Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku.
Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl
jen odkazovat, třeba jako na starší kauzu.
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: This Security Alert addresses CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as PHP2Shell, allow for unauthenticated remote code execution in PHP. Oracle strongly recommends that customers apply the available security patches without delay. The Security Alert advisory will continue to be updated as additional product patches become…
A recent post by the BYOD gang appears to line up with a security incident that prompted campus-wide action at Michigan State University. BYOD drew attention in October for an attack on the University of New Mexico.
For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Binance, a global cryptocurrency exchange, has suffered a cyberattack resulting in the theft of approximately $6.3 billion in digital assets. Attackers reportedly compromised a DevOps engineer’s laptop and abused internal wallet infrastructure to authorize unauthorized withdrawals. The incident ranks among the largest cryptocurrency thefts ever…
Introduction As part of proactive threat monitoring, Kaspersky’s Cyber Threat Intelligence team identified a malicious campaign involving C2 agents controlled by artificial intelligence. Confirmed victims of the campaign included organizations in the education sector in several countries across Africa and Latin America. CyberStrikeAI played a key role in the post-exploitation phase. This is an open-source framework in which an LLM orchestrator on the command-and-control server plans actions,…
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.1, CVEs: CVE-2026-119553, CVE-2026-119554, CVE-2026-119555, CVE-2026-119556, Summary: CVE-2026-119553 (CVSS: 7.1): Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../…
The state’s Department of Education (FLDOE) said on Thursday it became aware of a data breach involving the Florida Student Financial Aid website on October 19.
Završio je ovogodišnji Hacknite, CTF natjecanje za srednjoškolce, a pobjedu je odnio tim 4, sastavljen od učenika Škole za dizajn, grafiku i održivu gradnju – Split, III. gimnazije, Split i zagrebačke XV. gimnazije. Tim je pobjedu ostvario uz mentorstvo Nikoline Smilović. Sedmo izdanje Hacknitea okupilo je 45 timova, odnosno ukupno 225 učenika i učenica. Natjecanje se održalo od 23. do 25. listopada 2026. godine. Natjecateljska ljestvica zaključana je 25. listopada u 20 sati, a nakon dodatnih…
In this article Stages of AI adoption by North Korean threat actors AI use across North Korean threat operations AI-assisted targeting and reconnaissance AI-assisted social engineering and identity deception AI-assisted software and tooling development AI-assisted operational scaling and analysis Mitigation and protection guidance Microsoft Defender detections As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed, efficiency, and…
Upozorňujeme na aktivně zneužívané zranitelnosti CVE-2026-88771 a CVE-2026-88772 v produktu Citrix Netscaler, které umožňují vzdálené spuštění kódu. Doporučujeme bezodkladně aktualizovat na verzi 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS nebo 13.1-37.279 a novější podle používané produktové řady. Dále doporučujeme prověřit indikátory kompromitace, jelikož aktualizace nemusí kompromitaci odstranit. Zranitelnosti Zranitelnost CVE-2026-88771 spočívá v nesprávném ověřování vstupů a umožňuje…
The University of New Mexico was able to restore systems used by its healthcare facilities after a cyberattack forced it to divert ambulances and cancel classes at its medical school.
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]
On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an investigation I conducted with Minh Giang and Lucas Miller of TrendAI Research. Although Oracle issued a patch under a single CVE, we reported three distinct vulnerabilities across multiple PeopleSoft components. We are coordinating with Oracle to assign separate CVEs…
AI is widening the attack surface of the critical infrastructure facilities and services that state, local, and education (SLED) organizations run. In the final post of our Cybersecurity Awareness Month series, we explain how a whole-of-state security approach can help SLED agencies protect their critical infrastructure. Key takeaways Because cyber attackers prey on under-resourced targets, they often go after SLED organizations, especially those that operate critical infrastructure, including…
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
A pro-Ukraine group that says it operates within Russia took responsibility for anti-Putin messages appearing on an education assessment platform. Authorities said they had restored systems.
Završilo je ovogodišnje izdanje europskog natjecanja iz kibernetičke sigurnosti European Cybersecurity Challenge (ECSC) 2026, koje je od 12. do 16. listopada održano u njemačkom Bochumu. Više od 400 mladih natjecatelja iz 42 zemlje odmjerilo je znanja i vještine u praktičnim izazovima iz različitih područja kibernetičke sigurnosti. ECSC okuplja nacionalne timove sastavljene od natjecatelja u dobi od 14 do 25 godina koji se za sudjelovanje kvalificiraju kroz nacionalne selekcijske programe i…
Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE). It has begun notifying students and families after an unauthorized party accessed and copied student information from an ETS-operated secure file transfer protocol (SFTP) site.…
Written by: Tyler McLellan Introduction Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst configuration tampering against AOMEI origin servers. Each tampering window remained active for only five to ten minutes before reverting to authentic versions. This is the first time that we have…
Rok za prijavu na ovogodišnje Hacknite natjecanje produljen je do srijede, 21. listopada 2026. godine. Mentori i srednjoškolci zainteresirani za kibernetičku sigurnost tako imaju još nekoliko dana za okupljanje timova i prijavu na sedmo izdanje Hacknitea – CTF (Capture the Flag) natjecanja za srednje škole. Hacknite je natjecanje namijenjeno srednjoškolskim timovima, a cilj mu je potaknuti razvoj znanja i vještina u području kibernetičke sigurnosti te podići svijest o važnosti primjene…
U njemačkom Bochumu počelo je ovogodišnje izdanje European Cybersecurity Challengea (ECSC), jednog od najvažnijih europskih natjecanja za mlade talente u području kibernetičke sigurnosti. Natjecanje se održava od 12. do 16. listopada 2026. godine, a okuplja više od 400 natjecatelja iz 42 zemlje. CARNET-ov Nacionalni CERT i ove je godine odabrao te vodi Team Croatia, nacionalni tim mladih stručnjaka i entuzijasta iz područja kibernetičke sigurnosti. Na ECSC-u mogu sudjelovati natjecatelji u dobi…
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]
Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. The phishing emails exhibited highly consistent structure, rhetoric, and personalization patterns, suggesting the threat actor likely used AI-assisted content generation to rapidly customize invitation lures…
Most industries manage one major compliance framework. Universities might manage four simultaneously, each bringing with it unique requirements, enforcement mechanisms, and consequences for failure. Here's what that actually looks like in practice. In Part 1 of this series, we laid out the scale of the threat facing higher education: 4,388 cyberattacks per organization per week, a 24% year-over-year increase, and the fundamental architectural flaw of defending each campus independently. If the…
Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems unavailable.
A ransomware attack that affected the University of Illinois Chicago (UIC) College of Medicine resulted in the theft of some information from its servers.
The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. [...]
Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. [...]
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]
An Iranian national accused by the U.S. of taking part in dozens of breaches involving the theft of academic data and intellectual property has been extradited from Montenegro.
Higher education faces a difficult security equation. Universities hold large volumes of sensitive student, financial, health, and research data while supporting open networks, distributed users, legacy infrastructure, and increasingly complex cloud environments. Attackers have taken notice, and the pressure on security teams continues to grow.In Q2 2025, universities faced an average of 4,388 cyberattacks per organization per week, up 24% from the same period in 2024. Nine in ten universities…
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts. Talos first observed UAT-11587 activity in September 2025. By July 2026, Talos had identified at least 16 affected or targeted institutional environments across eight Asian countries. Antino is a Rust-compiled Windows…
In this article Observed operators and targetingMalware packaging and distributionNeedyMantis architecture and capabilitiesMitigation and protection guidanceHunting queriesIndicators of compromise Microsoft Threat Intelligence has identified NeedyMantis, a modular post-compromise malware family observed in a limited number of targeted operations affecting telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Based on…
Ranjivost dobije ocjenu 9,8 od 10. Zvuči ozbiljno, ali što ta ocjena zapravo govori i što sljedeće učiniti? Brojevi imaju snažan utjecaj na način na koji donosimo odluke. Kritična ranjivost može nas natjerati na hitno djelovanje, dok se ona s niskom ocjenom može ostaviti za sljedeći termin održavanja. Međutim, sama ocjena ne govori nužno koja je ranjivost najvažnija za određeno okruženje. Zato je potrebno uzeti u obzir i druge pokazatelje, poput vjerojatnosti iskorištavanja, procjena…
In this article Who is Storm-2570?Storm-2570 attack chain: From initial foothold to impactWhat Storm-2570 activity means for defendersMitigation and protection guidanceMicrosoft Defender detectionsHunting queries Activity associated with Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, illustrates how tracking and responding to ransomware attacks by payload alone can obscure the affiliates carrying out intrusions and the recurring behaviors that defenders can use to…
Rilevate due nuove vulnerabilità in Moodle, nota piattaforma open source tipicamente utilizzata per l'erogazione di corsi in modalità e-learning. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato l'accesso ad informazioni sensibili e eludere le funzionalità di sicurezza sui sistemi interessati.
In this article What is device code phishing?EvilTokens platform and operationsEvilTokens phishing emailsMitigation and protection guidanceMicrosoft Defender XDR detectionsHunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most widely used phishing-as-a-service (PhaaS) platforms, providing cybercriminals with AI capabilities for tailoring phishing lures and analyzing compromised inboxes to identify high-value targets. This AI-powered cybercrime…
Rilevate quattro vulnerabilità, di cui due con gravità “alta”, in Design Scuole Italia, noto tema WordPress destinato alla realizzazione dei siti istituzionali delle scuole italiane. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di leggere file arbitrari sul filesystem, eludere i meccanismi di autenticazione ed accedere a informazioni sensibili sui sistemi interessati
Online maths learning platform Mathspace disclosed over the weekend that attackers stole data from more than 1 million students, staff, and parents after breaching its Metabase internal reporting system. [...]
Research by: Amit Yardeni Key Points A Chinese-speaking actor is now targeting Brazil. Check Point Research has uncovered a sustained campaign against Brazilian organizations, primarily government and educational institutions since mid-2025. We dubbed this group Gambling Goblin: a Chinese-speaking cybercrime cluster connected to a previously documented group, Earth Berberoka, that targeted gambling sites across Asia. It marks a shift from Brazil’s usual home-grown banking-trojan threats to a…
Koliko god se pridržavali svih sigurnosnih preporuka, ponekad se dogodi da nešto ipak pođe po krivu, bilo da je riječ o sumnjivoj poruci na koju smo kliknuli, kompromitiranom računu ili neugodnom iskustvu s nekim na internetu. Uz sve savjete o prevenciji, jednako je važno znati i kako reagirati ako se dogodi problem. U nastavku donosimo pregled nekoliko čestih situacija i osnovne korake koje možete poduzeti sami, bez obzira radi li se o vašem uređaju, računu ili neugodnom iskustvu na mreži. Ako…
In this article Attack chain overviewCampaign scope and targetingMitigation and protection guidanceReferencesLearn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribute malicious installers. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of…
Otvorene su prijave na 7. izdanje Hacknite – CTF natjecanja za srednje škole! Ovogodišnje natjecanje donosi nova pravila vezana uz prijavu i korištenje tehnologija umjetne inteligencije. Prilikom prijave timova u obrazac je potrebno upisati @skole.hr adrese prijavitelja i natjecatelja! Tijekom natjecanja je ograničeno korištenje AI alata, a detaljnu uputu što se smije, a što ne pronaći ćete u Pravilima na dnu stranice. Natjecanje u obliku CTF-a (Capture the Flag) namijenjeno je srednjoškolskim…
Svaki put kada pristupimo internetu (pretražujemo, komuniciramo, plaćamo online, objavljujemo fotografije ili se prijavljujemo u neku aplikaciju) ostavljamo za sobom trag podataka. Taj trag naziva se digitalni trag i on nas prati mnogo dulje nego što bismo možda željeli. Povratak u školske klupe dobar je trenutak da se podsjetimo kako svjesno upravljati onim što o nama govori internet. Što je digitalni trag i zašto je važan Digitalni trag čini skup svih podataka koje ostavljamo svojim…
Overview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the time of writing, the vulnerability has not been assigned a CVE identifier, and PaperCut has not publicly disclosed a CVSS score, vulnerability class, authentication requirements, or the technical details…
Početak školske godine znači povratak svakodnevnom korištenju laptopa, tableta i mobitela za učenje, komunikaciju i zabavu. Povećano korištenje digitalnih uređaja i online usluga sa sobom donosi i veći broj prilika za kibernetičke prijetnje, zbog čega je važno obratiti pozornost na osnovne sigurnosne navike. U nastavku donosimo nekoliko jednostavnih koraka za zaštitu koji mogu značajno smanjiti rizik od kibernetičkog napada. Redovito ažurirajte svoje uređaje i aplikacije. Omogućite automatsko…
A two-year investigation into educational technology (EdTech) apps used by Utah schools found that many were collecting and sharing student data in ways that appeared inconsistent with their privacy commitments. EdTech is a massive commercial industry and some argue that it functions much like traditional big tech by prioritizing profits, scalable software, and user data collection over proven learning outcomes. The project, published by the Utah State Board of Education in partnership with…
Internet je veliko mjesto gdje gotovo svatko može stvarati i dijeliti sadržaj. Zato je važno obratiti pozornost i razmisliti o sadržaju s kojim se susrećete. Prije nego što nešto kliknete, podijelite ili povjerujete, zastanite i razmislite tko je objavio sadržaj i zašto te je li istinit ili je osmišljen da vas navede na krivi trag. Najčešći oblici prijevara na internetu s kojima se možete susresti S početkom školske godine mogu se očekivati prijevare kao što su phishing poruke s navodnim važnim…
S početkom školske godine dolaze nova prijateljstva, novi predmeti, ali i novi korisnički računi i uređaji. Prije nego što vam školske obveze preuzmu svu pažnju, sada je prilika da se pobrinete za sigurnost svojih računa, uređaja i podataka. Za početak je potrebno usvojiti osnovna pravila kibernetičke higijene pomoću kojih možete spriječiti situacije kao što su neovlašteni pristup vašim računima i uređajima, gubitak podataka, razne ucjene te krađa novca. 1/ Koristite snažne i jedinstvene…
Written by: Gabby Roncone, Wesley Shields Overview Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States. Examples of these techniques can be found in our previous blog on UNC6293’s phishing operations. We now track an…
The Justice Department accused 17 alleged hackers with ties to the Iranian government of breaching email accounts at U.S. government agencies and stealing intellectual property from dozens of universities.
The University of Texas at San Antonio, which serves 40,000 students across six campuses, said its IT team identified threat activity on its academic campus over the weekend and took some systems, including phones, offline in response.
In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the most interesting part of this campaign isn’t the initial infection method – it’s the malicious implants the attackers use for cyber…
Microsoft’s August 2026 Patch Tuesday addresses 421 Microsoft vulnerabilities, including 62 rated Critical. One Windows vulnerability has been exploited in the wild by the Lazarus group to gain SYSTEM privileges. The August update is smaller than July’s record-breaking release, but it’s still among Microsoft’s largest Patch Tuesday batches. More importantly, it includes several flaws likely to attract attacker interest: a publicly disclosed Windows privilege escalation flaw with a proof-of…
Introduction Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information (PII) that is often insecure or insufficiently tested against known vulnerabilities. In addition, machines used by multiple people without accountability can be vulnerable to insider threats. The…