Proxyware crew hijacks D-Link, Ubiquiti, SAP via old CVEs
GreyNoise found 143 devices in 34 countries enrolled into the Pawns.app residential-proxy network via CVE-2024-3273, Log4Shell, and SAP NetWeaver's CVE-2025-31324.
Newsroom
UK Legal Aid breach wider than first said, records to 1978
A forensic review of the April 2025 Legal Aid Agency breach found stolen records dating to 1978 and ~250,000 predating 2007. Hackers claim data on 2M+ people.
Fake Arch AUR packages impersonate yay and paru, run as root
An AUR account uploaded typosquatted yay/paru packages whose install scripts fetched and ran a remote shell as root; the AUR team banned the account on October 13.
Candiru spyware reached Al Jazeera through zero-click ads
Citizen Lab links Candiru spyware to zero-click infections of 45+ Al Jazeera devices, delivered through targeted ads brokered by Israeli ad firm Discover-Tech.
CenterPoint Energy breach hits 1M+ Texans, utility confirms
CenterPoint Energy told the Texas AG that 1,062,060 residents had names, addresses, SSNs and driver's license numbers exposed; a forum hacker claims 7.49 million records in all.
Drupal patches critical Field UI RCE reachable via modules
Drupal core flaw CVE-2026-108097 (SA-CORE-2026-014, 19/25) runs arbitrary PHP via an unchecked #region_callback in Field UI; contributed modules expose an unauthenticated RCE path.
Langflow MCP stdio RCE exploited in the wild, fix in 1.9.0
CVE-2026-105740 (CVSS 9.9) lets any authenticated Langflow user run OS commands via an MCP stdio server config; Previdian honeypots logged 1,423 exploit attempts since September 19.
Next.js ships out-of-band fix for two critical RCE flaws
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated RCE flaws — one in use cache, one via SVG image optimization (CVE-2026-96889) — plus a Server Actions DoS.
NGINX fixes five flaws, including a TLS client-cert bypass
NGINX 1.30.6 and 1.31.7 fix five CVEs: three heap bugs that can crash workers, an HTTP/3 request-smuggling bug, and a TLS session-ticket forgery that can skip client-cert checks.