Security

Proxmox VE is an incredible virtualization platform, but a fresh install needs hardening before it’s production-ready. This guide covers everything from basic configuration to advanced security controls. Prerequisites Proxmox VE 8.x installed on bare metal Physical access or IPMI/iKVM for recovery Basic Linux command line familiarity 1. Repository Configuration Disable Enterprise Repositories By default, Proxmox uses enterprise repositories that require a subscription. For homelab use, switch to the community repositories: ...

📡 Tech & Security Digest — 2026-10-27 Curated from Hacker News, security blogs, and tech publications. BleepingComputer Microsoft releases emergency .NET patches for critical Brotli flaw — Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shel… Apple backports CoreGraphics zero-day patches to older iPhones — ​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in “extremely sophisticated… CISA confirms PHP2Shell vulnerabilities now exploited in attacks — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited securit… PHP2Shell security flaws now sucessfully exploited in the wild — Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wil… BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot — A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and… Hacker News PaperPilot – Zero-Cloud, Pure-Rust PDF Engine with WASM and MCP (231 pts) The Mythical Man-Month in the Age of AI (178 pts) Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses) (142 pts) Show HN: Hob - Open-source, on device alternative to Claude Cowork and ChatGPT (148 pts) Concerning behavior from a popular open-weight AI model (304 pts) Roblox downloaded 145GB models from us (including adult content) without asking (64 pts) Three new discoveries in mathematics, computer science, and physics (946 pts) The Exponential Time Hypothesis Is False [pdf] (648 pts) Show HN: Encarta 95 Web (60 pts) New ‘Circadian’ Subtype of Depression Affecting 1 in 4 Patients (68 pts) Krebs on Security Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… Microsoft Plugs Nearly 1,000 Security Holes — Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest singl… The Hacker News PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware — Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mi… LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release — LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python packa… ⚡ Weekly Recap: This2Shell, That2Shell, Everything’s an RCE? Rogue AI, Supply Chain Chaos and More — This2Shell, That2Shell, Everything2Shell. That’s pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up… Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware — A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, secu… Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data — Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have de… LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor — The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, … PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw — PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packag… Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware — Cybersecurity researchers are calling attention to what they say is a “recurring social engineering pattern” across hundreds of cases in which threat … Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks — Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud…

📡 Tech & Security Digest — 2026-10-26 Curated from Hacker News, security blogs, and tech publications. Ars Technica Switch 2 security takes a hit as hackers unlock homebrew access — “Userland” exploit relies on integer overflow found in “SmileBasic” interpreter. … BleepingComputer Arista patches new VeloCloud Orchestrator zero-day exploited in attacks — Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deploym… PHP shares mitigation for new RCE vulnerability with no patch — The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configuration… PHP2Shell security flaws now sucessfully exploited in the wild — Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wil… BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot — A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and… HPE patches eight max severity RCE and auth bypass AOS flaws — Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximu… Hacker News PaperPilot – Zero-Cloud, Pure-Rust PDF Engine with WASM and MCP (160 pts) OpenAI and Anthropic cut their LLM prices by up to 80% within a few months. Why? (344 pts) UTS #39: Unicode Security Mechanisms (42 pts) Show HN: ADRs for AI – Deliberation records for human–AI work, versioned in Git (51 pts) AI didn’t cause the tech jobs bust, but it explains why there’s no recovery (57 pts) A mathematician reads the AI future (63 pts) Cognitive Mercantilism: AI panic resembles fears of early capitalism (69 pts) AI use leads UC Berkeley math professor to see ’no point’ in grading homework (220 pts) Cerebras Deploys Trillion-Parameter AI Models (356 pts) Switzerland. Block by block. At 1:1 scale (197 pts) Krebs on Security Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… Microsoft Plugs Nearly 1,000 Security Holes — Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest singl… The Hacker News PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware — Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mi… LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release — LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python packa… Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware — A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, secu… Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data — Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have de… LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor — The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, … Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks — Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud… PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t — You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not … PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert — This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versi…

📡 Tech & Security Digest — 2026-10-25 Curated from Hacker News, security blogs, and tech publications. Ars Technica Switch 2 security takes a hit as hackers unlock homebrew access — “Userland” exploit relies on integer overflow found in “SmileBasic” interpreter. … BleepingComputer Arista patches new VeloCloud Orchestrator zero-day exploited in attacks — Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deploym… PHP shares mitigation for new RCE vulnerability with no patch — The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configuration… Machine speed attacks require machine speed detection and response — Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world atta… BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot — A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and… HPE patches eight max severity RCE and auth bypass AOS flaws — Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximu… Hacker News Today, we hacked what we’d set out to hack: the iPhone (1082 pts) CVE Tracker (217 pts) Apple Security Research Device (176 pts) Cerebras Deploys Trillion-Parameter AI Models (174 pts) America has lost 200k of jobs in media, film and the arts. How much is AI? (370 pts) A practical guide to AI image generation, from diffusion to agents (270 pts) Why is AI generated language so hard to understand? (202 pts) Symbolic Learning in Python and Julia (67 pts) No signs of AI payoff outside the tech sector (555 pts) Meta Ignores Brazilian Court Order to End Bolsonaro Favoritism (127 pts) Krebs on Security Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… Microsoft Plugs Nearly 1,000 Security Holes — Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest singl… The Hacker News Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution — Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM th… Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA — Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access … PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware — Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mi… LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release — LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python packa… Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data — Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have de… LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor — The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, … Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites — A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watc… Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks — Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud… PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t — You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not … PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert — This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versi…

📡 Tech & Security Digest — 2026-10-24 Curated from Hacker News, security blogs, and tech publications. Ars Technica Switch 2 security takes a hit as hackers unlock homebrew access — “Userland” exploit relies on integer overflow found in “SmileBasic” interpreter. … BleepingComputer Arista patches new VeloCloud Orchestrator zero-day exploited in attacks — Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deploym… PHP shares mitigation for new RCE vulnerability with no patch — The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configuration… Machine speed attacks require machine speed detection and response — Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world atta… HPE patches eight max severity RCE and auth bypass AOS flaws — Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximu… GitLab warns of new max severity code execution vulnerability — GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulne… Hacker News Today, we hacked what we’d set out to hack: the iPhone (944 pts) Apple Security Research Device (96 pts) CVE Tracker (184 pts) Hacker reverses Samsung TV, finds on-board AI listening OpenAI account suspended (285 pts) A practical guide to AI image generation, from diffusion to agents (132 pts) Evolving Threat: http2shell is an RCE in Node, Python, and more (173 pts) Docker is weird (847 pts) OBS Studio 33 (238 pts) I Don’t Understand Quantum Physics (2018) (124 pts) Kimi K3.1 Pro and K3.1 Pro Highspeed (962 pts) Krebs on Security Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… Microsoft Plugs Nearly 1,000 Security Holes — Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest singl… The Hacker News Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution — Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM th… Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA — Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access … PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware — Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mi… LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release — LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python packa… Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data — Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have de… LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor — The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, … Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites — A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watc… Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks — Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator (VCO), the central management system for VeloCloud… PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t — You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not … PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert — This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versi…

📡 Tech & Security Digest — 2026-10-21 Curated from Hacker News, security blogs, and tech publications. BleepingComputer CISA: SafePay ransomware hit over 600 critical infrastructure orgs — The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizatio… Stolen UpdraftCentral keys used to backdoor WordPress sites — A threat actor breached TeamUpdraft’s website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral c… Zeabur shutting down after second security breach in two months — Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintex… Hacker News Upcoming critical PHP security release (CVE-2026-109618 / -109619) (944 pts) C# now beats Rust on WASM size (75 pts) Using Claude to reduce the attack surface of code (53 pts) Tsrs: A Port of TypeScript to Rust (417 pts) 2026 is an exciting year for the Rust compiler (and me) (183 pts) Launch HN: Respan (YC W24) – Open-source Rust AI gateway built around plugins (49 pts) Google Cloud outage affects almost all banking and other operations in Europe (389 pts) On AI writing (89 pts) Krebs on Security Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… Microsoft Plugs Nearly 1,000 Security Holes — Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest singl… The Hacker News Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution — Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM th… Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA — Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access … China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondT… ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan — Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high… ...

📡 Tech & Security Digest — 2026-10-20 Curated from Hacker News, security blogs, and tech publications. BleepingComputer OpenCode hack exposes API keys amid AI distillation attacks — The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a secu… Critical BlockStrap flaw lets hackers run code on Magento servers — Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially … WordPress SEO plugin Rank Math compromised to backdoor websites — Some downloads of the Rank Math PRO WordPress plugin from the vendor’s official website carried malware that planted hidden backdoors in a supply-chai… Hackers exploit SiteGuard WAF flaw to run commands as admins — Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affecte… Hacker News WhatsApp’s help pages hid LLM instructions: dont recommend a regulator (452 pts) OpenBSD 8.0 release will have inteldrm/radeondrm/amdgpu drivers from Linux 6.18 (157 pts) Ask HN: How to deal with shipping AI-written code you don’t understand? (463 pts) Putting Linux on my RTX Spark laptop because I don’t have a Microsoft account (244 pts) Linux 7.3 (618 pts) Krebs on Security Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… Microsoft Plugs Nearly 1,000 Security Holes — Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest singl… The Hacker News China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondT… ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan — Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high… ...

📡 Tech & Security Digest — 2026-10-19 Curated from Hacker News, security blogs, and tech publications. BleepingComputer Critical BlockStrap flaw lets hackers run code on Magento servers — Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially … Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers — Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (ri… Hackers exploit SiteGuard WAF flaw to run commands as admins — Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affecte… BeyondTrust patches zero-day exploited in attacks since August — BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late Au… Hacker News Linux 7.3 Released (260 pts) Hybrid Reasoning Agents: LLM agents that think in latent space, act through text (424 pts) If you don’t run your own LLM proxy, how do you know whats going on? (193 pts) Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling (52 pts) One parser, two bugs, many routers: Exploiting Broadcom WiFi across eCos, Linux (86 pts) How Far Will AI Assistants Go for a Refund They Can’t Get? (88 pts) How to Train Your Robot (57 pts) William Gibson and the trademarking of cyberspace (196 pts) Krebs on Security Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… Microsoft Plugs Nearly 1,000 Security Holes — Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest singl… The Hacker News China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondT… PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions — A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident … Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation — Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vuln… ...

📡 Tech & Security Digest — 2026-10-18 Curated from Hacker News, security blogs, and tech publications. Ars Technica OpenAI models hacked a crypto wallet and breached more websites — The actions could have resulted in criminal charges had humans been behind the keyboard. … BleepingComputer Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers — Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (ri… Critical BlockStrap flaw lets hackers run code on Magento servers — Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially … BeyondTrust patches zero-day exploited in attacks since August — BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late Au… Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack — ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities an… Drupal patches critical RCE flaws, warns exploits may emerge soon — Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the c… Hacker News OpenCode Hacked: User credentials leaked (868 pts) A skeptic’s first contact with Kubernetes (2024) (119 pts) Krebs on Security FBI Arrests Executive at Ransomware Negotiation Firm — Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an inves… Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… ShinyHunters Extorted Boeing Spin-off Prior to Arrests — A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooper… Two Alleged ‘TeamPCP’ Hackers Arrested in Australia — Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrati… The Hacker News China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondT… Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation — Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vuln… ...

📡 Tech & Security Digest — 2026-10-17 Curated from Hacker News, security blogs, and tech publications. Ars Technica OpenAI models hacked a crypto wallet and breached more websites — The actions could have resulted in criminal charges had humans been behind the keyboard. … BleepingComputer Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers — Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (ri… Critical BlockStrap flaw lets hackers run code on Magento servers — Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially … BeyondTrust patches zero-day exploited in attacks since August — BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late Au… Hacker News Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD (188 pts) Krebs on Security FBI Arrests Executive at Ransomware Negotiation Firm — Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an inves… Microsoft Patches More Than 1,400 Security Flaws — Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today’s epic patch… ShinyHunters Extorted Boeing Spin-off Prior to Arrests — A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooper… Two Alleged ‘TeamPCP’ Hackers Arrested in Australia — Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrati… The Hacker News China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers — The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondT… Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation — Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vuln… ...