VIRY.CZ RADAR je monitor bezpečnostních hrozeb: advisories, zranitelnosti
a threat intel z 65 veřejných zdrojů
z 25 zemí, česky a na jednom místě.
V archivu máme 10 471 položek.
Více informací
Jsem „protkán“ AI. Snažím se pochopit zdrojové texty a bez vymýšlení je
zestručnit a převést do českého jazyka, případně s využitím AI seskupit.
Patřičně jsem pak hrdý na
týdenní reporty, kde s pomocí AI zpracovávám
stovky článků a hledám v nich souvislosti. Používám ale i čistou matematiku,
takže pokud například více zdrojů mluví o shodné CVE chybě, seskupím to do
jednoho příspěvku.
Doporučuji se přihlásit k jejich odběru.
Pokud se Vám líbím, nebráním se
finanční podpoře :-)
Původní „Igiho stránka o virech“ se odstěhovala sem.
Všechny zprávy za posledních 7 dní
K seskupování zpráv do jedné události používám AI 3x denně nebo logiku kolem shodného výčtu CVE (okamžitě). Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku.
Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl
jen odkazovat, třeba jako na starší kauzu.
304 záznamů z 372 položek
· strana 1 z 6
CZ ·
EN/orig
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.7, CVEs: CVE-2026-114408, CVE-2026-115654, CVE-2026-115653, Summary: CVE-2026-114408 (CVSS: 8.7): _nx_icmpv6_process_packet_too_big adds the destination quoted in an ICMPv6 Packet Too Big message to the destination table, then reads the entry the add returns without checking that the add succeeded. When the table is full, the add fails and returns a NULL entry, and the function dereferences it. A sender…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.3, CVEs: CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-104080, CVE-2026-77876, CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, Summary: CVE-2026-77877 (CVSS: 8.6): Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting…
The NCSC warns that ‘tech on the cheap’ has left UK organisations exposed to AI uncovering and exploiting longstanding cyber security weaknesses and calls for urgent investment in resilience.
Unit 42 details recent threat intelligence, highlighting cyberespionage, financial extortion, and the rapid adoption of AI across offensive workflows. The post Unit 42 Threat Intelligence Highlights - Nov. 2, 2026 appeared first on Unit 42.
In this article Classifying the vulnerability landscape Vulnerabilities exploited in the wild Where defenders should focus Patching is slow, while exploitation is fast Impact, exposure and where to focus Next in line How Microsoft Security helps defenders act References Learn More The vulnerability landscape continues to expand. From 1999 through September 2026, approximately 383,000 software vulnerabilities had been disclosed across platforms and technologies, yet only about 2,000 CVEs …
A recent post by the BYOD gang appears to line up with a security incident that prompted campus-wide action at Michigan State University. BYOD drew attention in October for an attack on the University of New Mexico.
Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment. [...]
Serial Number: AV26-1113 Date: November 2, 2026 As of November 2, 2026, SUSE is affected by a vulnerability in the following product: Rancher Prior to 2.11.19 Prior to 2.12.15 Prior to 2.13.11 Prior to 2.14.7 Prior to 2.15.3 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Rancher meta proxy allowlist bypass leading to server-side request forgery SUSE Update Advisories
An alliance of Belarusian and pro-Ukrainian hackers claimed to have taken out Russia's federal statistics agency, Rosstat, and stolen vast amounts of sensitive government data in a cyberattack.
Serial Number: AV26-1112 Date: November 2, 2026 As of November 2, 2026, Barracuda Networks is affected by a vulnerability in the following products: Barracuda Email Security Gateway (ESG) Prior to 9.4.0.030 Barracuda Load Balancer Application Delivery Controller (ADC) Prior to 6.4.0 Barracuda Web Application Firewall (WAF) Prior to 11.0.1 Barracuda Web Security Gateway (WSG) Prior to 16.1.100.100 Barracuda Message Archiver (BMA) Prior to 5.5.4.0 Barracuda WAF Control Center (WCC) Prior to 2.2.1…
For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Binance, a global cryptocurrency exchange, has suffered a cyberattack resulting in the theft of approximately $6.3 billion in digital assets. Attackers reportedly compromised a DevOps engineer’s laptop and abused internal wallet infrastructure to authorize unauthorized withdrawals. The incident ranks among the largest cryptocurrency thefts ever…
Rilevate alcune vulnerabilità, di cui 4 con gravità "alta", in SQLite, libreria open source per la gestione di basi di dati relazionali incorporata in numerose applicazioni. Tali vulnerabilità potrebbero consentire a un attaccante di iniettare comandi di sistema, alterare la memoria dei processi interessati e compromettere la disponibilità del servizio sui sistemi coinvolti.
The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining "hot wallets" on instances running older versions. [...]
Mobile carriers can retain years of call and text metadata, exposing sensitive details about customers' relationships, locations, and daily routines if breached. Cape examines the privacy risks of long-term telecom data retention and how its mobile service reduces exposure by automatically deleting call records. [...]
Apple does not attribute attacks or the notices to specific malicious actors or geographical regions, the notification said, due to the “extreme cost, sophistication, and worldwide nature of mercenary spyware attacks [which] make them some of the most advanced digital threats in existence today.”
Serial number: AV26-1111 Date: November 2, 2026 As of October 30, 2026, Red Hat is affected by vulnerabilities in the following products: Red Hat Build of Keycloak All version Red Hat Enterprise Linux 10 All version Red Hat Enterprise Linux 6 All version Red Hat Enterprise Linux 7 All version Red Hat Enterprise Linux 8 All version Red Hat Enterprise Linux 9 All version Red Hat Fuse 7 All version Red Hat Hardened Images All version Red Hat JBoss Enterprise Application Platform 7 All version Red…
Recently, our team exposed sophisticated scam kits designed to steal sensitive data and trick consumers. But underground marketplaces are not just for malware and stolen passwords. They also offer services designed to manipulate your opinion of the products and services you buy every day. In our latest research, we examined cybercrime forums where sellers advertise illicit “reputation management” services. For the right price, these underground operators offer to flood a product with glowing,…
Serial number: AV26-1110 Date: November 2, 2026 As of October 30, 2026, Dell is affected by vulnerabilities in the following products: OpenManage Enterprise Prior to 4.8.0 PowerProtect Data Domain Prior to 7.13.1.90 Prior to 8.3.1.50 Prior to 8.6.1.30 Prior to 8.9.0.0 PowerProtect Data Domain Management Center Prior to 7.13.1.90 Prior to 8.3.1.50 Prior to 8.6.1.30 Prior to 8.9.0.0 PowerProtect Data Domain Virtual Edition Prior to 7.13.1.90 Prior to 8.3.1.50 Prior to 8.6.1.30 Prior to 8.9.0.0…
Applebee’s has fixed a security flaw that exposed customers’ personal information after a researcher discovered a database password embedded in the restaurant chain’s Android app. The researcher, Robert Wiggins, found the password with help from AI. It gave him access to an internal Applebee’s customer database. A password written directly into an app’s code or configuration is known as a hardcoded credential. Anyone who extracts it may be able to use it to access the system. The exposed…
Serial number: AV26-1109 Date: November 2, 2026 As of October 29, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 156.0.8078.79/.80 (Windows/Mac), and 156.0.8078.79 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Google Chrome Security Advisory
Written by: Christopher Romano, Codi Starks, Garrett Mahoney, John Wolfram, Josh Murchie, K Singh, Mathew Potaczek, Mike Lombardi, Rik Dolfing Introduction Mandiant responded to multiple incidents in 2026 in which threat actors hijacked enterprise access to Large Language Models (LLMs), a tactic known as "LLMJacking." Spanning a variety of cloud and LLM providers, these intrusions impacted organizations in North America, South America, and Asia Pacific across the financial services, retail,…
FortiGuard Labs examines a BITTER cyberespionage campaign targeting South Asian organizations through three attack chains and the PapRAT remote access trojan
Google and industry partners have dismantled the XCPE malware botnet consisting of more than 1.3 million Android TV streaming TV boxes that Google says its manufacturer intentionally infected with malware to generate revenue through cybercrime activities. [...]
Supermarket and grocery store refrigerators across Europe appear to have been hacked early Monday — the second such incident in recent weeks where attackers have manipulated temperature controls and caused stock to spoil.
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. [...]
Rilevate quattro vulnerabilità di sicurezza, di cui 2 con gravità “alta”, in Chamilo LMS, sistema di e-learning e gestione dei contenuti. Tali vulnerabilità potrebbero consentire a un attaccante remoto, in determinate condizioni, di eseguire codice arbitrario o di compromettere un account esistente, anche amministrativo.
Aggiornamenti di sicurezza sanano tre vulnerabilità con gravità “alta” che interessano i prodotti ManageEngine SharePoint Manager Plus, soluzione per la gestione e il monitoraggio degli ambienti SharePoint, nonché ManageEngine Password Manager Pro e PAM360, piattaforme per la gestione di credenziali, account privilegiati e accessi amministrativi.
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. [...]
Canonical heeft een kwetsbaarheid verholpen in LXD. De kwetsbaarheid (CVE-2026-112816) wordt veroorzaakt door onjuiste validatie van certificaatketens binnen de HTTPS API van Canonical LXD. De kwetsbaarheid treft LXD-versies vóór 4.0.15, 5.0.11, 5.21.9 en 6.10.1 binnen de betreffende releasebranches. Hierdoor kunnen niet-geauthenticeerde aanvallers die netwerktoegang hebben tot de HTTPS API en beschikken over het publieke certificaat van een vertrouwde client, zich voordoen als die client. Dit…
Introduction As part of proactive threat monitoring, Kaspersky’s Cyber Threat Intelligence team identified a malicious campaign involving C2 agents controlled by artificial intelligence. Confirmed victims of the campaign included organizations in the education sector in several countries across Africa and Latin America. CyberStrikeAI played a key role in the post-exploitation phase. This is an open-source framework in which an LLM orchestrator on the command-and-control server plans actions,…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
De multiples vulnérabilités ont été découvertes dans Tenable Identity Exposure. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans Redmine. Certaines d'entre elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS), un contournement de la politique de sécurité et un déni de service.
Recently, I had to extract embedded files from a set of OneNote files (extension .one). My onedump.py tool can extract individual files, so I would have to run this many times. To avoid this, I added a new feature to my onedump.py tool: producing JSON data. Several of my tools already have such a feature: they produce JSON data with the content of their analysis results. onedump's option --jsonoutput produces JSON output with the content of each embedded file found inside the OneNote file. And…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-118636, Summary: JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5, CVEs: CVE-2026-120194, Summary: A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. [...]
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. [...]
Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a "logged-in service," offering limited access to visitors without accounts. [...]
Blockchain analytics firm Chainalysis disclosed a data breach after attackers used "offensive agentic techniques" to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. [...]
VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value. If a model refuses to perform the target assessment, VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails. This stealer is self-deleting, and there is no attacker-owned infrastructure. The…
Wireshark Release Candidate 5.0.0 was published: soon we can expect a new major version of Wireshark. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
YARA-X's 1.22.1 is a bugfix version, it brings 2 bugfixes. Notice that there was also a release of YARA: 4.6.0, and that this release does not include the YARA-X improvement that adds built-in functions to read 64-bit integers: int64, int64be, uint64, and uint64be. This shows that YARA-X has replaced YARA. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.