|
🍎 Hackers exploit Apple flaw to spread malware
LINK
|
- Hackers tied to Russia are abusing an Apple authentication flaw to push data-stealing malware, prompting CISA to add CVE-2024-27834 to its Known Exploited Vulnerabilities list after reports of active attacks in the wild.
- The medium-severity bug lets an attacker bypass Pointer Authentication, and Apple fixed it back in May 2024 across iOS, iPadOS, macOS Sonoma, tvOS, watchOS, and Safari after it was shown as a zero-day at Pwn2Own Vancouver.
- Researchers at Sekoia link the campaign to APT29, which used hacked sites, fake lookalike pages, and a supply chain attack to run malicious JavaScript, and federal agencies must patch by November 18.
|
🔓 DreamHost breach exposed FTP logins and webmail sessions
LINK
|
- Web host DreamHost says attackers broke into its web-based File Manager and spent two months stealing customers' FTP and SFTP usernames and passwords before the intrusion was found on October 23, 2026.
- The thief exploited a flaw in the software running the File Manager, reaching login details for anyone who signed in from August 2026 onward; DreamHost has since blocked the access and patched the hole.
- Webmail systems may also have been touched, exposing session data and credentials for some users, though DreamHost found no sign that control panel logins or billing details were reached, and is offering a year of Equifax credit monitoring.
|
🐧 OpenAI's AI automates mass vulnerability discovery
LINK
|
- OpenAI showed off an automated pipeline that used an upcoming cyber-focused AI model to find, confirm, and write patches for 948 local privilege escalation flaws in a widely used Linux distribution, costing $1.2 million in API fees.
- The five-stage agentic system reproduced over 1,700 vulnerabilities within 30 hours and built working proof-of-concept exploits for the privilege escalation bugs plus hundreds of information leaks before human researchers reviewed each result.
- OpenAI said the agents came up with at least 10 new Linux attack techniques, and argued patch generation must keep pace so that an outdated low-privilege account effectively hands a resourced attacker root access.
|
🔒 SonicWall won't patch retired tool
LINK
|
- SonicWall says it will not fix two security flaws in its Global Management System software, version 9.5.2 and earlier, because the product has reached end-of-life, and is urging customers to move to its newer Network Security Manager.
- The more serious bug, CVE-2026-109593, rated 9.1, lets an attacker on the network read internal GMS files without logging in; the second flaw needs an account and allows database tampering through SQL injection.
- Neither flaw is reported as exploited, but a separate maximum-severity SonicWall bug patched last month, CVE-2026-102255, is under active attack, with Previdian counting about 2,540 attempts since early October, including dozens on Tuesday.
|
🔄 APT flaw lets attackers swap packages
LINK
|
- A newly found flaw in APT, the package manager behind Debian and Ubuntu, lets an attacker who can tamper with HTTP traffic swap in an unverified package and run code with root privileges.
- Tracked as CVE-2026-109518, the bug abuses HTTP redirects and download retries to overwrite hard links with a chosen payload; Debian disclosed it yesterday, crediting researcher Max Justicz, and Ubuntu rated it High at 7.7.
- Both distributions have shipped fixes, including APT 3.0.4 for Debian 13 and a separate patched version for Debian 12; Ubuntu advises updating, briefly turning off retries, and downloading packages over HTTPS.
|
|
