Credential-Stealing GitHub Actions Workflows Found Across Tens of Thousands of Repositories
Security researchers reported credential-stealing GitHub Actions workflows planted across tens of thousands of repositories. The campaign illustrates how a poisoned CI workflow can turn source-control automation into a route for…
Researchers Used a Public OpenAI Model to Build a Chrome Full-Chain Exploit
Researchers reported using a public OpenAI model to help build a Chrome full-chain exploit in six days, with a claimed value of $250,000. The report is a practical reminder that…
curl 8.23.0 Fixes HTTP/2 Upload Use-After-Free Flaw
The curl project released curl 8.23.0 with a fix for CVE-2026-92392, an HTTP/2 upload use-after-free issue affecting curl and libcurl 8.12.0 through 8.22.0. Reporting says a proof of concept demonstrated…
Ivanti Connect Secure Zero-Day: CISA Urges Immediate Updates Amid Exploitation
CISA is urging organizations to update Ivanti Connect Secure after reports of active exploitation of a zero-day authentication-bypass vulnerability. Researchers cited in reporting observed exploitation attempts against honeypot sensors, underscoring…
Microsoft October 2026 Patch Tuesday Fixes 1,413 Flaws, Including an Exploited Windows Shell Bug
Microsoft’s October 2026 Patch Tuesday addresses a record 1,413 vulnerabilities, including an exploited Windows Shell security-feature bypass. The scale of the release means defenders should make prioritization—not simply raw patch…
Cisco Warns of Active Attacks Exploiting Critical Secure Email Gateway Flaw
Cisco disclosed that attackers are actively exploiting a critical vulnerability in Secure Email Gateway appliances. The issue, tracked as CVE-2026-76519, can allow a remote, unauthenticated attacker to write files and…
Chrome security update addresses 29 high-severity vulnerabilities
Coverage published October 13 reports that Google released a Chrome security update addressing 29 high-severity vulnerabilities and one medium-severity issue, with memory-safety defects making up much of the disclosed set.…
Ransomware exploitation report puts GlobalProtect VPN patching in focus
SANS NewsBites’ October 13 issue highlights reporting that a Palo Alto GlobalProtect VPN vulnerability, tracked as CVE-2026-0257, has been exploited by ransomware operators. The report is a reminder that remote-access…
Ledger investigates reported unauthorized hardware implant in reseller-sold wallets
Ledger said it was investigating reports of an unauthorized hardware implant in wallets sold through CryptoBilis, according to an October 13 update reported by The Hacker News. The report says…
Windows 11 24H2 Home and Pro reach end of updates
Microsoft’s October 13 servicing notice for Windows 11 lists KB5127648 for supported builds, while contemporary Patch Tuesday coverage notes that Windows 11 version 24H2 Home and Pro reached end of…