https://firewallscoop.com/Cybersecurity news without the noiseenThu, 22 Oct 2026 22:21:57 +0000https://firewallscoop.com/news/vulnerabilities/phpspreadsheet-xml-flaw-allows-ssrf-and-local/https://firewallscoop.com/news/vulnerabilities/phpspreadsheet-xml-flaw-allows-ssrf-and-local/Thu, 22 Oct 2026 18:13:42 +0000VulnerabilitiesA high-severity vulnerability in PhpSpreadsheet enables attackers to trigger denial of service or access local files via crafted spreadsheet XML inputs.https://firewallscoop.com/news/vulnerabilities/high-severity-cve-2026-114138-allows/https://firewallscoop.com/news/vulnerabilities/high-severity-cve-2026-114138-allows/Thu, 22 Oct 2026 17:34:36 +0000VulnerabilitiesAn unauthenticated denial-of-service flaw in Django REST Framework versions below 3.18.2 allows attackers to exhaust server resources using crafted HTTP headers.https://firewallscoop.com/news/vulnerabilities/8-7-high-unauthenticated-path-traversal-hits/https://firewallscoop.com/news/vulnerabilities/8-7-high-unauthenticated-path-traversal-hits/Thu, 22 Oct 2026 12:57:45 +0000VulnerabilitiesAttackers can read local files on unpatched OrbiTeam BSCW Server instances by manipulating theme parameters without any login credentials.https://firewallscoop.com/news/vulnerabilities/cve-2026-115333-lotus-middleware-auth-bypass/https://firewallscoop.com/news/vulnerabilities/cve-2026-115333-lotus-middleware-auth-bypass/Thu, 22 Oct 2026 11:42:43 +0000VulnerabilitiesA high-severity flaw in Lotus versions up to 0.10.2 allows attackers to forge API keys using only known prefixes, potentially altering usage metrics and billing records for affected organizations.https://firewallscoop.com/news/vulnerabilities/devguard-unifies-six-supply-chain-scans-into-one/https://firewallscoop.com/news/vulnerabilities/devguard-unifies-six-supply-chain-scans-into-one/Thu, 22 Oct 2026 10:55:15 +0000VulnerabilitiesThe open-source DevGuard platform aggregates six security checks and syncs findings with developer tools to streamline software supply chain risk management.https://firewallscoop.com/news/cyber-attacks/hirudo-rat-replaces-eight-indonesian-banking-apps/https://firewallscoop.com/news/cyber-attacks/hirudo-rat-replaces-eight-indonesian-banking-apps/Thu, 22 Oct 2026 10:31:56 +0000Cyber AttacksThe Android trojan tricks users into uninstalling legitimate financial apps to install modified versions that bypass security checks and steal credentials.https://firewallscoop.com/news/vulnerabilities/one-attacker-probes-exposed-flowise-ai-for/https://firewallscoop.com/news/vulnerabilities/one-attacker-probes-exposed-flowise-ai-for/Thu, 22 Oct 2026 10:01:55 +0000VulnerabilitiesResearchers observed an operator using an unauthenticated Flowise server to harvest credentials and attempt workflow hijacking via simulated nodes.https://firewallscoop.com/news/vulnerabilities/php-foundation-ships-security-updates-for-8-2/https://firewallscoop.com/news/vulnerabilities/php-foundation-ships-security-updates-for-8-2/Thu, 22 Oct 2026 07:21:58 +0000VulnerabilitiesThe PHP project released patches for four major versions after identifying two critical flaws and observing CVE IDs circulating online ahead of schedule.https://firewallscoop.com/news/cloud-security/litellm-1-107-0-python-startup-hook-steals-cloud/https://firewallscoop.com/news/cloud-security/litellm-1-107-0-python-startup-hook-steals-cloud/Thu, 22 Oct 2026 05:56:40 +0000Cloud SecurityMalicious LiteLLM 1.107.0 release installed credential stealers via Python startup hooks, exposing cloud keys, developer tokens, and AI tool sessions to theft.https://firewallscoop.com/news/vulnerabilities/cvss-9-9-low-priv-attackers-seize-control-of/https://firewallscoop.com/news/vulnerabilities/cvss-9-9-low-priv-attackers-seize-control-of/Thu, 22 Oct 2026 05:29:19 +0000VulnerabilitiesA CVSS 9.9 vulnerability in Oracle Trusted Answer Search 26.1 allows low-privileged network attackers to take over the system via Oracle Net.https://firewallscoop.com/news/vulnerabilities/cve-2026-110264-gitlab-self-managed-users-urged/https://firewallscoop.com/news/vulnerabilities/cve-2026-110264-gitlab-self-managed-users-urged/Thu, 22 Oct 2026 05:04:40 +0000VulnerabilitiesSelf-managed GitLab users must update immediately to fix a critical integer overflow bug allowing remote code execution without login credentials.https://firewallscoop.com/news/vulnerabilities/cvss-9-8-critical-oracle-webcenter-content-flaw/https://firewallscoop.com/news/vulnerabilities/cvss-9-8-critical-oracle-webcenter-content-flaw/Thu, 22 Oct 2026 03:58:28 +0000VulnerabilitiesA critical remote code execution flaw in Oracle WebCenter Content allows unauthenticated attackers to seize control of affected servers without credentials.https://firewallscoop.com/news/vulnerabilities/cvss-9-9-oracle-essbase-21-8-3-0-0-exposes-low/https://firewallscoop.com/news/vulnerabilities/cvss-9-9-oracle-essbase-21-8-3-0-0-exposes-low/Thu, 22 Oct 2026 03:43:21 +0000VulnerabilitiesA CVSS 9.9 flaw in Oracle Essbase allows low-privileged attackers to seize full control via HTTP, exposing environments running version 21.8.3.0.0 to immediate compromise.https://firewallscoop.com/news/vulnerabilities/php-issues-urgent-patches-for-two-critical/https://firewallscoop.com/news/vulnerabilities/php-issues-urgent-patches-for-two-critical/Wed, 21 Oct 2026 18:19:46 +0000VulnerabilitiesTwo critical vulnerabilities in PHP allow attackers to execute code remotely without credentials, affecting all web-serving deployments using supported versions.https://firewallscoop.com/news/cyber-attacks/dhs-mandates-removal-of-deepseek-ai-and/https://firewallscoop.com/news/cyber-attacks/dhs-mandates-removal-of-deepseek-ai-and/Wed, 21 Oct 2026 09:56:20 +0000Cyber AttacksHomeland Security orders civilian agencies to purge DeepSeek tools and halt purchases, citing national security risks and data tracking concerns.https://firewallscoop.com/news/vulnerabilities/unauthenticated-rce-risk-in-duplicator-plugins/https://firewallscoop.com/news/vulnerabilities/unauthenticated-rce-risk-in-duplicator-plugins/Wed, 21 Oct 2026 04:12:54 +0000VulnerabilitiesAttackers can trigger remote code execution or file deletion via object injection flaws in Duplicator and Duplicator Pro versions prior to the latest releases.https://firewallscoop.com/news/vulnerabilities/cvss-9-1-authenticated-http-stack-overflow/https://firewallscoop.com/news/vulnerabilities/cvss-9-1-authenticated-http-stack-overflow/Wed, 21 Oct 2026 03:23:03 +0000VulnerabilitiesA stack-based buffer overflow in the batchupg feature of this router model permits arbitrary code execution via authenticated HTTP requests.https://firewallscoop.com/news/vulnerabilities/cvss-9-1-flaw-enables-remote-code-execution-on/https://firewallscoop.com/news/vulnerabilities/cvss-9-1-flaw-enables-remote-code-execution-on/Wed, 21 Oct 2026 02:27:26 +0000VulnerabilitiesAn authenticated command injection vulnerability in Totolink X2000R firmware allows attackers to execute arbitrary code on the device via crafted HTTP requests.https://firewallscoop.com/news/vulnerabilities/four-plex-media-server-flaws-hit-cisa-kev-with/https://firewallscoop.com/news/vulnerabilities/four-plex-media-server-flaws-hit-cisa-kev-with/Wed, 21 Oct 2026 01:52:52 +0000VulnerabilitiesFederal agencies face strict deadlines to fix four chained flaws in Plex Media Server, including high-severity file write and SSRF issues.https://firewallscoop.com/news/vulnerabilities/cvss-9-1-critical-authenticated-rce-in-totolink/https://firewallscoop.com/news/vulnerabilities/cvss-9-1-critical-authenticated-rce-in-totolink/Wed, 21 Oct 2026 00:47:36 +0000VulnerabilitiesAuthenticated attackers can execute arbitrary code via stack-based buffer overflows in the Totolink X2000R web interface. No patch is currently available.https://firewallscoop.com/news/vulnerabilities/cvss-10-0-cve-2026-81212-ibm-datastage-5-4-0-0/https://firewallscoop.com/news/vulnerabilities/cvss-10-0-cve-2026-81212-ibm-datastage-5-4-0-0/Wed, 21 Oct 2026 00:04:00 +0000VulnerabilitiesA critical flaw in IBM DataStage 5.4.0.0 allows anonymous callers to poison tenant data and collapse encryption boundaries without authentication.https://firewallscoop.com/news/vulnerabilities/one-cache-poisoning-flaw-affects-all-apache/https://firewallscoop.com/news/vulnerabilities/one-cache-poisoning-flaw-affects-all-apache/Tue, 20 Oct 2026 23:25:44 +0000VulnerabilitiesA low-severity cross-user cache issue in the retired Apache Cocoon framework exposes multi-user apps to data leakage, with no patch planned.https://firewallscoop.com/news/cyber-attacks/tech-giants-block-emudhra-certificates-linked-to/https://firewallscoop.com/news/cyber-attacks/tech-giants-block-emudhra-certificates-linked-to/Tue, 20 Oct 2026 23:09:06 +0000Cyber AttacksMajor technology companies have blocked certificates from Indian CA eMudhra after discovering eight private keys were compromised, according to Dark Reading.https://firewallscoop.com/news/vulnerabilities/draytek-vigor2960-command-injection-flaw-exposes/https://firewallscoop.com/news/vulnerabilities/draytek-vigor2960-command-injection-flaw-exposes/Tue, 20 Oct 2026 14:49:59 +0000VulnerabilitiesA critical remote command injection flaw in unsupported DrayTek routers has a public exploit, though a limited patch is available for the affected version.https://firewallscoop.com/news/vulnerabilities/cvss-8-6-authenticated-attackers-execute-code-on/https://firewallscoop.com/news/vulnerabilities/cvss-8-6-authenticated-attackers-execute-code-on/Tue, 20 Oct 2026 10:07:06 +0000VulnerabilitiesA stack-based buffer overflow in Advantech ADAM-3600 units prior to version 2.8.5.0 enables authenticated attackers to execute arbitrary code via long file paths.https://firewallscoop.com/news/vulnerabilities/8-4-severity-siemens-software-center-flaw-used-in/https://firewallscoop.com/news/vulnerabilities/8-4-severity-siemens-software-center-flaw-used-in/Tue, 20 Oct 2026 08:18:59 +0000VulnerabilitiesAttackers exploit a high-severity DLL sideloading flaw in Siemens Software Center to deploy remote access trojans via trusted installers.https://firewallscoop.com/news/cyber-attacks/2-phishing-domains-mimic-google-meet-to-steal-2fa/https://firewallscoop.com/news/cyber-attacks/2-phishing-domains-mimic-google-meet-to-steal-2fa/Tue, 20 Oct 2026 08:06:45 +0000Cyber AttacksThreat intelligence reveals two domains hosting phishing pages that mimic Google Meet to harvest login details and two-factor authentication codes from users.https://firewallscoop.com/news/malware/six-ips-host-romulus-platform-for-clickfix/https://firewallscoop.com/news/malware/six-ips-host-romulus-platform-for-clickfix/Tue, 20 Oct 2026 05:26:26 +0000Malware & RansomwareResearchers identified six servers hosting the ROMULUS platform, which tricks users into running commands that install LegionLoader and other malicious software.https://firewallscoop.com/news/cyber-attacks/65-whitepapers-detail-pentagons-echotribble-ai/https://firewallscoop.com/news/cyber-attacks/65-whitepapers-detail-pentagons-echotribble-ai/Tue, 20 Oct 2026 03:46:21 +0000Cyber AttacksPublic documents reveal a Pentagon plan to develop an agentic AI framework designed to navigate infrastructure and neutralize threats across connected and isolated networks.https://firewallscoop.com/news/vulnerabilities/plex2shell-chain-4-flaws-deploy-cryptominers-on/https://firewallscoop.com/news/vulnerabilities/plex2shell-chain-4-flaws-deploy-cryptominers-on/Tue, 20 Oct 2026 00:23:26 +0000VulnerabilitiesAttackers are actively exploiting a chain of four vulnerabilities in Plex Media Server to install cryptominers and proxy software on unpatched systems.https://firewallscoop.com/news/vulnerabilities/cve-2026-112770-craft-cms-authenticated-rce-via/https://firewallscoop.com/news/vulnerabilities/cve-2026-112770-craft-cms-authenticated-rce-via/Mon, 19 Oct 2026 20:59:26 +0000VulnerabilitiesA high-severity flaw in Craft CMS allows logged-in users to execute arbitrary code by abusing the Twig group filter without proper safeguards.https://firewallscoop.com/news/cyber-attacks/3-tampering-windows-malwarebytes-identifies-aomei/https://firewallscoop.com/news/cyber-attacks/3-tampering-windows-malwarebytes-identifies-aomei/Mon, 19 Oct 2026 15:25:59 +0000Cyber AttacksCompromised update infrastructure pushed malware to AOMEI Backupper users during brief tampering windows in April through July.https://firewallscoop.com/news/cyber-attacks/33-of-q3-phishing-targets-microsoft-credentials/https://firewallscoop.com/news/cyber-attacks/33-of-q3-phishing-targets-microsoft-credentials/Mon, 19 Oct 2026 09:59:52 +0000Cyber AttacksCheck Point data shows Microsoft accounted for nearly a third of all brand impersonation attempts in the third quarter, far outpacing Apple and Google.https://firewallscoop.com/news/cloud-security/microsoft-exit-threatens-nscales-35b-ipo-and-23/https://firewallscoop.com/news/cloud-security/microsoft-exit-threatens-nscales-35b-ipo-and-23/Mon, 19 Oct 2026 09:24:25 +0000Cloud SecurityMicrosoft exits a major UK cloud infrastructure agreement with Nscale, a move that impacts the firm's valuation and planned public listing.https://firewallscoop.com/news/threat-intel/dark-web-search-engines-explained-how-hidden/https://firewallscoop.com/news/threat-intel/dark-web-search-engines-explained-how-hidden/Mon, 19 Oct 2026 05:41:08 +0000Threat IntelligenceDark web search engines crawl encrypted networks using automated spiders just like traditional web crawlers do, but they index content designed to evade standard discovery.https://firewallscoop.com/news/threat-intel/dfir-training-for-small-business-threat-readiness/https://firewallscoop.com/news/threat-intel/dfir-training-for-small-business-threat-readiness/Mon, 19 Oct 2026 05:25:02 +0000Threat IntelligenceSmall teams that practice live memory capture preserve critical breach evidence that standard automated back-ups silently wipe away during an incident.https://firewallscoop.com/news/cyber-attacks/2-credential-stealings-fake-watchguard-site/https://firewallscoop.com/news/cyber-attacks/2-credential-stealings-fake-watchguard-site/Sun, 18 Oct 2026 17:28:47 +0000Cyber AttacksHuntress found a phishing domain that harvested VPN login details twice before delivering the genuine, signed installer to unsuspecting users.https://firewallscoop.com/news/cyber-attacks/sidecopy-group-uses-lnk-shortcuts-to-install/https://firewallscoop.com/news/cyber-attacks/sidecopy-group-uses-lnk-shortcuts-to-install/Sun, 18 Oct 2026 04:44:35 +0000Cyber AttacksIndian authorities warn that the SideCopy hacker group targets organizations with phishing emails that deploy a medium-severity remote access tool via malicious shortcuts.https://firewallscoop.com/news/vulnerabilities/freerdp-8-3-high-severity-heap-overflow-allows/https://firewallscoop.com/news/vulnerabilities/freerdp-8-3-high-severity-heap-overflow-allows/Sat, 17 Oct 2026 19:57:30 +0000VulnerabilitiesA high-severity heap out-of-bounds write in FreeRDP versions prior to 3.32.0 enables unauthenticated attackers to exploit the NTLM authentication path without needing valid credentials.https://firewallscoop.com/news/vulnerabilities/zoneminder-command-injection-cve-2026-30971-hits/https://firewallscoop.com/news/vulnerabilities/zoneminder-command-injection-cve-2026-30971-hits/Sat, 17 Oct 2026 18:24:38 +0000VulnerabilitiesAn authenticated command injection flaw in ZoneMinder versions before 1.39.2 allows arbitrary code execution via monitor device paths, posing a high risk to CCTV environments.