Category: Cybersecurity & Malware

A security vulnerability in the Linux kernel’s vhost subsystem, tracked as CVE-2026-74580 and named Vghost, allows local users to gain root access across nearly a decade of kernel versions. In certain virtualization setups, untrusted virtual machines can exploit the flaw to write to the host’s memory and take control of the program running the virtual machine. Tencent Zhuque Lab discovered the flaw and released a fix on August 3, publishing detailed documentation and working demonstrations on October 12. No public evidence of exploitation has emerged.

The vhost subsystem manages network and input/output acceleration for virtual machines and containers. The vulnerability stems from a cache mechanism that fails to clear when ring configurations change, allowing attackers to access kernel memory without bounds checking. The flaw affects Linux kernels from version 4.11 through 7.2-rc4 and has been confirmed on major distributions. Users should install patched kernels or restrict access to vhost device nodes as a temporary measure. Major Linux distributors including Red Hat, Amazon, and Oracle have released fixes.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Microsoft has identified problems with this month’s Windows Server security updates that are disrupting Exchange Server operations. The company confirmed that users on Windows Server 2019 and later versions are experiencing difficulties signing into Outlook on the web and receiving email after installing the October updates. Some affected systems display specific error messages and event logs indicating mailbox access failures.

Microsoft attributes the issues to a new default memory limit on Endpoint Mapper that restricts simultaneous lookup calls to 512, which proves insufficient during heavy Exchange Server usage. While the company works on a permanent solution, it has released a temporary workaround involving a registry modification that administrators can apply to affected systems. Microsoft clarified that the problems are not caused by Exchange Server security updates themselves and advised customers against uninstalling the Windows Server updates.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

A vulnerability in Broadcom’s Wi-Fi setup software allows attackers within radio range to execute code with root privileges on affected routers without needing the network password, according to a disclosure by security researcher Quentin Kaiser on October 16. The flaw affects routers from multiple vendors, with Kaiser demonstrating successful attacks against home gateways supplied by three Belgian internet providers. In some cases, the exploit extracted the Wi-Fi password from the device, while in others it established a remote command shell over the air.

The vulnerability exists in Broadcom’s Wi-Fi Protected Setup implementation and stems from improper handling of fragmented setup messages, which can corrupt router memory. Millions of devices worldwide are estimated to be affected, including older eCos-based chips that will likely never receive patches. No CVE has been assigned despite Broadcom’s knowledge of the flaw since 2018, and no fixes have been deployed to affected routers. Defenders can use YARA rules and scanning scripts to identify vulnerable equipment, though replacement remains the only option for devices incapable of receiving patches.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

Anne Arundel County, Maryland, confirmed that unauthorized actors accessed government computer systems and copied files during a breach discovered on August 28. County officials launched an investigation into the incident, which affected a limited number of systems. Authorities are currently reviewing the stolen files to determine whether any data related to county residents was compromised. The county notified federal law enforcement and other government agencies about the breach. The Baltimore suburb is home to over 600,000 residents and hosts numerous federal agencies, including the Defense Department and Internal Revenue Service.

The Rhysida ransomware gang claimed responsibility for the attack and threatened to release 2.6 terabytes of stolen documents unless a $2 million ransom was paid. This marks the second cyberattack on Anne Arundel County in recent years, following a separate ransomware incident last year. Rhysida has targeted multiple government entities worldwide, including cities in Seattle and Columbus, and Kuwait’s Finance Ministry. County officials noted an increase in cybercrimes targeting state and local governments, with several municipalities across the United States experiencing service disruptions from cyberattacks in recent weeks.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Proofpoint has announced plans to acquire Varonis Systems in an all-cash transaction valued at $6.3 billion. The deal will combine two established cybersecurity companies, with Proofpoint traditionally focused on email security and identity threat defense, while Miami-based Varonis specializes in data visibility and security. The merged entity will serve more than 16,000 enterprises and millions of organizations worldwide, positioning itself as a major player in the cybersecurity industry.

The combined company aims to develop a unified platform addressing artificial intelligence security concerns, enabling organizations to identify sensitive data, manage access controls, and prevent data loss. Both firms are recognized for their cybersecurity research capabilities. Proofpoint is owned by private equity firm Thoma Bravo. This acquisition represents one of several major consolidation moves in the cybersecurity sector this year, following comparable deals such as Accenture’s stake in Dragos and Cyera’s acquisition of Oasis Security.

Source: Read the full story at The Record

This summary was written with AI assistance from the linked source.

Drupal has released patches for two critical vulnerabilities affecting all supported versions of its content management system. The flaws exist in the Field UI module within Drupal core and the Entity List contributed module, both of which could enable remote code execution on affected websites. The Drupal Security Team warned that attackers may develop working exploits within hours or days of the vulnerabilities becoming public, urging administrators to apply updates immediately.

Site administrators are advised to update Drupal core to versions 10.6.19, 11.3.19, or 11.4.10 depending on their release branch, and to update the Entity List module to version 3.0.10. For those unable to upgrade immediately, Drupal recommends uninstalling the Field UI module as a temporary protective measure. The vulnerabilities affect over one million websites that use Drupal, a popular open-source platform especially among government agencies, universities, and non-profit organizations.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Researchers have identified a malicious npm package called “imgdecode” as part of a supply chain attack campaign named MALFEX. Uploaded on September 30, 2026, the package contains a Windows dynamic-link library that downloads encrypted shellcode from GitHub, decrypts it, and injects it into a new process when loaded. The package has been downloaded 979 times and remains available on npm. The MALFEX campaign, active since August 2023, has distributed eight malicious packages across five publisher accounts designed to compromise Windows systems through various infection methods.

The threat actor behind MALFEX has demonstrated responsiveness to public disclosures and npm removals by quickly publishing replacement packages. The malware performs anti-analysis checks and harvests sensitive files, cryptocurrency wallet information, and data from web browsers and gaming applications. It also establishes command-and-control connections enabling shell execution, file transfers, and system monitoring. Developers who installed these packages should immediately isolate affected Windows systems, check for persistence mechanisms, rotate credentials, and move cryptocurrency to new wallets if seed phrases were compromised.

Source: Read the full story at The Hacker News

This summary was written with AI assistance from the linked source.

ConnectWise has suspended access to its Cloud Backup service following a security breach involving unauthorized access to application identities that compromised Microsoft 365 tenants. The attack began around October 15 from a single IP address, with Huntress identifying at least 162 compromised tenants. Microsoft confirmed the malicious activity on the same date. The attacker used the backup service’s existing permissions to access customer data, including emails, files, and Teams chats. Since the attack involved automated scripts rather than user logins, security measures like multi-factor authentication proved ineffective.

Multiple cybersecurity firms documented the breach’s scope and methods. Todyl researchers found that attackers directly authenticated to Microsoft 365 using the backup application’s credentials, while Huntress observed persistence attempts on nearly 50 monitored tenants where attackers assigned themselves administrative roles. Microsoft characterized the incident as an active supply-chain attack. ConnectWise stated that stored backup data had not been compromised and would remain accessible once services resume, though the company provided no timeline for restoration. Administrators have been advised to review application credentials, sign-in activities, and remove unauthorized additions since October 13.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.