​A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime’s built-in HTTP/2 support on the 24.x and 26.x release lines. A second HTTP/2 flaw… Read More »Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections’ Data

​Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software… Read More »Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

​A critical flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and… Read More »Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely

​ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there… Read More »ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients

​Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities… Read More »Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation

​Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot… Read More »AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets

​Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026. Cynet’s CyOps and Research teams said they identified… Read More »Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits

​Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff… Read More »Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords

​The in-house Python script behind eMudhra’s October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys.… Read More »eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise