N-able Takes Cloud Platform Offline Following Disclosure of Over 30 Zero-Day Vulnerabilities
N-able has taken its hosted N-central environments offline and has advised on-premises clients to power down their servers after a security researcher revealed more than 30 purported zero-day vulnerabilities, some of which could allow attackers to seize control of affected systems. On Sunday, November 8, security researcher Sean Bales made the vulnerabilities public and created…
Vanderbilt University affected by BYOD ransomware attack, claims of data theft
Vanderbilt University has issued a warning regarding its response to a cyberattack attributed to the BYOD ransomware group, which asserts that it has encrypted the university’s databases and stolen sensitive information related to students, employees, and research. The university confirmed the occurrence of this incident on Monday, indicating that university devices, systems, and cloud services…
Google Disrupts XCPE Android Malware Botnet Affecting Millions of Devices, Bans TV Box Manufacturer
Google, along with industry collaborators, has successfully dismantled the XCPE malware botnet, which comprises over 1.3 million Android TV streaming boxes. The company claims that the manufacturer intentionally infected these devices with malware to profit from cybercriminal activities. Google confidently links the botnet to the Chinese manufacturer Videostrong Technology Co., accusing it of deliberately embedding…
Commonalities Among Exploited Vulnerabilities: A Data-Driven Examination of Real-World Incidents
The landscape of vulnerabilities is continually growing. Between 1999 and September 2026, around 383,000 software vulnerabilities have been revealed across various platforms and technologies; however, only about 2,000 CVEs (approximately 0.5%) have been associated with actual exploitation in the real world. These vulnerabilities exhibit distinct patterns. Malicious actors tend to focus on weaknesses that facilitate…
Attackers Take Advantage of Severe Siemens IoT2050 Vulnerability to Establish Remote Command Backdoors
A critical security vulnerability affecting Siemens SIMATIC IoT2050 Advanced devices has been actively exploited, according to VulnCheck. This vulnerability, identified as CVE-2026-58115 (CVSS score: 10.0), involves a lack of authentication for an essential function, which can be leveraged by an unauthenticated remote attacker to execute arbitrary code. Siemens stated in an advisory issued in August…
PHP Releases Second Windows Security Update in Five Days to Address Brotli Code Execution Vulnerability
PHP has recompiled its official Windows packages for versions 8.2 to 8.5 to address CVE-2026-111497, a vulnerability in the Brotli compression library included in these packages. This vulnerability could allow an attacker to corrupt memory and potentially execute code. According to PHP, the vulnerability can be exploited via the cURL extension when it automatically decompresses…
Ex-Pentester Utilized ARTEX AI to Acquire 8.2 Million Data Records
Authorities in South Korea have identified seven individuals connected to a cybercrime scheme that infiltrated over 90 organizations within the nation, with the ARTEX AI pentesting framework being employed in the majority of the attacks. As reported by local media referencing the Seoul Metropolitan Police, the leader of the group has experience in penetration testing…
CISA Verifies Ongoing Exploitation of Two PHP2Shell Vulnerabilities Allowing Remote Code Execution
On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that the recently patched PHP2Shell vulnerabilities are being actively exploited, adding them to its Known Exploited Vulnerabilities (KEV) catalog. Both PHP vulnerabilities, which have a CVSS score of 9.2, enable unauthenticated remote code execution on affected systems: CVE-2026-109618 – A vulnerability related to out-of-memory…
Hackers Take Advantage of Plex2Shell Vulnerabilities to Install Crypto Miners and Linux Proxy Backdoor
Malicious actors have started to take advantage of a series of vulnerabilities in Plex Media Server to install cryptocurrency miners and reverse proxy software, just one day after a proof-of-concept (PoC) was released to the public. A researcher known online as boredhackerblog reported that the exploitation involves a combination of four distinct vulnerabilities, collectively referred…
Hackers Take Control of AOMEI Update Servers to Covertly Distribute Malware
It has been reported that hackers gained access to AOMEI’s servers to disseminate malware via a built-in promotional feature within its backup software. They briefly altered configuration files before reverting them to their original state to conceal the attacks. The supply chain attacks occurred between April and July 2026, targeting the update and notification systems…
