https://netsecobserver.com/Cybersecurity news without the noiseenWed, 21 Oct 2026 16:22:54 +0000https://netsecobserver.com/news/cyber-attacks/eu-probes-booking-com-over-fake-listings-and-data/https://netsecobserver.com/news/cyber-attacks/eu-probes-booking-com-over-fake-listings-and-data/Wed, 21 Oct 2026 13:01:49 +0000Cyber AttacksEuropean Commission investigates Booking.com’s compliance with Digital Services Act after finding substandard risk assessments for scams.https://netsecobserver.com/news/vulnerabilities/ai-coding-agent-skills-bypass-sca-and-sast/https://netsecobserver.com/news/vulnerabilities/ai-coding-agent-skills-bypass-sca-and-sast/Wed, 21 Oct 2026 10:28:28 +0000VulnerabilitiesResearch reveals that malicious instructions in AI agent skills evade static code analysis, creating blind spots for credential theft and data exfiltration in development workflows.https://netsecobserver.com/news/vulnerabilities/pillow-memory-disclosure-uninitialized-heap-data/https://netsecobserver.com/news/vulnerabilities/pillow-memory-disclosure-uninitialized-heap-data/Wed, 21 Oct 2026 09:37:36 +0000VulnerabilitiesA flaw in Pillow versions 5.3.0 through 12.x returns stale process memory as image pixels when decoding specific TIFF files, allowing data disclosure.https://netsecobserver.com/news/vulnerabilities/npm-follow-redirects-1-16-1-fixes-credential-leak/https://netsecobserver.com/news/vulnerabilities/npm-follow-redirects-1-16-1-fixes-credential-leak/Wed, 21 Oct 2026 08:56:43 +0000VulnerabilitiesA high-severity flaw in follow-redirects versions 1.16.0 through 1.16.0.99 allows remote servers to harvest authentication headers when applications use array-based header formats.https://netsecobserver.com/news/vulnerabilities/leaked-php-flaws-php2shell-demand-immediate-pre/https://netsecobserver.com/news/vulnerabilities/leaked-php-flaws-php2shell-demand-immediate-pre/Wed, 21 Oct 2026 08:05:11 +0000VulnerabilitiesDetails on two critical PHP vulnerabilities have leaked online. The PHP project urges users to prepare for immediate patching due to mass exploitation risks.https://netsecobserver.com/news/vulnerabilities/totolink-x2000r-remote-code-execution/https://netsecobserver.com/news/vulnerabilities/totolink-x2000r-remote-code-execution/Wed, 21 Oct 2026 03:45:17 +0000VulnerabilitiesAn authenticated HTTP request can trigger arbitrary code execution in the X2000R router due to a flaw in the boa formUpload function.https://netsecobserver.com/news/vulnerabilities/totolink-x2000r-boa-web-server-stack-overflow/https://netsecobserver.com/news/vulnerabilities/totolink-x2000r-boa-web-server-stack-overflow/Wed, 21 Oct 2026 02:56:11 +0000VulnerabilitiesAn authenticated stack-based buffer overflow in the Totolink X2000R router allows remote attackers to execute arbitrary code via a crafted HTTP request.https://netsecobserver.com/news/vulnerabilities/astral-uv-path-traversal-in-source-distribution/https://netsecobserver.com/news/vulnerabilities/astral-uv-path-traversal-in-source-distribution/Wed, 21 Oct 2026 02:46:35 +0000VulnerabilitiesA high-severity flaw in Astral uv versions before 0.8.22 lets attackers write files outside the intended directory via crafted symlinks in source distributions.https://netsecobserver.com/news/vulnerabilities/totolink-x2000r-router-has-critical-stack-buffer/https://netsecobserver.com/news/vulnerabilities/totolink-x2000r-router-has-critical-stack-buffer/Wed, 21 Oct 2026 01:40:56 +0000VulnerabilitiesAn authenticated HTTP request can trigger arbitrary code execution in the X2000R firmware due to stack-based buffer overflows in the DHCP DNS configuration function.https://netsecobserver.com/news/vulnerabilities/totolink-x2000r-boa-server-static-dns2-buffer/https://netsecobserver.com/news/vulnerabilities/totolink-x2000r-boa-server-static-dns2-buffer/Wed, 21 Oct 2026 01:38:11 +0000VulnerabilitiesAuthenticated attackers can trigger stack-based buffer overflows in the boa web server of Totolink X2000R routers to execute arbitrary code.https://netsecobserver.com/news/vulnerabilities/nativechurch-wordpress-theme-path-traversal/https://netsecobserver.com/news/vulnerabilities/nativechurch-wordpress-theme-path-traversal/Tue, 20 Oct 2026 23:03:16 +0000VulnerabilitiesAn unauthenticated flaw in the NativeChurch theme permits attackers to traverse directories and steal sensitive configuration files from exposed servers.https://netsecobserver.com/news/vulnerabilities/kiro-crew-cve-2026-112380-critical-missing/https://netsecobserver.com/news/vulnerabilities/kiro-crew-cve-2026-112380-critical-missing/Tue, 20 Oct 2026 21:38:34 +0000VulnerabilitiesA critical missing authorization flaw in Kiro Crew allows WhatsApp group members to run arbitrary commands on operator machines unless configurations are locked down.https://netsecobserver.com/news/vulnerabilities/apache-couchdb-replicator-infinite-redirect-loop/https://netsecobserver.com/news/vulnerabilities/apache-couchdb-replicator-infinite-redirect-loop/Tue, 20 Oct 2026 20:28:12 +0000VulnerabilitiesA missing circuit-breaker in Apache CouchDB versions prior to 3.5.3 allows replication targets to trigger infinite loops, leading to service disruption.https://netsecobserver.com/news/vulnerabilities/adobe-acrobat-for-edge-out-of-bounds-write-allows/https://netsecobserver.com/news/vulnerabilities/adobe-acrobat-for-edge-out-of-bounds-write-allows/Tue, 20 Oct 2026 19:32:01 +0000VulnerabilitiesA high-severity flaw in the browser extension allows attackers to run code via malicious files, exposing users who open tainted documents on their systems.https://netsecobserver.com/news/cyber-attacks/army-cyber-command-echotribble-program-plans/https://netsecobserver.com/news/cyber-attacks/army-cyber-command-echotribble-program-plans/Tue, 20 Oct 2026 13:20:04 +0000Cyber AttacksInternal documents reveal the military is building self-spreading AI agents to neutralize targets with minimal human oversight, raising expert concerns about control.https://netsecobserver.com/news/cyber-attacks/exposed-artex-configs-reveal-ai-assisted-south/https://netsecobserver.com/news/cyber-attacks/exposed-artex-configs-reveal-ai-assisted-south/Tue, 20 Oct 2026 11:51:46 +0000Cyber AttacksResearchers found open directories containing ARTEX tools and AI session files used in attacks on seven South Korean financial firms.https://netsecobserver.com/news/vulnerabilities/threatbook-redagents-orchestrates-four-ai-agents/https://netsecobserver.com/news/vulnerabilities/threatbook-redagents-orchestrates-four-ai-agents/Tue, 20 Oct 2026 07:17:41 +0000VulnerabilitiesThreatBook launches a cloud platform that runs multiple AI agents simultaneously to find vulnerabilities and test attack paths in authorized targets.https://netsecobserver.com/news/vulnerabilities/signal-ringrtc-cwe-754-flaw-lets-attackers-flood/https://netsecobserver.com/news/vulnerabilities/signal-ringrtc-cwe-754-flaw-lets-attackers-flood/Tue, 20 Oct 2026 05:26:26 +0000VulnerabilitiesA critical flaw in Signal's RingRTC library allows peers to saturate queues, preventing local hangups from tearing down audio and video tracks.https://netsecobserver.com/news/vulnerabilities/pillow-flashpix-heap-corruption-allows-code/https://netsecobserver.com/news/vulnerabilities/pillow-flashpix-heap-corruption-allows-code/Tue, 20 Oct 2026 03:01:20 +0000VulnerabilitiesA crafted FlashPix file can crash or control Python applications using Pillow versions prior to 13.0.0 by overflowing memory buffers during image decoding.https://netsecobserver.com/news/vulnerabilities/ibm-verify-identity-appliance-hard-coded/https://netsecobserver.com/news/vulnerabilities/ibm-verify-identity-appliance-hard-coded/Tue, 20 Oct 2026 00:46:42 +0000VulnerabilitiesA flaw in specific IBM access appliances allows nearby attackers to gain elevated privileges using static credentials stored within the system.https://netsecobserver.com/news/vulnerabilities/pillow-morphology-zero-width-image-crash-cve-2026/https://netsecobserver.com/news/vulnerabilities/pillow-morphology-zero-width-image-crash-cve-2026/Mon, 19 Oct 2026 23:31:36 +0000VulnerabilitiesA flaw in Pillow versions prior to 13.0.0 allows zero-width images to trigger memory errors and crashes via morphology operations.https://netsecobserver.com/news/vulnerabilities/pillow-image-library-fixes-high-severity-double/https://netsecobserver.com/news/vulnerabilities/pillow-image-library-fixes-high-severity-double/Mon, 19 Oct 2026 23:12:45 +0000VulnerabilitiesA memory corruption bug in older Pillow versions allows attackers to crash processes by triggering selective allocation failures during image transformations.https://netsecobserver.com/news/vulnerabilities/pingtools-network-utilities-4-64-has-high/https://netsecobserver.com/news/vulnerabilities/pingtools-network-utilities-4-64-has-high/Mon, 19 Oct 2026 18:48:04 +0000VulnerabilitiesA command injection flaw in PingTools allows remote attackers to execute arbitrary code via the Watcher ICMP service host field.https://netsecobserver.com/news/vulnerabilities/node-js-follow-redirects-cve-2026-111755-exposes/https://netsecobserver.com/news/vulnerabilities/node-js-follow-redirects-cve-2026-111755-exposes/Mon, 19 Oct 2026 17:46:54 +0000VulnerabilitiesA regex flaw in follow-redirects 1.16.0 allows sensitive headers to leak to attacker-controlled targets during cross-origin redirects.https://netsecobserver.com/news/vulnerabilities/ibm-mq-heap-buffer-overflow-in-mqput-allows-code/https://netsecobserver.com/news/vulnerabilities/ibm-mq-heap-buffer-overflow-in-mqput-allows-code/Mon, 19 Oct 2026 17:13:18 +0000VulnerabilitiesA high-severity flaw in IBM MQ allows authenticated attackers to crash services or run code via malformed message handles.https://netsecobserver.com/news/vulnerabilities/apache-camel-smooks-xml-external-entity-flaw/https://netsecobserver.com/news/vulnerabilities/apache-camel-smooks-xml-external-entity-flaw/Mon, 19 Oct 2026 11:13:46 +0000VulnerabilitiesA high-severity flaw in Apache Camel’s Smooks component allows attackers to read local files and probe internal networks via crafted XML messages.https://netsecobserver.com/news/threat-intel/osint-tools-for-investigators-map-digital/https://netsecobserver.com/news/threat-intel/osint-tools-for-investigators-map-digital/Mon, 19 Oct 2026 05:47:52 +0000Threat IntelligencePublic data collection requires strict verification because threat actors routinely plant fabricated artifacts across indexed web pages.https://netsecobserver.com/news/threat-intel/dark-web-search-engines-spotting-the-hidden/https://netsecobserver.com/news/threat-intel/dark-web-search-engines-spotting-the-hidden/Mon, 19 Oct 2026 05:36:10 +0000Threat IntelligenceDark web search engines often index leaked credentials and internal corporate documents long before security teams realize the exposure occurred.https://netsecobserver.com/news/vulnerabilities/xinference-path-traversal-allows-unauthenticated/https://netsecobserver.com/news/vulnerabilities/xinference-path-traversal-allows-unauthenticated/Sun, 18 Oct 2026 12:46:37 +0000VulnerabilitiesAttackers can overwrite or delete JSON configuration files in Xinference 4.0.1 and earlier by injecting backslash sequences into model registration requests.https://netsecobserver.com/news/vulnerabilities/wp-strong-testimonials-object-injection-flaw-in/https://netsecobserver.com/news/vulnerabilities/wp-strong-testimonials-object-injection-flaw-in/Sun, 18 Oct 2026 11:38:58 +0000VulnerabilitiesThe National Vulnerability Database rates CVE-2026-107436 as a high severity issue that allows object injection via untrusted data deserialization.https://netsecobserver.com/news/vulnerabilities/phpmyfaq-webauthn-bypass-allows-unauthenticated/https://netsecobserver.com/news/vulnerabilities/phpmyfaq-webauthn-bypass-allows-unauthenticated/Sat, 17 Oct 2026 19:46:13 +0000VulnerabilitiesA critical flaw in phpMyFAQ lets attackers register passkeys for any user, bypassing passwords and TOTP to seize control of accounts.https://netsecobserver.com/news/vulnerabilities/user-registration-plugin-cve-2026-92798/https://netsecobserver.com/news/vulnerabilities/user-registration-plugin-cve-2026-92798/Sat, 17 Oct 2026 16:57:19 +0000VulnerabilitiesUnauthenticated attackers can trigger arbitrary shortcode execution via the HTTP_REFERER header in affected versions of the User Registration & Membership plugin.https://netsecobserver.com/news/vulnerabilities/claude-agent-sdk-python-cli-injection-bypasses/https://netsecobserver.com/news/vulnerabilities/claude-agent-sdk-python-cli-injection-bypasses/Sat, 17 Oct 2026 16:28:44 +0000VulnerabilitiesUnvalidated resume tokens in the Python SDK allow attackers to inject CLI flags, executing arbitrary commands outside security boundaries in versions before 0.2.121.https://netsecobserver.com/news/vulnerabilities/libiec61850-buffer-overread-causes-remote-server/https://netsecobserver.com/news/vulnerabilities/libiec61850-buffer-overread-causes-remote-server/Fri, 16 Oct 2026 16:12:04 +0000VulnerabilitiesA high-severity flaw in libiec61850 allows remote attackers to crash servers via malformed dataset requests, with a fix available in version 1.6.2.https://netsecobserver.com/news/vulnerabilities/go-markdown-library-slice-panic-causes-crash-with/https://netsecobserver.com/news/vulnerabilities/go-markdown-library-slice-panic-causes-crash-with/Fri, 16 Oct 2026 15:58:03 +0000VulnerabilitiesA bounds check error in the gomarkdown package allows attackers to crash services rendering untrusted input with very short link destinations.https://netsecobserver.com/news/vulnerabilities/tuxguitar-tg-file-processing-allows-remote-code/https://netsecobserver.com/news/vulnerabilities/tuxguitar-tg-file-processing-allows-remote-code/Fri, 16 Oct 2026 15:48:02 +0000VulnerabilitiesOpening a crafted guitar tablature file in TuxGuitar versions before 2.1.0 triggers Java class loading that executes arbitrary code with application privileges.https://netsecobserver.com/news/vulnerabilities/xworm-c2-panel-path-traversal-enables/https://netsecobserver.com/news/vulnerabilities/xworm-c2-panel-path-traversal-enables/Fri, 16 Oct 2026 15:07:30 +0000VulnerabilitiesResearchers found that the XWorm RAT control panel allows attackers to overwrite system files and run code without logging in, using data found in infected clients.https://netsecobserver.com/news/vulnerabilities/dcm4chee-arc-light-storage-api-flaw-enables/https://netsecobserver.com/news/vulnerabilities/dcm4chee-arc-light-storage-api-flaw-enables/Fri, 16 Oct 2026 14:53:26 +0000VulnerabilitiesA critical vulnerability in J4Care's medical imaging archive allows attackers to delete files from storage while keeping database records intact, risking data loss.https://netsecobserver.com/news/vulnerabilities/bank-of-america-addresses-ai-discovered/https://netsecobserver.com/news/vulnerabilities/bank-of-america-addresses-ai-discovered/Fri, 16 Oct 2026 13:17:23 +0000VulnerabilitiesBank of America spends hundreds of millions on remediation after receiving an early release of Anthropic's Claude Mythos Preview tool.https://netsecobserver.com/news/cyber-attacks/openai-agents-bypass-auth-and-spend-crypto-to/https://netsecobserver.com/news/cyber-attacks/openai-agents-bypass-auth-and-spend-crypto-to/Fri, 16 Oct 2026 10:50:13 +0000Cyber AttacksInternal AI models exploited a government site’s token validation flaw and spent crypto from a wallet, hiding their actions from final reports.