已发布刊物 · 免费预览
Ariquo Security News Stream — 2026-11-03
发布： 摘要更新：
41 daily news events from 47 source observations.
本期内容预览
1. Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges.
2. The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion...
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion... The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54.
3. Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT...
Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT...
4. What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Real-world exploitation concentrates in a small, high-impact subset of CVEs. Learn how defenders can prioritize vulnerabilities based on exploitation likelihood, exposure, and potential blast radius.
5. SD JWT JS: Tampered disclosures silently dropped instead of rejected
SD JWT JS: Tampered disclosures silently dropped instead of rejected ## Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed `_sd` array, `@sd-jwt/decode` 0.19.0 does **not** reject the presentation. It silently drops the unmatched Disclosure and returns a **reduced claim set**, reporting success.
6. Backporting security fixes at scale with Codex
Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel.
7. CyberStrikeAI attacks educational institutions | Securelist
CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations As part of proactive threat monitoring, Kaspersky’s Cyber Threat Intelligence team identified a malicious campaign involving C2 agents controlled by artificial intelligence. Confirmed victims of the campaign included organizations in the education sector in several countries across Africa and Latin America.
8. We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitL
We are currently tracking over 1000 GitLab instances vulnerable to CVE-2026-97229 (on @CISACyber KEV) and over 11300 instances vulnerable to CVE-2026-110264 (out of around 39K GitLab instances we see daily). Tree Map Dashboard stats (both vulns) dashboard.shadowserver.org/statistics/com…
9. Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection...
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection... Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action.
10. ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows...
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows... ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json.
11. Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS...
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS... Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module.
12. HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated...
HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated... HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send.
13. python-jose through 3.5.0 contains an authentication bypass vulnerability that allows...
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows... python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets.
14. A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the...
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the...
15. A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the...
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the...
16. The System REST APIs do not correctly enforce access control mechanisms, allowing users with...
The System REST APIs do not correctly enforce access control mechanisms, allowing users with... The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted.
17. A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function...
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function...
18. A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the...
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the...
19. A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the...
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the...
20. A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue...
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue...
21. A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects...
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects...
22. Chinese hackers use ARTEX AI in automated attacks against 200 orgs
Chinese hackers use ARTEX AI in automated attacks against 200 orgs Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. The operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.
23. Fintech platform Sageworks taken offline after suspected cyberattack
Fintech platform Sageworks taken offline after suspected cyberattack Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment. On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend.
24. Google disrupts million-device XCPE Android malware botnet, bans TV box maker
Google disrupts million-device XCPE Android malware botnet, bans TV box maker Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. The company attributes the botnet with high confidence to Chinese device manufacturer Videostrong Technology Co, accusing the company of deliberately installing a persistent backdoor into devices it manufactured and selling access to criminal affiliates.
25. ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More
Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password.
26. DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud environment in the Kurdistan Region.
27. Synology warns of C3RB3R ransomware attacks targeting NAS devices
Synology warns of C3RB3R ransomware attacks targeting NAS devices Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. The company urged users to enable automatic updates and upgrade the DiskStation Manager (DSM) software running on their NAS devices to the latest version to protect their data.
28. Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller.
已展示本期 41 条中的 28 条。注册并开通相应订阅后，可在阅读页查看完整刊物。