news
Security and Windows TCO Leftovers
-
Security Week ☛ Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Threat actors have been observed delivering cryptocurrency miners and proxy software.
-
Daniel Stenberg ☛ Do minor curl vulnerabilities in the open
The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in our Microsoft's proprietary prison GitHub repository.
-
Security Week ☛ One Compromised Login Exposed Millions of California Students’ Records
Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006.
-
Security Week ☛ Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
The persistent, stealthy FortiGate implant was deployed against a telecommunications organization.
-
Security Week ☛ Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.
-
Security Week ☛ ConnectWise Suspends Cloud Services in Response to Cyberattack
The services remain unavailable as the company continues remediation and security validation.
-
Security Week ☛ Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Critical flaws impact the Entity List and Field UI modules, and exploit paths exist with contributed modules.
-
LWN ☛ Security updates for Monday
Security updates have been issued by AlmaLinux (idm:DL1, kernel, libsoup, perl-URI, python3.14-urllib3, and webkit2gtk3), Debian (apache2, cifs-utils, haproxy, jq, kernel, and xen), Fedora (aom, chezmoi, chromium, docker-buildx, freeipa, freerdp, GitPython, httpd, jfrog-cli, kernel, knot, libheif, log4net, mongo-c-driver, nant, NetworkManager, openssl, plasma-nm, python-cairosvg, python-django5, python-django6, qt5-qtbase, radicale, rust-faster-hex, rust-onefetch, SDL3_image, syncthing, thunderbird, tor, webkitgtk, and wordpress), Mageia (curl, libreoffice, mozjs140, mutt, nodejs-braces, parted, perl-Net-Whois-Raw, perl-XS-Parse-Keyword, and python-django), Oracle (kernel, kernel-uek, python36:3.6, and wireshark), Red Hat (gvfs, kernel, and kernel-rt), Slackware (libXtst), and SUSE (agama, ansible-core, bcel, bind, buildah, busybox, cadvisor, chromium, cosign, cups-filters, distribution-registry, fetchmail, gcc13, ghostscript, gimp, glib2, go1.26, go1.27, golang-github-lusitaniae-apache_exporter, golang-github-prometheus-alertmanager, google-osconfig-agent, grype-db, hauler, hawk2, helm, ImageMagick, iperf, kernel, libheif, libpng16, librsvg, libsoup, libsoup2, libthrift-0_25_0, libx11, libxi, libxpm, mutt, ntfs-3g_ntfsprogs, nvidia-open-driver-g07-signed, nvidia-open-driver-G07-signed-check, openssl-3, openvpn, p11-kit, pacemaker, perl-xs-parse-keyword, pgvector, php8, podman, psqlodbc, python-anyio, python-hpack, python-jwcrypto, python-oauthlib, python-pyjwt, python-tornado6, python-urllib3, python-virtualenv, python313-ruff, python313-social-auth-app-django, python313-urllib3, python313-urllib3_1, python313-validators, python313-waitress, python313-zipp, qemu, qsnapper, squid, strongswan, stunnel, swtpm, unbound, virtiofsd, webkit2gtk3, xen, and xwayland).
-
The Register UK ☛ Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking
Paulos Yibelo, the researcher who in early October claimed to have found a guest-host escape flaw in Linux KVM, the hypervisor used by most hyperscale clouds, has named the flaw PwnEscape and warned it might represent a new way to attack Linux – on top of being a 9.3-rated critical nasty in its own right.
Yibelo’s work is now CVE-2026-99999. It is a scary bug because it makes a guest-host escape possible with a few malformed IPv4 packets.
-
Windows TCO / Windows Bot Nets
-
Security Week ☛ Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect backdoored Windows PCs via ClickFix lures.
-