[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog:all:1":3},{"total":4,"posts":5,"page":93,"per_page":94},27,[6,16,23,30,37,44,51,58,65,72,79,86],{"slug":7,"kind":8,"title":9,"excerpt":10,"cover_image_url":11,"cover_image_alt":12,"author_name":13,"published_at":14,"reading_minutes":15},"check-point-gaia-under-attack-php2shell-chained-to-root-for","rapid-alert","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","Marcus Lenngren","2026-11-13T11:18:49.874+00:00",3,{"slug":17,"kind":8,"title":18,"excerpt":19,"cover_image_url":20,"cover_image_alt":21,"author_name":13,"published_at":22,"reading_minutes":15},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":24,"kind":8,"title":25,"excerpt":26,"cover_image_url":27,"cover_image_alt":28,"author_name":13,"published_at":29,"reading_minutes":15},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00",{"slug":31,"kind":8,"title":32,"excerpt":33,"cover_image_url":34,"cover_image_alt":35,"author_name":13,"published_at":36,"reading_minutes":15},"sparrow-framework-china-linked-clusters-use-fake-chrome-cert","Sparrow framework: China-linked clusters use fake Chrome cert warnings and Linux footholds","Check Point links three China-nexus espionage clusters through the Sparrow framework, run by a supplier it calls CopperDragon. Watering holes push fake Chrome certificate fixes that install the SquadC backdoor, while Linux servers are used as entry points.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsparrow-framework-china-linked-clusters-use-fake-chrome-cert-54104957-cover.png","Sparrow \u002F SquadC rapid alert: Got a 'Certificate Fix' prompt? That installer is a backdoor.","2026-11-11T14:07:03.811+00:00",{"slug":38,"kind":8,"title":39,"excerpt":40,"cover_image_url":41,"cover_image_alt":42,"author_name":13,"published_at":43,"reading_minutes":15},"microsoft-november-2026-patch-tuesday-exploited-outlook-ntlm","Microsoft November 2026 Patch Tuesday: exploited Outlook NTLM zero-day among 1,093 fixes","Microsoft's November 2026 Patch Tuesday fixes 1,093 CVEs, including CVE-2026-124194, an actively exploited Outlook spoofing flaw that leaks a user's NTLMv2 hash when a crafted file is opened. Patch Outlook first and block outbound NTLM.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fmicrosoft-november-2026-patch-tuesday-exploited-outlook-ntlm-ff3584f4-cover.png","CVE-2026-124194 rapid alert: Still trust an .msg from a stranger? One open leaks your NTLMv2 hash.","2026-11-10T20:19:01.411+00:00",{"slug":45,"kind":8,"title":46,"excerpt":47,"cover_image_url":48,"cover_image_alt":49,"author_name":13,"published_at":50,"reading_minutes":15},"google-patches-eighth-exploited-chrome-zero-day-of-2026-xml","Google patches eighth exploited Chrome zero-day of 2026: XML use-after-free CVE-2026-125350","Google has shipped an emergency Chrome update for CVE-2026-125350, a high-severity use-after-free in the XML component that attackers are already exploiting. Update to 157.0.8103.50 and relaunch tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgoogle-patches-eighth-exploited-chrome-zero-day-of-2026-xml-8d70dfbb-cover.png","Chrome 157.0.8103.50 rapid alert: Is Chrome your daily browser? One bad page can run their code.","2026-11-10T11:41:11.865+00:00",{"slug":52,"kind":8,"title":53,"excerpt":54,"cover_image_url":55,"cover_image_alt":56,"author_name":13,"published_at":57,"reading_minutes":15},"sshole-cve-2026-123158-openssh-authentication-bypass-hits","SSHole (CVE-2026-123158): OpenSSH authentication bypass hits Alpine and musl systems, exploited within hours","An OpenSSH flaw lets attackers log into passwordless accounts on Alpine Linux and other musl-based systems using an oversized password. One connection, no retries. Patched in 10.6p2 on 5 Nov, exploited in the wild within nine hours. What to do tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsshole-cve-2026-123158-openssh-authentication-bypass-hits-0144dfdb-cover.png","OpenSSH 10.6p2 rapid alert: Your container built on Alpine? One SSH connection and root is theirs.","2026-11-06T13:21:25.555+00:00",{"slug":59,"kind":8,"title":60,"excerpt":61,"cover_image_url":62,"cover_image_alt":63,"author_name":13,"published_at":64,"reading_minutes":15},"openai-s-ai-pipeline-built-948-working-linux-kernel-root","OpenAI's AI pipeline built 948 working Linux kernel root exploits in one run: what admins should do now","OpenAI says an autonomous pipeline on an unreleased cyber model produced 1,169 working local root exploits for 948 unique Linux kernel flaws in a mid-October run. Patches are landing upstream in stages. Treat any unpatched box as root-exposed and update now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fopenai-s-ai-pipeline-built-948-working-linux-kernel-root-95462f16-cover.png","Linux Kernel LPEs rapid alert: Running an unpatched Linux box? A normal user account is now root.","2026-11-06T10:33:12.697+00:00",{"slug":66,"kind":8,"title":67,"excerpt":68,"cover_image_url":69,"cover_image_alt":70,"author_name":13,"published_at":71,"reading_minutes":15},"apt29-watering-holes-hit-ios-and-android-with-zero-click-n","APT29 watering holes hit iOS and Android with zero-click n-day exploit chains","Sekoia links a large watering hole campaign to Russia's APT29. Poisoned and cloned sites, plus a one-week compromise of the Plerdy analytics tracker, served n-day exploit chains to outdated iPhones and Android Chrome. No click needed. Update now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fapt29-watering-holes-hit-ios-and-android-with-zero-click-n-e6d884f7-cover.png","APT29 WateringHole rapid alert: Phone one version behind? One page view and it's drained.","2026-11-05T12:57:11.234+00:00",{"slug":73,"kind":8,"title":74,"excerpt":75,"cover_image_url":76,"cover_image_alt":77,"author_name":13,"published_at":78,"reading_minutes":15},"barracuda-esg-pre-auth-bypass-chains-with-root-command","Barracuda ESG: pre-auth bypass chains with root command injection across six product lines","Barracuda disclosed CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6) on 2 Nov 2026. Chained, they bypass authorization and give root on affected appliances. Patches are out. No active exploitation reported yet.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fbarracuda-esg-pre-auth-bypass-chains-with-root-command-dbf2dea8-cover.png","Barracuda ESG rapid alert: Your email gateway is a Barracuda? Chained, it may be root with no login.","2026-11-04T15:14:35.355+00:00",{"slug":80,"kind":8,"title":81,"excerpt":82,"cover_image_url":83,"cover_image_alt":84,"author_name":13,"published_at":85,"reading_minutes":15},"node-red-cve-2026-58115-exploited-in-the-wild-one-http","Node-RED CVE-2026-58115 exploited in the wild: one HTTP request drops Linux bots and webshells","A missing authentication flaw in Node-RED (CVSS 10.0) is under active exploitation. Attackers send a single POST to deploy a flow that runs arbitrary code, planting a Linux bot and persistent webshells. Check whether your instance is reachable and whether adminAuth is set.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode-red-cve-2026-58115-exploited-in-the-wild-one-http-e1d48fa9-cover.png","Node-RED CVE-58115 rapid alert: Node-RED reachable from outside? One POST and the box runs their code.","2026-11-04T12:56:21.464+00:00",{"slug":87,"kind":8,"title":88,"excerpt":89,"cover_image_url":90,"cover_image_alt":91,"author_name":13,"published_at":92,"reading_minutes":15},"linux-kernel-tcp-rce-cve-2026-98432-attackers-are-scanning","Linux kernel TCP RCE CVE-2026-98432: attackers are scanning now, Red Hat patched, Ubuntu fixes in testing","A critical use-after-free in the Linux kernel's IPv4 TCP code lets remote, unauthenticated attackers run code as root. Rated 9.8. Scanning began on 2 Nov. Red Hat has patched RHEL 8, 9 and 10; Ubuntu's fixes are still in -proposed.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flinux-kernel-tcp-rce-cve-2026-98432-attackers-are-scanning-b4529a6f-cover.png","Linux TCP CVE-2026-98432 rapid alert: Running a Linux server on 443? One SYN packet gets root, no login.","2026-11-04T05:18:56.278+00:00",1,12]