic, publisher and linked coverage
Latest · UTC	First report	Key topic	Publisher
11-05 23:09	Meet *sshole, the vulnerability that lets hackers SSH into Linux devices ↗Vulnerabilities · Ars Technica Security · 2026-11-05 23:09 UTC	Vulnerabilities	Ars Technica Security
11-05 17:45	OpenSSH flaw lets attackers log into password-disabled Linux accounts ↗Vulnerabilities · BleepingComputer · 2026-11-05 17:45 UTC	Vulnerabilities	BleepingComputer
11-05 13:00	Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries ↗Vulnerabilities · The Register Security · 2026-11-05 13:00 UTC Details us · Checked after news was detected	Vulnerabilities	The Register Security
11-05 11:02	Google puts new limits on AI agents that hunt threats and fix vulnerabilities ↗AI security · Help Net Security · 2026-11-05 11:02 UTC	AI security	Help Net Security
11-05 09:18	GhostMap Android flaw lets malicious app trigger persistent boot loop ↗Vulnerabilities · BleepingComputer · 2026-11-05 09:18 UTC	Vulnerabilities	BleepingComputer
11-05 08:55	CISA Adds One Known Exploited Vulnerability to Catalog ↗CVE-2024-27834 · CISA Alerts & Advisories · 2026-11-05 08:55 UTC 2 more reports First recorded report: CISA Alerts & Advisories · 2026-11-04T12:00:00.000Z Related coverage: Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says ↗ The Hacker News · 2026-11-05 05:17 UTC U.S. CISA adds Apple flaw to its Known Exploited Vulnerabilities catalog ↗ Security Affairs · 2026-11-05 08:55 UTC Article mentions: CVE-2024-27834 No unambiguous tracked-package match.	CVE-2024-27834	CISA Alerts & Advisories
11-04 22:26	Hackers exploited iOS and Android flaws to infect phones ↗Vulnerabilities · Ars Technica Security · 2026-11-04 22:26 UTC	Vulnerabilities	Ars Technica Security
11-04 21:48	Critical Rails Bug Threatens to Derail Vulnerable Servers ↗Vulnerabilities · Dark Reading · 2026-11-04 21:48 UTC	Vulnerabilities	Dark Reading
11-04 21:06	Surviving cybersecurity until the end of 2026 ↗Aikido Security Blog · 2026-11-04 21:06 UTC	—	Aikido Security Blog
11-04 12:11	CISA flags WordPress RCE flaw as actively exploited in attacks ↗Vulnerabilities · BleepingComputer · 2026-11-04 12:11 UTC	Vulnerabilities	BleepingComputer
11-04 11:46	Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory ↗Vulnerabilities · The Hacker News · 2026-11-04 11:46 UTC	Vulnerabilities	The Hacker News
11-04 09:45	CISA Adds One Known Exploited Vulnerability to Catalog ↗CVE-2026-119977 · CISA Alerts & Advisories · 2026-11-04 09:45 UTC 3 more reports First recorded report: CISA Alerts & Advisories · 2026-11-03T12:00:00.000Z Related coverage: CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades ↗ The Hacker News · 2026-11-04 05:43 UTC U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog ↗ Security Affairs · 2026-11-04 09:16 UTC NCSC-2026-0466 [1.00] [L/H] Kwetsbaarheid verholpen in WordPress Core ↗ NCSC Netherlands · 2026-11-04 09:45 UTC Article mentions: CVE-2026-119977 No unambiguous tracked-package match.	CVE-2026-119977	CISA Alerts & Advisories
11-04 00:00	GHSA-v6rj-xm57-3p59 (actionview): Possible XSS vulnerability in Action View highlight helper ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC	Vulnerabilities	RubySec
11-04 00:00	GHSA-rwvh-fw6r-pwvp (actionpack): Possible DoS vulnerability in Action Controller Live streaming ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC	Vulnerabilities	RubySec
11-04 00:00	GHSA-rq8q-p985-fjq7 (actionview): Possible XSS vulnerability in Action View strip_tags ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC	Vulnerabilities	RubySec
11-04 00:00	GHSA-p2pm-g2h6-7j5j (activestorage): Possible DoS vulnerability in Active Storage filename handling ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC	Vulnerabilities	RubySec
11-04 00:00	GHSA-8474-xrp6-wh69 (activesupport): Possible DoS vulnerability in Active Support safe_constantize ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC	Vulnerabilities	RubySec
11-04 00:00	GHSA-4v2w-w6g6-f8f8 (activestorage): Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC	Vulnerabilities	RubySec
11-04 00:00	GHSA-2w9f-fxwj-w2qf (activesupport): Possible XSS vulnerability in Active Support MessagePack serializer ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC	Vulnerabilities	RubySec
11-04 00:00	GHSA-2p2f-4rq4-gjwc (actionview): Possible XSS vulnerability in Action View text helpers ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC	Vulnerabilities	RubySec
11-03 15:06	Barracuda warns of critical flaws allowing root access to devices ↗Vulnerabilities · BleepingComputer · 2026-11-03 15:06 UTC	Vulnerabilities	BleepingComputer
11-03 14:00	Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities ↗Vulnerabilities · Cloudflare Blog · 2026-11-03 14:00 UTC	Vulnerabilities	Cloudflare Blog
11-03 12:21	Android’s November 2026 Updates Patch Over 200 Vulnerabilities ↗Vulnerabilities · SecurityWeek · 2026-11-03 12:21 UTC	Vulnerabilities	SecurityWeek
11-03 08:54	U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog ↗CVE-2026-104935 +2 · Security Affairs · 2026-11-03 08:54 UTC 1 more reports First recorded report: Security Affairs · 2026-10-31T19:33:36.000Z Related coverage: NCSC-2026-0416 [1.01] [H/H] ZeroDay kwetsbaarheden verholpen in Ivanti Connect Secure ↗ NCSC Netherlands · 2026-11-03 08:54 UTC Article mentions: CVE-2026-111357 · CVE-2026-118527 · CVE-2026-104935 No unambiguous tracked-package match.	CVE-2026-104935 +2	Security Affairs
11-02 20:20	What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks ↗Vulnerabilities · Microsoft Security Blog · 2026-11-02 20:20 UTC	Vulnerabilities	Microsoft Security Blog
11-02 15:58	Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain ↗CVE-2026-111357 +1 · SecurityWeek · 2026-11-02 15:58 UTC 2 more reports First recorded report: SecurityWeek · 2026-11-02T07:57:49.000Z Related coverage: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) ↗ Rapid7 Blog · 2026-11-02 11:04 UTC CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) ↗ Help Net Security · 2026-11-02 15:58 UTC Article mentions: CVE-2026-111357 · CVE-2026-118527 No unambiguous tracked-package match.	CVE-2026-111357 +1	SecurityWeek
11-02 12:47	Over 1,000 GitLab servers vulnerable to ongoing RCE attacks ↗Vulnerabilities · BleepingComputer · 2026-11-02 12:47 UTC	Vulnerabilities	BleepingComputer
11-02 11:50	Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers ↗Vulnerabilities · The Hacker News · 2026-11-02 11:50 UTC	Vulnerabilities	The Hacker News
11-01 00:00	Beta9 is vulnerable to a Build Worker Sandbox Escape via Chroot-only Buildah Isolation ↗CVE-2026-120306 · JFrog Security Research · 2026-11-01 00:00 UTC 1 more reports First recorded report: JFrog Security Research · 2026-11-01T00:00:00.000Z Related coverage: Beta9 is vulnerable to a Build Worker Sandbox Escape via Chroot-only Buildah Isolation ↗ JFrog Security Research · 2026-11-01 00:00 UTC Article mentions: CVE-2026-120306 No unambiguous tracked-package match.	CVE-2026-120306	JFrog Security Research
11-01 00:00	Beta9 is vulnerable to a Container Escape via Unvalidated Sandbox File Paths ↗CVE-2026-120307 · JFrog Security Research · 2026-11-01 00:00 UTC Details Article mentions: CVE-2026-120307 No unambiguous tracked-package match.	CVE-2026-120307	JFrog Security Research
11-01 00:00	Beta9 is vulnerable to Host Filesystem Exposure via Volume Path Traversal ↗CVE-2026-120308 · JFrog Security Research · 2026-11-01 00:00 UTC Details Article mentions: CVE-2026-120308 No unambiguous tracked-package match.	CVE-2026-120308	JFrog Security Research
11-01 00:00	Prefab UI is vulnerable to Remote Code Execution via a Pyodide js Bridge to Deno ↗CVE-2026-120338 · JFrog Security Research · 2026-11-01 00:00 UTC Details Article mentions: CVE-2026-120338 No unambiguous tracked-package match.	CVE-2026-120338	JFrog Security Research
10-30 21:09	Critical Linux kernel flaw allows remote root attacks on MPTCP servers ↗Vulnerabilities · BleepingComputer · 2026-10-30 21:09 UTC	Vulnerabilities	BleepingComputer
10-30 20:25	CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗CVE-2026-76418 +1 · CISA Alerts & Advisories · 2026-10-30 20:25 UTC 1 more reports First recorded report: CISA Alerts & Advisories · 2026-10-29T12:00:00.000Z Related coverage: U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog ↗ Security Affairs · 2026-10-30 20:25 UTC Article mentions: CVE-2026-97229 · CVE-2026-76418 No unambiguous tracked-package match.	CVE-2026-76418 +1	CISA Alerts & Advisories
10-30 16:23	Binance’s $6.3 Billion Cyber Heist Shows Crypto Vulnerabilities ↗Vulnerabilities · Bloomberg Technology · 2026-10-30 16:23 UTC	Vulnerabilities	Bloomberg Technology
10-30 15:39	L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara ↗Vulnerabilities · Dark Reading · 2026-10-30 15:39 UTC	Vulnerabilities	Dark Reading
10-30 15:17	TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them ↗Vulnerabilities · The Hacker News · 2026-10-30 15:17 UTC	Vulnerabilities	The Hacker News
10-30 14:08	WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours ↗Vulnerabilities · The Hacker News · 2026-10-30 14:08 UTC	Vulnerabilities	The Hacker News
10-30 14:00	SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone ↗Vulnerabilities · BleepingComputer · 2026-10-30 14:00 UTC	Vulnerabilities	BleepingComputer
10-30 13:00	CISA says max severity GitLab flaw now exploited in the wild ↗Vulnerabilities · BleepingComputer · 2026-10-30 13:00 UTC	Vulnerabilities	BleepingComputer
10-30 12:04	Fresh WordPress Vulnerability in Attackers’ Crosshairs ↗Vulnerabilities · SecurityWeek · 2026-10-30 12:04 UTC	Vulnerabilities	SecurityWeek
10-30 12:00	CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗CVE-2026-111357 +1 · CISA Alerts & Advisories · 2026-10-30 12:00 UTC Details Article mentions: CVE-2026-111357 · CVE-2026-118527 No unambiguous tracked-package match.	CVE-2026-111357 +1	CISA Alerts & Advisories
10-30 11:07	Drupal Commerce Core Vulnerability Exploited Against Online Stores ↗Vulnerabilities · SecurityWeek · 2026-10-30 11:07 UTC	Vulnerabilities	SecurityWeek
10-30 10:16	Drupal warns of critical Commerce Core flaw exploited in attacks ↗Vulnerabilities · BleepingComputer · 2026-10-30 10:16 UTC	Vulnerabilities	BleepingComputer
10-30 05:00	Smart TVs can harbor unpatched security flaws and track what you watch ↗Vulnerabilities · Help Net Security · 2026-10-30 05:00 UTC	Vulnerabilities	Help Net Security
10-29 23:54	PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Detecting unauthenticated remote code execution in PHP core ↗PHP2Shell · Sysdig Blog · 2026-10-29 23:54 UTC 7 more reports First recorded report: Sysdig Blog · 2026-10-28T00:00:00.000Z Related coverage: Even after PHP2Shell, blast radius matters more than a CVSS score ↗ BleepingComputer · 2026-10-28 13:50 UTC PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network ↗ The Hacker News · 2026-10-28 16:02 UTC Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces ↗ The Hacker News · 2026-10-29 05:50 UTC The day after tomorrow: After PHP2Shell, it gets worse, then defenders win ↗ Aikido Security Blog · 2026-10-29 13:00 UTC Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) ↗ Unit 42 by Palo Alto Networks · 2026-10-29 18:00 UTC What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained ↗ Aikido Security Blog · 2026-10-29 19:07 UTC CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL) ↗ Palo Alto Networks Security Advisories · 2026-10-29 23:54 UTC Article mentions: CVE-2026-109618 · CVE-2026-109619 No unambiguous tracked-package match.	PHP2Shell	Sysdig Blog
10-29 16:05	CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗CVE-2026-41709 +1 · CISA Alerts & Advisories · 2026-10-29 16:05 UTC 1 more reports First recorded report: CISA Alerts & Advisories · 2026-10-28T12:00:00.000Z Related coverage: U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog ↗ Security Affairs · 2026-10-29 16:05 UTC Article mentions: CVE-2026-41709 · CVE-2026-46300 No unambiguous tracked-package match.	CVE-2026-41709 +1	CISA Alerts & Advisories
10-29 15:01	Google Says Gemini 4 Carbon Leads in Finding, Exploiting and Fixing Vulnerabilities ↗Vulnerabilities · SecurityWeek · 2026-10-29 15:01 UTC	Vulnerabilities	SecurityWeek
10-29 13:42	Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities ↗Vulnerabilities · SecurityWeek · 2026-10-29 13:42 UTC	Vulnerabilities	SecurityWeek
10-29 13:42	Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities ↗Vulnerabilities · The Hacker News · 2026-10-29 13:42 UTC	Vulnerabilities	The Hacker News

Reviewed incident reports · 0

Last reviewed 2026-10-08. Selected historical incidents; a past compromise does not establish that a current release is compromised.

No reviewed stories match these filters. This does not mean no incidents have occurred.

About this feed and search

Search stored headlines, publishers, article mentions and matched package names, plus reviewed-report summaries. Full article bodies are not searchable. Coverage with the same specific topic is grouped within a 72-hour episode. Each row links to its earliest recorded report; later coverage is linked under Details. Roundups, generic platforms and separate campaign waves are not merged on a broad mention alone. Multiple reports are not independent corroboration. Ecosystem filtering uses package matches, so unmatched articles are excluded when you select an ecosystem.

Article mentions identify terms, not confirmed affected products or versions. Package links are automated leads, not confirmed vulnerability findings. Maintenance checks do not prove an affected version is safe.

Selected vulnerability advisories · 2

Sources and package mappings checked 2026-10-08. This is a manually reviewed selection of historical advisories, not a current exploitation ranking or complete CVE database. The news headlines above update separately.

An identity match is a reason to investigate, not confirmation that your installed release is vulnerable. Manifest checks do not establish runtime configuration or resolve every transitive dependency.

Vulnerability	Product / package relationship
React Server Components denial of service CVE-2026-23864 ↗ React maintainers	React Server Components server packages Server Components deployments only; plain client-side React is not implicated. The January 2026 advisory describes follow-up DoS fixes in 19.0.4, 19.1.5 and 19.2.4. These are historical fixes for this advisory, not a guarantee against later vulnerabilities; follow current upstream guidance. react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack
React Server Components remote code execution CVE-2025-55182 ↗ React maintainers	React Server Components server packages The original RCE advisory identifies 19.0.0, 19.1.0, 19.1.1 and 19.2.0 in the three server packages. Client-only React is outside this scope. Later advisories require further patches; the initial RCE fix does not certify a release against other vulnerabilities. react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack

Vulnerability

Product / package relationship

React Server Components denial of service
CVE-2026-23864 ↗

React maintainers

React Server Components server packages

Server Components deployments only; plain client-side React is not implicated. The January 2026 advisory describes follow-up DoS fixes in 19.0.4, 19.1.5 and 19.2.4. These are historical fixes for this advisory, not a guarantee against later vulnerabilities; follow current upstream guidance.

react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack

React Server Components remote code execution
CVE-2025-55182 ↗

React maintainers

React Server Components server packages

The original RCE advisory identifies 19.0.0, 19.1.0, 19.1.1 and 19.2.0 in the three server packages. Client-only React is outside this scope. Later advisories require further patches; the initial RCE fix does not certify a release against other vulnerabilities.

react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack

Runtime advisories on OpenCVE

Browse CVEs by vendor and product. Runtime CVEs do not automatically apply to every package in that ecosystem; verify affected versions and configurations.

News sources · 81 configured feeds

The news worker checks for due feeds one minute after each completed run. Individual feeds use one-, two- or ten-minute intervals; slow requests can delay a check. Clear tracked-package mentions trigger priority checks; they do not establish that an installed version is vulnerable. Sources without an RSS link and Feedspot’s directory are browsing resources. Reviewed reports above remain curated.

Security news and research

Recent headlines · 50

Meet *sshole, the vulnerability that lets hackers SSH into Linux devices ↗Vulnerabilities · Ars Technica Security · 2026-11-05 23:09 UTC

OpenSSH flaw lets attackers log into password-disabled Linux accounts ↗Vulnerabilities · BleepingComputer · 2026-11-05 17:45 UTC

Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries ↗Vulnerabilities · The Register Security · 2026-11-05 13:00 UTC

Google puts new limits on AI agents that hunt threats and fix vulnerabilities ↗AI security · Help Net Security · 2026-11-05 11:02 UTC

GhostMap Android flaw lets malicious app trigger persistent boot loop ↗Vulnerabilities · BleepingComputer · 2026-11-05 09:18 UTC

CISA Adds One Known Exploited Vulnerability to Catalog ↗CVE-2024-27834 · CISA Alerts & Advisories · 2026-11-05 08:55 UTC

Hackers exploited iOS and Android flaws to infect phones ↗Vulnerabilities · Ars Technica Security · 2026-11-04 22:26 UTC

Critical Rails Bug Threatens to Derail Vulnerable Servers ↗Vulnerabilities · Dark Reading · 2026-11-04 21:48 UTC

Surviving cybersecurity until the end of 2026 ↗Aikido Security Blog · 2026-11-04 21:06 UTC

CISA flags WordPress RCE flaw as actively exploited in attacks ↗Vulnerabilities · BleepingComputer · 2026-11-04 12:11 UTC

Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory ↗Vulnerabilities · The Hacker News · 2026-11-04 11:46 UTC

CISA Adds One Known Exploited Vulnerability to Catalog ↗CVE-2026-119977 · CISA Alerts & Advisories · 2026-11-04 09:45 UTC

GHSA-v6rj-xm57-3p59 (actionview): Possible XSS vulnerability in Action View highlight helper ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC

GHSA-rwvh-fw6r-pwvp (actionpack): Possible DoS vulnerability in Action Controller Live streaming ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC

GHSA-rq8q-p985-fjq7 (actionview): Possible XSS vulnerability in Action View strip_tags ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC

GHSA-p2pm-g2h6-7j5j (activestorage): Possible DoS vulnerability in Active Storage filename handling ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC

GHSA-8474-xrp6-wh69 (activesupport): Possible DoS vulnerability in Active Support safe_constantize ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC

GHSA-4v2w-w6g6-f8f8 (activestorage): Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC

GHSA-2w9f-fxwj-w2qf (activesupport): Possible XSS vulnerability in Active Support MessagePack serializer ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC

GHSA-2p2f-4rq4-gjwc (actionview): Possible XSS vulnerability in Action View text helpers ↗Vulnerabilities · RubySec · 2026-11-04 00:00 UTC

Barracuda warns of critical flaws allowing root access to devices ↗Vulnerabilities · BleepingComputer · 2026-11-03 15:06 UTC

Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities ↗Vulnerabilities · Cloudflare Blog · 2026-11-03 14:00 UTC

Android’s November 2026 Updates Patch Over 200 Vulnerabilities ↗Vulnerabilities · SecurityWeek · 2026-11-03 12:21 UTC

U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog ↗CVE-2026-104935 +2 · Security Affairs · 2026-11-03 08:54 UTC

What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks ↗Vulnerabilities · Microsoft Security Blog · 2026-11-02 20:20 UTC

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain ↗CVE-2026-111357 +1 · SecurityWeek · 2026-11-02 15:58 UTC

Over 1,000 GitLab servers vulnerable to ongoing RCE attacks ↗Vulnerabilities · BleepingComputer · 2026-11-02 12:47 UTC

Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers ↗Vulnerabilities · The Hacker News · 2026-11-02 11:50 UTC

Beta9 is vulnerable to a Build Worker Sandbox Escape via Chroot-only Buildah Isolation ↗CVE-2026-120306 · JFrog Security Research · 2026-11-01 00:00 UTC

Beta9 is vulnerable to a Container Escape via Unvalidated Sandbox File Paths ↗CVE-2026-120307 · JFrog Security Research · 2026-11-01 00:00 UTC

Beta9 is vulnerable to Host Filesystem Exposure via Volume Path Traversal ↗CVE-2026-120308 · JFrog Security Research · 2026-11-01 00:00 UTC

Prefab UI is vulnerable to Remote Code Execution via a Pyodide js Bridge to Deno ↗CVE-2026-120338 · JFrog Security Research · 2026-11-01 00:00 UTC

Critical Linux kernel flaw allows remote root attacks on MPTCP servers ↗Vulnerabilities · BleepingComputer · 2026-10-30 21:09 UTC

CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗CVE-2026-76418 +1 · CISA Alerts & Advisories · 2026-10-30 20:25 UTC

Binance’s $6.3 Billion Cyber Heist Shows Crypto Vulnerabilities ↗Vulnerabilities · Bloomberg Technology · 2026-10-30 16:23 UTC

L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara ↗Vulnerabilities · Dark Reading · 2026-10-30 15:39 UTC

TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them ↗Vulnerabilities · The Hacker News · 2026-10-30 15:17 UTC

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours ↗Vulnerabilities · The Hacker News · 2026-10-30 14:08 UTC

SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone ↗Vulnerabilities · BleepingComputer · 2026-10-30 14:00 UTC

CISA says max severity GitLab flaw now exploited in the wild ↗Vulnerabilities · BleepingComputer · 2026-10-30 13:00 UTC

Fresh WordPress Vulnerability in Attackers’ Crosshairs ↗Vulnerabilities · SecurityWeek · 2026-10-30 12:04 UTC

CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗CVE-2026-111357 +1 · CISA Alerts & Advisories · 2026-10-30 12:00 UTC

Drupal Commerce Core Vulnerability Exploited Against Online Stores ↗Vulnerabilities · SecurityWeek · 2026-10-30 11:07 UTC

Drupal warns of critical Commerce Core flaw exploited in attacks ↗Vulnerabilities · BleepingComputer · 2026-10-30 10:16 UTC

Smart TVs can harbor unpatched security flaws and track what you watch ↗Vulnerabilities · Help Net Security · 2026-10-30 05:00 UTC

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Detecting unauthenticated remote code execution in PHP core ↗PHP2Shell · Sysdig Blog · 2026-10-29 23:54 UTC

CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗CVE-2026-41709 +1 · CISA Alerts & Advisories · 2026-10-29 16:05 UTC

Google Says Gemini 4 Carbon Leads in Finding, Exploiting and Fixing Vulnerabilities ↗Vulnerabilities · SecurityWeek · 2026-10-29 15:01 UTC

Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities ↗Vulnerabilities · SecurityWeek · 2026-10-29 13:42 UTC

Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities ↗Vulnerabilities · The Hacker News · 2026-10-29 13:42 UTC