News
-
GitHub previews package firewall aimed at stopping malicious dependencies before installation
GitHub has introduced a preview package firewall for enterprise customers, initially covering npm dependencies and giving administrators controls over downloads requested by build runners and coding agents.
-
Cisco patches critical Expressway flaw exposing clustered systems to root-level code execution
Cisco has fixed a CVSS 9.8 vulnerability in clustered Expressway systems that could permit unauthenticated remote command execution under specific conditions, with no workaround available.
-
Ransomware groups exploit PAN-OS VPN bypass to enter corporate and virtualised systems
Palo Alto Networks Unit 42 says ransomware operators including Qilin and Inc have exploited a PAN-OS authentication bypass, with investigators observing follow-on access to virtualisation and backup infrastructure.
-
Microsoft links ConnectWise compromise to AI-assisted cloud intrusion campaign
Microsoft attributes a major ConnectWise cloud application compromise to China-aligned Storm-0940, saying the group used the ARTEX AI penetration testing framework to accelerate attempts against Microsoft 365 tenants.
-
EU cyber rules can require reports on unsupported industrial devices without forcing fixes
ENISA says Cyber Resilience Act reporting obligations can persist after connected products reach end of support, while manufacturers may not have a corresponding legal duty to repair vulnerabilities in old devices.
-
Economic size shows little relationship with national cyber preparedness, Comparitech says
Comparitech places Finland first in its cybersecurity preparedness ranking of the 50 largest economies and reports little correlation between GDP and its institutional indicators; the study does not measure actual attack resilience.
-
Railway warns customers to rotate secrets after suspected access to environment variables
Railway says attackers may have obtained decrypted customer environment variables. It began restoring builds in stages on 22 October while asking users to rotate secrets and reconnect affected integrations.
-
LiteLLM compromised release carried credential stealer through Python and container registries
LiteLLM says stolen developer tokens enabled a malicious 21 October release through PyPI and Docker registries. The affected artifacts were withdrawn that day; the investigation remains open.
-
GitLab issues emergency fixes for critical unauthenticated server code execution flaw
GitLab has released emergency security updates for a CVSS 10.0 vulnerability in its regular expression compiler, warning that some self-managed installations could be exposed to unauthenticated code execution.
-
LOXONE restores logistics after internal cyberattack as data exposure investigation continues
LOXONE says an 18 October attack affected internal CRM and applicant systems. By 21 October, worldwide logistics had resumed, while the company reported no impact on customer building controls.