Over 1,000 GitLab servers vulnerable to ongoing RCE attacks
Over 1,000 Internet-exposed GitLab servers are still unpatched against a maximum-severity flaw actively exploited in remote code execution attacks.
Security Feed
Cybersecurity news & advisories
500 articles 45 of 45 sources updated RSS ↗
Trending
Cross-source coverage · last 72 h
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Bleeping Computer
CCCS Alerts & Advisories
The Hacker News
Trail of Bits
+1
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown
Trail of Bits
Backporting security fixes at scale with Codex
59m ago
The Hacker News
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
2h ago
Bleeping Computer
Alpine Linux rebuilds GitLab after attempted RCE attack
21h ago
CCCS Alerts & Advisories
Linux security advisory (AV26-1108)
30 Oct
Bleeping Computer
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
30 Oct
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Bleeping Computer
CCCS Alerts & Advisories
The Hacker News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist
Infosecurity Magazine
SecurityWeek
The Hacker News
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI),
FBI pins $6.3B Binance crypto heist on North Korean hackers
Ars Technica Security
The Register Security
The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazarus Group as the exchange scrambles to replace stolen funds and reassure customers. In an alert published Saturday, the agency attributed the October 29 attack to TraderTraitor, a North Korean hacking operation linked to Lazarus, which has made a lucrative career out of relieving crypto exchanges of their digital assets. Pyongyang was already in the frame before the FBI weighed in. Blockchain intelligence firms TRM Labs and Elliptic…
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Rapid7 Blog
SecurityWeek
CVE-2026-111357 ↗
CVE-2026-118527 ↗
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527 , classified as generation of predictable numbers or identifiers ( CWE-340 ), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry , allows a remote authenticated attacker to upload…
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Cyber Security News
The Hacker News
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company
Hackers Use CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft
Cyber Security News
The Hacker News
Hackers are now using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand. CyberStrikeAI is an open-source, Go-based platform built for penetration testing. Criminals have already turned it toward real targets, and earlier reports showed how attackers targeted Fortinet FortiGate devices with the same framework. This new campaign shows the…
Cyber Security News
Hackers Use CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft
2h ago
The Hacker News
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
7h ago
The Hacker News
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
1 Nov
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
SecurityWeek
The Hacker News
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
SecurityWeek
The Hacker News
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October
Latest
AI Vulnerability Finding
A comment : 3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the…
Backporting security fixes at scale with Codex
Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering…
FBI pins $6.3B Binance crypto heist on North Korean hackers
The FBI has blamed North Korean hackers for the record-breaking $6.3 billion theft from cryptocurrency exchange Binance, pointing the finger at the notorious Lazarus Group as the exchange scrambles to replace stolen…
Hackers Exploit ChatGPT’s Popularity With Fake Billing Notices That Target Credit Cards and OTPs
Hackers are impersonating OpenAI in fake ChatGPT Plus billing emails that lead users to payment pages designed to steal credit card details and one-time passwords. The campaign combines convincing subscription warnings…
Malicious Claude Code Extension Served in Cursor Supply Chain Attack
The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.
Synology warns of C3RB3R ransomware attacks targeting NAS devices
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks.
Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login…
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing…
Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys
Hackers are posing as trusted artificial intelligence bots to search websites for passwords, API keys, and cloud credentials. The campaign uses the names of ChatGPT, Claude, Perplexity, and other AI services to disguise…
Could Nick Andersen’s leadership outlast the clock on his acting role?
The clock is running out on Nick Andersen’s time to serve as acting director of the Cybersecurity and Infrastructure Security Agency, but there appear to be efforts afoot to keep him in the role for longer, with no…
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed…
Hackers Use CyberStrikeAI Agents to Automate Windows Domain Takeovers and Credential Theft
Hackers are now using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed…
Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
The attackers used offensive agentic techniques to access the company’s systems and internal tools.
Hackers Hijack Swedish Supermarket Fridges and Raise Freezer Temperatures to 55°C
Hackers have reportedly targeted refrigeration systems at Swedish supermarkets, leaving stores with spoiled food after freezers reached temperatures as high as 55°C. Several ICA locations and six Coop stores were…
FBI Attributes Binance Heist to North Korea’s TraderTraitor
The FBI has blamed North Korean APT group TraderTraitor for the world’s biggest cyber heist
Top 10 Best Identity Governance & Administration (IGA) Tools in 2026
Quick Answer: Linx is the AI-native solution for modern IGA across all identity types; SailPoint remains the IGA benchmark with AI-driven certifications; Saviynt leads cloud-native converged governance; Microsoft Entra…
PentestPad: How Pentest Companies Adapt In The Era of AI
Every penetration testing firm is facing the same pressure right now. AI tools are faster, cheaper, andincreasingly capable, and testers are using them whether the company has a policy on it or not. There’s ahigh change…
Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features
WIRED uncovered some 400 apps and websites linked to Chinese-language developers that look like regular AI tools but had secret features that let users create violent AI-generated images and video.
Top 10 Best Incident Response Retainer Services in 2026 [Ranked & Scored]
A retainer converts breach-day chaos into a phone number with obligations attached: guaranteed response times, pre-negotiated rates, privilege structure already standing, and in the modern form unused hours flexing into…
Top 10 Best Digital Forensics & Incident Response (DFIR) Companies in 2026 [Ranked & Scored]
DFIR is the one security purchase evaluated under the worst possible conditions: mid-breach, counsel on the line, adversary still inside. What separates firms then isn’t marketing it’s responder bench depth, forensic…
Top 10 Best Managed SIEM Services in 2026 [Ranked & Scored]
The dirty secret of SIEM ownership: the license is half the cost, and the unstaffed half tuning, content, triage is where programs quietly die . Managed SIEM rents that discipline , in flavors that matter more than…
Top 10 Best SOC-as-a-Service Providers in 2026 [Ranked & Scored]
Building a 24/7 SOC takes roughly a dozen analysts before vacation math works which is why SOC-as-a-Service became the mid-market’s default answer and the enterprise’s pressure valve. The 2026 field divides by…
Ivanti patches two more Connect Secure zero-days chained in attacks
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.
Polymarket Returns $3.9 Million to Traders as DebugBear Cites DNS Hijack
DebugBear says its DNS records were compromised via its domain registrar, and early findings show a single customer was targeted.
Chainalysis Warns Customers After “Offensive Agentic” Security Incident
Chainalysis reveals AI-driven attack that led to unauthorized activity
FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
The FBI has officially pinned the $6 billion Binance hack on North Korea’s TraderTraitor as the attackers launder the stolen crypto.
A week in security (October 26 – November 1)
Last week on Malwarebytes Labs: Fake PDF and search tools hijacked searches for 13.4 million Chrome users Photo ID, bank checks, face scan? The UK’s age-check options Binance hit by largest-ever crypto theft, with $6.3…
CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations
Introduction As part of proactive threat monitoring, Kaspersky’s Cyber Threat Intelligence team identified a malicious campaign involving C2 agents controlled by artificial intelligence. Confirmed victims of the…
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.
New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value…
FBI blames N. Korea’s TraderTraitor for Binance theft, urges crypto industry to block transactions
The FBI and U.S. Secret Service alleged this weekend that North Korean hackers were responsible for stealing more than $6.3 billion from cryptocurrency platform Binance last week.
Federal court tosses Trump lawsuit challenging Alaska Senate certification
A federal judge dismissed a lawsuit from the federal government seeking to preemptively block Democratic Senate candidate Mary Peltola from assuming office if she wins her race. The Department of Justice sued Alaska…
FBI links $6.3 billion Binance crypto heist to North Korean hackers
The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record.
🍍📟 Introducing 2.0 for WiFi Pineapple Pager and One More Thing
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005: -----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆ Our Site → https://www.hak5.org Shop → http://hakshop.myshopify.com/ Community →…
🍍📟 [PAYLOAD] 🔴 Hak5 Live: WiFi Pineapple Pager with Darren Kitchen
Hak5 -- Cyber Security Education, Inspiration, News & Community since 2005: -----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆-----☆ Our Site → https://www.hak5.org Shop → http://hakshop.myshopify.com/ Community →…
🔴 [PAYLOAD] Shark Jack Display 🦈
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community – where all hackers belong. Hak5 is one of, if…
Alpine Linux rebuilds GitLab after attempted RCE attack
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over…
OpenAI says it's doubling Pro usage limits and bringing Work features to Chat
OpenAI has just confirmed that it's rolling out ChatGPT Work capabilities directly into regular Chat, while also combining usage allowances across ChatGPT and Codex.
Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
The startup maps how identities, assets and vulnerabilities connect, and uses AI agents to find and fix risky combinations of issues.
OneNote File Extraction, (Sun, Nov 1st)
Recently, I had to extract embedded files from a set of OneNote files (extension .one).
CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the…
Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded…
FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade…
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted…
Northflank security breach leads to abuse of customers' AI API keys
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys.
New Android SMS of Death exploit can remotely crash unpatched phones
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or…
Reddit to lock content behind logins to fight scrapers
Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a "logged-in service," offering limited access to visitors without accounts.
No articles found
Try adjusting your search, category, tags, source selection, or date range.