System Admin Stuff

Microsoft finally fixes VPN issues caused by September updates

2026-10-31T09:24:38.112+05:30

Microsoft has resolved Always On VPN connection failures triggered after installing the September 2026 Windows 11 security updates. [...]

source https://www.bleepingcomputer.com/news/microsoft/microsoft-finally-fixes-vpn-issues-caused-by-september-updates/

Drupal warns of critical Commerce Core flaw exploited in attacks

2026-10-31T09:24:36.002+05:30

Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. [...]

source https://www.bleepingcomputer.com/news/security/drupal-warns-of-critical-commerce-core-flaw-exploited-in-attacks/

Japan Airlines suffers third-party data breach exposing passenger info

2026-10-30T04:24:13.958+05:30

Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers. [...]

source https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/

Polymarket halts trading after crypto-draining script breach, $2.5M traced

2026-10-30T03:24:36.576+05:30

Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. [...]

source https://www.bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced/

Fake crypto app on Apple App Store linked to $23K wallet theft

2026-10-30T01:24:14.084+05:30

A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. [...]

source https://www.bleepingcomputer.com/news/security/fake-crypto-app-on-apple-app-store-linked-to-23k-wallet-theft/

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

2026-10-30T00:24:09.818+05:30

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. [...]

source https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware/

Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

2026-10-29T02:33:34.208+05:30

Attackers are probing a critical Oracle E-Business Suite vulnerability that can lead to remote code execution (RCE), despite Oracle issuing a patch earlier this month.

Meanwhile, new analysis indicates that an Oracle PeopleSoft zero-day exploited by ShinyHunters as early as May involves three distinct vulnerabilities that can be combined to achieve RCE. Patching alone may not remove attackers from already compromised systems, particularly if they've installed web shells.

First up: CVE-2026-101767, a critical, unauthenticated SQL injection bug in Oracle EBS that can lead to RCE.

“Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused Cyber said in an X post.

Horizon3 researchers found and disclosed the bug to Oracle, and the vendor patched the issue in its October release.

“An attacker can send a crafted request to the vulnerable servlet to execute SQL with the privileges of the APPS database user,” Horizon3 explained at the time. “The attack chain also enables operating system command execution with the privileges of the EBS application account.”

This means an unauthorized user can modify application data accessible to APPS, and execute commands. “Depending on the deployment, affected data may include financial, payroll, HR, and procurement records,” the bug hunters said.

The Register reached out to Oracle with multiple questions for this story - including whether it has documented any successful exploitation of CVE-2026-101767 - and did not receive an immediate response.

Moving on to the PeopleSoft-ShinyHunters fiasco: TrendAI’s Zero Day Initiative (ZDI) found and reported the PeopleSoft issues on June 10, and Oracle issued a patch under one vulnerability identifier: CVE-2026-35273.

In early June, ShinyHunters told The Reg that the group hacked more than 100 organizations via an Oracle PeopleSoft zero-day, CVE-2026-35273.

Google’s consulting and incident response biz, Mandiant, later confirmed the data theft and extortion crew exploited CVE-2026-35273 as a zero-day, mostly against schools and the education sector.

By late September, however, Mandiant said ShinyHunters massively expanded its targeting, “deploying web shells on dozens of systems globally, spanning higher education, technology, IT services, healthcare, agriculture, transportation, and government.”

According to ZDI bug hunter Bobby Gould, there are actually three distinct vulnerabilities across multiple PeopleSoft components, and each should receive its own CVE identifier rather than being grouped under CVE-2026-35273.

Gould, along with TrendAI researchers Minh Giang and Lucas Miller, originally found and reported three distinct bugs to Oracle in June. “We are coordinating with Oracle to assign separate CVEs for each issue,” he said in a Tuesday blog.

The first issue is a Server-Side Request Forgery (SSRF) vulnerability in the PeopleSoft Integration Gateway (PSIGW), which gives attackers a foothold in the PeopleSoft application. In June, Oracle introduced a “validateClient” method to allow PeopleSoft system administrators to restrict access to certain functionality. The SSRF bug, however, allows crims to make requests that satisfy the validation requirement to access endpoints vulnerable to RCE, Gould wrote.

“While this solution does restrict access, an attacker on any trusted host can still reach PSEMHUB,” he said, referring to PeopleSoft Environment Management Hub (PSEMHUB). “Because Oracle allows localhost by default, the PSIGW SSRF provides exactly that access.”

The second bug is an external control of file path vulnerability in PSEMHUB’s ExecuteProcessActivityCommand handler. This message handler is designed to allow remote clients to write log entries to the PeopleSoft server’s filesystem - but it doesn’t properly validate requests, which allows an attacker to write a web shell into a file path and achieve RCE.

The third vulnerability, also in PSEMHUB, is a deserialization of untrusted data flaw. An attacker can use a file-write vulnerability to plant a malicious XML file inside a PeopleSoft directory that stores environment configuration data, then wait for PSEMHUB to initialize, such as after a service or system restart. This triggers deserialization of the malicious XML file, potentially allowing the attacker to achieve RCE.

“Attackers can combine these vulnerabilities to compromise affected instances of PeopleSoft,” Gould warned.®

source https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121

Police seize Virtualine bulletproof service tied to ransowmare, cybercrime

2026-10-29T02:24:12.443+05:30

U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. [...]

source https://www.bleepingcomputer.com/news/security/police-seize-virtualine-bulletproof-service-tied-to-ransowmare-cybercrime/

Discord to let search engines index public server messages

2026-10-29T00:24:35.100+05:30

Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]

source https://www.bleepingcomputer.com/news/security/discord-to-let-search-engines-index-public-server-messages/

Apple takes powerful M6 chip to the MacBook Pro, iMac

2026-10-28T03:33:28.570+05:30

If you were waiting to upgrade your Mac until you could get one with the latest CPU, the wait is over. Apple’s 6th-gen M-series processors are finally trickling down to its 14-inch MacBook Pro and iMac family early next month.

Available in either “space black” or silver, Apple’s base-model MacBook Pro is largely unchanged from last gen. This is a mid-cycle refresh and so most of the improvements are under the hood. It sports the same high-res mini-LED display, chiclet keyboard, and port selection as its predecessor.

Most of the improvements come from the silicon itself. Announced alongside a refreshed Mac mini in August, and fabbed on TSMC’s 2nm process tech, the M6 features a refreshed CPU with 12 CPU and 12 GPU cores, and is now complemented by a dual 16-core Neural Engine (what Apple calls its NPUs) which promises better performance for the slew of Apple Intelligence features now baked into macOS Golden Gate.

The M6 MacBook Pro comes standard with 16 GB of unified memory, good for 153 GB/s of bandwidth. Memory can be specced up to 24 GB or 32 GB, boosting bandwidth to 170 GB/s for those with more demanding workloads or, as is more often the case, an aversion to closing Chrome tabs.

Compared to the outgoing M5, which for the moment is still available in the MacBook Air, Apple says the M6 delivers significant performance gains thanks to the addition of two more cores. In Xcode, Apple boasts up to 30 percent higher performance versus a similarly equipped M5 MacBook Pro.

The GPU enjoys similar gains in Blender ray tracing, local AI inference, and image processing, delivering 1.3x faster prompt processing and 1.3x faster rendering, and 1.2x faster performance in the Affinity creative suite.

Despite higher performance, Apple boasts the same 24-hour battery life as the outgoing M5 model. Pricing also remains unchanged. A 16 GB model with 1 TB of solid state storage will set you back $1,999.

One area of improvement not related to performance is connectivity. The M6 finally brings Wi-Fi 7 and Bluetooth 6 connectivity to the 14-inch MacBook Pro.

The majority of these improvements also come to Apple’s most colorful of all-in-one desktops: the iMac. Here the performance jump is even larger, owing to the fact the machine never got the M5. Apple claims 1.5x faster performance in productivity apps like Excel, 2x faster graphics performance and 5x faster in local AI.

Continuing the trend of better connectivity, along with Wi-Fi 7 and Bluetooth 6, certain iMac models also gain 2.5 Gbps Ethernet. As with the MacBook Pro, pricing remains unchanged, with iMacs starting at $1,499.

Both the M6 MacBook Pro and iMac are available for preorder starting tomorrow with availability beginning Friday, Nov. 6. ®

source https://www.theregister.com/personal-tech/2026/10/27/apple-takes-powerful-m6-chip-to-the-macbook-pro-imac/5305797

Hackers hijack Convertr analytics script to steal payment card data

2026-10-28T03:24:19.807+05:30

A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]

source https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data/

Microsoft releases Windows OOB updates to distrust eMudhra certificates

2026-10-28T00:24:23.967+05:30

Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]

source https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-oob-updates-to-distrust-emudhra-certificates/

OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing

2026-10-27T02:24:38.581+05:30

OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models. [...]

source https://www.bleepingcomputer.com/news/artificial-intelligence/openai-launches-gpt-61-terra-with-3x-faster-ai-agents-50-percent-lower-pricing/

DreamHost forces password resets in ongoing "incident"

2026-10-27T01:24:10.243+05:30

DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...]

source https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident/

Microsoft releases emergency .NET security fixes for Google Brotli bug

2026-10-27T00:33:33.892+05:30

To address a vulnerability in Google's Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update "as soon as possible" after releasing an out-of-band (OOB) security update.

It released new versions for .NET 8, 9, 10, and .NET 11 to patch against the Brotli bug, following similar updates from Node.js, Python, and other projects.

Senior program manager Rahul Bhandari said in the October 25 release that the buffer overflow vulnerability in Brotli, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft's advisory, could allow an unauthenticated attacker to read or corrupt process memory, potentially resulting in information disclosure, denial of service, or elevation of privilege.

Microsoft’s own advisory for the vulnerability, which some are referring to as Broccoli2Shell or Node2Shell, confirms that while experts have cobbled working exploits together, there is nothing to suggest that criminals are using them in successful attacks.

However, its exploitability assessment reads: “Exploitation More Likely.”

Broccoli2Shell was first disclosed on October 21 by the Node.js team, which released fixes for ten vulnerabilities, the most serious of which was CVE-2026-111497.

Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with the discovery, but failed to mention why it was only recognized as a security flaw and disclosed properly in October, despite the underlying bug having been fixed in Brotli's source code in February.

OpenAI filled in the gap with a Xeet: “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability, and there was no more recent release of Brotli.

“Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software.”

Attackers can exploit vulnerable systems by providing them with malicious Brotli-compressed data via a specially crafted request.

The vulnerability went slightly under the radar due to the disclosure timing closely aligning with that of PHP2Shell, although fixing the critical flaw should be a priority due to the range of technologies that are affected.

In addition to .NET, Node.js, and Python, Bun, Envoy, and Istio have all released patches, and JFrog has worked up an exploit affecting FFmpeg using a specially crafted JPEG XL image, extending the exploit path beyond HTTP.

It said that FFmpeg reaches Brotli through libjxl, which it uses to decompress metadata stored in brob boxes within the image format.

The same researchers said the vulnerability affects Apache Arrow too, with attackers able to cause a denial of service.

Merav Bar, threat researcher at Wiz, added that cloud users are exposed extensively, noting that 91 percent of cloud environments rely on components vulnerable to the Brotli flaw and that 82 percent of cloud environments have publicly exposed Node.js instances.

She said: “Cloud environments are particularly exposed due to the widespread use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services.”

“Successful exploitation could enable attackers to compromise application workloads, access sensitive information, disrupt service availability, or execute malicious code within affected containers or runtime environments,” Bar added.

In an advisory published through its Patch the Planet initiative, OpenAI recommended blocking untrusted Brotli-compressed data where practical until patches can be applied. It also advised maintainers to rebuild affected deployments and restart services to ensure the fixes take effect. ®

source https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515

How to run a city builder on 16 MHz

2026-10-26T06:38:16.845+05:30

When thinking about impressive technical achievements in retro games, most people will first point to graphical milestones set by action games like Doom or Quake. Rightfully so, but at least I am personally far more impressed by the early examples of the city builder genre. Simulating whole economies on a large scale with a fraction of today’s power seems impossible if modern builder games even struggle on modern machines.

Of course this didn’t stop developers in the past to develop and run city builder games on significantly weaker hardware. The original SimCity for example lists Intel’s 386SX as the CPU in it’s system requirements. A CPU which at the time of it’s launch ran at magnificent 16 MHz.
↫ Lars Thießen

What’s even more impressive are some of the other systems the origin al SimCity was ported to, which had even more limited hardware than a 386SX. The Super Nintendo got a SimCity port, which even included fun extras like a Mario statue and Bowser taking up the mantle of the Godzilla disaster, and additional systems the PC version didn’t have. Hell, they even worked on a port to the NES, but it was cancelled and thought lost, until a relatively complete and working copy was discovered in 2017. Even this NES version contained features not available in the PC version.

Hardware limitations really did breed a lot of innovation back in those days, and sometimes I wonder if programmers and developers could benefit from tasking themselves with working within such limitations today, if only to become a bit more prudent with resources.

source https://www.osnews.com/story/146228/how-to-run-a-city-builder-on-16-mhz/

AI coding agents hijacked using AGENTS.md file in Downloads folder

2026-10-25T21:24:19.474+05:30

Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package. [...]

source https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/

Want to build a UK datacenter? Please hold while Whitehall transfers you

2026-10-25T16:33:40.716+05:30

Building a UK datacenter spans three government departments: one handles datacenter policy, another telecoms, and a third energy.

MPs this week explored what Prime Minister Andy Burnham's summer reshuffle means for businesses navigating Whitehall.

Liz Lloyd, parliamentary under-secretary of state, sits across two departments with a portfolio of responsibilities as long as a weekly shopping list. She explained to MPs this week that, following the decision to get rid of the Department for Science, Innovation and Technology (DSIT), liaison with the tech industry on datacenter construction fell to the Department for Business, Innovation, Science and Trade (BIST).

Lloyd, who works across BIST and the Department for Digital, Culture, Media and Sport (DCMS), went on to explain that digital infrastructure sits within DCMS.

Speaking to the House of Commons Science and Technology Committee, Lloyd acknowledged that some departmental responsibilities overlapped.

"In terms of sector responsibilities, that is clear that technology, sorry, that telecom sits with DCMS and datacenters with BIST. When you're actually in an industry or you're trying to run a business, that that that is clear," the junior minister said.

Any business trying to build a datacenter might also want to know how to get power to it. As far as The Register can figure out, that would be the Department for Energy and Net Zero. Planning permission rests with local government, although the overall policy lies with the Ministry of Housing, Communities and Local Government. It may be clear, but it is hardly simple.

The problem is real, though. Earlier this month, Microsoft pulled out of plans for Britain's largest AI supercomputer because of difficulties securing power for the facility.

Elsewhere in the hearing, Lloyd was asked about the government's early 2025 claim that modernizing aging technology and digitizing processes could deliver £45 billion in productivity savings.

Asked if the government stood by the figure, the junior minister said: "The £45 billion figure was an estimate of long-term productivity gains. It wasn't a kind of one-off figure for savings… it was never a figure that was a target or a cashable savings figure."

When the figure was publicized under the Starmer government in January 2025, the press release was headed "Archaic tech sees public sector miss £45 billion annual savings." It continued: "Taxpayer funded services from the NHS to local councils are missing out on £45 billion in productivity savings because they are too often dependent on old and outdated technology."

It claimed the government would "tackle these issues" using "digital tools, AI and common sense to overhaul public sector technology." ®

source https://www.theregister.com/public-sector/2026/10/25/want-to-build-a-uk-datacenter-please-hold-while-whitehall-transfers-you/5304956

Reg readers land on 'Binface' as name for UK space cleanup mission

2026-10-25T14:33:44.921+05:30

The UK Space Agency asked for names for its Active Debris Removal Mission, and, of course, the Register readership didn't disappoint.

The Active Debris Removal Mission, led by ClearSpace UK and intended to remove a pair of UK-registered satellites from Low Earth Orbit (thus demonstrating Blighty's prowess when it comes to orbital litter picking), needs a name.

Let's face it, Active Debris Removal Mission hardly rolls off the tongue and, while engineers have long found ways to make meaning from acronyms (this writer has always been rather fond of PICNIC – Problem In Chair, Not In Computer), the UK Space Agency decided it needed a proper name.

What could possibly go wrong? After all, it's not as if the great British public has form when it comes to picking interesting names (as the infamous Boaty McBoatface debacle demonstrated).

SpaceyMcSpaceFace and Binny McBinFace therefore took an early lead in voting (for our American readers, a bin is a word for a trash can).

Other suggestions included a reference to the long-running British game show, 3-2-1, with "Dusty Bin". Dusty Bin was the show's booby prize, and it's good to know that some people are at least as old as this writer.

Another, clearly inspired by our own PARIS and LOHAN, was SHART – Satellite Harvesting And Re-entry Tug, and there was the delightful Project TIDY (Targeted Intervention for Debris in the Yard), which sounds a little too much like it might win.

We at The Register tend to steer clear of politics if possible, but "Prime Binister" tickled our fancy. As did a tribute to the UK's most famous second-place candidate: Baron Binface.

For readers unaware, a candidate named Count Binface, presenting as an intergalactic space warrior with a dustbin for a head, stood in the Clacton by-election in 2026. The candidate came second after almost ten thousand voters decided they preferred a novelty candidate to the incumbent, Nigel Farage.

Farage won by a substantial margin. However, Binface (and McBinface) have secured the popular vote for a satellite clean-up mission. At least as far as Register readers are concerned.

We asked Count Binface for thoughts on the mission, and will update this piece should a response be forthcoming. ®

source https://www.theregister.com/offbeat/2026/10/25/reg-readers-land-on-binface-as-name-for-uk-space-cleanup-mission/5305144

Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack

2026-10-24T03:33:21.597+05:30

An independent evaluation of OpenAI's internal misalignment monitoring system revealed that the system was not fit for purpose during a period when the company's bots were breaking into model-hosting platform Hugging Face. The safeguards weren't nearly strong enough.

"The METR and Redwood employees discovered a number of novel vulnerabilities in the asynchronous internal misalignment monitoring system as it existed on and before July 21st," said evaluation partners METR and Redwood Research in a report released on Thursday.

The system, since improved according to OpenAI, was intended to monitor AI agent behavior. But as described by METR and Redwood Research, its monitoring capability was incomplete and could be bypassed by the agents it was supposed to monitor.

Bypassing the system wasn't always necessary because it wasn't always operative. Monitoring was suspended, for example, during compaction events. Compaction is a process by which AI models condense the data in their context window to make room for further input. And between May and July 2026, about 10 percent of eligible internal Codex traffic went unmonitored during compaction, according to the report.

That gap was theoretically large enough to allow AI agents to postpone monitoring indefinitely: agents could further suppress monitoring by continuing to take actions without returning control to the user.

"At the time of the exercise, the monitoring system triggered when agents returned control to the user, so during the time period when compaction events were not being monitored, agents could indefinitely postpone being monitored by simply continuing to take actions," the report explains.

This is not to say that OpenAI agents necessarily did so – the actions they did take, against Hugging Face and other organizations, have now been well documented. But OpenAI's internal monitoring system could easily have missed any misbehavior, were the company's AI agents inclined to conceal their activities – by acting during compaction – or simply to operate in system blind spots.

The report continues in this vein, citing not only monitoring gaps but poorly constructed software – dare we say vibe-coded? – that gave OpenAI agents the means to evade the shoddy monitoring.

"We found a way Codex agents could in principle bypass Codex sandboxing and Auto-Review, allowing them to take any action that the host user could take," the report says. "We also discovered an exploit agents could use that would prevent hundreds of recent actions (including the actions involved in the exploit itself) from being monitored."

The details of this exploit were redacted by OpenAI, but to summarize: the monitoring system that missed some traffic could be avoided by agents that were constrained by a non-working sandbox and had access to an exploit to evade monitoring.

But that's not all. The evaluators found that AI agents could craft inputs that caused monitoring to fail, that there were two client-controllable headers capable of disabling the monitoring of new agents, and that there were two unmonitored agentic tools that were thought to be read-only but could be exploited to take arbitrary action in the sandbox – which as noted above leaked like a sieve.

In conclusion, METR and Redwood Research propose that the agent monitoring systems used by AI companies actually work and are robust enough to "withstand deliberate, strategic, and sustained attacks from highly capable internal agents at scale." ®

source https://www.theregister.com/ai-and-ml/2026/10/23/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging-face-attack/5305200

Abandoned Popcorn Time app exposed millions of devices to RCE attacks

2026-10-24T03:24:36.561+05:30

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]

source https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/

Microsoft Teams to get AI-powered, context-aware phishing detection

2026-10-24T01:24:15.108+05:30

Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]

source https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/

Railway warns devs to rotate secrets after potential breach

2026-10-23T03:24:32.027+05:30

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]

source https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/

Capcom confirms data breach affecting 11.7 million accounts

2026-10-23T02:24:10.073+05:30

Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. [...]

source https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/

Max-severity GitLab bug allows remote code execution over 12 years of releases

2026-10-23T01:33:25.099+05:30

GitLab on Wednesday patched a maximum-severity flaw that could allow unauthenticated attackers to execute arbitrary code on self-managed servers under certain conditions. Affected software releases date back a full 12 years - so upgrade to a fixed version now.

The integer overflow bug, tracked as CVE-2026-110264, affects regular-expression compilation in GitLab Community Edition (CE) and Enterprise Edition (EE), including versions dating back to GitLab 7.0, released in June 2014.

The flaw, “under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,” the vendor said in its release notes.

GitLab released fixes in versions 19.5.1, 19.4.3, and 19.3.6, and backported the patch to versions 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The vendor “strongly recommends” that all organizations running vulnerable software upgrade to a fixed version “as soon as possible.”

GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, remains patched, and the vendor also released two threat detections (here and here) for customers with self-managed instances.

Bug hunter Johan Carlsson reported the vulnerability through GitLab’s HackerOne bug bounty program.

“For organizations running self-managed GitLab infrastructure, the potential impact is severe,” warned threat-detection firm SOC Prime. “GitLab repositories frequently contain source code, CI/CD configuration, deployment secrets, access tokens, infrastructure definitions, and connections to production environments. Server-level compromise could therefore create opportunities for credential theft, repository manipulation, supply chain attacks, persistence, or lateral movement.”

While there’s no indication - yet - of any in-the-wild exploitation attempts, we’d expect criminals to start scanning for vulnerable instances soon.

The ongoing PHP chaos may have given defenders a short head-start on this one, but considering the perfect 10 CVSS severity rating and GitLab’s reach into the enterprise - it claims 50 million registered users and more than 50 percent of the Fortune 100 - that’s not going to last long.

Last month, attackers started battering another max-severity flaw in the same GitLab CE and EE products just days after the vendor issued a patch, according to the US Cybersecurity and Infrastructure Security Agency and private researchers.®

source https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854