GoKawiil
Tech News
Security researchers identified a vulnerability dubbed 'SneakPeek' in Anthropic's Claude Code Desktop application, located in its file preview feature. The flaw reportedly lets attackers silently exfiltrate sensitive developer credentials, including SSH private keys, AWS credentials, and Claude OAuth tokens, without requiring any user interaction.
Palo Alto Networks disclosed a high-severity PAN-OS flaw, rated 8.6, that lets authenticated attackers with management-interface access execute code as root. The company said it observed limited exploitation in the wild and has released patches for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, with a fix for 11.2.16 due October 15. The flaw affects PA-Series and VM-Series firewalls and Panorama appliances, but not Cloud NGFW or Prisma Access.
Microsoft released its October Patch Tuesday update, addressing roughly 1,410 security vulnerabilities including two zero-day flaws across supported Windows versions. The release is also the first official update for Windows 11 26H2 and the final supported update for Windows 11 24H2 Home and Pro editions. It also includes fixes for File Explorer and Bluetooth issues, plus the ability to remap the Copilot key.
Cisco has released a patch for CVE-2026-76519, a path traversal bug in Secure Email Gateway's Advanced Malware Protection feature that lets unauthenticated attackers send a malicious email attachment to gain root-level command execution on unpatched devices. Cisco's security team said it detected active exploitation of the flaw in October 2026 and published indicators of compromise for administrators to check their systems. The vulnerability only affects devices with File Reputation enabled and running Content Scanner Tools versions earlier than 25.3.0.5525.
CISA is directing admins to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure that has been exploited as a zero-day since at least October 1. Ivanti released patched versions on Tuesday, and researchers at Volexity and Defused say an unknown threat actor chained the bug with two other flaws to gain unauthenticated root access and steal Active Directory credentials, LAPS passwords and BitLocker keys.
Microsoft released its largest-ever Patch Tuesday update in October, addressing a record number of vulnerabilities across its product line. The update includes fixes for security bypasses and unauthenticated remote code execution flaws, some of which are reported as actively exploited zero-days.
Microsoft released its October 2026 Patch Tuesday update, fixing 1,411 vulnerabilities across its product line, including three zero-day flaws. The bulk of the disclosed issues affect .NET and related components, spanning remote code execution, elevation of privilege, denial of service, and information disclosure bugs rated mostly Important severity.
At New York Comic Con, sound designer Natsuko Inoue and colleague Hisafumi Takeuchi described how they created Godzilla and King Ghidorah's screams for the film Godzilla Minus Zero by blasting speakers from atop an outdoor dam, startling nearby picnickers, walkers and at least one barking dog. The team also used analog foley techniques, such as flapping a rubber fisherman's suit, to generate Ghidorah's wing sounds.
Ivanti has issued an urgent patch advisory for CVE-2026-104935, a high-severity authentication bypass flaw in its Connect Secure VPN gateway that is being actively exploited. The vulnerability, discovered by Volexity, affects multiple recent ICS versions and lets unauthenticated attackers run arbitrary commands without user interaction. Shadowserver reports more than 5,500 ICS instances currently exposed online.
Trend Micro's Zero Day Initiative concluded Pwn2Own Ireland 2026, awarding $1,262,000 across three days as researchers demonstrated 98 zero-day vulnerabilities in devices including the Samsung Galaxy S26, Google Pixel 10, OpenAI Codex and Oracle's Autonomous AI Database. Ikotas Labs won the contest overall with $361,000 and 42.5 Master of Pwn points, including a $300,000 payout for a chained exploit against the Pixel 10, ahead of runners-up Xint and Team ZyGoat.
On the opening day of Pwn2Own Ireland 2026, security researchers chained 32 zero-day vulnerabilities to breach devices across categories including mobile phones, printers, smart home gadgets and AI systems, earning $388,500 in prizes. Samsung's Galaxy S26 was compromised twice, while VinSOC researchers led the leaderboard after chaining seven zero-days against a Philips Hue Bridge Pro and five against Oracle's Autonomous AI Database. Other targets included OpenAI's Codex coding agent, Lexmark and Canon printers, a Sonos Era 300 speaker, and LiteLLM, though an attempt on the Google Pixel 10 failed within the time limit.
Citrix has released emergency firmware updates for NetScaler ADC and Gateway appliances to fix CVE-2026-88779, a memory buffer vulnerability in SAML authentication with a CVSS score of 8.7. The company confirmed the bug has already been exploited in targeted attacks against unpatched devices, causing denial-of-service outages, and said it has found no evidence of customer data being compromised. Fixed versions include 14.1-73.41 and 13.1-64.28, with separate builds for FIPS and NDcPP customers.