Today in cyber
FluxRein collects breaking security news, CVEs, ransomware and AI-model security research from 90+ public sources, refreshed every hour.
items / 24h
142
critical / 24h
2
KEV adds / 24h
0
last update
Top stories
View all- The Register – SecuritySuspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
- The Hacker NewsChina-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
- Help Net SecurityChinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
- Security AffairsU.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog
Security Affairs·Critical
Volt Typhoon Used Silent Train to Hide Zero-Day AttacksVolt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm…
The Register – Security·Critical
Oracle celebrates end of Cybersecurity Awareness Month with quadruple troubleAttackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month. Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities…
Ars Technica – Security·Low
Massive leak exposes 41,000 DHS workers and undercover ICE agentsAn unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive…
The Hacker News·Critical
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other DistributionsA flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote…
- GitHub Discovery · Security advisory commitsaghdetngf/cybervault-cve-intel: Add Security Advisory for CVE-2026-111357 (CVSS 7.0) - CyberVault
- GitHub Discovery · Security advisory commitsaghdetngf/cybervault-cve-intel: Add Security Advisory for CVE-2026-98432 (CVSS 9.8) - CyberVault
The Hacker News·Critical
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left OpenAn attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI…
- Hacker News (security, 100+ points)GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
- Security AffairsCVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers
- ESET WeLiveSecurityESET APT Activity Report Q2 2026–Q3 2026
Hackread·Low
Binance Probes Suspected $5.8 Billion Crypto Hack, $3 Billion FrozenBinance investigates a $5.8 billion crypto theft, with $3 billion in assets frozen. The exchange says user funds are safe as investigators trace funds.
- BleepingComputerBinance probes potential $5.8 billion crypto-theft hack
The Hacker News·Critical
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash FirewallsCisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system.…
Cisco Talos·Critical
NIK C2: The new AI-enabled command-and-control frameworkCisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.” NIK C2 contains a Windows implant, using which, an actor can dump credentials, stream the victim's keystrokes to collect the targeted victim’s sensitive data, and instruct an integrated AI…
The Register – Security·Critical
Admin dropped the F-bomb in a password to show hackers who was really 1337Welcome back to PWNED, in which The Reg offers cautionary tales from folks who’ve left their doors wide open to attackers and lived to tell the tale. This week’s misadventure involves unpatched older machines and a password that was supposed to send a message to crims. Our story comes courtesy once again of leading…
WIRED Security·Critical
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution FlawThe critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.
Breaches & Attacks
View allAnasshouran/nqp-platform: chore: remove staging-only R4 report leaked to main via PR #127 (#128)
chore: remove staging-only R4 report leaked to main via PR #127 (#128) * chore: remove staging-only R4 report leaked to main via PR #127 Remove docs/audit/STAGING-0-R4-REMEDIATION-REPORT.md which was accidentally included in PR #127 (staging -> main merge). This file is staging-specific remediation documentation and…
- okuvu/Okuvu: ci(E16-S8): fail-closed secret scan gate; written rotation for the leaked secretGitHub Discovery · Remediation commits·Medium
- miteshpant/incidentrank: Remove hard auto-fail on failureCondition breach; replace with 35-min attempt ceilingGitHub Discovery · Remediation commits·Medium
- In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad securityThe Register – Security·Low
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion FrozenThe Hacker News·Medium
Vulnerabilities & CVEs
View alldbhack-2026/dbhackAgent: Add vulnerability remediation demo: docs/vulnerability-remediation-demo.md
Add vulnerability remediation demo: docs/vulnerability-remediation-demo.md
- dbhack-2026/dbhackAgent: Add vulnerability remediation demo: scripts/create_bitbucket_pr.pyGitHub Discovery · Remediation commits·Low
- Smart TVs can harbor unpatched security flaws and track what you watchHelp Net Security·Low
- aghdetngf/cybervault-cve-intel: Add Security Advisory for CVE-2026-111357 (CVSS 7.0) - CyberVaultGitHub Discovery · Security advisory commits·High
- sjmayomis/Mayomis-CyberSecPortfolio: Add vulnerability assessment report for database serverGitHub Discovery · Remediation commits·Low
Ransomware
View allDataBreaches.netMedium
UNM Health addresses cyberattack in New Mexico after ransomware group claims responsibilityJohn Rupolo reports: University of New Mexico Health is addressing concerns after a cyberattack on Monday, with reports surfacing this week that a ransomware group claimed responsibility for the incident. “So what I can say is we’re also aware of those claims by that group,” said Chris Ramirez, communications director…
- IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor AssessmentMicrosoft Security Blog·Low
- IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increasesCisco Talos·Medium
- Ukrainian Nefilim and Hive Affiliate Artem Stryzhak Jailed for 70 MonthsHackread·Low
- AI used in Aur0ra ransomware testing and executionSophos X-Ops Threat Research·Medium
Malware
View allGHSA-w3jr-q4jr-xq95: Malicious code in twitter-request-diagnostics (PyPI)
Malicious code in twitter-request-diagnostics (PyPI)
- GHSA-9wjc-g5vf-3m22: Malicious code in test-01-rafamarrara-learning-dc (PyPI)GitHub Advisories · malware·Low
- GHSA-j272-m9j4-g3v9: Malware in dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llcGitHub Advisories · malware·Low
- GHSA-cjmr-6xg2-vf8h: Malware in dowload_ebok_lolita_by_vladimir_nabokov_oy1gyGitHub Advisories · malware·Low
- GHSA-p6mc-228w-6q75: Malware in dowload_ebok_armageddon_by_max_hastings_kv3s4GitHub Advisories · malware·Low
Phishing & Web Threats
View allScammers rebuild fake shopping sites within hours of a takedown
One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026. A ticket scam used a similar setup. Several websites…
- Anthropic-Themed Phishing Emails Bypass Top Security ToolsDark Reading·
- Online Scam Volumes Double to Overtake PhishingInfosecurity Magazine·
- Shame and sleepless nights haunt scam victims long after the money is goneHelp Net Security·
- Yet Another ClickFix Campaign, (Wed, Oct 28th)SANS Internet Storm Center·
AI & Model Security
View allOpenAI doubles ChatGPT Pro usage limits after backlash over planned 50% cut
OpenAI says it won't reduce usage limits for the $100, $200, and $500 ChatGPT Pro plans, as well as Business Premium, and it also promised to keep Dots usage independent. [...]
- Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatchedThe Register – Security·
- Hugging Face malware campaign returns to hijack GPUs for crypto miningBleepingComputer·
- Claude Model Builds Exploits Across Major Browsers & OSesDark Reading·
- EMBRACE Flaws in 5 AI Coding Tools Enable Code Execution and File TheftHackread·High
Threat Intelligence
View allleanprover/lean4: `Task.bind` leaks the inner task when the bind task is dropped while its function runs
`Task.bind` leaks the inner task when the bind task is dropped while its function runs ### Prerequisites * [x] Check that your issue is not already filed: https://github.com/leanprover/lean4/issues * [x] Reduce the issue to a minimal, self-contained, reproducible test case. Avoid dependencies to Mathlib or Batteries.…
- ISC Stormcast For Friday, October 30th, 2026 https://isc.sans.edu/podcastdetail/10158, (Fri, Oct 30th)SANS Internet Storm Center·
- How do you validate SIEM detection rules beyond checking whether they fire? I’m building an open-source SIEM and looking for blue-team feedbackReddit · r/blueteamsec·
- Rethinking Cybersecurity Awareness in the AI EraDark Reading·
- Limits of Java Certificate Bypass: Fingerprint Blocklist InsightsReddit · r/blueteamsec·
Cloud Security
View allCohere’s Qwen Story: Looks More Like Model Jaggedness
Key findings Re-sampling URLs from the trace shared by Cohere yields 52 different destination hosts, many of which are local or do not exist, and one is an invalid top-level domain. Swapping the order of two program names in a check for available tools made the model much less likely to continue with a network call.…
- Windows 11 KB5127936 update released with 41 changes and fixesBleepingComputer·
- Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.The Hacker News·
- Microsoft urges Entra ID admins to migrate users to passkeysBleepingComputer·
- Introducing Route 53 Resolved IP Validation for AWS Network FirewallAWS Security Blog·
Policy & Regulation
View allgraphql-rust/juniper: Missing security policy prevents a responsible disclosure in case a security vulnerability is discovered
Missing security policy prevents a responsible disclosure in case a security vulnerability is discovered **Is your feature request related to a problem? Please describe.** There is no [security policy](https://github.com/graphql-rust/juniper/security/policy) set up for this project. Also, searching for `security` in…
- GM settles with 36 states for selling driver data, agrees to $220 million fine and reformsThe Record·
- JPMorgan Chase, Goldman Sachs underscore security in AI plansCybersecurity Dive·
- FTC to probe major companies over personalized pricing and payThe Record·
- Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifyingThe Register – Security·