jeudi 15 octobre 2026

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware,

Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud

The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]

Ledger asks sellers across Asia to halt sales after supply-chain attack

Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]

Cisco patches new Secure Email Gateway zero-day exploited in attacks

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.  CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability  CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability  CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability  These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.  Binding Operational Directive (BOD)

Microsoft fixes VPN issues caused by September Windows updates

Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. [...]

The Blind Spots of Agentic Pentesting and How to Close Them

AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. [...]

Package managers have an integrity problem

I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat. Of the 25 package managers reviewed 1 , fewer than half used lockfiles that checked for tampering by default, and only two verified the integrity of every package they downloaded. Supply-chain attacks caused by developer compromise are a common story, but imagine what happens if ongoing m

Front Lines Podcast: What Founders Get Wrong When Pitching CISOs

On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.

Socket for Origin Now Available

Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace.

v5.4.54

Changelog ( v5.4.53...v5.4.54 ) minor #66959 Release v5.4.54 security #cve-2026-109449 [ExpressionLanguage] Bound the nesting level of parsed expressions ( @nicolas-grekas , @lazerg ) security #cve-2026-108082 [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack ( @nicolas-grekas ) security #cve-2026-109413 [Yaml] Bound recursion depth in the inline lexer ( @nicolas-grekas ) bug #66938 [HttpClient] Don't add the query option again to redirect targets in NoPrivateNetworkHttpClient ( @nicolas-grekas ) bug #66723 [ExpressionLanguage] Bound the depth of the parsed node t

Next.js Security Update for Upstream Vulnerabilities

The October 14, 2026 out-of-band security update for Next.js is now available

SymfonyCon Warsaw 2026: Web-less Console: Standalone Apps in Symfony 8.2

Want to sharpen your PHP and Symfony skills? SymfonyCon Warsaw 2026 is hitting Poland on November 26-27! Join developers from around the world for two days of 3 parallel tracks and great community events. Secure your spot now and get ready! 🎤 Speaker…

Node.js 24.22.0 (LTS)

Node.js 26.12.0 (Current)

Tree Appreciator

Tool: Tree Appreciator Another game experiment with Claude. This one used the default Claude iPhone app (chat mode, not Claude Code mode), where I prompted Claude Opus 5.5 Max with: Build a three js game called "Tree appreciator" - it shows you two algorithmically generated trees and the game mechanics is about appreciating the differences between them. Think hard about how to make sure it is both fun and beautiful. Somewhat embarrassingly given my recent talk , I've found that telling Opus 5.5 "make sure it is fun" works uncomfortably well. In this case Claude crunched for 3 hours and 7 minut

AI is mass decompiling games. That's both awesome and scary.

AI is mass decompiling games. That's both awesome and scary. Indie game developer Popcar talks about the recent wave of AI-powered decompilation of existing games, enabling weird mashups between existing games, and producing a boom in game preservation projects to get old games working on new hardware (often in a browser using WebAssembly). I like how this piece captures both the positives and the negatives of this new development: Most people already realized the scary part by now. If AI can decompile games and software, then the entire tech industry is about to explode. Anybody can decompile

HiRO-ACEv2: Simulating extreme weather at 3 km resolution for a fraction of the cost

SentinelOne cuts malware analysis from weeks to hours

With OpenAI Daybreak, SentinelOne cuts weeks of malware analysis to hours, creating capacity to investigate more threats.

Amp puts AI agents to work beyond code with OpenAI models

See how Amp pushes the frontier of what agents can do with GPT-6 Astra, Ultrafast, GPT-Live-1, and Sign in with ChatGPT.

AI Agent Security Risks: What Can Go Wrong When Agents Act on Their Own

Learn the top AI agent security risks, from prompt injection to excessive autonomy and credential exposure, and how to contain them.

Harbor + Docker Sandboxes: Run Safe, Reproducible Agent Evals

Harbor can now run every eval task in Docker Sandboxes Docker Sandboxes are MicroVM environments to run agents like Claude Code, Codex, Cursor, and more safely With Sandboxes, define custom network policies for fair, reproducible evals Run your evals locally or in the cloud: starting for free on Docker Sandboxes on local surfaces and scaling...

Yandex outage: Data shows that instead of going dark, malicious bots went on the move

When strikes hit Yandex data centers, many assumed Russian bot operations went dark. Cloudflare data reveals that while search crawling stopped, malicious bots simply migrated to other networks.

GitHub availability report: September 2026

In September, we experienced two incidents that resulted in degraded performance across GitHub services. The post GitHub availability report: September 2026 appeared first on The GitHub Blog .

From 2,500 requests to 24: Rebuilding star history without the stargazers

Our new repo star history API now provides trends without returning individual identities or requiring unbounded database work. These are the engineering tradeoffs we made. The post From 2,500 requests to 24: Rebuilding star history without the stargazers appeared first on The GitHub Blog .

Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug

While adding MySQL support to Hyperdrive, we found a subtle protocol bug when caching query results. Here is how we tracked down a 0.001% rate error and made Hyperdrive MySQL generally available.

Why Is My Kubernetes Job Still Pending? Tracing Kueue Admission with Headlamp

You submit a Kubernetes Job and wait for its Pods to appear. A minute passes. Then another. The Job is still suspended, there are no application logs, and there may not even be a Pod to inspect. In a cluster managed by Kueue , this can be completely normal. Kueue may still be deciding whether the Job can use the requested resources. The useful question is not only “Why is the Pod pending?” It is first “Has Kueue admitted the Workload?” The Kueue plugin for Headlamp brings that investigation into the Headlamp UI. Instead of reconstructing the admission path from several commands and large YAML