The Files Look Clean. The F5 Appliance Could Still Be Backdoored.
Sophos found a rootkit that makes Apache execute a malicious version of legitimate BIG-IP APM files while the copies on disk remain clean.
Security
Vulnerabilities, defensive security, architecture and operational security.
Google Fixed 230 Chrome Bugs. One Was Already in Attackers’ Hands.
Google's exploited V8 flaw was one stage in BlueMoon, a three-vulnerability Chrome and Windows chain that multiple espionage groups adopted within days. Patch both Chrome and Windows, then hunt the published indicators.
A CVSS 10 Passport Flaw Leads SAP’s September Security Fixes
SAP's September Patch Day brings 19 new security notes and one update, led by a CVSS 10 Extended Passport flaw. Four issues are critical, including unauthenticated paths into NetWeaver and CAP multitenancy.
Nine Years of Passport and Flight Data Sat Behind Default Credentials
Researchers reached a Vietnam-linked passenger-data cluster through a cloud path and default credentials. It contained 220,783,700 flight records, including passport details, but ownership and possible theft remain unconfirmed.
Outlook Could Run Attackers’ Code While You Were Simply Reading an Email
A Critical Outlook vulnerability removes the click from a familiar phishing scenario. Microsoft says a specially crafted email can trigger code execution when it appears in the Reading Pane, forcing businesses to rethink both patch priority and the protection promised by user awareness.
Two Windows Flaws Were Already Under Attack When Microsoft’s 974-CVE Patch Tuesday Landed
Microsoft has confirmed exploitation of two Windows privilege-escalation vulnerabilities. One can break out of an AppContainer on older Windows systems; the other affects the Update Stack on current Windows releases. Together, they turn partial access into a race for SYSTEM.
September Patch Tuesday Forces Restarts Across Windows While Two Flaws Are Already Under Attack
Microsoft’s September security release is not a simple highest-score-first exercise. Two Windows flaws are already being exploited, several network services expose unauthenticated remote-code paths, Outlook can be attacked without a click, and even hotpatch-enrolled systems face a restart. Here is the order businesses should use.
Europe Nears Its First Quantum-Safe Deadline With “Limited Progress”
Europe’s first post-quantum milestone arrives at the end of 2026. The roadmap is not a blanket law, but the EU’s own assessment says implementation is still making only limited progress.
One Writable Memory Section Put Nvidia’s Windows User Boundary in Doubt
A public PoC says Nvidia’s Windows GPU components expose shared memory that any user can write. Nvidia is investigating the scope and remediation.
A PoC Turned Avast’s Malware Sandbox Into a Route to SYSTEM
A public PoC claims Avast’s malware sandbox can become a route to Windows SYSTEM. Gen Digital says the privilege-escalation flaw has been fixed.