Google patched Chrome’s eighth actively exploited zero-day of 2026, while attackers also exploited flaws in Barracuda email gateways and some Linux systems to gain privileged access. Barracuda warned of attacks a week after releasing patches; GreyNoise detected Linux attacks four days after that flaw became public.
Tools meant to help developers and security teams also carried threats: fake GitHub projects infected more than 2,000 PCs, disabling defenses and installing malware. Separately, researchers found a Ruby package that stole credentials and planted backdoors in AI coding tool settings, though they confirmed no victims or successful spread.
Layer3 Intel also detected residential proxy traffic exiting the network registered to the Executive Office of the President, which hosts the White House network. That finding does not establish a breach: the data identifies neither the devices nor the people involved, and researchers did not establish that internal systems were exposed.
Layer3 Intel detected residential proxy traffic exiting AS2650, the network registered to the Executive Office of the President that hosts the White House network. Researchers recorded 236 connections from six IP addresses through 28 proxy services between October 5 and November 3. The data does not identify the devices or people involved, and Layer3 did not establish that internal systems were exposed.
A malware campaign using GitHub projects infected more than 2,000 PCs, targeting blockchain game enthusiasts and, more recently, cybersecurity professionals, Doctor Web found. The projects pose as game utilities and security tools, including an Fscan results analyzer. The malware disables Windows defenses, removes antivirus products and deploys AsyncRAT, a cryptocurrency clipboard hijacker and a data stealer.
Attackers are exploiting *sshole, a vulnerability involving OpenSSH and the musl library that allows unauthenticated access to privileged accounts on Linux systems meeting certain conditions. Greynoise said Monday that a group it tracks as GT10 attacked its honeypots in Southeast Asia, four days after the flaw became public. The firm accessed a GT10 server that revealed potential additional victims and attack tools.
Progress Software released WS_FTP Server 2025.0.5 (10.0.5) for Windows to fix five high-severity flaws that expose credentials, allow unauthorized file access or disrupt transfers. The flaws include CVE-2026-115338, which exposes unencrypted XFT traffic, and CVE-2026-115339, which lets unauthenticated remote attackers exhaust XFT memory. The supplied advisory reports no active exploitation.
Attackers are exploiting two recently patched Barracuda Email Security Gateway vulnerabilities to gain root access, affecting a small number of organizations. The flaws, CVE-2026-116606 and CVE-2026-111560, allow authentication bypass and operating system command injection when combined. Exploitation requires access to the appliance’s administrative interface; Barracuda released patches a week before warning of active attacks.
Google patched nine Chrome vulnerabilities, including CVE-2026-125350, the browser’s eighth actively exploited zero-day of 2026. The fixes are in Chrome 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, with a gradual rollout over the coming days and weeks. Google has not disclosed how attackers exploited the flaw or who was behind the attacks.
Apple released updates, including iOS and iPadOS 27.2.1, to fix iMessage flaws that could let remote attackers join group chats (CVE-2026-113961) or let newly added members read earlier messages (CVE-2026-113960). The updates also patch a Brotli flaw listed in CISA’s Known Exploited Vulnerabilities catalog. Separate updates for older iPhones, the seventh-generation iPad and some Apple Watches do not list those fixes.
The malicious Ruby gem strutil-core 1.0.1 ran a credential-stealing worm during installation and planted backdoors in AI coding tool settings. Sandbox testing recorded reads from 51 credential stores, and the malware included a monitor that deletes the user’s home folder if a stolen GitHub token stops working. RubyGems removed the package within hours; researchers confirmed no victims or successful spread.
Forever Security researchers showed that a browser extension running scripts on claude.ai could use Dispatch to make Claude Desktop execute code when users were signed in to both with Dispatch enabled. The test installed an npm package and automatically approved prompts through the controlled web page. Researchers reported no real attacks and said the flaw remained exploitable despite Anthropic’s planned retirement of Dispatch.
