usevimli.dev

News

What moved in DevOps, AI, security and the self-hosted world — summarized every morning, always with sources.

Top storySecuritybleepingcomputer.comAlpine Linux rebuilds GitLab after attempted exploitation of CVE-2026-97229Attackers submitted malicious CI configurations to exploit CVE-2026-97229, an unauthenticated remote code execution flaw in GitLab's regular expression compiler, crashing workers on Alpine's GitLab server. Alpine found no evidence of code execution or tampering, but missing logs meant it could not rule out a compromise, so it rebuilt the instance. Users should reset their GitLab passwords and pull the fixed alpinelinux/gitlab:19.3.6 image published October 27.
RSS

02 Nov 2026

  1. Securitybleepingcomputer.comAlpine Linux rebuilds GitLab after attempted exploitation of CVE-2026-97229Attackers submitted malicious CI configurations to exploit CVE-2026-97229, an unauthenticated remote code execution flaw in GitLab's regular expression compiler, crashing workers on Alpine's GitLab server. Alpine found no evidence of code execution or tampering, but missing logs meant it could not rule out a compromise, so it rebuilt the instance. Users should reset their GitLab passwords and pull the fixed alpinelinux/gitlab:19.3.6 image published October 27.
  2. Securitythehackernews.comCVSS 10.0 flaw in LXD and MicroCloud allowed client impersonationA critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. The attacker needed network access to the HTTPS API and the trusted client's public certificate. Once in, the attacker could act as that client and reach the cluster and its virtual machines.
  3. Securitybleepingcomputer.comFBI attributes $6.3 billion Binance theft to North Korean TraderTraitor hackersThe FBI confirmed that North Korea's TraderTraitor group, also tracked as Lazarus Group, stole roughly $6.36 billion in cryptocurrency from Binance, moving most of it across ten blockchains within minutes. The breach began with a compromised DevOps engineer's laptop that opened access to a service container. The FBI published associated cryptocurrency addresses and asked exchanges to block them. Binance says it has covered about 95% of the loss and plans to resume first-phase withdrawals on November 1.
  4. AIshiftdelete.netOpen-weight GLM 5.3 model built working Firefox exploits from unshipped patchesEpoch AI researchers showed that the open-weight GLM 5.3 model could turn Firefox security patches, visible in public code before reaching users, into working attacks. The resulting chains escaped the browser sandbox and read local files across six recent Firefox releases. Mozilla fixed the flaw in Firefox 159.0 on October 27. The same attack could not be reproduced in Chrome.
  5. Open sourcelwn.netLinux 7.2.15 is the final release of the 7.2 stable seriesGreg Kroah-Hartman announced kernel 7.2.15, the last 7.2.y release, after which the tree is end-of-life. He said the branch retired earlier than normal to avoid keeping too many stable branches alive at once. Systems running 7.2.y should move to 7.3.y.
  6. Releasesgithub.comVaultwarden 1.37.5 ships security fixes for website icons and emergency accessVaultwarden 1.37.5 fixes two medium-severity advisories affecting website icons and emergency access, with details private pending CVE assignment. The update is also required for newer web vault features, including two-step login toggling and emergency account takeover. The bundled web vault is now v2026.10.1, and invalid configuration values now stop startup with an error.
  7. Türkiyewebtekno.comSocial media ban for under-15s takes effect in TürkiyeA regulation from the Presidency's Cybersecurity Directorate took effect on November 1, barring social networks from serving children under 15. Age verification runs through an e-Devlet token that reveals only whether the user is over 15 or 18, not personal data. Existing accounts have until March 31, 2027 to verify. Unverified accounts will be closed and their data deleted. Platforms must give 15 to 18 year-olds a separate, high-privacy service by default.

01 Nov 2026

  1. Securitythehackernews.comCVSS 10.0 flaw in LXD and MicroCloud allowed trusted-client impersonationA critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. The attacker needed network access to the HTTPS API and the trusted client's public certificate. Once in, they could act as that client, with access to the cluster and its virtual machines.
  2. Securitythehackernews.comHijacked Polymarket script drained about $2.7 million from tradersMalicious code on prediction market Polymarket replaced a third-party page-speed script from DebugBear. On October 29 it sold some signed-in traders' positions and moved their funds to the attackers. Polymarket is refunding about $2.7 million to 726 affected wallets.
  3. Securitybleepingcomputer.comReddit will lock content behind logins to fight scrapersReddit co-founder Steve Huffman said the site will gradually become a "logged-in service," with limited access for visitors without accounts. He cited personalization and scrapers, noting that most unauthorized data access happens through logged-out pages. A login pilot will start in selected markets outside the United States in the coming months. The front page and pages reached from search results should stay visible.

31 Oct 2026

  1. Securitybleepingcomputer.comLinux kernel MPTCP flaw allows remote root, and Anthropic built a working exploitCVE-2026-98432 is a use-after-free race condition in the kernel's IPv4 TCP code, scored 9.8 out of 10 and affecting kernels back to 4.4 across major distributions. Anthropic says an unreleased Claude model built a working exploit that reached remote root on a server running an MPTCP (Multipath TCP) listener. Fixes are available upstream and in Debian, but Ubuntu and RHEL releases were still waiting as of October 30. Note that Go 1.24 enables MPTCP by default on Linux, so some Go services may be exposed without their owners knowing. Disabling MPTCP alone is not enough, since the bug also triggers via ordinary TCP. CIQ says firewall rules blocking IPv4 TCP packets with IP options can help until patches arrive. No exploitation in the wild has been confirmed.
  2. Securitysecurityweek.comPHP2Shell attacks root Palo Alto firewalls but WordPress sites hold so farA China-linked group chained the PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 with the Fragnesia kernel privilege-escalation bug to install webshells with root privileges on Palo Alto PAN-OS firewalls, compromising at least 25 devices. Palo Alto has patched all affected PAN-OS branches plus Panorama and urges customers to keep the management interface off the internet. Attacks on WordPress sites have failed so far, but Defiant stresses that updating PHP remains essential.
  3. Securitythehackernews.comTeamViewer flaw let controlled machines attack the connecting computerTeamViewer has fixed a flaw where a compromised host (the machine being controlled) could attack the viewer (the computer connecting to it), crashing its TeamViewer software and potentially more. Update to the latest version.
  4. Securitythehackernews.comChinese hackers use AI-powered ARTEX framework against 200+ organizationsCrowdStrike attributes attacks using ARTEX, a Go-based, AI-powered penetration testing framework, to the China-linked actor it calls Vapor Panda. The campaign targets over 200 high-value organizations worldwide.
  5. Securityarstechnica.comAnthropic's VS Code extension on Cursor was backdoored for nearly 12 hoursAttackers compromised Anthropic's verified Cursor account and pushed a backdoored version of its VS Code extension for close to 12 hours. How the account was accessed is still unknown.
  6. Cloudblog.cloudflare.comCloudflare patched eMudhra weak keys in hours but much of the Internet is still exposedAfter certificate authority eMudhra was found on October 19 to have eight trivially weak intermediate keys, anyone could forge certificates for any domain that unpatched clients not enforcing Certificate Transparency would accept. Cloudflare patched its high-impact systems within hours and has logged roughly 22,000 attempted handshakes with the weak keys since October 21, including forged certificates created within hours of the disclosure. It has seen no evidence so far that its own connections were intercepted. Modern browsers are mostly patched, but Android WebView lags with 30-40% still accepting, and more than half of probes on large networks still trust the compromised chain. Patching remains essential.
  7. AIcloud.google.comGoogle Cloud ships Agent Compute Engine, llm-d 1.0 and TPU updatesGoogle Cloud launched Agent Compute Engine, a compute service that runs autonomous AI agents in hardware-isolated microVM sandboxes with sub-second activation, plus gateway and registry tools for governing them. It also open-sourced llm-d 1.0, a Kubernetes-native stack for serving large language models across TPU and GPU fleets, and TorchTPU with Meta, which brings Google TPUs into PyTorch. GKE gained a preview CPU startup boost with up to 2x faster cold starts, and Oracle will become the first hyperscaler to offer TPUs outside Google Cloud, from 2027.
  8. Open sourcepostgresql.orgpgAdmin 4 9.19 fixes 15 security vulnerabilitiesThe release patches 15 CVEs, including an OS command injection in the Import/Export Data tool, LDAP and Kerberos logins landing in the wrong account, and several bypasses of login limits and file-path checks. Server-mode users must configure the new password-command allowlist (SERVERPASSEXECCOMMANDS) before first start after upgrading. The release also adds editing data through auto-updatable views and saving query results as JSON or XML.

30 Oct 2026

  1. Securitythehackernews.comLinux kernel TCP flaw CVE-2026-98432 rated 9.8 affects Ubuntu and RHELThe Linux kernel's own CVE team rates CVE-2026-98432, a flaw in the kernel's TCP code, at 9.8 out of 10. It affects Ubuntu, Red Hat Enterprise Linux and other distributions. Anthropic said on October 27 that its AI model wrote an exploit for the flaw that lets a remote attacker with no credentials run commands as root on affected Linux servers. Patch as soon as your distribution ships a fixed kernel.
  2. Securitysecurityweek.comAnalysts attribute the roughly $6.3 billion Binance hack to North Korea's TraderTraitorMost of the money was gone within roughly 20 minutes; the previous record was Bybit's $1.5 billion loss. Binance's initial findings suggest the attacker reached a service container from a compromised DevOps engineer's laptop and submitted unauthorized withdrawals. Blockchain analysts attribute the attack to North Korea's TraderTraitor unit. About $3 billion has been frozen, but the attackers still hold about $2.4 billion in ETH and BTC that no issuer can freeze.
  3. Securitythehackernews.comThreatsDay rounds up critical firewall flaws, banking trojans and token theftThe Hacker News' weekly roundup covers critical firewall vulnerabilities, rented banking trojans, a weaponized PDF campaign and token theft, plus 26 more stories. It notes exposed passwords, old bugs still being exploited, and attackers borrowing trust from familiar apps, websites and AI tools.
  4. Self-hostednoted.lolPicPeak: event-focused self-hosted photo galleries with guest uploadsPicPeak is an open-source (MIT), self-hosted photo and video gallery platform that treats each gallery as an event. Galleries can be password-protected, set to expire and shared by link, and visitors can download images or the whole collection as a ZIP without an account. Guests can contribute photos directly, and a live slideshow mode displays incoming photos during an event. Deploy with an all-in-one Docker image using SQLite, or a Docker Compose stack with PostgreSQL and Redis. Storage supports local disks and S3-compatible backends, and existing media directories can be referenced without copying.
  5. Releasesgithub.comn8n 1.123.90 requires a signed token for invitationsAccepting an invitation now requires a signed token. If you run n8n 1.x, update for this security fix.
  6. Releasesgithub.comn8n 2.46.2 pre-release tightens execution permissions and queue handlingWorkflow routes now need the execution:read permission to read execution data, and the release fixes how queue mode hands jobs to idle workers.
↑

↑↓ · enter · esc