https://redteamtribune.com/The security desk for defendersenWed, 21 Oct 2026 16:19:58 +0000https://redteamtribune.com/topic/cyber-attacks/attackers-hijack-staples-and-dell-order/https://redteamtribune.com/topic/cyber-attacks/attackers-hijack-staples-and-dell-order/Wed, 21 Oct 2026 11:15:13 +0000Cyber AttacksCisco Talos reports that malicious actors abused legitimate email pipelines from Staples and Dell to push victims toward fraudulent phone numbers, bypassing traditional email security checks.https://redteamtribune.com/topic/vulnerabilities/aiohttp-multipart-requests-cause-unbounded-file/https://redteamtribune.com/topic/vulnerabilities/aiohttp-multipart-requests-cause-unbounded-file/Wed, 21 Oct 2026 09:58:30 +0000VulnerabilitiesUnauthenticated attackers can drain file descriptors in aiohttp servers via crafted requests, a high-severity flaw patched in version 3.14.4.https://redteamtribune.com/topic/vulnerabilities/eclipse-iofog-websocket-authentication-bypass/https://redteamtribune.com/topic/vulnerabilities/eclipse-iofog-websocket-authentication-bypass/Wed, 21 Oct 2026 08:56:43 +0000VulnerabilitiesAttackers can seize administrative control of Eclipse ioFog instances by sending custom tokens over WebSocket connections, bypassing authentication checks entirely.https://redteamtribune.com/topic/vulnerabilities/argo-cd-jsonnet-flaw-risks-server-crash-and-file/https://redteamtribune.com/topic/vulnerabilities/argo-cd-jsonnet-flaw-risks-server-crash-and-file/Wed, 21 Oct 2026 08:24:44 +0000VulnerabilitiesA critical flaw in Argo CD allows attackers to read sensitive files and crash servers via JSONnet evaluation, affecting versions up to 3.6.0-rc2.https://redteamtribune.com/topic/vulnerabilities/argo-cd-kustomize-injection-bug-lets-read-only/https://redteamtribune.com/topic/vulnerabilities/argo-cd-kustomize-injection-bug-lets-read-only/Wed, 21 Oct 2026 08:08:18 +0000VulnerabilitiesAttackers with read-only access to applications can execute commands on Argo CD repo servers by injecting git options through Kustomize files.https://redteamtribune.com/topic/vulnerabilities/php-remote-code-execution-flaws-rated-9-2-trigger/https://redteamtribune.com/topic/vulnerabilities/php-remote-code-execution-flaws-rated-9-2-trigger/Wed, 21 Oct 2026 06:58:19 +0000VulnerabilitiesPHP teams prepare for critical updates addressing two unconfirmed RCE vulnerabilities with a 9.2 CVSS score, targeting supported branches only.https://redteamtribune.com/topic/vulnerabilities/openstack-manila-authenticated-cross-project/https://redteamtribune.com/topic/vulnerabilities/openstack-manila-authenticated-cross-project/Wed, 21 Oct 2026 06:26:45 +0000VulnerabilitiesAuthenticated users can manipulate any public share in OpenStack Manila, enabling data theft and access rule changes without owner permission.https://redteamtribune.com/topic/cyber-attacks/iq-lvbs-claims-rival-comma-ai-ip-targeted/https://redteamtribune.com/topic/cyber-attacks/iq-lvbs-claims-rival-comma-ai-ip-targeted/Wed, 21 Oct 2026 04:40:21 +0000Cyber AttacksStartup alleges repeated attempts to steal driving AI model and access user devices originated from competitor's infrastructure.https://redteamtribune.com/topic/vulnerabilities/duplicator-object-injection-cve-2026-82814-allows/https://redteamtribune.com/topic/vulnerabilities/duplicator-object-injection-cve-2026-82814-allows/Wed, 21 Oct 2026 04:40:21 +0000VulnerabilitiesAttackers can trigger remote code execution or file deletion on WordPress sites using Duplicator versions prior to the latest release, requiring no authentication.https://redteamtribune.com/topic/vulnerabilities/php-cvss-9-2-vulnerabilities-impact-wordpress/https://redteamtribune.com/topic/vulnerabilities/php-cvss-9-2-vulnerabilities-impact-wordpress/Wed, 21 Oct 2026 04:29:08 +0000VulnerabilitiesTwo high-severity vulnerabilities in PHP, both rated 9.2, will be patched in an update scheduled for October 21, 2026, affecting all dependent applications.https://redteamtribune.com/topic/vulnerabilities/totolink-x2000r-missing-signature-check-in-boa/https://redteamtribune.com/topic/vulnerabilities/totolink-x2000r-missing-signature-check-in-boa/Wed, 21 Oct 2026 04:12:39 +0000VulnerabilitiesAttackers with valid credentials can install arbitrary firmware on this router by exploiting a missing signature check in the update process.https://redteamtribune.com/topic/vulnerabilities/php-rce-flaws-at-9-2-cvss-severity-prompt/https://redteamtribune.com/topic/vulnerabilities/php-rce-flaws-at-9-2-cvss-severity-prompt/Wed, 21 Oct 2026 03:21:04 +0000VulnerabilitiesLeaked details of two critical PHP vulnerabilities lead maintainers to schedule emergency patches for October 21.https://redteamtribune.com/topic/cyber-attacks/deepseek-ai-fingerprinting-risks-prompt-dhs-ban/https://redteamtribune.com/topic/cyber-attacks/deepseek-ai-fingerprinting-risks-prompt-dhs-ban/Tue, 20 Oct 2026 20:10:14 +0000Cyber AttacksHomeland Security mandates purging DeepSeek tools and affiliated third-party software from government networks due to data tracking risks.https://redteamtribune.com/topic/vulnerabilities/apache-tomcat-critical-http-2-async-recycling-bug/https://redteamtribune.com/topic/vulnerabilities/apache-tomcat-critical-http-2-async-recycling-bug/Tue, 20 Oct 2026 19:20:32 +0000VulnerabilitiesA critical bug in Apache Tomcat allows HTTP/2 asynchronous requests to mix, potentially leaking data between users until patches are applied.https://redteamtribune.com/topic/cyber-attacks/palo-alto-pan-os-auth-bypass-enables-ransomware/https://redteamtribune.com/topic/cyber-attacks/palo-alto-pan-os-auth-bypass-enables-ransomware/Tue, 20 Oct 2026 18:38:04 +0000Cyber AttacksAttackers use CVE-2026-0257 to bypass VPN security controls and deploy ransomware across multiple industries, according to Unit 42 reports.https://redteamtribune.com/topic/vulnerabilities/froxlor-symlink-vulnerability-enables-root/https://redteamtribune.com/topic/vulnerabilities/froxlor-symlink-vulnerability-enables-root/Tue, 20 Oct 2026 17:54:24 +0000VulnerabilitiesBefore version 2.3.15, Froxlor contains a critical symlink flaw allowing customers to seize control of host directories via cron jobs.https://redteamtribune.com/topic/cyber-attacks/google-meet-phishing-fake-domains-steal-2fa-while/https://redteamtribune.com/topic/cyber-attacks/google-meet-phishing-fake-domains-steal-2fa-while/Tue, 20 Oct 2026 08:06:45 +0000Cyber AttacksThreat intelligence reveals two domains mimicking Google Meet to steal login details and 2FA codes, while an exposed install page leaks database configuration.https://redteamtribune.com/topic/vulnerabilities/siemens-software-center-dll-sideloading-enables/https://redteamtribune.com/topic/vulnerabilities/siemens-software-center-dll-sideloading-enables/Tue, 20 Oct 2026 08:00:18 +0000VulnerabilitiesAttackers abused a signed Siemens installer to load malicious code via CVE-2026-110936, achieving high-privilege execution on victim systems.https://redteamtribune.com/topic/cyber-attacks/anthropics-claude-code-spotted-1-175-cpu-xmrig/https://redteamtribune.com/topic/cyber-attacks/anthropics-claude-code-spotted-1-175-cpu-xmrig/Tue, 20 Oct 2026 07:24:32 +0000Cyber AttacksAnthropic’s coding assistant detected an unauthorized cryptocurrency miner consuming significant CPU resources during a routine application development task on macOS.https://redteamtribune.com/topic/cyber-attacks/ftc-119-5b-senior-fraud-toll-hidden-as-investment/https://redteamtribune.com/topic/cyber-attacks/ftc-119-5b-senior-fraud-toll-hidden-as-investment/Tue, 20 Oct 2026 05:08:48 +0000Cyber AttacksFederal data show senior fraud losses hit $3 billion in 2025, with investment schemes driving a sharp surge in reported financial harm.https://redteamtribune.com/topic/vulnerabilities/aiohttp-idle-connection-flaw-exhausts-server/https://redteamtribune.com/topic/vulnerabilities/aiohttp-idle-connection-flaw-exhausts-server/Tue, 20 Oct 2026 01:57:46 +0000VulnerabilitiesA high-severity vulnerability in aiohttp allows attackers to exhaust server capacity by holding idle connections open indefinitely before sending data.https://redteamtribune.com/topic/vulnerabilities/db-gpt-0-8-2-endpoint-error-grants/https://redteamtribune.com/topic/vulnerabilities/db-gpt-0-8-2-endpoint-error-grants/Tue, 20 Oct 2026 01:51:10 +0000VulnerabilitiesA flaw in DB-GPT 0.8.2 allows attackers to run code as root without login, exposing containers and databases to full compromise.https://redteamtribune.com/topic/vulnerabilities/terra-ai-driven-prototype-pollution-and-ssrf/https://redteamtribune.com/topic/vulnerabilities/terra-ai-driven-prototype-pollution-and-ssrf/Tue, 20 Oct 2026 00:23:26 +0000VulnerabilitiesAI-driven vulnerability discovery has led to a sharp rise in patch failures, with nearly one in forty GitHub fixes requiring follow-up advisories within 90 days.https://redteamtribune.com/topic/cyber-attacks/zoom-integrates-world-id-biometric-verification/https://redteamtribune.com/topic/cyber-attacks/zoom-integrates-world-id-biometric-verification/Mon, 19 Oct 2026 19:09:14 +0000Cyber AttacksEnterprise users can now prove human identity via iris scans and selfie checks to counter AI-generated video fraud on Zoom calls.https://redteamtribune.com/topic/cyber-attacks/ai-deepfakes-and-fake-pac-sites-fbi-warns-of/https://redteamtribune.com/topic/cyber-attacks/ai-deepfakes-and-fake-pac-sites-fbi-warns-of/Mon, 19 Oct 2026 16:21:26 +0000Cyber AttacksThe FBI warns that fraudsters are using AI deepfakes and fake donation sites to steal data and money before November elections.https://redteamtribune.com/topic/cyber-attacks/aomei-backuffer-update-supply-chain-breach/https://redteamtribune.com/topic/cyber-attacks/aomei-backuffer-update-supply-chain-breach/Mon, 19 Oct 2026 15:25:59 +0000Cyber AttacksAttackers hijacked update servers to push malware, gaining remote control of PCs through tampered download instructions during brief windows.https://redteamtribune.com/topic/vulnerabilities/ai-agents-risk-creating-hidden-backdoors-via/https://redteamtribune.com/topic/vulnerabilities/ai-agents-risk-creating-hidden-backdoors-via/Mon, 19 Oct 2026 07:08:02 +0000VulnerabilitiesU.S. agencies warn autonomous AI systems may independently exploit security flaws to establish persistent access without external attacker commands.https://redteamtribune.com/topic/vulnerabilities/bearer-cli-sast-scanner-ranks-vulnerabilities-by/https://redteamtribune.com/topic/vulnerabilities/bearer-cli-sast-scanner-ranks-vulnerabilities-by/Mon, 19 Oct 2026 06:07:24 +0000VulnerabilitiesThe new static analysis scanner ranks vulnerabilities based on sensitive data paths, helping teams focus remediation efforts on the most critical code segments.https://redteamtribune.com/topic/threat-intel/dark-web-threat-intelligence-implementation-steps/https://redteamtribune.com/topic/threat-intel/dark-web-threat-intelligence-implementation-steps/Mon, 19 Oct 2026 05:39:45 +0000Threat IntelligenceMonitoring hidden forums yields more noise than signal unless you filter automated chatter before ingestion.https://redteamtribune.com/topic/threat-intel/osint-tools-for-investigators-checklist-to-harden/https://redteamtribune.com/topic/threat-intel/osint-tools-for-investigators-checklist-to-harden/Mon, 19 Oct 2026 05:24:26 +0000Threat IntelligenceDefenders often leak more sensitive network architecture data through open source intelligence queries than attackers discover through active reconnaissance.https://redteamtribune.com/topic/threat-intel/7-mistakes-that-expose-you-to-dark-web-search/https://redteamtribune.com/topic/threat-intel/7-mistakes-that-expose-you-to-dark-web-search/Mon, 19 Oct 2026 04:18:15 +0000Threat IntelligenceYour configuration errors and leaked credentials allow dark web search engines to index your infrastructure, turning internal assets into public hunting grounds.https://redteamtribune.com/topic/cyber-attacks/claude-ai-reconstructs-nist-elliptic-curve-seed/https://redteamtribune.com/topic/cyber-attacks/claude-ai-reconstructs-nist-elliptic-curve-seed/Sun, 18 Oct 2026 04:14:24 +0000Cyber AttacksAnthropic’s model identified standard random number generators as the source for public cryptographic parameters, resolving a long-standing mystery about their origins.https://redteamtribune.com/topic/cyber-attacks/connectwise-skykick-credential-abuse-exposes-162/https://redteamtribune.com/topic/cyber-attacks/connectwise-skykick-credential-abuse-exposes-162/Sat, 17 Oct 2026 20:36:32 +0000Cyber AttacksHuntress confirms attackers abused vendor credentials to access Microsoft 365 data across 162 tenants using broad backup application permissions.https://redteamtribune.com/topic/cyber-attacks/anthropic-claude-reveals-nsa-curve-seed-origins/https://redteamtribune.com/topic/cyber-attacks/anthropic-claude-reveals-nsa-curve-seed-origins/Sat, 17 Oct 2026 17:12:25 +0000Cyber AttacksAn AI model solved a 25-year mystery regarding NIST elliptic curve parameters, showing they used a standard random number generator rather than hidden inputs.https://redteamtribune.com/topic/cyber-attacks/connectwise-backup-credential-breach-exposes/https://redteamtribune.com/topic/cyber-attacks/connectwise-backup-credential-breach-exposes/Sat, 17 Oct 2026 16:00:32 +0000Cyber AttacksAttackers used a stolen vendor API secret to access 173 Microsoft 365 environments, bypassing user authentication through a trusted backup application.https://redteamtribune.com/topic/vulnerabilities/freertos-mpu-authorization-bug-on-cortex-r82/https://redteamtribune.com/topic/vulnerabilities/freertos-mpu-authorization-bug-on-cortex-r82/Fri, 16 Oct 2026 17:48:38 +0000VulnerabilitiesUnprivileged tasks in FreeRTOS V11.3.0 and V11.3.1 can bypass memory protection on Arm Cortex-R82, accessing kernel regions outside assigned boundaries.https://redteamtribune.com/topic/vulnerabilities/sparx-enterprise-architect-xxe-flaw-unpatched/https://redteamtribune.com/topic/vulnerabilities/sparx-enterprise-architect-xxe-flaw-unpatched/Fri, 16 Oct 2026 15:57:38 +0000VulnerabilitiesA flaw in the XSLT Debugger allows attackers to read files if users open crafted documents, posing a risk to unpatched versions.https://redteamtribune.com/topic/vulnerabilities/xworm-path-traversal-bug-enables-remote-hijack-of/https://redteamtribune.com/topic/vulnerabilities/xworm-path-traversal-bug-enables-remote-hijack-of/Fri, 16 Oct 2026 15:07:30 +0000VulnerabilitiesRemote attackers can hijack XWorm command servers by exploiting a path traversal bug, gaining full control over the infrastructure without operator interaction.https://redteamtribune.com/topic/vulnerabilities/eseecloud-static-credentials-flaw-lets-attackers/https://redteamtribune.com/topic/vulnerabilities/eseecloud-static-credentials-flaw-lets-attackers/Fri, 16 Oct 2026 14:45:47 +0000VulnerabilitiesAttackers can log into EseeCloud devices using static credentials, bypassing authentication entirely on affected firmware and app versions.https://redteamtribune.com/topic/vulnerabilities/crafty-controller-critical-stored-xss-cve-2026/https://redteamtribune.com/topic/vulnerabilities/crafty-controller-critical-stored-xss-cve-2026/Fri, 16 Oct 2026 14:21:54 +0000VulnerabilitiesA critical stored cross-site scripting flaw in Crafty Controller allows unauthenticated remote attackers to inject malicious scripts through HTTP headers.