New York, United States, 28th October 2026, CyberNewswire
Tag: Vulnerability
Cloud isolation bypass via Kubernetes vulnerability chain
Security researchers have disclosed a critical vulnerability chain in a major cloud provider’s managed Kubernetes service that enabled complete bypass of…
Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand,…
CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by…
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
A Kaspersky expert presents a cloud isolation bypass case honored at Russian Pentest Award 2026. Learn how vulnerabilities in Kubernetes, Konnectivity,…
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in “extremely sophisticated”…
CVE-2026-118029 – Unverified ownership of the default Athena query result location in AWS SDK for pandas
Bulletin ID: 2026-153-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/28/2026 08:30 AM PDT Description: AWS SDK for…
Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability
Veeam released security fixes for a critical authorization bypass vulnerability in Veeam Backup & Replication that lets an attacker without login…
Node2Shell Vulnerability Actively Exploited in the Wild, CISA Warns
CISA has added the Node2Shell flaw, tracked as CVE-2026-111497, to its Known Exploited Vulnerabilities catalog. Attackers are already sending live exploit…
Black Duck launches AI agent for vulnerability remediation
Application security vendor Black Duck has introduced Signal Agentic Fix, an AI agent designed to accelerate vulnerability remediation from discovery to…
CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers
CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) enables pre-OS code execution. Exposed servers need firmware patches and checks. A critical…
Hackers Actively Exploiting New Oracle EBS RCE Vulnerability
Hackers have begun testing a critical Oracle E-Business Suite vulnerability that can let them run commands without logging in. Threat intelligence firm…
Inside Node2Shell: A Closer Look at CVE-2026-111497
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: Inside Node2Shell: A Closer Look at CVE-2026-111497
CVE-2026-115418 – SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)
Bulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT Description: The AWS Cloud…
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled…
Millions of security cameras at risk: DoS vulnerability in Intelbras devices
During our research, we discovered a denial-of-service vulnerability that could affect millions of Intelbras IP camera systems built on the platform…
Hackers Start Probing Fresh Oracle EBS Vulnerability
CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution.
PHP RCE Flaw CVE-2026-115560 Mitigation Guidance
PHP maintainers have disclosed CVE-2026-115560, a remote code execution vulnerability that affects a limited subset of PHP installations due to specific…
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it…
Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database
Blue Initiative launches a new vulnerability database for IT and OT CVEs relevant to the maritime industry