A new tool called coldframe, built as a single standalone Python file, impersonates Danfoss AK-SM 800A and Copeland/Dixell XWEB EVO refrigeration controllers to lure attackers. It replicates real device details like TLS settings, HTTP headers, login flows, and known exploit paths, logging credentials, exploit attempts and attacker actions without exposing any real system. The project follows reports of 2026 attacks in which hackers used default passwords and unpatched firmware to break into internet-facing refrigeration supervisors across Europe and trigger forced defrost cycles.
github.com
· 2026-11-07
Security researchers disclosed CVE-2026-123158, a vulnerability in Alpine Linux's default OpenSSH setup that allows attackers to log into password-disabled or key-only accounts simply by sending an oversized password string. The bug stems from musl libc, the lightweight C library used by Alpine and other distros including Void Linux, OpenWrt, and Yocto-based embedded systems, meaning the exposure extends beyond Alpine itself. Alpine Linux and OpenSSH maintainers have issued patches, and users are urged to update and restart affected services immediately.
zdnet.com
· 2026-11-07
A root-user broadcast posted early Saturday morning recounts a brutal week of patching: a routine Monday fix, Patch Tuesday, an 'Exploit Wednesday' after someone reverse-engineered the patch diff, and an out-of-band fix on Thursday. The message, styled as a mock CVE advisory, asks the security community to pause filing vulnerabilities, reserving CVE numbers, or publishing proof-of-concept exploits for just 24 hours.
nocveday.com
· 2026-11-06
SonicWall has released security updates addressing seven SonicOS vulnerabilities, including CVE-2026-19868, an SSL-VPN authentication bypass that lets attackers with valid alternate credentials evade SAML authentication, including SAML-enforced MFA. SonicWall confirmed it is investigating a report of active exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, directing federal agencies to patch by November 20, 2026. The fix also covers two 8.8-severity management interface bugs, pre-authentication buffer overflows in SSL-VPN and TACACS+ services, and a weak password hashing issue on virtual appliances.
bleepingcomputer.com
· 2026-11-06
A Hacker News poster flagged that Ubuntu has not yet shipped a fix for CVE-2026-98432, a vulnerability rated 9.8 in severity, nearly a week after disclosure. Ubuntu's security tracker still lists the issue as 'work in progress,' though it now includes a suggested mitigation. The poster says they have been relying on manual mitigations in the meantime.
news.ycombinator.com
· 2026-11-06
Barracuda Networks has released patches for two vulnerabilities, CVE-2026-116606 and CVE-2026-111560, affecting its Email Security Gateway and several other products including its Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Chained together, the flaws could let an attacker with access to a device's administrative interface bypass authorization controls and gain root access.
bleepingcomputer.com
· 2026-11-03
A critical remote code execution vulnerability rated 9.8 on the CVSS scale, tracked as CVE-2026-98432, remains unpatched in Ubuntu's 22.04, 24.04, and 26.04 LTS kernels almost three weeks after disclosure. Canonical has not released updated kernel packages or given a timeline for when fixes will ship.
freenode.net
· 2026-11-02
A critical remote-code-execution bug in the Linux kernel's TCP stack, CVE-2026-98432 (CVSS 9.8), has existed since 2016 and affects nearly all Linux servers. Debian shipped a patch on October 16, but as of November 2 every supported Ubuntu release, including LTS versions, is still listed as vulnerable, more than two weeks later and days after a working root exploit was reportedly demonstrated.
chalmovsky.com
· 2026-11-02
Shadowserver reports more than 1,000 internet-facing GitLab servers remain vulnerable to CVE-2026-97229, a critical integer overflow bug in GitLab's CI/CD Regular Expression Compiler that lets unauthenticated attackers run arbitrary code via crafted regex in pipeline configs. GitLab shipped fixes on October 12 in versions 19.4.2, 19.3.5 and 19.2.8, but CISA has now confirmed active exploitation and added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until Sunday to patch.
bleepingcomputer.com
· 2026-11-02
Synology issued an advisory saying threat actors are exploiting a vulnerability patched in December 2024 to deploy C3RB3R ransomware against NAS devices still running outdated DSM software. The company did not name the specific flaw but pointed to a November 2024 advisory covering three vulnerabilities allowing code execution and file read/write access. Synology is urging customers to update DSM immediately, enable automatic updates, and block internet access to the management web interface.
bleepingcomputer.com
· 2026-11-02
Ivanti has released fixes for two additional Connect Secure gateway vulnerabilities, CVE-2026-111357 and CVE-2026-118527, which attackers chained together with a previously patched authentication bypass flaw, CVE-2026-104935. Researchers at Volexity and Defused say the attack campaign has been running since at least October 1, with one threat actor achieving root-level code execution on fully patched devices without deploying malware.
bleepingcomputer.com
· 2026-11-02
Attackers tried to exploit CVE-2026-97229, a maximum-severity remote code execution flaw in GitLab's CI/CD regex compiler, against Alpine Linux's development infrastructure on October 20-21, repeatedly crashing GitLab processes. Alpine found no direct evidence code was executed or packages tampered with, but due to missing logs it could not rule out compromise, so it rebuilt its GitLab instance and reset all passwords.
bleepingcomputer.com
· 2026-11-01
GoKawiil