937 results for “security_crawler_carl”
Why is the latest shooting in northern Syria raising security concerns?
Three civilians were injured when unidentified gunmen opened fire on their vehicle near the town of Fafin in…
#Conflict #Conflicts #War #Aleppo #civilians #SecurityConcerns #Syria #Syrianauthorities
https://www.europesays.com/3332261/
I'm working on a super lightweight intrusion detection and security stance scanner for modern Linux, and it hilariously has called out Oneleet (a security company, I have their agent installed because my employer is prepping for a SOC2 audit) for not signing their agent package. The other offender with unsigned packages is Google.
I've been signing packages for my tiny software business that barely makes any money for decades now, and an alleged security company and one of the biggest tech companies in the world can't be bothered. It's fucking embarrassing.
🚨 KeePassXC 2.8.0 is out with several security fixes and a major move to Qt 6
Release: https://github.com/keepassxreboot/keepassxc/releases
https://keepassxc.org/download
The update fixes CVE-2026-69150, a use-after-free triggered when importing a crafted legacy KDB file, along with multiple additional browser integration, memory safety, and Windows security issues that are still awaiting CVE assignments.
Security fixes include:
• Crafted KDB import use-after-free
• Browser entry reference injection
• Out-of-bounds writes in native messaging
• Weak Pageant shared-memory mapping names on Windows
• Integer overflow and out-of-bounds read in the legacy KDB importer
• Improved clearing of decrypted database fragments from memory
KeePassXC 2.8.0 also adds remote database synchronization, configurable shortcuts, SSH key generation, Wayland Auto-Type support, Linux Quick Unlock, and native Windows Arm64 builds.
via @dotnet : .NET October 2026 Out-of-Band Security Updates
https://ift.tt/bRNdyF8
#dotNET #dotNETSecurity #SecurityUpdates #Cybersecurity #SoftwareSecurity #PatchTuesday #Brotli #ASP.NETCore #LinuxSecurity #dotNET8 #dotNET9 #dotNET10 #dotNET11 #Developers #Mic…
Presidential vote in Bulgaria heads to runoff amid Black Sea security fears
Experts said the very low voter turnout expressed frustration "with the very functioning of democracy" among Bulgarian citizens.
https://www.sbs.com.au/news/article/presidential-vote-in-bulgaria-heads-to-runoff/bfxgnitvp
Casio suspends Casio Watches app services over critical security issue, leaving some features unavailable
Casio has temporarily suspended certain functions…
#NewsBeep #News #Technology #AU #Australia #benchmarks #Bluetoothwatches #Casio #CASIOWATCHES #CASIOWATCHESapp #Cybersecurity #G-Shock #graphicscard #laptop #netbook #notebook #PHP #processor #reports #review #reviews #securityvulnerability #servicesuspension #smartphoneapp #test #tests #watchconnectivity
https://www.newsbeep.com/au/940687/
France Protest Updates: Hundreds of Thousands March Amid Heavy Security
Young people demonstrated across Italy on Saturday amid a heavy police presence to prevent the looting and violence…
#Italy #Europe #Europa #EU #CostofLivingandAffordability #Demonstrations #education #Emmanuel(1977-) #France #Macron #ProtestsandRiots
https://www.europesays.com/italy/58204/
There Isn’t an Easy Exploit for This PHP Vulnerability, by (not found or attributed):
How to Configure Additional #Firewall Rules on Rocky Linux VPS (5 Minute Guide)
This article provides a guide for how to configure additional firewall rules on Rocky Linux VPS for improved #security of your system.
How to Configure Additional Firewall Rules on Rocky Linux VPS
This tutorial will guide you through the process of configuring additional firewall rules on a Rocky Linux VPS using firewalld. ...
Continued 👉 https://blog.radwebhosting.com/configure-additional-firewall-rules-on-rocky-linux-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social #vpsguide #sshcommands #rockylinux #serverhardening
POSIX wordexp(3) is dangerous by @yossarian https://lobste.rs/s/tbbiqb #c #security
https://yossarian.net/til/post/posix-wordexp-3-is-dangerous/
CW: biztonsági
A Node.js okt.21-i kiadásban egy Brotli dekóderben talált határon túli írás (CVE-2026-111497) távoli kódfuttatást tehet lehetővé minden támogatott ágban (22.x, 24.x, 26.x). Javított verziók: 22.23.4, 24.22.1, 26.12.1. Nincsen átmeneti workaround — frissítés szükséges. #NodeJS #Security #CVE #Brotli #OpenSource
📨 Software is dead and my private key is "4"
https://www.alexhyett.com/newsletter/software-is-dead-and-my-private-key-is-4/
#ai #security
#Proton hosts #Flock map revealing over 300,000 #cameras , defying cease-and-desist threats against creator — privacy-focused company hosts site on #Swiss servers, says users have the right to know who’s recording them | Tom's Hardware
By contrast, Proton’s Flock #camera map is easily accessible worldwide. Its location in #Switzerland also makes it a little more complicated for the #surveillance company to take legal action. Its move to preserve Michael’s work also follows the company’s #privacy ethos.
#alpr #security #ceaseanddesist
The PHP Foundation funding crisis threatens global web security. Discover how one full-time employee and AI tools protect 70% of the internet from hackers.
https://www.europesays.com/conflicts/50971/ Pentagon designates Confucius Institutes in US a national security threat – Taylorville Daily News #confucius #designates #institutes #national #Pentagon #PentagonNews #Security #threat
The Machine Week ran from October 13 to 22, and it produced 5 incidents where automation or AI agents did the heavy lifting. The headline number: a nation-state actor fired 2,900 sign-in attempts per minute at 2,250 Microsoft 365 tenants using an open-source AI pentest framework, reaching privileged access in under three hours.
ConnectWise / Storm-0940: AI Agents at Machine Speed
What happened: On October 15, Storm-0940 — a China-state-aligned group Microsoft tracks since 2021 — used ARTEX, a Go-based agentic AI penetration-testing framework, to compromise ConnectWise Cloud Backup's application credentials. From there, AI agents automated password spraying at 2,900 attempts per minute across 2,250+ downstream Microsoft 365 tenants, authenticating via already-trusted ConnectWise app identities without interactive sign-in. Microsoft disclosed the attribution on October 21.
Why it matters: The headline is "nation-state attack." The real risk is that ARTEX is open source. Any actor with a stolen OAuth app credential can now compress a multi-week intrusion into hours, and your MFA won't stop an app identity that's already trusted. Audit every third-party OAuth app registered in your tenant and revoke any you can't name.
Arista VCO: The Third Zero-Day in Four Months
What happened: On October 22, Arista published Security Advisory SA 0199 for CVE-2026-114625, a SQL injection in VeloCloud Orchestrator (on-prem) rated CVSS 9.9 that lets any logged-in user — down to "Enterprise Read Only" — escalate to superuser operator. It is the third exploited VCO zero-day since July 2026. Affected builds: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12. Arista confirmed active exploitation at the time of disclosure.
Why it matters: The headline is "patch VCO." The real risk is that three zero-days in one product within four months means the same code path is being probed repeatedly, and on-prem VCO is the control plane for your entire SD-WAN. If you can't patch within 48 hours, isolate the orchestrator from the internet.
OVHcloud CLI: 94 Minutes on GitHub
What happened: On October 19, a compromised OVHcloud developer GitHub account was used to replace the download binaries for five CLI releases (v0.11.0 through v0.15.0) with a secret-stealing trojan. The malicious builds were live for 94 minutes (14:47–16:21 UTC+2) before detection. The trojan harvested cloud credentials, SSH keys, and environment variables from the local disk.
Why it matters: The headline is "don't download OVHcloud CLI." The real risk is that any CLI you curl | sh or brew install is a supply chain target, and a 94-minute window is enough for a CI pipeline to pull it. Pin your CLI tools by SHA-256 and verify release artifacts before execution.
Patch Tuesday: 1,413 CVEs and a MotW Bypass
What happened: On October 13, Microsoft shipped the largest Patch Tuesday in its history: 1,413 CVEs, including CVE-2026-96951, an actively exploited Windows Shell security feature bypass (CVSS 8.8) that defeats Mark of the Web. CISA added it to the KEV catalog the same day with a federal remediation deadline of October 16. The same week, Palo Alto patched an exploited PAN-OS RCE and Cisco patched an exploited Secure Email Gateway flaw.
Why it matters: The headline is "patch Windows." The real risk is that MotW is the last line between a downloaded file and Office Protected View or SmartScreen. A bypass means a single malicious attachment can now land in a sandbox-less context. Verify your endpoint actually applies the October 13 cumulative update, not just the patch metadata.
The Wider Machine Week: Automation Everywhere
Plex2Shell. Four chained Plex Media Server CVEs were patched on October 16. Crypto miners and a proxy backdoor appeared within 24 hours of the proof of concept. If you run Plex at home, it's already been scanned.
Capcom. On October 22, Capcom confirmed a breach of CAPCOM ID exposing 11.7 million account email addresses. Hackers also changed login passwords for 196 accounts and leaked dates of birth for 43.
Nikkei. On October 19, Japanese media group Nikkei disclosed its third breach in a month. Attackers used stolen credentials from October 7 to access a cloud development service, exposing 1.83 million records.
Oracle Health. On October 7, Oracle reported a breach of its healthcare unit affecting nearly 20 million US patients. Compromised data includes Social Security numbers, home addresses, and medical records.
Japan NPA. On October 21, the National Police Agency said personal information for approximately 125,000 officers and staff across 20 prefectural forces was compromised through an attack on cloud provider Arcadia.
What This Means for You
If an AI agent can reach your M365 tenant, your SD-WAN control plane, and your local SSH keys through three different trust paths in the same afternoon, you don't have a patching problem — you have a trust-boundary problem.#ai #themachineweek #security #software #coding #development #engineering #inclusive #community
The Machine Week: The Week Attackers Almost Went Full Autopilot
RE: https://social.tchncs.de/@beandev/117492340458196093
Scheint ja dann nicht so wichtig zu sein.
#PHP2Shell #Security
https://www.europesays.com/unitedstates/65400/ US Deputy Secretary of War for Western Hemisphere Security Visits Medellin’s Pentagon #Colombia #Defense #Defense&Pentagon #featured #Medellin #pentagon #security #ShieldOfTheAmericas
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns https://thehackernews.com/2026/10/go-issues-emergency-update-blocking.html
