Jeff Davies - f4n6 (Page 15)

notes

CISA Malcolm

1. Executive summary CISA published ICSA-26-280-01 on 2026-10-15 covering seven vulnerabilities in Malcolm, the open-source network traffic analysis suite used

15 Oct 2026 · 12 min read read →

notes

Ransomware: iah6477 named camden-living (GB)

1. Executive summary A ransomware leak-site listing posted on 2026-10-15 names "camden-living" (country code GB) as a victim of a

15 Oct 2026 · 5 min read read →

notes

Spyware vendors found a way to make targeted ads even worse

1. Executive summary Citizen Lab has published what it describes as the first publicly confirmed case of zero-click mercenary spyware delivered through targeted online advertising,

15 Oct 2026 · 6 min read read →

notes

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

1. Executive summary Vercel released an out-of-band security update for Next.js on 2026-10-14 fixing two critical unauthenticated remote code execution flaws

15 Oct 2026 · 7 min read read →

notes

CikaBika Bot RAT Uses Discord for C&C

1. Executive summary SecurityWeek reported on 2026-10-15 that a remote access trojan tracked as CikaBika is delivered through phishing and uses Discord for command-

15 Oct 2026 · 4 min read read →

notes

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

1. Executive summary Ahsay has released new fixes for two AhsayCBS flaws, CVE-2026-105133 (CVSS 5.5 MEDIUM, CWE-287) and CVE-2026-105134 (CVSS

15 Oct 2026 · 6 min read read →

notes

Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies

1. Executive summary SecurityWeek reported on 2026-10-15 that a new Android banking trojan and remote access trojan, tracked as Hirudo, replaces installed banking apps

15 Oct 2026 · 8 min read read →

notes

UK keeps AI safeguards in the maybe pile for Cyber Security BIll

1. Executive summary At a Business, Innovation, Science and Trade Committee hearing on 14 October 2026, senior UK civil servants said the government is still considering

15 Oct 2026 · 6 min read read →

notes

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

1. Executive summary A credential-theft campaign tracked as GhostAction compromised the GitHub accounts of about 1,900 users and pushed malicious GitHub Actions workflows into

15 Oct 2026 · 7 min read read →

notes

Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

1. Executive summary Previdian has issued an alert covering active exploitation attempts against CVE-2026-105740, an OS command injection flaw in Langflow, the open-source

15 Oct 2026 · 6 min read read →

notes

Using TLS to protect data

1. Executive summary The NCSC has published revised guidance on configuring TLS, covering recommended cryptographic profiles for TLS 1.3 and TLS 1.2, the deprecation

15 Oct 2026 · 6 min read read →

notes

Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

1. Executive summary Unit 42 has published an investigation into a September 2024 intrusion against a telecommunications managed service provider in which attackers exploited CVE-2024-

15 Oct 2026 · 9 min read read →