Google’s privacy pivot: how Personal Intelligence could bring Gmail into ad targeting
Google’s recent tweak to its privacy policy has…
Updated 3 hours ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
Kentik Links Foreign Traffic Floods to North Korea .kp Outage
Multiple waves of traffic this week knocked large parts of North Korea’s public internet offline, leaving more than 40 .kp websites intermittently unreachable for roughly 32 hours. The outages began in the early hours of October 20 (02:01 UTC) and affected core services including the Ministry of Foreign Affairs and the Korean Central News Agency. Internet measurement firm Kentik, through its internet analysis director Doug Madory, traced sudden traffic floods…
Stadia RAT: StealC’s Comeback Brings Hidden Desktop Control and Browser Theft to Windows PCs
The StealC operation that law enforcement disrupted this summer has not disappeared — it has evolved. Researchers recently identified a rebuilt strain, marketed as Stadia, that fuses credential theft with a Remote Access Trojan (RAT) feature set designed to give operators secret, persistent control over infected Windows machines. While the takedown seized infrastructure, surviving code and a ready customer base appear to have enabled the seller to rebrand and relaunch…
Windows Server 2016: Why January 2027 Is a Hard Deadline for Administrators
Microsoft’s long-term support clock for Windows Server 2016 is winding down: the January 2027 security update will be the last one published for this OS, and after January 12, 2027, systems still running Windows Server 2016 will no longer receive monthly security updates. That simple sentence changes the risk profile for any environment still depending on 2016-era servers. If your estate includes domain controllers, application servers, or infrastructure appliances on…
BlackX Bootkit: How Attackers Bypass Windows Secure Boot on Patched Systems
A sophisticated UEFI bootkit called BlackX has been observed in targeted cyberespionage campaigns against diplomatic organizations in Central Asia. Even on systems that showed up-to-date Windows patches, attackers found a path to run code before Windows started by exploiting gaps in how Secure Boot protections were deployed. The discovery highlights a subtle but critical distinction between installing updates and fully activating the firmware-level protections those updates are intended to enable.…
ArtCraft, Get Craft Apps, and the New Open-Source Beat in Creative Software
For years, creative professionals and hobbyists alike have chosen established, paid suites for design, illustration, audio, and motion work. Lately, a new class of open-source “get craft” apps — exemplified by projects like ArtCraft — has begun to shift that balance. These tools are not just affordable alternatives; they are changing workflows, challenging licensing models, and proving that community-driven software can deliver the polish and interoperability pros expect. This piece…
Critical Okta Access Gateway Flaw Could Let Admin-Level Input Trigger System Commands
Okta has published an advisory about a high-severity vulnerability in Okta Access Gateway that can allow specially crafted administrative input to trigger system command execution inside the appliance. The issue highlights the continuing importance of limiting and monitoring privileged access to management consoles and of applying vendor patches quickly when they address control-plane weaknesses. What happened Okta disclosed CVE-2026-115547, a vulnerability affecting Okta Access Gateway releases prior to 2026.10.2. According…
Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know
Imperva researchers have demonstrated a proof-of-concept exploit—dubbed “Node2Shell”—that uses crafted Brotli-compressed data to achieve remote code execution (RCE) against an official Node.js 24.22.0 build for Linux arm64. The issue, tracked as CVE-2026-111497, was disclosed by Node.js and patched on October 21, 2026. While the demonstration did not work reliably on every attempt and targeted a specific build and architecture, it highlights a real risk for services that decode untrusted Brotli…
Firewall Fallout: How k0t Exploited Exposed Edge Devices to Harvest 70,000+ Credentials
Security teams woke up to a coordinated campaign that systematically targeted internet-facing firewalls and VPN appliances, resulting in the exposure of more than 70,000 credentials and LDAP dumps. Researchers from Group-IB and NyxLab attribute the activity to an operator tracked as k0t (also known as CryptoFeel, Member19, and QazWsxShop). The intrusions—detected largely between February and June 2026—rely less on high-value targeting and more on mass enumeration of exposed devices, leaving…
PHP2Shell Proof-of-Concept Goes Public — Potassium Botnet Attempts and What Defenders Should Do
Public proof-of-concept code for two critical PHP vulnerabilities—collectively dubbed PHP2Shell—has been released, and security teams have observed scanning and failed attempts to use the flaws to deliver botnet malware. While attempted exploitation is concerning, researchers stress that scans and blocked deliveries are not the same as confirmed successful compromises. The key takeaways are straightforward: review runtime configurations, apply the issued PHP fixes, and treat detection telemetry carefully so you don’t…
PHP’s New Warning: Narrow Unpatched RCE Path After PHP2Shell Fixes
PHP released a short advisory on October 23 warning of a separate, unlikely path that could let an attacker run code on a web server — just two days after emergency fixes for the critical PHP2Shell flaws. While the newly disclosed issue (CVE-2026-115560) is not being treated as an emergency, administrators should understand the configuration that creates the risk, confirm whether their apps are affected, and apply the recommended mitigation…
Citrix NetScaler Zero-Day in the Wild: Remote Code Execution, Web Shells and What to Do Now
A critical remote code execution flaw in Citrix NetScaler ADC and Gateway — tracked as CVE-2026-88771 — is being actively exploited to run commands on exposed appliances, install web shells and deliver malware. Observers report attackers using a staged technique that poisons logs, triggers a diagnostic process to execute embedded commands, and then attempts to persist via web shells or a FreeBSD x64 binary. With NetScaler devices frequently positioned at…
Emergency Java Patch: Oracle Distrusts eMudhra Intermediates to Fix CVE-2026-91403
Oracle has released an emergency Java security update to address a critical certificate-trust vulnerability that could let attackers impersonate legitimate HTTPS services. Published October 21, 2026 and tracked as CVE-2026-91403 with a CVSS 3.1 score of 9.1, the issue affects the Java Secure Socket Extension (JSSE) and several GraalVM builds. Although Oracle reports no confirmed exploitations yet, the low complexity and lack of required authentication make this an urgent patch…