VIRY.CZ RADAR je monitor bezpečnostních hrozeb: advisories, zranitelnosti a threat intel z 65 veřejných zdrojů z 25 zemí, česky a na jednom místě. V archivu máme 10 471 položek.
Jsem „protkán“ AI. Snažím se pochopit zdrojové texty a bez vymýšlení je zestručnit a převést do českého jazyka, případně s využitím AI seskupit. Patřičně jsem pak hrdý na týdenní reporty, kde s pomocí AI zpracovávám stovky článků a hledám v nich souvislosti. Používám ale i čistou matematiku, takže pokud například více zdrojů mluví o shodné CVE chybě, seskupím to do jednoho příspěvku. Doporučuji se přihlásit k jejich odběru. Pokud se Vám líbím, nebráním se finanční podpoře :-)
Původní „Igiho stránka o virech“ se odstěhovala sem.
Blockchain analytics firm Chainalysis disclosed a data breach after attackers used "offensive agentic techniques" to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. [...]
Chainalysis US
VOLTA is a mature stealer implant with an optional AI-integration layer. After stealing credentials, sessions, and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim’s assets by monetization value. If a model refuses to perform the target assessment, VOLTA fails over to a three-model chain, implying a direct engineering effort and expectation of hitting model guardrails. This stealer is self-deleting, and there is no attacker-owned infrastructure. The…
Wireshark Release Candidate 5.0.0 was published: soon we can expect a new major version of Wireshark. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Wireshark US
YARA-X's 1.22.1 is a bugfix version, it brings 2 bugfixes. Notice that there was also a release of YARA: 4.6.0, and that this release does not include the YARA-X improvement that adds built-in functions to read 64-bit integers: int64, int64be, uint64, and uint64be. This shows that YARA-X has replaced YARA. Didier Stevens Senior handler blog.DidierStevens.com (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
US
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-108270, CVE-2026-108279, CVE-2026-108278, CVE-2026-108275, CVE-2026-108353, CVE-2026-108341, CVE-2026-108363, CVE-2026-108364, CVE-2026-108271, CVE-2026-108272, CVE-2026-108273, CVE-2026-108276, CVE-2026-108277, CVE-2026-108280, CVE-2026-108345, CVE-2026-108347, CVE-2026-108365, CVE-2026-108371, CVE-2026-108343, CVE-2026-108344 (+12 other associated CVEs), Summary: RT 5.0.11 is now…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.4, CVEs: CVE-2026-103093, CVE-2026-103094, CVE-2026-6877, Summary: CVE-2026-103093 (CVSS: 9.4): ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling…
EPSS 0.00 CVSS 9.4 CVE-2026-103093 CVE-2026-103094 CVE-2026-6877 ServiceNow FI
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2025-31704, Summary: A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.
EPSS 0.01 CVSS 9.8 CVE-2025-31704 Dahua FI
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.1, CVEs: CVE-2026-119553, CVE-2026-119554, CVE-2026-119555, CVE-2026-119556, Summary: CVE-2026-119553 (CVSS: 7.1): Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../…
EPSS 0.00 CVSS 7.1 CVE-2026-119553 CVE-2026-119554 CVE-2026-119555 CVE-2026-119556 Moodle školství FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 8.7, CVEs: CVE-2026-119408, Summary: CVE-2026-119408 (CVSS: 8.7): The Function and Function Item nodes run user code in the vm2 sandbox, and the LangChain Code node runs user code in the n8n main process. An authenticated user with permission to create or modify workflows could use these nodes to execute arbitrary code in the n8n main process, outside the task runner isolation that applies to the Code node.
EPSS 0.01 CVSS 8.7 CVE-2026-119408 n8n FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.5, CVEs: CVE-2026-119371, CVE-2026-119372, CVE-2026-119373, CVE-2026-119374, CVE-2026-119375, CVE-2026-119376, CVE-2026-119377, CVE-2026-119378, CVE-2026-119379, Summary: CVE-2026-119371 (CVSS: 6.8): SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers…
EPSS 0.00 CVSS 8.5 CVE-2026-119371 CVE-2026-119372 CVE-2026-119373 CVE-2026-119374 CVE-2026-119375 CVE-2026-119376 CVE-2026-119377 CVE-2026-119378 CVE-2026-119379 SQLite FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2026-91913, CVE-2026-111505, CVE-2026-94349, CVE-2026-91917, CVE-2026-101213, CVE-2026-91912, CVE-2026-111504, CVE-2026-101210, CVE-2026-101214, CVE-2026-91914, CVE-2026-111503, CVE-2026-91907, CVE-2026-91915, CVE-2026-91905, CVE-2026-91903, CVE-2026-91911, CVE-2026-91908, CVE-2026-91910, CVE-2026-91904, CVE-2026-91906 (+7 other associated CVEs), Summary: Dell OpenManage Enterprise…
CVSS 8.8 Dell FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-119528, Summary: A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
EPSS 0.00 CVSS 7.8 CVE-2026-119528 Red Hat GIMP FI
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.5, CVEs: CVE-2026-119718, CVE-2026-119719, CVE-2026-119720, CVE-2026-119721, CVE-2026-119722, Summary: CVE-2026-119718 (CVSS: 8.5): Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to…
EPSS 0.00 CVSS 8.5 CVE-2026-119718 CVE-2026-119719 CVE-2026-119720 CVE-2026-119721 CVE-2026-119722 Blender FI
Abdel Sghiouar, Google engineer and senior cloud developer advocate, thinks prompt injection should be called prompt poisoning Category: Guides & Best Practices
BE
The company, billing itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” said a recent hack exposed customer payment card numbers.
In this article Activity overview Attack chain overview Portable runtime staging and execution variants Host discovery and AD CS assessment Case 1: ESC1 abuse and the cost of an identity exclusion Case 2: PetitPotam and ESC8 turn a workstation into a domain-controller identity Why the response outcomes differed Actionable investigation methods References Learn More Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors used Microsoft Teams messages and…
Microsoft US
Aggiornamenti di sicurezza Progress risolvono molteplici vulnerabilità, di cui 6 con gravità “critica” e 3 con gravità “alta”, presenti in WS_FTP Server, soluzione software di file transfer sicuro utilizzata per trasferire, condividere e gestire file all'interno di organizzazioni e tra partner esterni.
EPSS 0.01 CVE-2026-84294 CVE-2026-84295 CVE-2026-90863 CVE-2026-90864 CVE-2026-90865 CVE-2026-90866 CVE-2026-90867 CVE-2026-90868 CVE-2026-90869 Progress IT
Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. [...]
Trezor US
The state’s Department of Education (FLDOE) said on Thursday it became aware of a data breach involving the Florida Student Financial Aid website on October 19.
Serial Number: AV26-1107 Date: October 30, 2026 As of October 28, 2026, MongoDB is affected by vulnerabilities in the following product: Laravel MongoDB Prior to 5.12.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Test Laravel HasOneThrough/HasManyThrough relations MongoDB Alerts
Serial Number: AV26-1106 Date: October 30, 2026 As of October 29, 2026, HashiCorp is affected by vulnerabilities in the following products: Nomad Prior to 2.1.0 Nomad Enterprise Prior to 2.1.0 Prior to 1.11.12 Prior to 1.10.18 Boundary Prior to 1.0.2 Boundary Enterprise Prior to 1.0.2 and 0.21.6 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. HCSEC-2026-52 - Nomad dispatch payload writes can escape…
HashiCorp CA
Tenable ha rilasciato aggiornamenti di sicurezza per risolvere 3 vulnerabilità, di cui una con gravità "critica", in Tenable Identity Exposure, piattaforma dedicata al rilevamento e alla gestione delle esposizioni negli ambienti Microsoft Active Directory. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente autenticato con privilegi limitati di eseguire codice arbitrario con privilegi elevati sul controller di dominio interessato.
Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators. Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed their searches through servers controlled by the operators before sending them to Yahoo or Bing. This gave the operators…
Google US
The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans
SK
Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening and security hygiene, rather than a single vulnerability or CVE. Manually validating advisory recommendations across enterprise networks is difficult, time-consuming, and prone to inconsistencies. Qualys Policy Audit transforms advisory guidance into automated configuration compliance checks,…
Cisco US
Ahmad Umar Agha, known online as “Th3Pr0,” was sentenced Thursday in federal court in Virginia to 42 months behind bars for his role in a conspiracy that was organized by former Syrian President Bashar al-Assad's closest advisers.
US
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 21 nuove vulnerabilità di sicurezza, di cui una con gravità “critica” e 19 con gravità “alta”. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un attaccante remoto di accedere a informazioni sensibili, compromettere la disponibilità del servizio, eludere i meccanismi di sicurezze ed eseguire codice arbitrario sui sistemi interessati.
EPSS 0.00 a dalších 3 CVE-2026-119263 CVE-2026-119264 CVE-2026-119265 CVE-2026-119266 CVE-2026-119267 CVE-2026-119268 CVE-2026-119269 CVE-2026-119270 CVE-2026-119271 CVE-2026-76024 CVE-2026-76025 CVE-2026-76026 CVE-2026-76027 CVE-2026-76028 CVE-2026-76029 CVE-2026-76030 CVE-2026-76031 Google IT
Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. [...]
Une vulnérabilité a été découverte dans Microsoft Visual Studio. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
EPSS 0.01 CVSS 7.4 CVE-2026-118147 Microsoft FR FI US
During its own research, CERT Polska has found 3 XSS vulnerabilities (from CVE-2026-105454 to CVE-2026-105456) in Request Tracker (RT) and RT for Incident Response software (RTIR).
EPSS 0.00 CVE-2026-105454 CVE-2026-105456 PL
Aggiornamenti di sicurezza risolvono tre vulnerabilità, di cui una con gravità "critica" e una con gravità "alta", in ServiceNow AI Platform, piattaforma di intelligenza artificiale e automazione di ServiceNow. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato autenticato di accedere ad informazioni sensibili e, in determinate condizioni, di eludere i meccanismi di isolamento della piattaforma ed eseguire codice arbitrario sul sistema host sottostante.
EPSS 0.00 CVE-2026-103093 CVE-2026-103094 ServiceNow IT
As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice. Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.” Here’s what those checks would involve: Photo ID matching: Comparing a live image of you with the…
The previously unknown malware, dubbed NetamLoader, uses legitimate Microsoft software components to execute malicious code, evade security tools and download additional programs onto infected computers.
Linux heeft kwetsbaarheden verholpen in de IPv4 TCP stack en het IPv4 networking subsystem van de Linux kernel. De eerste kwetsbaarheid betreft een race condition in de IPv4 TCP stack die leidt tot een use-after-free van socketopties tijdens gelijktijdige TCP SYN retransmissies of request socket migraties. Dit kan resulteren in systeeminstabiliteit of geheugenbeschadiging. De oorzaak is het voortijdig vrijgeven van inet_opt en ireq_opt structuren. De tweede kwetsbaarheid betreft een onjuiste…
Linux NL
Završio je ovogodišnji Hacknite, CTF natjecanje za srednjoškolce, a pobjedu je odnio tim 4, sastavljen od učenika Škole za dizajn, grafiku i održivu gradnju – Split, III. gimnazije, Split i zagrebačke XV. gimnazije. Tim je pobjedu ostvario uz mentorstvo Nikoline Smilović. Sedmo izdanje Hacknitea okupilo je 45 timova, odnosno ukupno 225 učenika i učenica. Natjecanje se održalo od 23. do 25. listopada 2026. godine. Natjecateljska ljestvica zaključana je 25. listopada u 20 sati, a nakon dodatnih…
školství HR
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-110970 to CVE-2026-110972) found in Płatnik software.
EPSS 0.00 CVE-2026-110970 CVE-2026-110972 Płatnik PL
.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{flex-direction:column;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482644_f2c16d-bc > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.38);}.kadence…
Progress ha rilasciato aggiornamenti di sicurezza per sanare 6 vulnerabilità con gravità “alta” nel prodotto Telerik Document Processing Libraries. Tali vulnerabilità potrebbero consentire a un attaccante remoto, in alcuni casi non autenticato, di compromettere la disponibilità del servizio, eludere i meccanismi di sicurezza e leggere o scrivere file arbitrari sui sistemi interessati.
EPSS 0.00 CVE-2026-118035 CVE-2026-118036 CVE-2026-118037 CVE-2026-118038 CVE-2026-118039 CVE-2026-118040 Progress IT
Poryadok, which operates 48 stores across 32 Russian cities, first reported technical problems on Sunday, saying its website, mobile app and physical stores were temporarily unavailable.
obchod US
CERT Polska has received a report about 5 vulnerabilities (from CVE-2025-68391 to CVE-2025-68395) found in ARKETEAM Protectel software.
EPSS 0.00 CVE-2025-68391 CVE-2025-68395 ARKETEAM PL
I veckans brev kan du läsa om att den norska nationella säkerhetsmyndigheten (NSM) höjer den nationella cyberrisknivån till hög. Du hittar även information om att sårbarheterna i PHP har lagts till i CISA:s KEV-katalog.
PHP SE
A modern organization protects its information systems with a whole suite of technologies that generate thousands of security alerts every day. Looking at these alerts in bulk, you’ll see that a significant share are false positives. Ideally, these alerts would be filtered out automatically so that analysts could focus on the ones that may point to a real incident. However, writing filters is a time-consuming task in itself. To create a correct filter, an analyst needs to: Review the logs…
RU
Dell heeft meerdere kritieke kwetsbaarheden verholpen in PowerProtect Data Domain, Data Domain Virtual Edition en Data Domain Management Center. De kritieke wetsbaarheden met kenmerk CVE-2026-103780, CVE-2026-86384, CVE-2026-86397 en CVE-2026-86400 in Dell PowerProtect Data Domain, hebben een CVSS-score van 9.8. Een niet-geauthenticeerde kwaadwillende kan deze kwetsbaarheden op afstand misbruiken om willekeurige opdrachten uit te voeren, inloggegevens te verkrijgen of accounts met verhoogde…
EPSS 0.01 CVE-2026-103780 CVE-2026-103792 CVE-2026-103799 CVE-2026-86384 CVE-2026-86397 CVE-2026-86400 CVE-2026-90717 Dell NL
Display of information in the Forocoches comments editor Fri, 10/30/2026 - 09:49 Aviso Affected Resources Comment editor. Description INCIBE has coordinated the disclosure of a high-severity vulnerability affecting the Forocoches comment editor, a component used to create and edit comments in discussion threads. The vulnerability was discovered by Miguel Jiménez. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type: CVE-2026-14467…
EPSS 0.00 CVSS 8.2 CVE-2026-14467 Forocoches ES
Deepfake fraud kits sell for $5. Learn how it reaches enterprises, real cases Group-IB investigated, and why detection alone can’t stop it.
SG
CrowdStrike US
US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-98432, Summary: A use-after-free vulnerability was found in the Linux kernel's IPv4 networking subsystem. A remote, unauthenticated attacker could exploit a race condition during TCP connection request processing to trigger remote code execution. The flaw arises when socket options are freed while still being accessed by a concurrent operation, such as a retransmitted connection…
EPSS 0.00 CVSS 9.8 CVE-2026-98432 Linux Red Hat Ubuntu Debian Amazon FI US BE CA CZ SK
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: None, CVEs: , Summary: A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29. Combined with an…
Telegram FI
php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the exception: one tuned exploit can reach every device that runs it. Key takeaways The five vulnerable PHP sites we exposed to the internet were not compromised, and public proofs-of-concept (PoCs) that go beyond version checks do not reliably confirm whether a host is…
KEV ✓ · ransomware EPSS 1.00 CVSS 9.2 CVE-2021-44228 CVE-2026-109618 CVE-2026-109619 CVE-2026-46300 PHP Palo Alto Networks US
CISA added CVE-2026-111357 to the Known Exploited Vulnerabilities catalog. Affected product: Ivanti Connect Secure. Remediation due date: 2026-11-02.
KEV ✓ EPSS 0.01 CVE-2026-111357 Ivanti US
CISA added CVE-2026-118527 to the Known Exploited Vulnerabilities catalog. Affected product: Ivanti Connect Secure. Remediation due date: 2026-11-13.
KEV ✓ CVE-2026-118527 Ivanti US
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
IBM FR
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, un contournement de la politique de sécurité et un déni de service.
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Red Hat FR
De multiples vulnérabilités ont été découvertes dans les produits MongoDB. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, une injection SQL (SQLi) et un contournement de la politique de sécurité.
EPSS 0.00 CVE-2026-116641 CVE-2026-118510 CVE-2026-118581 MongoDB FR
De multiples vulnérabilités ont été découvertes dans Suricata. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Suricata FR
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]
EPSS 0.00 CVE-2026-111943 CVE-2026-111944 GitLab Microsoft eMudhra Splunk Qualys Sectigo curl Mozilla Google Apple FR US IT BE
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.3, CVEs: CVE-2026-107239, CVE-2026-107238, CVE-2023-22793, Summary: CVE-2026-107239 (CVSS: 8.8): A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service. CVE-2026-107238 (CVSS: 8.7): A vulnerability allowing an authenticated domain user to perform…
EPSS 0.01 CVSS 9.3 CVE-2023-22793 CVE-2026-107238 CVE-2026-107239 Veeam Microsoft FI IT FR