Kategorie

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Ads in ChatGPT are chosen in part based on the conversation they appear under, and Meta now shapes the ads users see on Facebook and Instagram through conversations with its assistant.

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]

PHP has released emergency updates for two critical vulnerabilities that can let attackers run malicious code on a web server without logging in.

An online shop can be running normally while customers cannot reach it.

Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. [...]

eMudhra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a private encryption key of just 4—said it’s getting out of the business.

V. Srinivasan, chairman of India-based eMudhra Limited, cited increasing costs and complexities of compliance requirements—paired with the business generating just 1 percent of its revenue. He also said that the emergence of organizations providing TLS certificates free of charge further reduced returns on investment when compared to other products and services the company offers.

Don't let the door hit you on the butt

“However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” the company continued in a Thursday post. “In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.”

Read full article

Comments

Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...]

Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employee had that much reach with that little oversight, you would call it an insider risk. So why do we still call the agent a productivity [email protected]

Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]

Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

I was taking my dog for her perambulation through the leafy valleys and forests of one of the most densely populated parts of London this morning when it struck me how annoying it has become that I must now update multiple Apple devices across my family group. That’s pretty much mandatory given recent security warnings, and may involve additional updates over time.

“Why must I spend so much time updating other people’s stuff?” I asked myself, managing to combine resentment and self-pity within one short sentence. “Why can’t they learn how to update their own stuff?” I muttered, dreaming once again of that inevitable lottery win that absolutely will change my life. “If only there was an easier way.”

The one thing every family admin should do

You can do this in IT. There you have a suite of tools to manage devices. But for families, there are no easy ways, I thought.

That’s not to say you can’t do anything. Number one is the standard thing every family admin should do, though many of us don’t:

1. Open Settings > General > Software Update.
2. There, tap Automatic Updates and turn on Download (iOS, iPadOS, macOS) Updates and also turn on Install (iOS, iPadOS, macOS) Updates.

From then on, that device will automatically download and install updates overnight when it is locked, on Wi-Fi, and charging.

Great. You can forget it. Except you can’t, as not only must you take these steps on each individual device, which is really boring, but, unlike IT admins, you cannot monitor the family fleet to make sure every device is up to date. The first you’ll know they aren’t will probably be when someone has a tech problem you must resolve as a result of them cancelling those updates because they wanted to check their email.

Apple Business isn’t for the home

To resolve this, you can try to use Apple Business or third-party fleet device management tools, such as Jamf Now. Aimed at business users, in theory both tools could extend enterprise-grade device management into family setups, but neither seems ideal. 

Apple Business, for example, demands managed Apple accounts, requires strict registration as a business user and puts in place other barriers that prevent it being easily used to manage family tech. Jamf Now is much more flexible, but the company charges around four dollars for each device after three, which adds up fast when your extended family have iPhones, Macs, and iPads. 

Apple Configurator isn’t enough

Another option could be Apple Configurator. This is free and lets you supervise multiple devices manually. The limitation is that it only lets you manage iOS, iPadOS and tvOS devices — all it can do for Macs is enroll them to enable MDM. Another limitation is that you need to connect each device manually to your Mac for configuration — and during the config process you’ll need to back up the device, as it will be wiped and restored during the configuration process. 

Configurator is powerful — perhaps too powerful. Once it is applied, you can permanently block apps, force web content filtering, and stop AirDrop. You can also prevent people from changing the device name or passcode, or from adding new mail accounts. Much of this is great for family device management, I thought as I leaned over to deal with another canine gift, but the problem remains that it will not automate updates across the family group.

“Why must I always carry the load?” I muttered to myself, resentfully, as I walked toward the park trash can. “All I want is to make sure everybody installs software updates. Is that too much to ask?”

What Apple already offers

I really don’t think it is too much to ask. Apple has already built system hooks inside its operating systems that force devices to upgrade to specific OS versions by defined deadlines. These tools sit inside the Declarative Device Management (DDM) framework and are made available through MDM services. These aren’t APIs, but system-level hooks.

Could Apple provision these services from within Family Sharing?

I think it would be possible, but the problem is a philosophical one. There is a difference between business and family users, and the latter’s are seen as personal devices. What that means is that Apple’s fundamental security model for family devices is based on the individual user, protecting that user and ensuring that no remote user or server should be able to force deep, system changes — like OS updates — on someone else’s personal device. 

This makes a lot of sense, of course, because by adding managed software updates to Family Sharing, Apple would be empowering the administrator at the cost of individual users’ personal agency. It’s not hard to imagine situations in some families where such power might be abused. There’s also the risk of data loss.

Family Sharing does let you control things like content access and set time boundaries but leaves the software updating and other core tasks to the individual. 

Privacy may matter most

Should Apple change this? 

As I walked my deeply reluctant and not even slightly grateful dog back home, I reflected that perhaps individual privacy and agency are worth protecting. It’s what I am raising my family to care about, after all — but surely there should be a tool within Family Sharing that admins can use to remind family members to upgrade? Something a little stronger than a text message, email, or personal request, like perhaps a system message? 

“It would be helpful if I could just pop a pester message on everyone’s device reminding them to upgrade,” I thought as I turned the lock and walked into the family home. 

“Then at least I wouldn’t have to talk to everyone,” I thought as I snuck into my man-cave, where I reached over and began the tedious task of updating a couple of dozen devices all by myself.

“Is that all there is?” I thought, as I watched the morning wane.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multiple reports from the Associated Press, the New York Times, Reuters, and the Wall Street Journal, state District Court Judge Francis J. Mathew called Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]

Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical. [...]

INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspects. Codenamed Operation Serengeti III, the cybercrime crackdown took place between June 29 and August 31, 2026. "Authorities identified Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]