#InfoSEC

🚨New ransom group blog post!🚨

Group name: spacebears
Post title: SGLA (Schwartz, Giannini, Lantsberger & Adamson)
Organization: Schwartz, Giannini, Lantsberger & Adamson
Location: 🇺🇸 US
Sector: Professional Services
Info: https://cti.fyi/#disclosure/spacebears/SGLA%20%28Schwartz%2C%20Giannini%2C%20Lantsberger%20%26%20Adamson%29

#ransomware #cti #threatintelligence #cybersecurity #infosec

Possible Phishing 🎣
on: ⚠️hxxp[:]//facebookcustomersupportnumber25[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad959e63b7750000486f500
#cybersecurity #phishing #infosec #urldna #scam #infosec

Blogger Elias Taylor says public PHP2Shell PoCs fail on vanilla PHP and lean on a file-inclusion bug the target must already have. The top-starred PoC repo's README lists such app-side conditions for chain A and says code for chains D and E is for paid subscribers. PHP's advisory still says RCE was validated against default mod_php (attack complexity high), and Datadog says it reproduced both flaws.

https://eliastaylor.com/noexploit/

#PHP2Shell #PHP #InfoSec #Cybersecurity

Possible Phishing 🎣
on: ⚠️hxxps[:]//falselection[.]shop/1C06072qc83zmjs-7na7wo07ps0gn2m000012n9c1
🧬 Analysis at: https://urldna.io/scan/6ad9360a3b77500007852ca7
#cybersecurity #phishing #infosec #urldna #scam #infosec

CVE-2026-114727 (HIGH): Roundcube Webmail <1.6.20/1.7.5 allows SVG/EPS uploads, risking remote code execution via ImageMagick. Upgrade to 1.6.20+ or 1.7.5+ to mitigate. Details: https://radar.offseq.com/threat/cve-2026-114727-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-roundcube-webmail-0e067a7fe4b46d68 #OffSeq #Vulnerability #Infosec #Roundcube

🤖 GitLab patched a CVSS 10.0 unauth RCE in self-managed servers, affecting every release back to 7.0 (2014). No login needed to run code. The Oct 12 fix only covered 19.2+ — if you patched then, you need this second update.
🔗 https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html
#CVE #GitLab #RCE #InfoSec

Railway says an unauthorized party may have accessed encrypted environment variables and decrypted some, with impact that "may be limited to a subset of users." Yet it tells all users to roll every variable, paused all deployments, and invalidated all API tokens. Its status page showed only an outage until the 22:10 UTC notice, and paused builds blocked applying new keys. Railway gives no count or entry point.

https://blog.railway.com/p/security-disclosure-wednesday-october-21st

#CloudSecurity #DevOps #InfoSec #Cybersecurity

A New Mexico judge ordered Meta to pay $25B for deceiving users, down from $219.5B (43,899,725 jury-found violations at the $5,000 maximum). The court found Facebook promised a full post-Cambridge Analytica investigation but ran 14 forensic audits in three years and notified users about 2 apps. Meta says it will appeal, calling the case a "tax on speech." Injunctive relief is still pending.

https://www.cnbc.com/2026/10/21/meta-new-mexico-cambridge-analytica-penalty.html

#Privacy #Facebook #CambridgeAnalytica #InfoSec

The PHP Foundation says first signs of the flaw behind CVE-2026-109618 appeared in 2024, and the fix then stalled for months: "a structural failure." PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix it and CVE-2026-109619, both unauthenticated RCE (CVSS 9.2). It says Chainguard broke the embargo 6+ hours early; Chainguard's CEO told The Register he shipped because vendors reported exploitation. AWS saw a honeypot attempt on Oct 17.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

#PHP #InfoSec #Cybersecurity #OpenSource

Possible Phishing 🎣
on: ⚠️hxxp[:]//jj-facebook[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad9602e3b77500008f5c21e
#cybersecurity #phishing #infosec #urldna #scam #infosec

ASN: AS2518
Location: Tokyo, JP
Added: 2026-10-21T08:18

#shodansafari #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//onetimefstip[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/6ad967ef3b7750000270920e
#cybersecurity #phishing #infosec #urldna #scam #infosec

A screen full of data poison! Clockwise from top: NoiseBox Chrome Based Crawler Extension, NoiseBox router-level Wyse Crawler, and the new NoiseBox DNS Shuffler (coming soon). All working hard to obliterate our browsing patterns. All free, open source at Codeberg.org/NoiseBoxWorks
https://www.youtube.com/channel/UCi2cOT9eW575Fw-qoPB4seg
#Privacy #OpenSource #Infosec #DataPrivacy #BrowserExtension

CVE-2026-110353: HAProxy is affected by a denial-of-service flaw. A remote unauthenticated attacker can send truncated HTTP/2 PING frames to drive worker-thread CPU to exhaustion.

Affected versions span 3.2.0 through 3.4.5. No exploitation has been confirmed.

The fix ships in HAProxy 3.2.26, 3.3.17, 3.4.6, and later.

https://www.cve.org/CVERecord?id=CVE-2026-110353

#infosec #cybersecurity

ASN: AS23294
Location: Monroe, US
Added: 2026-10-21T07:50

#shodansafari #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//network-facebook[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad8cd3b3b775000094ec47e
#cybersecurity #phishing #infosec #urldna #scam #infosec

🤖 PHP2Shell (CVE-2026-109618/109619): the bug is real, but the thousands of "PoCs" flooding GitHub don't work on vanilla PHP — most silently rely on an LFI prerequisite, i.e. a second bug. 24h after disclosure: no working exploit. Not a Log4Shell.
🔗 https://eliastaylor.com/noexploit/
#CVE #PHP #Exploit #InfoSec

Patch 13 Apache Pulsar vulnerabilities and 4 Apache IoTDB flaws now, including critical bugs CVE-2026-105944, CVE-2026-105869, and CVE-2026-59229.

#ApachePulsar #ApacheIoTDB #Apache #Cybersecurity #Vulnerability #CloudSecurity #InfoSec

https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/?utm_source=mastodon&utm_medium=jetpack_social

Review the latest Cisco security advisory to patch 10 Cisco Expressway vulnerabilities, including critical 9.8 CVSS root RCE flaw CVE-2026-76466.

#Cisco #CiscoExpressway #RCE #CVE202676466 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/cisco-expressway-vulnerabilities-root-rce-patched/?utm_source=mastodon&utm_medium=jetpack_social

Possible Phishing 🎣
on: ⚠️hxxps[:]//telemachsi[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/6ad89b573b775000078529be
#cybersecurity #phishing #infosec #urldna #scam #infosec

ASN: AS9050
Location: Bucharest, RO
Added: 2026-10-21T09:47

#shodansafari #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//facebook-verification-system5[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad9523f3b7750000270916c
#cybersecurity #phishing #infosec #urldna #scam #infosec

New docker image for HortusFox v6.4 is now live! 😊

A big thanks to @thephpf for working so hard on the PHP patches. And everyone involved building docker images, posting news, supporting maintainers, and updating their own projects. You did an awesome job today!

What a #Spooktober indeed. We all deserve some rest now. 😴

Good night everyone. See y'all tomorrow. 💚

#PHP #FOSS #OpenSource #SelfHosted #SelfHosting #PHP2Shell #InfoSec

Possible Phishing 🎣
on: ⚠️hxxps[:]//docs[.]google[.]com/presentation/d/e/2PACX-1vRRY_5Lkya4ZoCF3ZLSddZWed9ZSkrF_gw0bqilBkNzJSBxXahIbjvhKBBbPmsnR0NVgbS398sFbQJK/pub?start=false&amp;loop=false&amp;delayms=3000
🧬 Analysis at: https://urldna.io/scan/6ad8fdbe3b775000045e8555
#cybersecurity #phishing #infosec #urldna #scam #infosec

Upgrade to Apache bRPC 1.18.0 to patch 35 Apache bRPC vulnerabilities, including high-severity flaws CVE-2026-48830 and CVE-2026-56388.

#ApachebRPC #Apache #RPC #Cybersecurity #Vulnerability #OpenSource #InfoSec

http://securityonline.info/apache-brpc-vulnerabilities-patched-1-18-0/?utm_source=mastodon&utm_medium=jetpack_social

PARTENAIRE POLAR 2026 SPONSOR : SECUR01
La prochaine édition de POLAR ne serait pas possible sans nos partenaires. Et cette année, nous sommes heureux d’avoir avec nous Secur01, qui est notre partenaire LANIÈRES et CAFÉ!
Pour en savoir plus sur la mission de cette compagnie, visiter leur site web : https://www.secur01.com/
—--
Our 4th edition of POLAR would not be possible without our sponsors. And this year, we are happy to have Secur01, a LANYARD & COFFEE sponsor!
If you want to learn more about this company’s mission, visit their website https://www.secur01.com/
#CISO #infosec #polar #hf2026 #cybersecurity

PARTENAIRE POLAR 2026 SPONSOR : TENABLE
La prochaine édition de POLAR ne serait pas possible sans nos partenaires. Et cette année, nous sommes heureux d’avoir avec nous Tenable, qui est notre partenaire BANNIÈRE!
Pour en savoir plus sur la mission de cette compagnie, visiter leur site web : https://www.tenable.com/
—--
Our 4th edition of POLAR would not be possible without our sponsors. And this year, we are happy to have Tenable, a BANNER sponsor!
If you want to learn more about this company’s mission, visit their website https://www.tenable.com/
#CISO #infosec #polar #hf2026 #cybersecurity

PARTENAIRE POLAR 2026 SPONSOR : CYBERDEFENSE AI
La prochaine édition de POLAR ne serait pas possible sans nos partenaires. Et cette année, nous sommes heureux d’avoir avec nous Cyberdefense AI, qui est notre partenaire KIOSQUE!
Pour en savoir plus sur la mission de cette compagnie, visiter leur site web : https://cyberdefense.ai/
—--
Our 4th edition of POLAR would not be possible without our sponsors. And this year, we are happy to have Cyberdefense AI, a KIOSK sponsor!
If you want to learn more about this company’s mission, visit their website https://cyberdefense.ai/
#CISO #infosec #polar #hf2026 #cybersecurity

PARTENAIRE POLAR 2026 SPONSOR : ASTATE
La prochaine édition de POLAR ne serait pas possible sans nos partenaires. Et cette année, nous sommes heureux d’avoir avec nous Astate, qui est notre partenaire KIOSQUE!
Pour en savoir plus sur la mission de cette compagnie, visiter leur site web : https://astate.one/
—--
Our 4th edition of POLAR would not be possible without our sponsors. And this year, we are happy to have Astate, a KIOSK sponsor!
If you want to learn more about this company’s mission, visit their website https://astate.one/
#CISO #infosec #polar #hf2026 #cybersecurity

🔴 EXPLOITED

Siemens Software Center has a DLL hijacking flaw (CVE-2026-110936) being exploited now: attackers pair the real signed app with a malicious DLL, so Windows runs their code.

Signature allowlists wave it through.

Fix: update to V4.0.9.8 and sweep for the indicators.

https://suriq.io/blog/siemens-software-center-cve-2026-110936-dll-hijack

#CVE #Detection #CISAKEV #infosec