search
compromised running
Trends
- 1PHP bug known two years before PHP2Shell exploit went publicโPHP vulnerability post-mortem reveals bug was known two years ago โ Small team of maintainers knew of the issue before it was made public, as new PHP2Shell chained exploit ravages servers
A small group of maintainers had known about the flaw roughly two years before it was disclosed publicly. The delay is drawing scrutiny as a chained exploit, dubbed PHP2Shell, is being used to compromise servers running PHP at scale. Security researchers are questioning the disclosure process, while administrators are urged to patch and harden affected systems as attacks continue to spread.
- 2BTCPay Server urges rebuilds after hot wallet thefts in older versionsโBTCPay Server urges rebuilds after hot wallet thefts hit version 2.4.1 and older BTCPay Server says attackers stole Bitc
BTCPay Server says attackers stole Bitcoin and Litecoin from hot wallets on servers running version 2.4.1 or earlier. The open-source payment processor is urging operators of those versions to sweep remaining funds and migrate to freshly built servers running the latest release. The warning has spread quickly among self-custody and infosec communities, who are debating whether the breach came from a supply-chain compromise or a vulnerability in older deployments.
- 3Hackers Exploit BTCPay Server Flaw to Drain Crypto WalletsโผHackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
Attackers are exploiting a vulnerability in BTCPay Server, a popular self-hosted cryptocurrency payment processor, to steal funds from merchants' hot wallets holding Bitcoin and Litecoin. The security flaw allows unauthorized access to wallet keys on compromised servers. Merchants running BTCPay Server are being urged to update their installations immediately and review wallet balances for suspicious activity.
- 4Synology warns ransomware attacks hit outdated DSM devicesโSynology warns ransomware attacks are targeting devices on outdated DSM versions Synology says attackers are exploiting
Synology has warned that ransomware attackers are actively targeting NAS devices running outdated versions of its DiskStation Manager software. The attackers are exploiting a vulnerability that Synology patched in December 2024, encrypting data on unpatched devices and demanding ransom. The company is urging all users to update their DSM installations immediately to avoid compromise.
- 5Google Patches Critical Zero-Click Android VulnerabilitiesโผGoogle Patches Critical Android Vulnerabilities Allowing Zero-Click Remote Code Execution Google released November 2026
Google has released its November 2026 Android security updates, fixing critical vulnerabilities that could allow attackers to run malicious code on devices without any user interaction. The patches also address a range of additional flaws affecting the mobile operating system. Security experts are urging users to install the updates promptly, as zero-click bugs are especially dangerous because victims need do nothing to be compromised.
- 6
A critical vulnerability in Node-RED, the open-source flow-based programming tool, is reportedly being exploited in real-world attacks. Attackers are targeting the flaw to compromise systems running the popular platform, which is widely used for wiring together hardware devices, APIs and online services. Administrators are being urged to check their deployments and apply available updates to limit exposure.
- 7Hackers Exploit Critical Node-RED Flaw to Deploy BotnetsโCritical Node-RED Vulnerability Exploited to Deploy Botnets and Webshells Hackers are exploiting a CVSS 10.0 vulnerabili
Attackers are exploiting a maximum-severity vulnerability in Node-RED, tracked as CVE-2026-58115, that allows unauthenticated remote code execution. The flaw is being used to install botnets and webshells on industrial and commercial servers. Security observers are urging organizations running Node-RED instances, particularly on internet-facing systems, to patch immediately and check for signs of compromise.
- 8Attackers Exploit Critical Siemens IoT2050 Flaw to Install BackdoorsโผAttackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors
Attackers are exploiting a critical vulnerability in Siemens' SIMATIC IoT2050 industrial gateway devices to gain remote command execution and plant backdoors. Security researchers warn that compromised devices allow attackers to run arbitrary commands and maintain persistent access to industrial networks. Organizations using the IoT2050 are urged to apply patches, restrict device exposure to the internet, and check for signs of compromise.
- 9Criminals hijack corporate AI accounts, racking up $1 million billsโCriminals are hijacking corporate AI model access, leaving some victims with bills near $1 million Google says criminals
Google researchers report that criminals are using stolen cloud credentials to run expensive AI models on compromised corporate accounts. Some victims have faced bills approaching $1 million, with more than $100,000 in charges added in a single day. The attackers are reportedly reselling access to the hijacked AI capacity on underground markets.
- 10Florida Student Aid Website Hack Exposes Data of 4.9 Million PeopleโผFlorida Student Aid Website Hack Puts Data of 4.9 Million People at Risk
A hack of Florida's student aid website has potentially compromised the personal data of 4.9 million people, according to a report by SecurityWeek. The breach affects users of the state's financial aid system, though details on what data was accessed and who is responsible remain limited. The incident is drawing attention to the security of state-run education portals and the scale of information they hold on students and applicants.
- 11Google disrupts million-device Android malware botnetโ# google # android # malware # security https://www. bleepingcomputer.com/news/secu rity/google-disrupts-million-device-
Google says it has disrupted an Android malware botnet known as BADBOX 2.0 that infected over a million devices, many of them cheap TV boxes and streaming sticks running pirated or uncertified Android firmware. The company has banned the manufacturer of the affected TV boxes from its ecosystem and warns users to avoid uncertified Android devices.
- 12Attackers exploit critical Node-RED flaw to install backdoorsโAttackers install backdoors through a critical vulnerability in Node-RED
Attackers are actively exploiting a critical vulnerability in Node-RED, the open-source flow-based programming tool widely used for industrial and IoT integrations, to install backdoors on compromised servers. Because Node-RED often runs in operational technology and automation environments, successful intrusions could give attackers persistent access to sensitive systems. Administrators are being urged to patch their instances and check for signs of compromise.
- 13Stellar Blade holds up well in Switch 2 portโStellar Blade is (mostly) just as good in stunning Switch 2 port
The action game Stellar Blade has arrived on Nintendo's Switch 2, and critics say the port largely preserves the original experience while taking advantage of the new handheld hardware. Polygon calls the conversion stunning and finds it mostly just as good as the PlayStation version, though some compromises were made in the process. The release brings the hit title to a much wider audience.