SANS reports SSH scanning associated with Sshole exploitation
SANS observes unusual SSH authentication attempts, with important limits on what its honeypot data establishes.
Tags /
#Vulnerability Management
127 reports
Qubes says November Xen advisories do not affect its security
Qubes distinguishes its own security impact from the existence of new Xen advisories; the listed batch requires no user action.
European refrigeration attacks: exposed controllers and the limits of attribution
Unit 42 reviews European refrigeration attacks and exposed controllers. Exposure counts are not victim counts, and the initial access route remains unconfirmed.
Exposed OAuth secrets give AI-assisted attackers a route into cloud tenants
Microsoft reports agents finding public secrets and abusing application identities. Removing a leaked secret from code is insufficient: investigate access and revoke or rotate the credentials.
Microsoft Q3 email findings: security exceptions can defeat successful detection
Microsoft’s Q3 email research highlights malicious messages passing through security overrides. Review exception scope alongside phishing and collaboration controls.
Talos Q3 revision: telecom attribution and the defensive findings that remain
Talos’s revised Q3 report narrows its telecom attribution. What changed, what the caseload figures still establish and which defensive priorities follow.
Node.js announces high-severity security releases for 11 November
Node.js has announced forthcoming security updates for its 26.x, 24.x and 22.x lines. Prepare deployment inventories; the notice does not yet provide CVEs or fixed release numbers.
Fake installers turn software searches into proxyware and compute-resource abuse
Microsoft describes deceptive Inno installers delivering proxyware, distributed-compute and utility payloads. Hunt the installation session, not just the final filename.
Ivanti Connect Secure: why the October fix does not close the whole exploit chain
Rapid7 reports additional exploited Connect Secure flaws and fixes. Separate initial-access patching from removal of an existing appliance compromise.
BeyondTrust and Bomgar attacks expose the persistence risk in trusted remote access
Mandiant's BeyondTrust findings show how appliance compromise becomes persistent access. The SolarWinds comparison concerns trust and recovery, without implying common attribution.
EDK II UEFI flaw CVE-2026-97631: finding exposed PXE boot paths and verifying firmware fixes
CVE-2026-97631 exposes vulnerable EDK II systems during PXE network boot. The urgent questions are network reachability, the firmware build and whether its vendor has shipped the fix.
Brotli CVE-2026-111497 extends beyond Node.js to Python, .NET and PHP dependencies
Brotli's CVE-2026-111497 is now in CISA's exploited-vulnerability catalogue. Exposure depends on the decoder and data path, with distinct fixes for Node.js, Python, .NET and PHP Windows builds.