Categories
19 articles
Cybersecurity News
Threat actor k0t targets exposed Fortinet and Palo Alto firewalls and VPNs: over 70,000 credentials
Group-IB and NyxLab have uncovered a campaign by the actor k0t that scans the internet for vulnerable Fortinet and Palo Alto firewalls and VPNs, regardless of sector or size. It is linked to Qilin ransomware. If you…
Cybersecurity News
GitLab fixes a CVSS 10.0 flaw that lets unauthenticated attackers run code on self-hosted servers
GitLab has released patches for CVE-2026-110264, a maximum-severity flaw (CVSS 10.0) that lets an attacker with no credentials run code on self-hosted GitLab servers. GitLab.com is not affected. If your company or your…
Cybersecurity News
PHP2Shell: PHP patches two critical flaws already facing exploitation attempts
On 21 October PHP released emergency patches for PHP2Shell, two critical flaws (CVSS 9.2) that let an attacker without an account run code on a web server. They affect PHP sites such as WordPress or PrestaShop, even if…
Cybersecurity News
CISA, the FBI and European agencies warn about SafePay, the ransomware that gets in through your VPN
CISA, the FBI and agencies from Germany and the UK are warning about SafePay, a ransomware group that has hit at least 600 organisations across Europe, the Americas and Australia. It gets in through VPNs, stolen…
Cybersecurity News
Rank Math PRO shipped a backdoor for 11 hours: how to tell if your WordPress site is affected
Copies of Rank Math PRO, a paid SEO plugin for WordPress, downloaded or updated between 20:02 UTC on 15 October and 07:12 UTC on 16 October contained a backdoor. If your site installed and activated it in that window…
Cybersecurity News
Next.js fixes two critical remote code execution flaws and a denial-of-service bug
Next.js has shipped an urgent update fixing two critical remote code execution flaws (CVSS 9.5) and a denial-of-service bug. It affects websites, online shops and customer portals built with the framework. Ask your team…
Cybersecurity News
Attackers breach hundreds of Microsoft 365 tenants with stolen ConnectWise Cloud Backup credential
Attackers used the stolen credential of the ConnectWise Cloud Backup app (formerly SkyKick) to get into hundreds of Microsoft 365 tenants, including in Spain. If you or your IT provider ever installed it, even if it…
Cybersecurity News
BeyondTrust fixes critical Remote Support flaw CVE-2026-102764, exploited by a Chinese group
BeyondTrust has fixed CVE-2026-102764, a critical flaw (CVSS 9.3) in Remote Support that a Chinese espionage group has exploited since 29 August. It affects self-hosted appliances up to 26.2.3; SaaS customers are…
Cybersecurity News
Attackers exploit a flaw in Nextcloud's built-in Collabora Online app to plant backdoors
Attackers are exploiting an unauthenticated command injection flaw (CVE-2026-110447) in Nextcloud's 'Collabora Online - Built-in CODE Server' app to plant PHP webshells. It affects you if you self-host Nextcloud with…
Cybersecurity News
Microsoft fixes an exploited Windows zero-day that bypasses Mark of the Web in a record Patch Tuesday
Microsoft's October Patch Tuesday, its largest yet, fixes CVE-2026-96951: an actively exploited Windows Shell flaw that lets internet files open without SmartScreen or Office warnings. It affects any business running…
Cybersecurity News
Attackers exploit a critical Bricksforge WordPress plugin flaw that lets them take over websites
Attackers are exploiting a critical flaw (CVE-2026-85097) in the Bricksforge WordPress plugin that lets them run code on a website without logging in. It affects Bricks-built sites running Bricksforge up to version…
Cybersecurity News
Attackers try to exploit critical SonicWall SMA1000 flaw CVE-2026-102255 three days after the patch
Since 8 October, attackers have been trying to exploit CVE-2026-102255, a maximum-severity flaw (CVSS 10.0) in SonicWall SMA1000 6210, 7210 and 8200v remote access gateways. SonicWall patched it on 6 October. If you run…
Cybersecurity News
Flax Typhoon exploits eight flaws in common software, and Spain signs the joint advisory
Flax Typhoon, a China-linked group, is exploiting eight flaws in widely used software, and CISA added five to its KEV catalog on 8 October. Spain co-signs the joint advisory. It affects companies running their own…
Cybersecurity News
Attackers exploit two unpatched AhsayCBS flaws, and the latest version, 10.3.4, is still vulnerable
Attackers are exploiting two unpatched flaws in AhsayCBS, a backup management console popular with IT providers, to run code remotely. Even the latest version, 10.3.4, is affected. If an MSP or integrator handles your…
Cybersecurity News
FortiBleed is still active: FBI warns of attacks on FortiGate firewalls using stolen credentials
The FBI and the US Secret Service warn that FortiBleed is still active: attackers are getting into Fortinet FortiGate firewalls and SSL VPNs with stolen or reused credentials, sometimes locking administrators out. If…
Cybersecurity News
Attackers are exploiting critical CVE-2026-21589 in Jira and Confluence Data Center
Since 7 October, attackers have been trying to exploit CVE-2026-21589, a critical flaw that lets anyone read files without authentication in eight self-hosted Atlassian Data Center products, including Jira, Confluence…
Cybersecurity News
A malicious spreadsheet can run code in LibreOffice and OpenOffice; only LibreOffice has a patch
A malicious spreadsheet can run an attacker's code in LibreOffice and Apache OpenOffice as soon as it is opened, with no macro warning, if Java is enabled. It affects any company using these suites. Update LibreOffice…
Cybersecurity News
Warlock ransomware keeps breaching unpatched on-premises SharePoint and targets Spanish-speaking countries
Symantec warns that the Warlock ransomware group is still breaking into unpatched on-premises SharePoint servers and has hit organisations in Spanish- and Portuguese-speaking countries, including in Europe. If your…
Cybersecurity News
Fortinet warns of a critical FortiMail flaw exploited as a zero-day and still unpatched
Fortinet has confirmed attackers are already exploiting CVE-2026-104286, a critical FortiMail flaw that lets them write files to the system without authenticating. It affects the 7.2, 7.4, 7.6 and 8.0 branches, and the…
