Tin tức an toàn thông tin
Tự động tổng hợp từ báo trong nước và các trang bảo mật quốc tế, bấm vào tin để đọc bài gốc. Cập nhật 18 phút trước.
🌐
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching. The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on SecurityWeek.
🌐
GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...]
🌐
Splunk, SolarWinds Release Fresh Security Updates
Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information. The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek.
🌐
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code…
🌐
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks. The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek.
🌐
PHP2Shell Exploitation Started Days Before Patches
Initial attempts were observed on October 17, and mass activity began shortly after patches were released. The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek.
🇻🇳
Phát hiện lỗ hổng 16 năm đe dọa hàng trăm triệu router Wi-Fi
Chuyên gia bảo mật vừa công bố lỗ hổng tồn tại suốt 16 năm cho phép kẻ gian tấn công router Wi-Fi mà không cần mật khẩu.
🌐
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code…
🌐
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches. The post Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU appeared first on SecurityWeek.
🇻🇳
Hàng nghìn trang web toàn cầu ngừng hoạt động vì lỗ hổng nghiêm trọng
Các lỗ hổng bảo mật mới trong PHP làm dấy lên lo ngại khi nhiều trang web trên toàn cầu phải triển khai biện pháp phòng ngừa.
🇻🇳
Công ty của kỹ sư Việt dùng AI tìm ra lỗi đe dọa Internet toàn cầu
Lỗ hổng bảo mật nghiêm trọng do Calif và OpenAI phát hiện đã đặt khoảng 70% website toàn cầu trước nguy cơ bị tấn công, buộc nhiều đơn vị khẩn trương cập nhật hệ thống.
🌐
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much…