Apache HTTP/2 Flaw Gets Public Heap-Corruption PoC
A public proof-of-concept reproduces heap corruption in Apache mod_http2, but it does not demonstrate remote code execution in the affected server.
NVIDIA CEO Jensen Huang Resigns, Colette Kress Named Interim Chief Executive
NVIDIA has announced a major leadership change, with longtime CEO Jensen Huang resigning from his positions as president, chief executive officer and member of the company's board of directors, effective immediately.
Baker Tilly Reports Client Data Breach at Third-Party Provider
Baker Tilly says an attacker obtained client information from an unnamed third-party platform. State filings list 10,456 affected Texas residents and 1,359 in South Carolina.
AntiFox AI Tool Linked to IIS and AWS Intrusions
Arctic Wolf linked AntiFox-hosted systems to IIS intrusions and AWS secret access; Amazon says attackers used credentials stolen from customer apps.
Researchers Find 35,578 Grok Build Apps Open to Anyone
Claroc found 35,578 Grok Build apps open without sign-in, including business records, patient information and employee passwords in some apps.
ScreenConnect Attacks Linked to RMM+ Extension Flaw
Huntress links attacks across 48 organizations to an RMM+ extension flaw that accepted blank access keys; ConnectWise disabled five related extensions.
Node.js Fixes 16 Flaws, Including TLS Memory Exposure
Node.js has released 22.23.5, 24.22.3 and 26.13.1 to fix 16 security flaws, including bugs that can expose TLS memory and crash HTTP/2 servers.
Silent Lynx Used AI Agent in Central Asian Espionage
CloudSEK says Silent Lynx used a DeepSeek-powered Hermes agent to automate reconnaissance and collect government documents across Central Asia, while maintaining access to railway and geospatial systems.
Bitquery Traces $348K From Across Protocol Domain Hijack
Across Protocol regained its domain after a phishing page redirected visitors to a wallet drainer. Bitquery traced about $348,000 in losses from nine wallets.
Maersk Confirms Data Extraction From Legacy System
Maersk confirms unauthorized access and data extraction from a legacy system inherited through an acquisition, while saying it has found no wider customer or partner impact.
AWS Clarifies Qubole Attack Did Not Compromise AWS Services
AWS says attackers abused customer-configured IAM trust relationships tied to Qubole, not a compromise of AWS services themselves.
eMudhra Revokes Eight More Intermediate CAs
eMudhra revoked eight more RSA intermediate CAs after it could not verify their key handling, bringing the certificate incident total to 16.
Windows Active Directory RCE Fixed in November Updates
Microsoft fixed CVE-2026-119948, a high-severity Active Directory buffer overflow that allows an authorized attacker to execute code over a network.
Loading
