https://fresh-reads.lovable.app/What developers should know about, and what to do — from advisory databases and the researchers who find supply-chain malware.Sun, 01 Nov 2026 08:57:41 +0000https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html22ceb67654e8ee2dSun, 01 Nov 2026 12:55:40 +0530Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $ [reported · The Hacker News]vulnshttps://thehackernews.com/2026/11/netamloader-malware-targets-government.htmled75cce192b3d6fcSun, 01 Nov 2026 12:32:58 +0530Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government ent [reported · The Hacker News]vulnshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-11-01Sun, 01 Nov 2026 03:30:23 +0000Including: pystr-codec — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]pypihttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-31Sat, 31 Oct 2026 16:09:39 +0000Including: @mamans2973/maman, skills-analyzer, md-to-slides, doctreelstm, is-it-ai, multi-convert, local-commander-agent — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://github.com/advisories/GHSA-4xm8-rg9h-jhq2cd2cf80431be7755Fri, 30 Oct 2026 22:57:22 +0000Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged user read, write and delete files outside the storage root. Reading /security.json discloses the JWT signing secret, enabling admin token forgery and remote code ex — What to do: Upgrade signalk-server to 2.34.0 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://github.com/advisories/GHSA-hff9-5pqw-6w9fe1698c89ebba49c9Fri, 30 Oct 2026 22:57:00 +0000Summary The ICO loader allocates data_size + BMP_FILE_HEADER_LEN bytes after reading a 32-bit attacker-controlled data_size. For data_size > UINT32_MAX - BMP_FILE_HEADER_LEN, the addition wraps before allocation. imgproxy then writes the ICO prefix and reads up to the original de — What to do: Upgrade github.com/imgproxy/imgproxy/v3 to 4.0.16 or later. [confirmed · GitHub Advisory Database]govulnshttps://www.wiz.io/blog/black-october-for-ai-developer-platforms866d4dd666d9f173Fri, 30 Oct 2026 22:51:44 +0000A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale. [confirmed · Wiz]ai-toolshttps://github.com/advisories/GHSA-5xjx-3w67-w9x9b8daa8711c1dd7cfFri, 30 Oct 2026 20:24:24 +0000Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the emSign root CA trust store certificate through the certifi distribution. It has since been removed through the bundle and the new version no longer includes them. [pypi-publish]: https://git — What to do: Upgrade pypa/gh-action-pypi-publish to 1.14.3 or later. [confirmed · GitHub Advisory Database]ci-cdvulnshttps://www.aikido.dev/blog/ai-agent-security-in-kubernetes-prompt-injection73225f6856d5a861Fri, 30 Oct 2026 19:31:00 +0000Abdel Sghiouar, Google engineer and senior cloud developer advocate, thinks prompt injection should be called prompt poisoning Category: Guides & Best Practices [confirmed · Aikido]ai-toolshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-30Fri, 30 Oct 2026 18:06:15 +0000Including: @pcb-dp/qa-commons, @sxm-content-creators/tools-ds, vas-tops2-reportingui, vas-tops2-core-clients-search, vas-tops2-core-client-cleanup-ui, @tops2/digital-assistant-ui, vas-tops2-core-property-search, vas-tops2-digital-assistant-ui… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments222bb1cb62f7d340Fri, 30 Oct 2026 17:00:00 +0000This blog discusses the general trend of Clipbanker malware, why they can be successful, what specific samples look like, and how to avoid them. [confirmed · ReversingLabs]vulnshttps://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/f98c69bf43c7c459Fri, 30 Oct 2026 10:36:54 -0400A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. [...] [reported · BleepingComputer]ai-toolshttps://nvd.nist.gov/vuln/detail/CVE-2026-118527d2279e40591fcdfcFri, 30 Oct 2026 12:00:00 +0000Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-111357dbc092ac98830251Fri, 30 Oct 2026 12:00:00 +0000Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://www.stepsecurity.io/blog/claude-code-extension-trojanizeda376c6814de942a8Fri, 30 Oct 2026 10:12:18 +0000On October 29, 2026, version 2.1.313 of the official Claude Code VS Code extension, anthropic.claude-code, was published with a malicious loader embedded in its extension.js bundle. The version was distributed through the Open-VSX registry and Cursor's extension marketplace, whic [confirmed · StepSecurity]ai-toolshttps://socket.dev/blog/claude-code-extension-compromise?utm_medium=feede8f44af938328989Fri, 30 Oct 2026 09:26:06 +0000Cursor removed a malicious Claude Code 2.1.313 extension from its marketplace. Socket examines registry records and the initial claims about its distribution. [confirmed · Socket]ai-toolshttps://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html90688d3151e2bf62Fri, 30 Oct 2026 14:25:47 +0530Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, versi [reported · The Hacker News]ai-toolshttps://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.htmle8ad629591f0f245Fri, 30 Oct 2026 12:57:05 +0530The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (C [reported · The Hacker News]vulnshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-29Thu, 29 Oct 2026 22:14:17 +0000Including: dowload_ebok_lolita_by_vladimir_nabokov_oy1gy, dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc, dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t, dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p, dowload_ebok_armageddon_by_max_hastings_kv3s4, bq-helix-recon-6ade983e, bq-helix-build-hook-6ade983e, orderbook-volt-plugin… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/ba3cd3eac5a72f80Thu, 29 Oct 2026 18:09:24 -0400A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a [reported · BleepingComputer]ai-toolshttps://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/866051d5fbe61a61Thu, 29 Oct 2026 14:38:26 -0400A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...] [reported · BleepingComputer]vulnshttps://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/7447e5f3d2cb5ceeThu, 29 Oct 2026 12:10:31 -0400A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. [...] [reported · BleepingComputer]vulnshttps://thehackernews.com/2026/10/fake-chatgpt-and-claude-apps-abuse.html9c56a02321bc491fThu, 29 Oct 2026 20:50:29 +0530Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim [reported · The Hacker News]ai-toolshttps://www.wiz.io/blog/the-rise-of-agentic-attacks4fbf402056f0c476Thu, 29 Oct 2026 14:26:22 +0000AI agents are changing how attackers operate. Explore real-world cases of agentic attacks, learn how to identify their fingerprints, and discover what they mean for the future of cybersecurity. [confirmed · Wiz]ai-toolshttps://www.bleepingcomputer.com/news/security/3-ways-ai-agents-already-operate-in-your-browser/814231d212d37a17Thu, 29 Oct 2026 10:00:10 -0400AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distingui [reported · BleepingComputer]ai-toolshttps://nvd.nist.gov/vuln/detail/CVE-2026-972296a6b9dc45f9e8cb7Thu, 29 Oct 2026 12:00:00 +0000GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-76418d70528cb55377fb4Thu, 29 Oct 2026 12:00:00 +0000Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) co — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://www.bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices/2813eb71c29272d4Thu, 29 Oct 2026 07:10:13 -0400Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. [...] [reported · BleepingComputer]vulnshttps://thehackernews.com/2026/10/cisco-patches-actively-exploited-asa.html72e13e190054f7a9Thu, 29 Oct 2026 16:14:46 +0530Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.htmld282bc7cb5d66e47Thu, 29 Oct 2026 15:56:33 +0530GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time [reported · The Hacker News]npmhttps://thehackernews.com/2026/10/hackers-exploited-cisco-sd-wan-flaw-to.html430f7914607482b3Thu, 29 Oct 2026 13:54:22 +0530Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for l [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/china-linked-hackers-exploited-vmware.html7ab67924bae5bc4aThu, 29 Oct 2026 11:52:33 +0530The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Wa [reported · The Hacker News]vulnshttps://socket.dev/blog/searchjacked?utm_medium=feedaf5cad61947e0a6aThu, 29 Oct 2026 02:01:54 +0000319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing. [confirmed · Socket]vulnshttps://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder/0248309e4dc5c583Thu, 29 Oct 2026 00:00:00 +0000We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it. [confirmed · Datadog Security Labs]npmvulnshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-28Wed, 28 Oct 2026 23:16:46 +0000Including: b20miner, @zaip-ai/cli, black-spindle, itsa-utils, itsa-react-checkbox, @walknpm/todo-cli, dsh-plugin-blender-3d, mock-transactions-sdk… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://github.com/advisories/GHSA-6jp4-8v48-cc5vdb6440d0114c0792Wed, 28 Oct 2026 21:23:44 +0000Summary The main Electrum server the client connects to is trusted with mempool ("unconfirmed") transactions. This is documented design. [0] However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, — What to do: Upgrade electrum to 4.8.3 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://github.com/advisories/GHSA-mghf-wjfp-p5xm9b6feff8c4ed6b6fWed, 28 Oct 2026 21:14:14 +0000Summary When running with the Cranelift compiler backend on an aarch64 target, Wasmtime can compile a Wasm module with more than ~256k targets on one br_table instruction in a way that results in an incorrect conditional branch target. This conditional branch could then jump to a — What to do: Upgrade wasmtime to 36.0.19 or later. [confirmed · GitHub Advisory Database]rustvulnshttps://github.com/advisories/GHSA-m665-v7pm-7grjfb59cb7f9aa5190eWed, 28 Oct 2026 21:09:50 +0000Summary A critical architectural parser differential exists in the zip crate ( (&mut self, file: &mut ZipFile ) -> ZipResult { file.safe_prepare_path(&self.outpath, &mut outpath, None:: bool)>)?; let mut outfile = fs::File::create(&outpath)?; io::copy(file, &mut outfile)?; Ok(()) — What to do: Upgrade zip to 9.0.5 or later. [confirmed · GitHub Advisory Database]rustvulnshttps://thehackernews.com/2026/10/volt-typhoon-used-covert-silent-train.html786b77ad2418a32fWed, 28 Oct 2026 23:38:33 +0530The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/google-to-allow-one-tap-android-app.htmla3232c7a99347bd1Wed, 28 Oct 2026 22:38:09 +0530Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every [reported · The Hacker News]vulnshttps://www.bleepingcomputer.com/news/security/volt-typhoon-hides-zero-day-attacks-using-silent-train-framework/8ff41c680a1efbd3Wed, 28 Oct 2026 12:00:00 -0400Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...] [reported · BleepingComputer]vulnshttps://www.bleepingcomputer.com/news/security/even-after-php2shell-blast-radius-matters-more-than-a-cvss-score/6b6cdecdf371b268Wed, 28 Oct 2026 09:50:59 -0400PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the dam [reported · BleepingComputer]ai-toolshttps://nvd.nist.gov/vuln/detail/CVE-2026-41709cb116937801ebf97Wed, 28 Oct 2026 12:00:00 +0000Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged. — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-46300b318c5e919de6962Wed, 28 Oct 2026 12:00:00 +0000Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fra — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://www.aikido.dev/blog/aikido-launches-external-network-pentesting22b50db7ba9b16c9Wed, 28 Oct 2026 10:00:00 +0000Aikido launches external network pentesting: AI agents attack your internet-facing systems from the outside and report only findings they actually exploit. Category: Company Updates [confirmed · Aikido]ai-toolshttps://thehackernews.com/2026/10/shinyhunters-exploited-oracle.htmle844a788d9dbb27eWed, 28 Oct 2026 11:34:58 +0530The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request [reported · The Hacker News]vulnshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-27Tue, 27 Oct 2026 23:04:33 +0000Including: csec-form-validatorr, ccsseecc-form-validator, ccsseecc-crypto-toolkit, ccsec-crypto-toolkit, ccsec-form-validator, csec-crypto-toolkit, csec-form-validator, agentenact… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://github.com/advisories/GHSA-26p8-2jq9-3vq96e6fe438e5786007Tue, 27 Oct 2026 21:26:32 +0000Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a — What to do: Upgrade mlflow to 3.17.0 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/4835c3a6eab4506fTue, 27 Oct 2026 16:57:25 -0400A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...] [reported · BleepingComputer]vulnshttps://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.htmlb0c9b44aa0625bf7Tue, 27 Oct 2026 23:56:46 +0530Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments us [reported · The Hacker News]ai-toolshttps://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/afa741ff67f996e3Tue, 27 Oct 2026 12:15:39 -0400Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure. [...] [reported · BleepingComputer]ai-toolshttps://github.com/advisories/GHSA-965c-763c-88jmd108bfb74ace1ff9Tue, 27 Oct 2026 15:32:05 +0000Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with — What to do: Upgrade better-auth to 1.7.7 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://github.com/advisories/GHSA-6v38-4h7w-rj9h8dfecbe7bc8ba1caTue, 27 Oct 2026 14:50:18 +0000Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a crypto — What to do: Upgrade authlib to 1.9.0 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://github.com/advisories/GHSA-m4w4-3r8h-jw98adf8b8bb6efab933Tue, 27 Oct 2026 13:30:41 +0000Impact Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component. The field_type parameter on a FunctionCall input field was passed to Python's built-in eval(), allowing an attacker who could influence that value to execute a — What to do: Upgrade agno to 2.3.24 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://github.com/advisories/GHSA-6hp3-vr39-rqw8d38040e0ef4b6cc2Tue, 27 Oct 2026 13:30:10 +0000Summary An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file (~132 KB) via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String — What to do: Upgrade monai to 1.6.1 or later. [confirmed · GitHub Advisory Database]pypivulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-48356cce5d2da15c38203Tue, 27 Oct 2026 12:00:00 +0000Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://nvd.nist.gov/vuln/detail/CVE-2026-111497530c9bb270879ff2Tue, 27 Oct 2026 12:00:00 +0000Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compr — What to do: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage [confirmed · CISA KEV]vulnshttps://thehackernews.com/2026/10/ai-generated-fake-login-pages-are.html7ad038240c5a22daTue, 27 Oct 2026 17:02:46 +0530Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond s [reported · The Hacker News]vulnshttps://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.htmld506c1a201741da2Tue, 27 Oct 2026 17:02:31 +0530The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russia [reported · The Hacker News]vulnshttps://www.stepsecurity.io/blog/stepsecurity-now-inventories-ai-agent-plugins-in-your-github-repositories-and-on-developer-machinesf2ed444d9d8428acTue, 27 Oct 2026 11:23:27 +0000Inventory the Claude Code and Codex plugins on developer machines and in your GitHub repositories: where each came from, what it bundles, whether it is enabled, and which repositories distribute it. [confirmed · StepSecurity]ai-tools