Threats

North Korea Phishes Ukrainians for War Intel

The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.

Dark Reading · 2d ago

Threats

Anthropic Finds Ingredients for Future AI Worms

Anthropic's latest study combines IoT and network tests to explore AI self-replication, which researchers said would be "challenging" to shut down.

Dark Reading · 2d ago

Threats

Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The…

The Hacker News · 2d ago

Vulnerabilities critical

Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30…

The Hacker News · 2d ago

Vulnerabilities critical

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes…

The Hacker News · 2d ago

Vulnerabilities critical

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw…

The Hacker News · 2d ago

Vulnerabilities

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a…

The Hacker News · 2d ago

Threats

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is…

The Hacker News · 2d ago

Vulnerabilities Official

Inductive Automation Ignition Software

View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level. The following versions of Inductive Automation Ignition Software are affected…

CISA Advisories · 2d ago

Vulnerabilities critical Official

Swann Communications SWIFI-SE2KIC

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SWIFI-SE2KIC firmware <=2.0.22 (CVE-2026-107605, CVE-2026-107606…

CISA Advisories · 2d ago · CVE-2026-107605, CVE-2026-107606 +1

Vulnerabilities critical Official

CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure

CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber…

CISA Advisories · 2d ago · CVE-2026-104935

Vulnerabilities high Official

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-96951 Microsoft Windows Command Injection Vulnerability CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by…

CISA Advisories · 2d ago · CVE-2026-96951, CVE-2026-104935