|
🛡️ Microsoft issues emergency .NET patches
LINK
|
- Microsoft has pushed out-of-band emergency patches for .NET, fixing four security flaws across every supported version from 8 through the 11 Release Candidate 3, and is urging developers to install the updates right away.
- The main flaw, CVE-2026-111497, is a buffer overflow in .NET's Brotli decompression that could let an unauthenticated attacker read or corrupt memory, though the risky request and response decompression features are not turned on by default.
- Microsoft also reissued two earlier advisories because its October 13 fixes fell short, and the patched releases span all current versions, with self-contained apps or containers needing a rebuild since they carry their own runtime.
|
🐘 PHP2Shell flaws used to hack government
LINK
|
- Attackers used the critical PHP2Shell flaw CVE-2026-109618 to break into a European government network, then let an AI agent run the follow-up attack, stealing password hashes and multi-factor secrets within two hours.
- The flaws allow remote code execution in default PHP setups and are being exploited in the wild, with Cloudflare reporting millions of attempts and a suspected North Korean group probing 216 unpatched hosts across many countries and sectors.
- No application fix helps; only updating PHP on the host closes the hole, as nearly 37 million internet-facing systems run PHP, and the PHP Foundation also warned of a third related flaw, CVE-2026-115560.
|
💾 Malicious file can hijack AI coding agents
LINK
|
- A text file dropped into a computer's Downloads folder can quietly order AI coding agents like OpenAI's Codex to install a malicious npm package or leak a user's login token, Forever Security found.
- The trick hides in AGENTS.md, an instructions file that coding agents trust; a real campaign using the package function-color went unnoticed on npm for about two years before removal, and Codex ran the malware in over 90% of tests.
- A similar CLAUDE.md file fooled Anthropic's Claude Code about half the time by rerouting requests to an attacker's server; the researchers say there's nothing for OpenAI or Anthropic to patch, so users must avoid running agents in Downloads and check unfamiliar instruction files.
|
🔓 Tailscale flaws give hackers root access
LINK
|
- A security researcher says flaws in Tailscale SSH let a hacker who controls one device on a network gain root access to other servers it can reach, with no stolen passwords, keys, or user action needed.
- Erica Windisch of Cyberdione Labs published the findings, named Tailworm, on Sunday after lab tests; the proof-of-concept code is private and shared only with Tailscale, which has issued no patch, CVE, or security bulletin.
- The attack needs port forwarding turned on, which headscale version 0.29.5 cannot disable; until a fix lands, users should write single device-to-device access rules, turn off forwarding where possible, and set node-key expiry.
|
|
