Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a vulnerability where the system does not fail securely, also known as 'failing open'. This flaw could allow a low privileged remote attacker to bypass protection mechanisms. The vulnerability has a medium severity with a CVSS score of 6.8, impacting confidentiality and integrity but not availability. No official patch or remediation details are provided in the available data.
CVE-2026-107655 is a vulnerability in the CUPS printing system used in Red Hat Hardened Images. It involves a null pointer dereference triggered by processing embedded job ticket comments with specific IPP attributes. An unauthenticated attacker able to submit print jobs can cause the print daemon to crash, resulting in a temporary denial of service for printing services. A security update addressing this issue is available from Red Hat.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a vulnerability where error messages may disclose sensitive information. This issue allows an unauthenticated remote attacker to potentially gain information disclosure. The vulnerability is classified as CWE-209 and has a low CVSS score of 3.7.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have an improper certificate validation vulnerability (CWE-295). This flaw allows an unauthenticated remote attacker to potentially cause denial of service, disclose information, or execute code remotely. The vulnerability has a high severity with a CVSS score of 7.5. No patch information is provided in the input data.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a vulnerability classified as Inclusion of Functionality from Untrusted Control Sphere (CWE-829). This flaw allows a low privileged remote attacker to potentially elevate privileges, access the filesystem, and execute code remotely. The vulnerability has a high severity with a CVSS score of 7.5. No patch or remediation information is provided in the available data.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a vulnerability involving initialization of a resource with an insecure default. This flaw could allow a low privileged local attacker to cause information disclosure. The vulnerability has a medium severity rating with a CVSS score of 6.3.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Protection mechanism bypass.
The United States disrupted two Chinese state-sponsored hacking tools, MicroScan and FishHub, used by the APT group Flax Typhoon and others to target critical infrastructure in the US and abroad. MicroScan is a Python-based vulnerability scanning tool with over 1,300 penetration testing scripts, used since at least 2017 against various software and services. FishHub facilitated network intrusions and data exfiltration via spear phishing, targeting universities and critical infrastructure entities. The US seized domains used by these tools and previously sanctioned the developer, Integrity Technology Group. The tools enabled reconnaissance, credential theft, and exfiltration of sensitive data from government, law enforcement, healthcare, and religious organizations, primarily in Southeast Asia. The disruption was part of a coordinated international effort involving multiple countries.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an improper validation of specified input type vulnerability. This flaw could allow a low privileged remote attacker to cause information tampering and exposure. The vulnerability has a low CVSS score of 3.1, indicating limited impact and exploitability.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a vulnerability classified as CWE-348 (Use of Less Trusted Source). This flaw allows an unauthenticated remote attacker to potentially tamper with information. The vulnerability has a low severity with a CVSS score of 3.7. No known exploits are reported in the wild, and no patch information is provided.
Citrix has issued an urgent warning for IT administrators to immediately patch a critical remote code execution (RCE) vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. The vulnerability allows remote attackers to execute arbitrary code on affected systems. No specific affected versions or patch details are provided in the available information. There is no confirmation of active exploitation in the wild at this time.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Protection mechanism bypass.
In late September 2026, seven malicious npm packages impersonating a NebulaAI SDK were deployed to deliver a Windows remote-access trojan (RAT). The RAT uses direct NT and win32k syscalls, avoiding DLL imports, and includes features such as hidden-desktop remote control, camera and microphone monitoring via Kernel Streaming, and persistence through Winlogon Shell. The malware communicates with a command-and-control server at 65.87.7.132 and disguises itself as conhost.exe while employing anti-analysis techniques.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a vulnerability involving improper restriction of excessive authentication attempts. This flaw allows an unauthenticated remote attacker to potentially bypass protection mechanisms, elevate privileges, and gain unauthorized access. The vulnerability is tracked as CVE-2026-76779 and has a high severity rating with a CVSS score of 7.4.
Anthropic has launched two cybersecurity initiatives: OSS Scanner, which uses AI to generate and send unreviewed vulnerability reports directly to opt-in open source maintainers, and the Critical Infrastructure Defense Program (CIDP), which partners with 11 firms to enhance operational technology (OT) security. OSS Scanner aims to accelerate vulnerability disclosure by bypassing human review, though some reports may contain inaccuracies. CIDP focuses on OT providers where patching is often difficult or delayed, leveraging AI models and on-site expertise to improve vulnerability remediation. Both programs build on lessons from Anthropic's Project Glasswing and seek to improve the speed and effectiveness of vulnerability management in open source and critical infrastructure environments.
CVE-2026-104635 is an uncontrolled recursion vulnerability in the elixir-protobuf protobuf library's JSON decoding functionality. It allows unauthenticated remote attackers to crash the decoding process by supplying a deeply nested JSON document that triggers infinite recursion in self-referential or cyclic message types. This affects applications using Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 with vulnerable versions of the protobuf library. The flaw does not impact confidentiality or integrity but can cause denial of service by exhausting memory.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have a missing authorization vulnerability (CWE-862) that allows a low privileged remote attacker to potentially elevate privileges. The vulnerability has a medium severity with a CVSS score of 4.3. No patch or remediation details are provided in the available data.
The Microsoft Digital Defense Report 2026 highlights key cybersecurity trends from July 2025 to June 2026, emphasizing the accelerating role of AI in attacks and the persistent exploitation of identity weaknesses. Attackers increasingly focus on session hijacking rather than malware delivery, with phishing evolving to steal credentials and sessions. Social engineering campaigns like ClickFix and vishing in Teams have surged dramatically. Patch velocity is critical as attackers weaponize vulnerabilities within a day, while many exploited flaws remain years old. Identity compromise remains the primary attack vector, with password spray attacks dominating cloud intrusion attempts. Business Contact Impersonation (BCI) and AI-driven automation are reshaping threat landscapes, but fundamental security hygiene like patching and multi-factor authentication remain essential defenses.
An unidentified, likely Chinese-speaking, financially motivated threat actor targeted South Korean financial institutions between late September and early October 2026, successfully exfiltrating data. The attacker used ARTEX, an open-source Chinese agentic penetration testing tool, combined with large language models such as DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to enhance operational tempo and conduct multiple intrusions rapidly. Analysis revealed exposed ARTEX configuration files, Claude Code session histories, and a two-server infrastructure involving Hong Kong. The adversary also researched Korean data breach marketplaces and Telegram channels for monetizing stolen data. The campaign demonstrates sophisticated use of AI-driven tooling to conduct targeted intrusions against financial institutions.
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.