Attackers Are Now Hijacking Exposed Node-RED Automation Servers With a Single Web Request 
Synology Issues a Rare Ransomware Warning: Outdated NAS Boxes Are Being Encrypted by C3RB3R 
Northflank Tells Every Customer to Rotate Secrets After a Breach, and Stolen AI Keys Are Already Being Used 
Attackers Are Trying to Catch WordPress Sites Mid-Update: The Race-Condition Flaw Fixed in 7.1.4, and a Checklist for Site Owners 
Run an Online Store on Drupal? Attackers Are Already Using a Commerce Core Flaw That Needs No Login. Five Steps for Today 
Should You Patch NGINX This Week? A Decision Tree After Five New Flaw Fixes
NGINX sits in front of a lot of small business apps, reverse proxies, and internal portals. On October 14 it...
Myth vs Reality: Can Ordinary Online Ads Deliver Government Spyware With No Click?
Security teams have warned for years that the ad ecosystem could carry more than coupons. This week researchers said they...
Before and After a Contractor Breach: How a BAE Systems Incident Halted Federal Bankruptcy Notices
Federal bankruptcy courts do not print every notice in-house. They lean on a shared service run by a contractor. This...
BeyondTrust Remote Support Was Hit by a China-Linked Zero-Day: Your Questions Answered
Remote support appliances sit on a short path to almost every machine your help desk touches. This week BeyondTrust and...
A Windows 11 Security Feature Is Blocking Some Remote Desktop Logins After Recent Updates
Here Is How Layered Defenses Help When a Safeguard Has to Step AsideSometimes a security feature and a business need...
More Than 1 Million Texans Caught Up in CenterPoint Energy Breach, With Social Security Numbers Among the Data
For a month, CenterPoint Energy customers knew only that something had gone wrong. This week, a state filing put a...
One Crafted Attachment, Root on the Mail Filter: The Cisco Secure Email Gateway Flaw on One Page, Plus an Admin Checklist
An email security gateway exists to inspect dangerous attachments. This flaw turns that job against it: a single message with...
Six Days, About $40,000 in AI Charges, One $250,000 Bounty: The Timeline of an AI-Assisted Chrome Break-In
The most valuable bug report Google pays for is a “full chain”: a set of Chrome flaws that, used together,...
One Stolen Employee Login Opened Meta’s GitHub Repositories: Questions and Answers on What Was Taken
Meta has confirmed that hackers got into part of its code-hosting setup on GitHub, and the cause was not an...
Palo Alto Firewalls Face an Exploited Zero-Day in the Management Interface: What We Know, What We Don’t, and What to Do Today
Firewalls are supposed to be the part of the network nobody has to worry about. This week, Palo Alto Networks...
