Stolen GitHub Tokens Turn Build Workflows Into Secret Stealers
The wfx-loot campaign used stolen GitHub tokens to plant a credential stealer in build workflows. Check pushes, runner logs and exposed credentials.
Check Point Traces a Gateway Intrusion to an ESXi Wiper
Check Point traced a gateway intrusion through a separate Gaia flaw to an ESXi wiper. Patch exposed gateways and investigate where they could connect.
Secure Client’s Posture Flaw Starts With Local Access
Cisco’s Secure Firewall Posture flaw affects Windows, macOS and Linux. Local access, platform-specific consequences and the installed correction matter.
ConnectWise Warns of Rogue ScreenConnect Deployments
ConnectWise is investigating rogue remote-access installs and has disabled five ScreenConnect extensions as a precaution. Here is what operators can check.
Apache Fixes a Critical HTTP/2 Code Execution Flaw
Apache HTTP Server 2.4.71 fixes a critical flaw in mod_http2. Check the running module and your distribution’s fixed package.
Node.js Security Releases Fix HTTPS Memory Exposure
Node.js 22.23.5, 24.22.3 and 26.13.1 fix HTTPS memory exposure and other TLS and HTTP/2 flaws. Verify the running runtime after the update.
November Patch Tuesday Puts Outlook First
Microsoft confirms an exploited Outlook flaw. Check the affected Office builds, November Windows updates and Exchange rollout tests.
Synology Patches Two Remote File Access Flaws in DSM
Synology fixed two DSM flaws that can let remote attackers read or write files. Check the fixed build for each NAS and review exposed services.
Five Exploited Flaws to Prioritise in November
Five flaws added to CISA’s exploited list on 9 and 10 November. Check the fixes for GPUStack, FreeSWITCH, Faspex, BroadWorks and Webtop.
Railway Traces Customer Secret Theft to a Build Isolation Flaw
Railway traced the theft of customer secrets to a build isolation escape and misconfigured cloud trust. It estimated the potential scope at 1.85% of workspaces.
N-able Patches N-central After Taking Hosted Servers Offline
N-able released N-central Hotfix 2. Follow the server, Agent and Probe rollout and check the Legacy API after further exploits were disclosed.
A Malicious Web Page Can Reach FortiClient’s Local API
Crafted web content can reach the FortiClient local API. Identify the Windows or Mac endpoint package and verify the running fixed build.