GoKawiil
Tech News
Security firm Defused says it detected threat actors scanning for systems vulnerable to CVE-2026-101767, an unauthenticated SQL injection flaw in Oracle E-Business Suite's Thin Client Framework servlet that can lead to remote code execution. Oracle patched the issue in its October 20 Critical Patch Update, and Shadowserver currently tracks over 670 internet-exposed EBS instances, mostly in the US.
CISA confirmed attackers are actively exploiting a critical vulnerability in Google's Brotli compression library, dubbed Node2Shell, that can let unauthenticated attackers crash systems, leak memory, or run arbitrary code. The agency added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 10 under Binding Operational Directive 26-04. Microsoft separately issued an emergency .NET update days earlier addressing related privilege-escalation risk from the same flaw.
Researchers from Anthropic and Google found a memory-corruption vulnerability (CVE-2026-97631) in an ICMP component of TianoCore EDK II, the open-source codebase underlying UEFI firmware used by nearly all major hardware vendors including AMI, Insyde and Phoenix. The flaw allows code execution before the OS or protections like Secure Boot load, though the payloads it delivers aren't persistent on their own. A coordinated disclosure planned for January was disrupted after AMI published a pull request with details and a fix, prompting TianoCore to issue a public advisory early.
Apple will send Sébastien Gros, its Director of Government Affairs for Europe, the Middle East, and Africa, to speak at Web Summit in Lisbon from November 9–12. The topic of his session has not yet been disclosed. Former Apple executive Tony Fadell is also among the more than 850 speakers set to attend.
Researchers Alex Matrosov and Dan Holmes discovered a memory-corruption flaw, rated 9.5 out of 10 in severity, in an ICMP component of TianoCore EDK II, the open-source reference code underlying UEFI firmware used by most hardware vendors including AMI, Insyde, and Phoenix. The flaw allows code execution before the operating system or protections like Secure Boot can engage, and although the initial exploit payload doesn't persist, it could be used to install other malware that runs at every boot. A planned coordinated disclosure for January was disrupted after AMI published a pull request detailing the bug and fix last month, prompting TianoCore to issue a public advisory early.
WIRED's Reviews team has begun publishing early Black Friday 2026 deal coverage, tracking price drops on gadgets its reviewers have personally tested and recommend. Among the highlighted discounts is Apple's AirTag, currently listed at one of its lowest prices seen, though WIRED notes this price point recurs fairly often.
Security firm Sansec says a Brazilian credit-card skimming group compromised a shared Plausible analytics tracker hosted on e-commerce platform Convertr's infrastructure, injecting malicious code that loads on checkout pages across the dozens of fashion merchants it serves. The skimmer, identified on October 24 and refined by October 26 to match Convertr's specific payment API fields, was designed to capture card numbers, expiration dates, CVVs, cardholder names and CPF tax IDs.
As public concern grows over AI's economic impact and data centers' strain on local communities, most politicians are distancing themselves from the industry ahead of the 2026 election. However, some candidates continue to publicly support data center expansion, while others propose conditions for future projects or reverse earlier pro-industry stances.
Wiz Research is monitoring activity related to two PHP vulnerabilities disclosed on October 21, 2026, dubbed PHP2Shell. The firm says it has seen only limited exploitation attempts in its telemetry and no public proof-of-concept for complete end-to-end attacks, though some partners have privately shared working exploits. Wiz reports internet-exposed vulnerable machines dropped about 67% in days following disclosure, and affected organizations fell roughly 47.9%.
Apple has backported a security patch for CVE-2026-86950, a CoreGraphics out-of-bounds write flaw, to older devices including the iPhone XS, XR, and several iPad models. The vulnerability, originally patched last month for newer iOS, iPadOS and macOS versions, was discovered by Meta Product Security and has reportedly been exploited in a highly targeted attack against specific individuals on iOS versions before iOS 27.
Smalltalks 2026 will be held October 14–16 at the Facultad Regional Rosario of UTN in Rosario, Argentina. Organizers say eight of the conference's talks come from the Cuis Smalltalk community or showcase work built with Cuis.
Security researchers confirmed successful exploitation of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), just days after patches shipped and earlier exploitation attempts had failed. Adel Karimi of Perplexity reported honeypot evidence of remote code execution against an Apache mod_php installation running PHP 8.4.26, including an 800 KiB decoded cookie dump and a function address matching a public exploit's offsets appearing in the execution payload. Expel researcher Marcus Hutchins corroborated the finding, calling it the highest-quality confirmation of in-the-wild exploitation seen so far.