NebuSec says a Telegram Android call flaw was fixed in version 12.10.4. The attack chain and affected devices remain partly unverified.
The Latest
What We Know About Telegram’s Android Call Attack
AI Security This Week: Practical Steps For Firewall Flaws, Trojan Rentals, And Token Theft
A weekly security roundup covers Fortinet firewall fixes, rented Android banking malware, a malicious PDF, Authenticator tokens and patch priorities.
Why Attackers Target Cisco SD-WAN Edge Boxes For Access, Not Data
Cisco Talos says KeyDrift malware targeted SD-WAN controllers to collect network encryption keys after attackers exploited a critical flaw.
CVE-2026-97229: GitLab Community Edition And Enterprise Edition Integer Overflow Or Wraparound Vulnerability Actively Exploited (CISA KEV)
CISA lists a GitLab CE and EE integer overflow as actively exploited. The supplied notice lacks affected versions, fix details and exploitation evidence.
CVE-2026-76418: Cisco Secure Firewall ASA Software And Cisco Secure FTD Software Unchecked Return Value To NULL Pointer Dereference Vulnerability Actively Exploited (CISA KEV)
CISA lists CVE-2026-76418 in Cisco ASA and FTD software as actively exploited; the supplied notice lacks details on fixes and attack scope.
Chained PHP2Shell Exploit Roots 25 Servers, Including US Government Servers
Dream Security reports a chained exploit rooted 25 PAN-OS servers, including systems in a U.S. government-affiliated environment.
What Five Working Attack Chains Tell Us About AI And Patching
Anthropic says an internal Claude model chained flaws across five platforms. Vendor records support some findings; the model’s role remains unclear.
Zero Click, Silent, Remote Android DoS
A researcher says a malformed WAP Push SMS can crash Android telephony without user action; Google reportedly classified the issue as non-security.
GitLab Security Incident: Attempted Exploitation Of CVE-2026-97229
Alpine says attackers tried to exploit a critical GitLab flaw on Oct. 20-21. It found no evidence of success but cannot rule out code execution.
Attackers Now Go After Your AI Tools: Stolen Sessions, Leaked Agent Logs And Hidden Reasoning
Check Point found AI login files in Aokigahara’s targets; Warp disclosed vendor access to limited agent traces, while a reported OpenAI flaw was fixed.
