IT News Analysis

1

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432 , can be reached by a remote, unauthenticated attacker and can lead to remote code execution,  Red Hat  and  Canonical  said. The Linux kernel's own CVE team rates the flaw 9.8 out of 10 on the CVSS scale. Red Hat, which initially rated it Moderate at 5.9, has raised its score to 9.8 and now calls it Critical. The bug has been present since Linux 4.4, and the upstream fix landed in October. What the Flaw Is When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor still rea...

Nov 03, 2026

2

Shadow AI Is Everywhere. Here’s How You Can Find and Secure It

Learn what works for uncovering shadow AI apps, agents, integrations, and data exposure—and what falls short.

3

The 4 Elements of Exposure Prioritization and How to Operationalize Them

Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner ® ’s report on exposure prioritization states that fewer than 10% of vulnerabilities are exploited, yet most are treated as urgent. The report also argues that CVSS scores alone do not predict actual exploitation or business impact. Gartner predicts that by 2028, organizations that prioritize exposures using threat intelligence , asset context , exploitability modeling , and security control validation will reduce breach likelihood by at least 70% compared to their peers relying primarily on CVSS-based vulnerability prioritization. Let’s break down how each element works, and how the Picus Platform puts all four into practice. Severity-based prioritization made sense. Then it didn't. Severity-driven prioritization was an entirely r...

Nov 03, 2026

4

Russia-Aligned Gorbag Hackers Exploit WinRAR Flaw to Deploy Data-Stealing Malware

A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher Damien Schaeffer said in a report shared with The Hacker News. The activity shares overlaps with a cluster tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) under the moniker UAC-0226 and by Trend Micro as SHADOW-EARTH-066 . Gorbag is known to be active since at least February 2025. A key tool in the threat actor's malware arsenal is GIFTEDCROOK, a C/C++ stealer that facilitates the theft of sensitive data from web browsers like Google Chrome, Microsoft Edge, and Mozilla Firefox, such as cookies, browsing history, and authentication data. Earlier this Ju...

Nov 03, 2026

5

Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets

BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions. "Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," BTCPay Server said . "The attackers used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026." Users who are running versions 2.4.1 or earlier are recommended to move to a fresh server with a new wallet, even in scenarios where users have not noticed a theft. In the event of stolen funds or suspected unauthorized access, it's imperative that users consider the entire machine and all secrets stored on it as compromised and follow the same recovery procedures. It's currently unknown when the attackers behind the campaign first began exploi...

Nov 03, 2026

6

Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement released last week. While Synology did not disclose the exact security flaw that's being exploited in these attacks, the company linked to a November 2024 security advisory that listed three vulnerabilities - CVE-2024-10441 (CVSS score: 9.8) - An improper encoding or escaping of output vulnerability in the system plugin daemon of DSM that could lead to remote code execution via unspecified vectors. CVE-2024-50629 (CVSS score: 5.3) - An improper encoding or escaping of output vulnerability in the webapi component of DSM that could allow remote attackers to read limite...

Nov 03, 2026

7

Put Your First Email Security Agent to Work Uncovering Hidden Threats.

Find phishing, BEC, and invoice fraud with Adaptive's 14-day read-only email scan. No MX changes required.

8

New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food

Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls,  said its products were involved , as they were three weeks earlier when  attackers hit hundreds of French supermarkets . No one had claimed the attacks by Monday night, and it was not known whether they were linked to the attack in France. Refrigeration controls are computers that run a store's fridges and freezers. They can be connected to the internet, allowing refrigeration contractors to monitor them and fix faults remotely. In Belgium, attackers switched cooling units into defrost mode, Stephan Moelans, chief executive of the refrigeration contractor Sabcobel,  told Belgi...

Nov 03, 2026

9

Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors

A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed . The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary code on the underlying server with maximum privileges," Siemens said in an advisory released back in August 2026. The issue has been remediated in versions 4.3.4.1 or later. As mitigations, Siemens recommends that users uninstall Node-RED or harden the installation by following the steps below - Enabling HTTPS access Securing the editor and admin API via cre...

Nov 03, 2026

10

Attackers Target Unpatched CryptoPayment Gateway Flaw That Can Expose Wallet Credentials

Threat actors are attempting to exploit an unpatched maximum-severity security vulnerability in the CryptoPayment Gateway WordPress plugin, according to findings from Defused Cyber. The vulnerability in question is CVE-2026-81648, which carries a CVSS score of 10.0. Successful exploitation of the flaw could permit unauthenticated users to delete arbitrary files on the server and extract sensitive data, including stored wallet credentials. "The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext," according to a description of the flaw on the NIST National Vulnerability Database (NVD). The vulnerability affects versions 1.2.1 through 1.2.2, which is the latest version. There are n...

Nov 03, 2026