VulnHub

Cybersecurity researchers have uncovered a malicious campaign involving npm packages that has been distributing information stealers and remote access trojans (RATs). Codenamed MALFEX, this operation has been linked to a single threat actor who has published 12 different packages since August 2023, with eight of them being identified as harmful. These malicious packages have been downloaded over 40,000 times, potentially compromising the systems of numerous developers and organizations using npm for package management. The presence of the Overlord RAT and other malware poses serious risks, including data theft and unauthorized access to users' systems. Developers and companies using npm should be vigilant and ensure they are not using any of these compromised packages.

SonicWall has issued hotfixes for four vulnerabilities in its SMA1000 appliances, which are used to facilitate remote access to corporate networks. The most critical flaw has been rated a perfect 10.0 on the CVSS scale and allows attackers to send unauthorized requests through the appliance, potentially accessing internal functions without needing any login credentials. SonicWall has stated that there is currently no evidence that these vulnerabilities are being actively exploited. However, organizations using these appliances should prioritize applying the patches to safeguard their networks. This incident emphasizes the need for companies to regularly update their security appliances to defend against potential attacks.

A serious vulnerability has been discovered in LMCache, an open-source tool used to enhance the performance of large language model servers like vLLM. This flaw allows unauthenticated attackers to execute code on the cache server, posing a significant risk since there is no patch currently available to fix the issue. The problem arises specifically in LMCache's multiprocess mode, where it operates as a standalone server that communicates with LLM workers via the ZeroMQ messaging library. As a result, any server utilizing this software could be at risk of unauthorized access and potential exploitation. Organizations using LMCache should take immediate steps to secure their systems and monitor for any suspicious activity.

The FBI and the Secret Service have issued a warning regarding the ongoing FortiBleed credential harvesting campaign, which targets Fortinet's FortiGate firewalls and SSL VPN gateways. This campaign has reportedly collected over 86,000 credentials, exploiting weaknesses in reused or leaked passwords and outdated password storage methods. Organizations using Fortinet products need to be vigilant, as attackers can gain unauthorized access to sensitive systems. The persistence of this threat highlights the importance of using strong, unique passwords and implementing robust security measures. Companies are urged to review their security protocols to protect against this active exploitation.

The Computer Emergency Response Team of Ukraine (CERT-UA) has reported that over 100 websites have been compromised with malicious JavaScript code to distribute LunexStealer, an information-stealing malware. This activity was detected in September 2026 and is linked to a threat group identified as UAC-0277. The malware targets users by masquerading as legitimate Cloudflare checks, tricking them into downloading the malicious software. This incident raises concerns for both website owners and users, as it highlights the ongoing risks associated with compromised web environments. Users who visit these affected sites may unknowingly expose their personal information to cybercriminals, making it crucial for individuals to be vigilant about the websites they access.

In October 2026, Android released updates that patched 25 vulnerabilities, including a significant flaw in the System component that could allow attackers to escalate their privileges. This particular vulnerability is critical, meaning it poses a serious risk to device security. Users of Android devices should install the latest updates as soon as possible to protect their systems from potential exploitation. The updates address weaknesses across various Android versions, ensuring that devices remain secure against these threats. Keeping software up to date is essential for maintaining security and preventing unauthorized access.

Hackers are actively exploiting security flaws in the Ninja Forms and WPC Product Bundles for WooCommerce WordPress plugins. These vulnerabilities allow attackers to execute stored cross-site scripting (XSS) attacks, which can lead to the installation of backdoors and the creation of unauthorized admin accounts on compromised sites. The impact is particularly concerning for website owners using these plugins, as it could lead to unauthorized access and control over their WordPress installations. Users should be vigilant and ensure their plugins are updated to protect against these attacks. The situation emphasizes the need for regular security checks and timely updates to safeguard web assets from exploitation.

Recent developments in cyberattacks show that malicious actors are becoming more sophisticated in hiding their payloads. They are now using DNS TXT records and browser cache pre-fetching techniques to obscure their activities, making it harder for security teams to detect early signs of an attack. This evolution in tactics poses a significant challenge for organizations trying to protect their networks. As these methods become more prevalent, it is crucial for companies to enhance their monitoring capabilities and adapt their security strategies to identify these hidden threats. Users and organizations alike need to stay vigilant and informed about these evolving attack methods to better safeguard their systems.

A recent study analyzed 2.5 million devices from 50 healthcare organizations and found that the industry is not adequately prepared for the future of quantum computing and its implications for data security. The research indicates that many healthcare systems are still relying on outdated cryptographic methods, which could leave sensitive patient data vulnerable as quantum technology advances. As quantum computers become more capable, they could potentially break current encryption standards, putting personal health information at risk. This lack of readiness is concerning for an industry that handles crucial and private data. The study calls for urgent upgrades to encryption methods to safeguard against future threats posed by quantum computing.

Researchers have discovered Linux backdoors that are targeting telecom and network devices in South Korea and Taiwan. These backdoors cleverly disguise their malicious traffic as legitimate email services, making it difficult for security systems to detect them. Attackers often name their malware after real components of the operating system to avoid detection. This tactic not only helps the malware blend in but also poses significant risks to network security in these regions. The ongoing threat underscores the need for enhanced monitoring and detection measures in organizations that rely on Linux systems for critical infrastructure.