Stolen Qubole Credentials Opened Customer AWS Accounts
Attackers used Qubole-linked AWS credentials to enter customer accounts, read secrets and download S3 data. Old integration roles still granted access.
Google Patches an Exploited Chrome XML Flaw
Google is rolling out fixes for an exploited Chrome XML flaw. Verify the running browser build on Stable or Extended Stable after relaunch.
Apple Patches Exploited Brotli Flaw in Out-of-Band Update
Apple’s 9 November updates fix an exploited Brotli flaw and close iMessage and device-pairing vulnerabilities. Check which version to install.
Synology Ships a Plex2Shell Fix for Its NAS Package
Synology released updated Plex Media Server packages for four DSM branches. Check the exact Plex build and review any server exposed before patching.
Mittwald Traces 56 Compromised Hosting Projects to Its MCP Server
Mittwald traced 56 compromised hosting projects to its MCP server. The company restored mStudio and SSH access while investigating the attack.
SonicWall Fixes an Exploited VPN Route Around SAML
SonicWall fixed an exploited SSL VPN flaw that bypasses SAML enforcement. Check alternate login paths and verify the fixed Gen7 or Gen8 build.
An OpenSSH Password Bypass Puts Some Alpine Hosts at Risk
Some Alpine configurations let an attacker bypass SSH password authentication. Check account conditions, update the package and restart SSH.
CISA Flags an Exploited WordPress Core Upgrade Flaw
CISA listed an exploited WordPress core flaw that can run code during a full upgrade. Check the fixed release and review the last upgrade window.
A Fake cPGuard Update Ran as Root on Hosting Servers
A malicious cPGuard update ran as root. Review the delivery window, look for compromise and rotate credentials exposed on affected servers.
Barracuda Patches a Chain That Can Give Attackers Root
Two flaws can give an attacker root on a Barracuda Email Security Gateway. Check management access and apply the patch for your firmware.
Tracebit Tests How Decoys Change an AI Attacker’s Decisions
Tracebit’s October cloud experiment reports fewer completed objectives and higher costs. The baseline, model differences and denominators matter.
Expressway Fixes Need More Than One Version Check
Cisco’s Expressway fixes have different scopes and version thresholds. Check clustered database access, wider hardening, provisioning and embedded PHP.