VulnHub

Last Sunday, an attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to gain unauthorized access to a NEAR AI inference server. This breach allowed the attacker to execute code and potentially view sensitive requests being processed on the server, including those made in a confidential mode designed to enhance privacy through a trusted execution environment. As a result, data from 18 agents and around 100 users was compromised. This incident raises serious concerns about the security of open-source software and the potential risks involved in handling sensitive data. Companies using SGLang or similar technologies need to assess their security measures to prevent future breaches.

Researchers at Check Point have identified three espionage campaigns linked by shared infrastructure and malware known as Sparrow. These campaigns have primarily targeted telecommunications companies, government bodies, military organizations, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. The clusters, named SilentDelivery, have been using similar malware code, indicating a coordinated effort from a group with ties to China. The implications of these attacks are serious, as they not only threaten sensitive data and national security but also highlight the ongoing risk to critical sectors worldwide. Organizations in these sectors should remain vigilant and enhance their security measures to protect against potential breaches.

Cybersecurity researchers have reported an attack exploiting two vulnerabilities in AhsayCBS, a backup software solution. This attack, observed by Huntress in early October 2026, utilized CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute unauthorized commands on compromised systems. The attackers deployed a Python-based backdoor capable of evading sandbox detection, which raises significant concerns for organizations using AhsayCBS. The vulnerabilities have been patched, but the incident serves as a reminder for companies to regularly update their software and monitor for any signs of compromise. Users of AhsayCBS should ensure they have installed the latest updates to protect against these exploits.

The cybercriminal group known as Blind Eagle has launched a new campaign targeting organizations across Latin America. They are using phishing tactics that mimic court-related notifications, such as court summons and fiscal notices, to trick users into downloading a remote access trojan (RAT). This RAT is linked to known malware variants like AsyncRAT and DCRat. The phishing messages are crafted in Portuguese and Spanish, making them particularly effective against local targets. As organizations fall victim to these tactics, sensitive data could be compromised, highlighting the need for enhanced cybersecurity measures in the region.

On October 11, 2023, a cyberattack targeted refrigeration controllers at approximately 700 retail locations across France, leading the French government to attribute the attack to a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC). The assailants modified the defrost settings on these controllers to high temperatures, resulting in significant food spoilage and causing fires at least 15 times. This incident raises serious concerns over the security of critical infrastructure, as it demonstrates how cyberattacks can disrupt everyday operations and pose risks to public safety. The French government is now investigating the full extent of the damage and the motivations behind the attack, which may have broader implications for international relations and cybersecurity strategies. Retailers affected by this incident are likely to face financial losses and increased scrutiny regarding their cybersecurity measures.

Google has released a security update to address nine vulnerabilities in Chrome, one of which is being actively exploited in the wild. This high-severity flaw, identified as CVE-2026-125350, is a use-after-free bug related to the XML component of the browser. Use-after-free vulnerabilities can allow attackers to execute arbitrary code, posing a significant risk to users. All Chrome users are advised to update their browsers promptly to protect against potential exploitation. Keeping software up to date is essential to maintain security and safeguard personal information.

Vanderbilt University has reported a ransomware attack attributed to the BYOD ransomware gang, which has allegedly encrypted the university's databases and stolen sensitive information. The affected data includes personal details of students and employees, as well as important research information. This incident raises significant concerns about data security and privacy within educational institutions, particularly as cyberattacks on universities have been on the rise. The university is actively working to mitigate the impact of the breach and restore its systems. The situation underscores the need for stronger cybersecurity measures to protect sensitive data from malicious actors.

N-able has temporarily taken its hosted N-central environments offline following the public disclosure of over 30 zero-day vulnerabilities by a security researcher. These vulnerabilities pose significant risks, potentially allowing attackers to gain control of affected systems. The company has also advised on-premises customers to shut down their servers to mitigate any risks. This incident is particularly concerning as zero-day vulnerabilities often remain undiscovered by the vendors, leaving systems exposed until patches are released. N-able's swift action reflects the urgency of addressing such security threats.

In October, France experienced a series of cyberattacks that targeted refrigeration systems at over 700 supermarkets and retail locations, leading to food spoilage and at least 15 reported fires. The French government has attributed these attacks to Iranian state-sponsored hackers. The disruption caused significant losses for businesses and raised concerns about the safety and security of retail operations. This incident underscores the potential dangers posed by state-backed cyber activities, particularly in critical infrastructure sectors like food supply. Authorities are now investigating the full extent of the damage and looking into measures to prevent similar attacks in the future.