IT News Analysis

1

Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers

Tailscale has released  version 1.104.4  to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how Tailscale SSH forwards network connections, a job the Tailscale background process carries out with root privileges. To use them, an attacker must already control a device that the network's access rules permit to open an SSH session to the target, with forwarding allowed in that rule. The flaws come from a report called  Tailworm , published days before the fix by Erica Windisch of Cyberdione Labs, who tested released versions of the Tailscale client and the self-hosted headscale control server in a lab. Tailscale SSH decides who can connect using a device's identity and the network's policy file, not a password or key, so an attacker does not need stolen credentials, only a foothold on a device the policy already trusts. The ...

Oct 28, 2026

2

The Toxic Combination: 62% of Agents Are One Prompt Away From Exfiltration

Get the report: how one unreviewed pair of permissions turns a single agent into a breach.

3

ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier,  CVE-2026-35273 , in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address by default, opening the door to remote code execution without a login. The breakdown comes from Bobby Gould of the Zero Day Initiative (ZDI), whose team reported the flaw to Oracle. In  its analysis , ZDI said it reported three distinct vulnerabilities across two PeopleSoft components, and that it is working with Oracle to assign a separate CVE to each. As of this week, the one June identifier is still the only one on the record. CVE-2026-35273 affects PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, carries a CVSS score of 9.8, and lets an unauthenticated attacker take o...

Oct 28, 2026

4

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in Google Brotli that could allow a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial-of-service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. CVE-2026-48356 (CVSS score: 9.3) - An unrestricted upload of a file with dangerous type vulnerability in Adobe Commerce and Magento that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. The development comes days after Sans...

Oct 28, 2026

5

CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published attacks that have leveraged ARTEX , an autonomous AI penetration testing framework, to single out entities in South Korea and Japan. "These environments held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories," security researchers Bakuei Matsukawa and Joseph C Chen said. "They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control." The first of the three attacks has been found to abuse CyberStrikeAI , another open-source penetra...

Oct 27, 2026

6

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked certificates. That is a setup an operator turns on deliberately; a default build does not.  GoAhead 6.1.1 , released to device makers on August 2, 2026, and publicly published on October 12, fixes it. GoAhead is a small web server that device makers build into firmware to run management pages on routers, printers, gateways and industrial controllers. Its maker, EmbedThis, says it runs in hundreds of millions of devices. The flaw was found by Sébastien Féry of FoxIO, who described it and two other TLS problems in a  write-up  on October 26. On an affected build, the server...

Oct 27, 2026

7

Turn Your Next Employee Mistake Into a Training Moment, Not a Breach.

Build safer habits with Adaptive's interactive training tailored to your team's roles and real-world risks.

8

Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads

Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file. Patches for the flaw were released last month by Apple in versions iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, acknowledging that it may have been exploited in sophisticated attacks against specific individuals using devices running iOS before iOS 27. The fixes have now been expanded to include iOS 18.7.11 and iPadOS 18.7.11, which support iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against ...

Oct 27, 2026

9

Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as  CVE-2026-80097  and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests, the tokens gave full access to the account's email, files, and calendar. Microsoft says exploitation also needs the victim to complete a sign-in step in Authenticator, and that the flaw has not been used in attacks. The research comes from Ofek Levin, working through a fellowship program at the security firm  Enclave , which published the technical details on October 23, 2026. Microsoft assigned the CVE on September 8 and rated it 8.6 on the CVSS scale, which it labels "Important." On Android, Authenticator does more than show six-digit codes. It also acts as a broker: when ...

Oct 27, 2026

10

Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a  statement  on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve owners' recovery phrases or wallet private keys. Keystone will destroy 18,835 unsold devices that carry the key, and all new devices will get a new one. Keystone found the unauthorized access on October 20, and its advice to owners depends on when a device arrived. For a device received after that date with the old key, the company said: "Even if such a device passes authentication, we cannot completely rule out the possibility that it is counterfeit." Owners of such a device should contact Keystone support and use it only after the company confirms it is genuine. A device del...

Oct 27, 2026