Latest security news
Page 11
Tue, October 20
Suspected cyber incident blocks Parkview Health patient portal in Indiana and Ohio
DysruptionHub reports: The health system disabled its network after suspicious activity, leaving MyChart and doctor searches unavailable and directing urgent medical needs to phone calls or walk-in clinics. A suspected cyber incident left Parkview Health patients without MyChart and online doctor searches Monday after the Indiana-based health system disabled its network in response to suspicious... Source
AIペネトレーションテスト基盤「Cairn」の公開パネルから見えた攻撃活動についてまとめてみた
2026年10月19日、セキュリティ企業のNorForgeは、公開状態のまま放置されていたAIペネトレーションテスト基盤Cairnの管理画面から、AIエージェントによる攻撃活動を観測したとするレポートを公表しました。ここでは関連する情報をまとめます。 Cairnとは何か Cairnはオープンソースのエージェント基盤で、開発元のREADMEは汎用のAI状態空間探索エンジンであり、自律的なペネトレーションテストで最初に検証したと説明している(出典: 3)。Cairnでは1つのタスクを1つのプロジェクトとして扱い、各プロジェクトに起点(origin)と事前に定めた目標(goal)を設定する。エージェ…
Studioへの不正アクセスについてまとめてみた
2026年10月16日、ノーコードのWebサイト制作サービス「Studio」を運営するStudioは、同社が利用するクラウド環境への第三者による不正アクセスにより、登録している顧客の情報が外部に流出した可能性があると公表しました。ここでは関連する情報をまとめます。 社内調査で発覚 Studioは、第三者がStudioの一部機能の脆弱性を悪用して同社のクラウド環境に不正にアクセスし、環境内のデータを外部から取得できる状態にしていたと公表した。この状態は10月14日にStudioが対処するまで続いていた。現時点で確認できている不正アクセスの期間は9月30日から10月1日(日本時間)。実際に第三者に…
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators
WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one. The text sat in the pages' code, never shown on screen, until it was removed by October 18. Whether the
What Security Teams Can Do To Tame Wild Code
A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns
Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor called HOOKEDGE and a previously
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the following actions since it began
栃木県警、全職員の情報流出か アルカディア不正アクセス、他県警でも被害判明相次ぐ 報道
防災情報配信サービスのアルカディアが不正アクセスを受けた問題を巡り、栃木県警の全職員約3900人分の個人情報が流出した可能性があると複数のメディアが報じた。神奈川や埼玉、福岡など他の県警でも同様の被害が相次ぎ判明している。
NECの委託先にサイバー攻撃 正規アカウント悪用し顧客のサーバ暗号化、個人情報の漏えいも
NECは10月20日、システム開発・保守業務の委託先が9月下旬にサイバー攻撃を受け、その影響でNECの顧客に不正アクセスや情報漏えいの被害が出たと発表した。漏えいした情報には個人情報も含まれるという。
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,
大会形式を刷新、2月に「SECCON Tournament」開催
日本ネットワークセキュリティ協会（JNSA）のSECCON実行委員会は、2月にセキュリティ競技大会「SECCON Tournament」を都内で開催すると発表した。
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the
Amazic joins MariaDB Foundation as a Silver Sponsor
MariaDB Foundation is pleased to welcome Amazic as a Silver Sponsor, adding a new supporter with strong connections across the software ecosystem. Amazic connects innovative software vendors with partners, developers and organisations looking to adopt modern technologies. Combining software distribution with technical enablement, training, content and community-focused events, Amazic helps bridge the gap between technology […] Amazic joins MariaDB Foundation as a Silver Sponsor appeared first on MariaDB.org
「Roundcube Webmail」にセキュリティ更新 - 複数の脆弱性を解消
ウェブメールソフト「Roundcube Webmail」の開発チームは現地時間2026年10月19日、セキュリティアップデートとなる「同1.7.5」「同1.6.20」をリリースした。脆弱性の修正を行っており、利用者に注意を呼びかけている。
Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge
A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp
NICTとMITRE、AIエージェントの脆弱性探索競技を12月に開催
情報通信研究機構（NICT）とMITREは、メール業務で活用されているAIエージェントのセキュリティ検証をテーマとした競技イベント「AI Breach Challenge 2026：Email Agent Security」を米国で12月に開催する。
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own
委託先が顧客のメアド保存のPCを紛失 - 山陰合同銀
山陰合同銀行は、委託先において顧客のメールアドレスが含まれるおそれがある業務用パソコンが所在不明となっていることを明らかにした。
ネットバンキングにログインしたまま別作業は危険？ 「ChatGPT Atlas」などのAIブラウザ7種でデータ窃取を検証
米ワシントン大学に所属する研究者らが発表した論文「Agentic Browsers and the Same-Origin Policy」は、AIエージェントがユーザーに代わってWeb操作を行うAIブラウザにおいて、メールやネットバンキングなどの機密情報が悪意あるサイトに窃取されるリスクを検証した研究報告だ。
気象庁の緊急地震速報の過大推定についてまとめてみた
2026年10月16日、気象庁は同日に北海道から中部地方へ発表した緊急地震速報(警報)について、マグニチュードを過大に推定したことによるものと公表しました。ここでは関連する情報をまとめます。 M6.9の地震がM9.9と推定され警報に 10月16日12時38分頃、カムチャツカ半島付近でM6.9(速報値)の地震が発生し、観測された最大震度は函館市の震度1だった。(出典: 2)緊急地震速報は12時38分27.7秒の第1報でM6.2と推定し、第14報(12時39分04.0秒)まではM6〜7台で推移した。12時39分23.6秒の第15報でM9.9となり、12時40分02.6秒の第17報で警報を発表した。…
ウェブサーバ「nginx」に複数脆弱性 - 3件が「クリティカル」との評価も
ウェブサーバ「nginx」や関連製品に複数の脆弱性が判明した。サービス拒否やコード実行、認証の回避、機密情報の漏洩などにつながるおそれがある。
Assurance Retraite: 70,372 件のアカウント情報が流出
lassuranceretraite.fr / 侵害日 2024-09-01 / 漏洩データ: Dates of birth, Email addresses, Family members' names, Government issued IDs, Income levels, Marital statuses, Names, Phone numbers, Physical addresses In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries . The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In…
メドレー、不正アクセスで停止中のサービスを作り直して再開へ 従来システムは再稼働させず
メドレーは10月19日、不正アクセスを受けて停止している医療機関向け業務支援システム「@link（アットリンク）」について、22日から一部機能の提供を再開すると発表した。従来のシステムは再稼働させず、別の環境に新たに構築したサービスにデータを移行して提供する。
社内の光回線申込受付管理システムで侵害、影響を調査 - ニフティ
ニフティは、同社の光回線サービスへ申し込んだ顧客の個人情報が外部へ流出した可能性があることを明らかにした。
SLES 15.6 repositories are being retired
The SLES 15.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL ZYPP archive .General support for SUSE Linux Enterprise Server (SLES) 15 SP6 (15.6) ended on December 31, 2025 (by upstream). All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. If you are still on SLES 15.6 either update to a newer SP (SP7 at the time of this writing), or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for…
RHEL 10.0 and 9.6 repositories are being retired
The RHEL 10.0 and RHEL 9.6 repositories are being retired from the main PostgreSQL RPM repository, and are moved to the PostgreSQL YUM archive . All PostgreSQL major versions that were built for these minor releases are available there, including PostgreSQL 18. The rolling EL-10 and EL-9 repository RPMs are not affected. If you are still on RHEL 10.0 or 9.6 (or on Rocky Linux / AlmaLinux 10.0 or 9.6), please either update to a newer minor release, or use the archive. The archived repositories section of the repository packages page generates the repository file and the install commands for ea…
FOSSASIA PGDay 2027: Bangkok, 9 March – CFP Open
We are happy to announce that FOSSASIA PGDay returns to Thailand on 9 March, 2027 , bringing the PostgreSQL community together at True Digital Park, Bangkok . Visit the PGDay website for more details. About Event FOSSASIA PGDay is an annual gathering for PostgreSQL users, developers, and enthusiasts, bringing together the community from across Asia and beyond. Co-located with the FOSSASIA Summit, the event provides a focused forum for sharing knowledge, practical experiences, and insights into PostgreSQL and its growing ecosystem. Previous editions have taken place in Singapore, Vietnam, Thai…
Announcing rustup 1.29.2
The rustup team is happy to announce the release of rustup version 1.29.2. Rustup is the recommended tool to install Rust , a programming language that empowers everyone to build reliable and efficient software. What's new in rustup 1.29.2 This is a small release which only updates the rustls-webpki and webpki-root-certs dependencies to address the problematic eMudhra intermediate certificates issue described in CVE-2026-111943 . See also RUSTSEC-2026-0382 . Further details are available in the changelog ! How to update If you have a previous version of rustup installed, getting the new one i…
[悪用確認] CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability
Siemens Software Center Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
[悪用確認] CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
Plex Media Server Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-11-03)
[悪用確認] CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
[悪用確認] CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-23)
ソースネクストへの不正アクセスについてまとめてみた
2026年10月15日、ソースネクストは、同社が管理する会員情報に対する第三者の不正アクセスで、会員の個人情報が外部に流出したことが判明したと公表しました。ここでは関連する情報をまとめます。 会員情報取得APIの不正利用 第三者は2026年10月9日10時頃から、会員情報取得APIを不正に利用して会員情報を取得していた(出典: 3)。10月13日9時頃、社員が会員情報を管理するシステムへの不正アクセスを見つけ、ソースネクストは外部からの不正な通信を遮断するなどの緊急措置を講じて13時36分までに封じ込めを完了した(出典: 3, 5)。以後、不正アクセスは確認されていないとしている(出典: 3)…
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities
Quarterly contributor outreach
Hi Django community, thank you all for continuing to contribute to Django. The Steering Council is reaching out to bring people's attention to a few areas. We have major features we'd like to test and review for 6.2 , smaller changes that could use attention and then various New Feature ideas we'd like community input on. Major features These PRs are things we'd like to refine, test and get merged in. We're looking for people to test the features themselves and review the PRs . Please see our guidelines on reviewing PRs . CompositeField (multi-column subqueries) (this only needs testing, not…
aiohttp server lacks an initial request/header timeout
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
AIOHTTP: Secure attribute not enforced for shared cookie
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The Secure attribute was not being enforced for the shared cookie. Impact It may be possible to send a shared cookie marked Secure through an unencrypted request.
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. Impact An attacker could cause resource exhaustion through specially crafted requests.
russh: Unbounded memory allocation in agent protocol server via crafted constraint records
影響: rust:russh <= 0.64.0 → 0.64.1 russh_keys::agent::server::add_key (russh/src/keys/agent/server.rs:271-319) spawns a dedicated tokio task for every 5-byte SSH_AGENT_CONSTRAIN_LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks and…
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
影響: rust:russh >= 0.34.0-beta.1, < 0.64.0 → 0.64.0 In russh/src/server/encrypted.rs, server_read_auth_request_pk (0.63.3, around lines 880-990): The requested algorithm name (pubkey_algo) is read and only used to decode the key: PublicKeyOrCertificate::decode(&pubkey_algo, &pubkey_key). The derived hash_alg is then dropped (PublicKeyOrCertificate::PublicKey { ref key, .. }). The signature blob is decoded (Signature::decode) and verified with Verifier::verify(&pubkey, &buf, &sig). ssh-key picks the hash from the signature's own algorithm…
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
影響: pip:mercury >= 3.0.0, < 3.2.11 → 3.2.11 Mercury turns Jupyter notebooks into shared web apps/dashboards. The mr.Markdown widget converts its input to HTML with python-markdown and no sanitization step. MarkdownWidget is an ipywidgets.HTML widget, whose value is written to the page as raw HTML (via innerHTML) with no sanitization, so the result reaches the DOM verbatim. When an app passes untrusted data (database rows, user submissions, uploaded file contents, or an external/LLM API response) to mr.Markdown, HTML/JS in that da…
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4 A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
影響: go:github.com/envoyproxy/ai-gateway >= 0.4.0-rc1, < 1.2.0-rc1 → 1.2.0-rc1 The MCP proxy's client-facing session ID embeds the authenticated caller's subject (JWT sub claim) specifically as an anti-hijacking discriminator — matching the Model Context Protocol specification's documented session-hijacking guidance (https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices#session-hijacking). However, the session-resume path never checks that discriminator against the current caller's identity, so any client that obtains a session ID…
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
影響: pip:graphifyy >= 0.7.2, < 0.9.70 → 0.9.70 The Fortran extractor's C-preprocessor step (graphify/extractors/fortran.py, _cpp_preprocess) applies an incomplete #include hardening. The -nostdinc -I /dev/null flags it relies on (comment "Security (F-007)") do not stop a capital-F Fortran source file from including absolute paths (#include "/etc/passwd") or from path-traversing out of the corpus (#include "../../../../home/victim/.ssh/id_rsa"). cpp always searches the directory of the file being preprocessed for quoted includes and…
Mercury: Unauthenticated Remote Code Execution via /api/kernels
影響: pip:mercury <= 3.2.5 → 3.2.6 Mercury runs a JupyterLab server with anonymous access by default (mercury_app/__main__.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints. The vulnerability /api/kernels is NOT in the blocklist (and cannot be — Mercury needs kernels…
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
影響: pip:loopx >= 0.0.1, < 0.4.5 → 0.4.5 loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction. The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about…