⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
The article uses an extended metaphor of open source as a child that grew up feral and then got drafted into a cybersecurity war. It describes how major incidents forced regulation and now open source faces threats from AI and poisoned distribution channels.
This article reports a use-after-free vulnerability in Linux's SCTP networking code, tracked as CVE-2026-64564 and named SCTPhantom. Tencent researchers used it to gain root and escape containers in tested distributions.
A critical 18-year-old vulnerability in Linux’s SCTP networking protocol, tracked as CVE-2026-64564 and dubbed SCTPhantom, allows local attackers to escalate privileges to root and escape containers. Discovered by Tencent’s Zhuque Lab, the flaw stems from a use-after-free bug in the SCTP code, which mishandles address deletions during dynamic address reconfiguration.
Security researcher Malcolm Stagg has uncovered a new attack class called NatJack that exploits vulnerabilities in network address translation (NAT) implementations to hijack TCP sessions, spoof DNS responses, and disrupt network connectivity. The flaws affect both Windows (CVE-2026-56181, CVSS 8.3) and Linux (CVE-2026-63913, CVSS 8.2) systems, particularly in Hyper-V and Netfilter conntrack components.
This article describes NatJack, a new attack class that abuses assumptions in NAT implementations to hijack TCP sessions, spoof DNS, expose ports, and exhaust NAT tables. Researcher Malcolm Stagg presented findings at Black Hat USA 2026, with CVEs assigned for Windows and Linux implementations.
This article from Cyble provides a deep dive into Europe's ransomware landscape in H1 2026, highlighting 866 attacks and a shift toward organized threat actors. Qilin dominates with 158 incidents, concentrating on Germany and specific sectors like construction and manufacturing.