CISA Flags ESXi CVE-2026-41709 and Fragnesia Linux Flaw as Exploited
October 29, 2026
CISA added VMware ESXi CVE-2026-41709 and Linux kernel flaw CVE-2026-46300 to KEV; CrowdStrike says China-nexus Warp Panda used the ESXi
Endpoint Security
CISA Flags ESXi CVE-2026-41709 and Fragnesia Linux Flaw as Exploited
CISA added VMware ESXi CVE-2026-41709 and Linux kernel flaw CVE-2026-46300 to KEV; CrowdStrike says China-nexus Warp Panda used the ESXi bug as a zero-day.
Yoba Campaign Hides XMRig Miner Behind Signed ChatGPT, Claude Files
Check Point says the Yoba campaign used fake GitHub pages for nonexistent AI apps to deliver an XMRig miner through signed OpenAI and Anthropic executables.
Fake FedEx Tax PDFs Deliver Sirius Backdoor That Survives Reset
Trellix details a Korean-language phishing campaign posing as FedEx that delivers a fileless Sirius Backdoor designed to persist through a full OS reset.
16-Year-Old EDK II PXE Flaw CVE-2026-97631 Runs Code Pre-Boot
A critical buffer overflow in TianoCore EDK II PXE code, CVE-2026-97631, can run code before Secure Boot loads, and no stable release contains a fix ...
Chrome 156 Update Fixes 52 Flaws Including Sandbox Escape
Google's Chrome 156.0.8078.73 update fixes 52 flaws, four critical, including CVE-2026-118306, a FileSystem bug that allows code execution outside the sandbox.
Fake Claude Download Pages on claude.ai Spread Mac Stealer
Gen Digital found fake Claude install guides hosted on the real claude.ai domain, promoted by Google Ads, delivering Atomic macOS Stealer and a Windows RAT.
Apple Backports Exploited CoreGraphics Zero-Day Fix to iOS 18
Apple released iOS and iPadOS 18.7.11 to fix CVE-2026-86950, an exploited CoreGraphics zero-day, about a month after CISA added the flaw to its KEV catalog.
Public PoC Released for macOS autofs Root and Gatekeeper Flaws
A researcher published a PoC for macOS autofs flaws CVE-2026-84568 (root) and CVE-2026-84570 (Gatekeeper bypass), which Apple already patched in September.
Onamae Desktop Cloud Hacked; Malware on Up to 26,739 Servers
GMO Internet Group says an intruder planted malicious programs on up to 26,739 Onamae.com Desktop Cloud servers in Japan and has shut the service down.
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94 minutes before detection.
Yoba Campaign Hides XMRig Miner Behind Signed ChatGPT, Claude Files
October 29, 2026
Check Point says the Yoba campaign used fake GitHub pages for nonexistent AI apps to deliver an XMRig miner through
Fake FedEx Tax PDFs Deliver Sirius Backdoor That Survives Reset
October 29, 2026
Trellix details a Korean-language phishing campaign posing as FedEx that delivers a fileless Sirius Backdoor designed to persist through a
16-Year-Old EDK II PXE Flaw CVE-2026-97631 Runs Code Pre-Boot
October 29, 2026
A critical buffer overflow in TianoCore EDK II PXE code, CVE-2026-97631, can run code before Secure Boot loads, and no
Chrome 156 Update Fixes 52 Flaws Including Sandbox Escape
October 28, 2026
Google’s Chrome 156.0.8078.73 update fixes 52 flaws, four critical, including CVE-2026-118306, a FileSystem bug that allows code execution outside the
Fake Claude Download Pages on claude.ai Spread Mac Stealer
October 28, 2026
Gen Digital found fake Claude install guides hosted on the real claude.ai domain, promoted by Google Ads, delivering Atomic macOS
Apple Backports Exploited CoreGraphics Zero-Day Fix to iOS 18
October 27, 2026
Apple released iOS and iPadOS 18.7.11 to fix CVE-2026-86950, an exploited CoreGraphics zero-day, about a month after CISA added the
Public PoC Released for macOS autofs Root and Gatekeeper Flaws
October 27, 2026
A researcher published a PoC for macOS autofs flaws CVE-2026-84568 (root) and CVE-2026-84570 (Gatekeeper bypass), which Apple already patched in
Onamae Desktop Cloud Hacked; Malware on Up to 26,739 Servers
October 23, 2026
GMO Internet Group says an intruder planted malicious programs on up to 26,739 Onamae.com Desktop Cloud servers in Japan and
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
October 21, 2026
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.