F5 Patches Three Critical NGINX Flaws in Out-of-Band Release
F5 has shipped out-of-band security patches for eleven NGINX vulnerabilities, and three of them are rated critical with a CVSSv4 score of 9.2. Out-of-band means the fixes did not wait for a regular release cycle, which tells you how F5’s threat model team views these. If you run NGINX anywhere in your stack, and almost […]
Application Gateway WAF learns to inspect IPv6 traffic
Azure’s Application Gateway Web Application Firewall now supports inspection and enforcement for IPv6 traffic, in public preview. Before this, the WAF could sit in front of dual-stack applications but its rules only bit on IPv4. IPv6 traffic flowed through uninspected, which was a genuine gap for anyone running regulated workloads on a dual-stack frontend. The […]
One parser, two bugs: the Broadcom WiFi flaw nobody issued a CVE for
Security researcher Quentin Kaiser presented new research on Broadcom’s WiFi WPS implementation at Hexacon in Paris on October 16, and the story behind the bug is almost as interesting as the bug itself. The short version: a memory corruption flaw in Broadcom’s proprietary 802.11 stack, present since at least 2010, exploitable over the air with […]
ConnectWise Cloud Backup breach: one vendor secret unlocked hundreds of Microsoft 365 tenants
Here is the part that should worry anyone running a Microsoft 365 tenant: the attackers never touched a user account. No phishing email, no stolen password, no MFA fatigue push. They authenticated straight into customer tenants as a vendor application, using a valid app secret that the vendor itself held. The vendor was ConnectWise Cloud […]
Targeted ads became a zero-click spyware pipeline
The Citizen Lab published research this week describing something that sounds like a threat model from a decade of worst-case thinking, except it is documented, evidenced, and apparently been running for years: targeted online advertising used as a delivery pipeline for zero-click mercenary spyware. The report, called AdFection, centers on an Israel-registered company named Discover […]
Passkeys are not a trap: the backlash post gets WebAuthn wrong
A post titled “Passkeys are a trap. Do not use them.” has been making the rounds on Hacker News this week, and Scott Helme’s rebuttal is the best response to it I have read. The short version: the trap argument rests on a misunderstanding of how WebAuthn attestation actually works, and the alternative it recommends, […]
Registry hijacks let attackers mint trusted TLS certificates for Google domains
Attackers did not need to breach Google, or any of the other organizations caught up in this incident. They needed DNS. Last month, someone compromised the third-party operators behind the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) country-code top-level domains, changed authoritative DNS records, and quietly walked through domain control validation to collect […]
Forged RSA signatures without factoring: the attack nobody thought was possible
For roughly two decades, one assumption held firm: the only way to forge an RSA signature was to factor the modulus first, and factoring a 1024-bit key was a job for a nation-state budget. A team at UC San Diego and INRIA just knocked that assumption over. They forged a valid 1024-bit RSA signature without […]
Azure SQL is retiring Always Encrypted with Intel SGX enclaves
Microsoft has announced that Always Encrypted with Intel SGX enclaves in Azure SQL Database will retire on October 31, 2027. The reason is not policy. It is silicon: SGX enclaves run on DC-series virtual machines, and that hardware generation is being phased out of Azure. If you run encrypted databases on DC-series compute, you have […]
SonicWall SMA1000 flaw exploited in the wild days after patch
SonicWall patched a maximum severity flaw in its SMA1000 appliances on October 6. By October 9, honeypots were catching real exploitation attempts. If you run one of these gateways and have not patched, the window between “advisory published” and “attackers knocking” has already closed. What the flaw is The vulnerability, tracked as CVE-2026-102255, is a […]
Shai-Hulud worm reaches AI infrastructure: Tensorlake npm SDK compromised
The Shai-Hulud npm worm has now reached AI infrastructure. On October 8, tensorlake@0.5.144, the npm SDK for Tensorlake’s platform for running AI agents and untrusted AI-generated code, shipped with the worm’s credential-stealing payload inside. The jump matters because the SDK installs on developer workstations and build runners, outside the sandbox protections the platform itself sells. […]
How a clicked link could empty a Telegram Desktop session
A link, two processes, and a stolen session Researchers at BeakSec have published a full walkthrough of CVE-2026-107181, a chain in Telegram Desktop that turns a single clicked link into an arbitrary file read, and from there into a full account takeover. The bug scores 8.1 on the CVSS scale. It affects Telegram Desktop through […]