# Archive
Browse past daily curated stories
Wednesday, October 28, 2026
-
1Ars Technica Security generalCode-execution flaw in UEFI firmware threatens most servers on planet Earth
A critical code-execution vulnerability in EDK2, the open-source UEFI firmware implementation used by most modern servers, allows attackers to execute arbitrary code during the early boot process before the OS loads. Because EDK2 underpins UEFI firmware across a vast range of enterprise and cloud server hardware, successful exploitation could compromise systems at a level below OS-based defenses. Security teams should prioritize firmware patching and monitor vendor advisories for affected hardware platforms.
-
2The Hacker News generalCISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
CISA added two critical PHP2Shell flaws — CVE-2026-109618 and CVE-2026-109619, both rated 9.2 CVSS — to its Known Exploited Vulnerabilities catalog, confirming active in-the-wild exploitation enabling unauthenticated remote code execution. Federal agencies were given a tight remediation deadline of Thursday to patch affected PHP deployments. The PHP project also issued a second emergency Windows package rebuild within five days to address the related Brotli library flaw CVE-2026-111497 affecting PHP 8.2 through 8.5.
-
3The Hacker News generalLazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
Kaspersky researchers linked North Korea's Lazarus Group to 'Operation FlashHole,' an espionage campaign active since at least July 2025 targeting South Korean organizations in construction, software, and wire-communication manufacturing. The group abused legitimate South Korean security software as an attack vector and deployed malware using post-quantum encryption, signaling an evolution in their operational tradecraft to defeat future decryption efforts. At least three organizations have been confirmed compromised.
-
4The Hacker News generalApple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple backported patches for CVE-2026-86950, an out-of-bounds write in CoreGraphics with a CVSS score of 8.8, to older iPhones and iPads after the flaw was exploited in 'extremely sophisticated' targeted attacks. The fix was originally released last month for current iOS devices; the backport extends coverage to users unable to run the latest OS versions. Defenders should treat this as urgent given confirmed in-the-wild exploitation.
-
5The Hacker News generalMicrosoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft patched CVE-2026-80097 in Microsoft Authenticator for Android (fixed in version 6.2606.4246), a flaw that allowed a zero-permission malicious app to impersonate trusted Microsoft applications like Teams and harvest work account sign-in tokens. Successful exploitation could enable full account takeover without requiring any special Android permissions, making it particularly dangerous in BYOD enterprise environments. All users of Microsoft Authenticator for Android should update immediately.
-
6The Hacker News generalAustralia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
Australia's Signals Directorate (ASD) conducted an offensive cyber operation against the Amadey malware backend, successfully severing the threat actor's access to approximately 180,000 infected computers worldwide. ASD operators gained access to the criminal operation's command-and-control infrastructure and cut off the controller's connection to all victim machines. This marks a notable example of a national intelligence agency using offensive access to a botnet backend for defensive disruption at scale.
-
7The Hacker News generalKeystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
Crypto hardware wallet maker Keystone announced on October 26 it will destroy all 18,835 devices in inventory after an attacker compromised its website and stole the device verification key used to authenticate genuine hardware. An adversary in possession of the key could manufacture counterfeit Keystone wallets that pass the official legitimacy check, enabling cryptocurrency theft from unsuspecting buyers. The company confirmed no existing user funds were directly at risk from this incident.
-
8BleepingComputer generalTailscale warns of SSH flaws allowing root privilege escalation
Tailscale disclosed nearly a dozen security vulnerabilities — dubbed 'Tailworm' — in its Tailscale SSH component that could be exploited for credential theft, server crashes, and root privilege escalation. Details were made public before any patches were available due to uncoordinated disclosure, forcing Tailscale's security team to rush fixes under active researcher scrutiny. Organizations using Tailscale SSH should monitor the vendor's security advisories and apply patches as soon as they are released.
-
9BleepingComputer generalUNM Health ransomware attack disrupts patient care, surgeries
The University of New Mexico Health Sciences Center suffered a ransomware attack that caused system outages, forced ambulance diversions to Albuquerque and Santa Fe facilities for approximately two hours, and suspended outpatient surgeries and appointments. The incident disrupted both patient care and academic operations at the health system, underscoring the continued targeting of healthcare institutions by ransomware operators. Specific threat actor attribution has not yet been publicly confirmed.
-
10SecurityWeek generalHPE Patches Dozens of Critical Flaws in Networking Products
HPE released patches addressing dozens of critical vulnerabilities across its networking product portfolio, including eight maximum-severity flaws enabling remote code execution and authentication bypass. The scope of affected products spans HPE's networking line, making this a high-priority patching event for enterprise network administrators. No CVE identifiers were specified in the initial disclosure, but the presence of max-severity RCE bugs warrants immediate review of affected HPE deployments.