Aggregator

Warhorse подтвердила проникновение, но пока не раскрыла, какую информацию могли получить злоумышленники.

Chainalysis has confirmed that an attacker used “offensive agentic techniques” to access its systems and internal tools, exposing customer account details. The blockchain investigation company said the accessed information included user IDs, full names, email addresses, and organization role labels, while its investigation has found no evidence that customer investigation content or authentication secrets were […]

The post Chainalysis Confirms Cyberattack Using Agentic Techniques That Exposed Customer Data appeared first on Cyber Security News.

A vulnerability described as critical has been identified in SoftIron HyperCloud up to 2.6.17. Affected by this vulnerability is an unknown functionality of the component Orchestrator. The manipulation results in command injection. This vulnerability is reported as CVE-2026-116755. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

本文详细记录了对某智能灯泡的低功耗蓝牙（BLE）安全测试全过程。文章从 Wireshark 与 nRF52832 抓包环境的搭建切入，直击物联网设备通信痛点，演示了如何捕获设备指令、逆向分析 GATT 读写 Payload，并成功利用 nRF Connect 实施重放攻击接管设备。文末针对实测漏洞，提出了引入随机数、挑战-应答机制及链路层加密等安全防护建议。

A vulnerability has been found in Node.js up to 24.22.0/26.12.0 and classified as problematic. This impacts the function tls.checkServerIdentity of the component TLS Hostname Verification. This manipulation causes improper certificate validation. This vulnerability is registered as CVE-2026-105483. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, has been found in Node.js. The impacted element is the function tls.checkServerIdentity of the component Hostname Verification. The manipulation leads to improper certificate validation. This vulnerability is listed as CVE-2026-106069. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability classified as critical was found in Node.js up to 22.23.3/24.22.0/26.12.0. The affected element is an unknown function of the component HTTP Agent. Executing a manipulation can lead to improper synchronization. This vulnerability is tracked as CVE-2026-105481. The attack can be launched remotely. No exploit exists.

A vulnerability, which was classified as critical, was found in Node.js. This affects the function dns.reverse of the component DNS Resolution. The manipulation of the argument Name results in improper input validation. This vulnerability is cataloged as CVE-2026-105482. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability has been found in FasterXML jackson-databind and classified as critical. Affected by this vulnerability is the function DatabindContext._resolveAndValidateGeneric of the component Generic Argument Validation. Performing a manipulation results in deserialization. This vulnerability is reported as CVE-2026-110879. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as critical has been discovered in x.org libXtst up to 1.2.5. This affects an unknown part of the component RECORD Reply Parser. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-94286. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability, which was classified as critical, was found in X.org libXrender up to 0.9.12. Impacted is the function RenderQueryPictFormats. Such manipulation leads to heap-based buffer overflow. This vulnerability is documented as CVE-2026-88807. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability identified as problematic has been detected in Red Hat Enterprise Linux. This affects an unknown function of the component PostgreSQL Data Backup. The manipulation of the argument leapp_old_postgresql_data leads to incorrect default permissions. This vulnerability is listed as CVE-2026-68563. The attack must be carried out locally. There is no available exploit.

A vulnerability classified as problematic has been found in Red Hat Enterprise Linux 10/9. Affected by this issue is some unknown functionality. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2026-68562. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as problematic, has been found in OPNsense up to 26.1.10. This impacts the function OPNsense\Core\ACL::hasPrivilege of the component ACL. This manipulation causes improper privilege management. This vulnerability is registered as CVE-2026-71490. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability was found in OPNsense up to 26.1.10 and classified as critical. The affected element is the function readline of the file syslog-ng-lockout.conf of the component WebGUI Login. The manipulation of the argument usernamefld results in injection. This vulnerability is known as CVE-2026-63442. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability identified as problematic has been detected in OPNsense up to 26.1.10. This affects the function ApiMutableModelControllerBase::delBase of the file config.xml of the component Safe-Delete. Performing a manipulation results in improper neutralization of data within xpath expressions. This vulnerability is identified as CVE-2026-58395. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

简介RSSHub 是一个开源的 RSS 生成器,能给本身没有 RSS 的网站(B 站、微博、GitHub Trending、Telegram 频道等)生成订阅源。不想

第六届全国开源情报技术大会（COSINT 2026）2026 年 11 月 13—15 日　·　贵州 · 贵阳

本报告全部基于公开来源情报（OSINT）：47份本地PDF文献（含美国国务院、GTI、EUAA、OSAC、Soufan Center、学术专著等）与多语种互联网检索（检索执行日2026-10-30），未使用任何涉密或非公开渠道。

A vulnerability was found in Linux Kernel up to 6.19.10. It has been rated as critical. Affected by this vulnerability is an unknown functionality. This manipulation causes denial of service. The identification of this vulnerability is CVE-2026-31573. The attack needs to be done within the local network. There is no exploit available. Upgrading the affected component is advised.