https://sentinel-post.pages.dev Автономная радиостанция кибербезопасности: живые CVE, угрозы и защита — без сенсаций ru Fri, 30 Oct 2026 13:13:15 GMT https://sentinel-post.pages.dev/item/trezor-warns-of-suspected-hardware-implant-in-one-of-its-wallets.html https://sentinel-post.pages.dev/item/trezor-warns-of-suspected-hardware-implant-in-one-of-its-wallets.html Fri, 30 Oct 2026 12:21:56 GMT A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to m https://sentinel-post.pages.dev/item/why-urgent-security-fixes-aren-t-fixed-observe-prove-act-confirm.html https://sentinel-post.pages.dev/item/why-urgent-security-fixes-aren-t-fixed-observe-prove-act-confirm.html Fri, 30 Oct 2026 11:58:53 GMT The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.  Their concerns are practical. An IPS protection could block legitimate traffic. https://sentinel-post.pages.dev/item/syrian-hacker-behind-fake-tweet-that-triggered-136-billion-marke.html https://sentinel-post.pages.dev/item/syrian-hacker-behind-fake-tweet-that-triggered-136-billion-marke.html Fri, 30 Oct 2026 10:40:45 GMT Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized and led by members of former Syrian President B https://sentinel-post.pages.dev/item/official-claude-code-extension-on-cursor-marketplace-trojanized-.html https://sentinel-post.pages.dev/item/official-claude-code-extension-on-cursor-marketplace-trojanized-.html Fri, 30 Oct 2026 08:55:47 GMT Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was dist https://sentinel-post.pages.dev/item/hackers-actively-exploit-highly-critical-drupal-commerce-core-au.html https://sentinel-post.pages.dev/item/hackers-actively-exploit-highly-critical-drupal-commerce-core-au.html Fri, 30 Oct 2026 07:45:30 GMT Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-[phone] (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This mo https://sentinel-post.pages.dev/item/cisa-adds-actively-exploited-gitlab-rce-and-cisco-firewall-dos-f.html https://sentinel-post.pages.dev/item/cisa-adds-actively-exploited-gitlab-rce-and-cisco-firewall-dos-f.html Fri, 30 Oct 2026 07:27:05 GMT The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-[phone] (CVSS score: 10.0) - An i https://sentinel-post.pages.dev/item/binance-suffers-security-breach-affecting-6-3-billion-in-assets-.html https://sentinel-post.pages.dev/item/binance-suffers-security-breach-affecting-6-3-billion-in-assets-.html Fri, 30 Oct 2026 04:14:59 GMT Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.  Tether and Circle said they have frozen https://sentinel-post.pages.dev/item/threatsday-critical-firewall-flaws-banking-trojans-rented-weapon.html https://sentinel-post.pages.dev/item/threatsday-critical-firewall-flaws-banking-trojans-rented-weapon.html Thu, 29 Oct 2026 19:11:58 GMT Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familia https://sentinel-post.pages.dev/item/cve-2026-118664-decode-uri-component-vulnerable-to-denial-of-ser.html https://sentinel-post.pages.dev/item/cve-2026-118664-decode-uri-component-vulnerable-to-denial-of-ser.html Thu, 29 Oct 2026 16:41:28 GMT Severity: high. ### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-[phone], is affec https://sentinel-post.pages.dev/item/ghsa-vpp8-g58w-m8mp-twisted-unauthenticated-remote-denial-of-ser.html https://sentinel-post.pages.dev/item/ghsa-vpp8-g58w-m8mp-twisted-unauthenticated-remote-denial-of-ser.html Thu, 29 Oct 2026 16:41:06 GMT Severity: high. ## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with `END_STREAM` and then immediately resets the strea https://sentinel-post.pages.dev/item/cve-2026-115907-zip-legacy-shrink-reduce-implode-decoder-denial-.html https://sentinel-post.pages.dev/item/cve-2026-115907-zip-legacy-shrink-reduce-implode-decoder-denial-.html Thu, 29 Oct 2026 16:40:19 GMT Severity: high. ### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. An attacker-controlled ZIP64 uncompressed size triggers a `capacity overflow` panic in the Shrink decoder in optimized builds, potenti https://sentinel-post.pages.dev/item/cve-2026-115908-zip-arbitrary-file-write-outside-the-extraction-.html https://sentinel-post.pages.dev/item/cve-2026-115908-zip-arbitrary-file-write-outside-the-extraction-.html Thu, 29 Oct 2026 16:40:12 GMT Severity: high. ### Summary - **Verified version:** zip `9.0.0-pre3` - **Affected versions:** `7.2.0` and later - **Precondition:** The attacker knows (or can guess) the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can w https://sentinel-post.pages.dev/item/cve-2026-115906-zip-aes-entry-hmac-authentication-bypass-on-prem.html https://sentinel-post.pages.dev/item/cve-2026-115906-zip-aes-entry-hmac-authentication-bypass-on-prem.html Thu, 29 Oct 2026 16:40:07 GMT Severity: medium. ### Summary An AES-encrypted (AE-x) entry's authentication code is verified only when the reader's byte counter lands exactly on zero. If the bounded entry reader reaches the archive's actual EOF before the attacker-controlled, header-declared `compressed_size`, the counter remain https://sentinel-post.pages.dev/item/cve-2026-115909-zip-unbounded-symlink-target-handling-can-abort-.html https://sentinel-post.pages.dev/item/cve-2026-115909-zip-unbounded-symlink-target-handling-can-abort-.html Thu, 29 Oct 2026 16:40:01 GMT Severity: high. ### Summary The symbolic-link branch of `ZipArchive::extract_internal()` allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with `SIGABRT` through this infallible allocation. ### Details ```rust #[ https://sentinel-post.pages.dev/item/cve-2026-118662-vite-server-fs-deny-bypassed-with-queries.html https://sentinel-post.pages.dev/item/cve-2026-118662-vite-server-fs-deny-bypassed-with-queries.html Thu, 29 Oct 2026 16:39:56 GMT Severity: medium. ### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser. This is the same as https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r. ### Impact Only apps that https://sentinel-post.pages.dev/item/cve-2026-63414-shopify-app-token-exchange-shop-context-confusion.html https://sentinel-post.pages.dev/item/cve-2026-63414-shopify-app-token-exchange-shop-context-confusion.html Thu, 29 Oct 2026 16:39:49 GMT Severity: high. In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Sh https://sentinel-post.pages.dev/item/cve-2026-62290-cert-manager-direct-acme-challenge-resources-can-.html https://sentinel-post.pages.dev/item/cve-2026-62290-cert-manager-direct-acme-challenge-resources-can-.html Thu, 29 Oct 2026 16:39:41 GMT Severity: high. ## Summary `Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an `Order`, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then https://sentinel-post.pages.dev/item/cve-2026-9086-keycloak-vulnerable-to-cross-site-scripting-xss-vi.html https://sentinel-post.pages.dev/item/cve-2026-9086-keycloak-vulnerable-to-cross-site-scripting-xss-vi.html Thu, 29 Oct 2026 16:39:03 GMT Severity: high. ### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registe https://sentinel-post.pages.dev/item/cve-2026-9083-keycloak-vulnerable-to-information-disclosure-thro.html https://sentinel-post.pages.dev/item/cve-2026-9083-keycloak-vulnerable-to-information-disclosure-thro.html Thu, 29 Oct 2026 16:38:31 GMT Severity: medium. ### Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrar https://sentinel-post.pages.dev/item/cve-2026-9799-keycloak-allows-unauthorized-access-to-resources-v.html https://sentinel-post.pages.dev/item/cve-2026-9799-keycloak-allows-unauthorized-access-to-resources-v.html Thu, 29 Oct 2026 16:37:57 GMT Severity: medium. ### Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the us https://sentinel-post.pages.dev/item/cve-2026-9800-keycloak-vulnerable-to-authorization-bypass-via-in.html https://sentinel-post.pages.dev/item/cve-2026-9800-keycloak-vulnerable-to-authorization-bypass-via-in.html Thu, 29 Oct 2026 16:37:26 GMT Severity: high. ### Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a re https://sentinel-post.pages.dev/item/cve-2026-9705-keycloak-attacker-can-re-enable-and-take-over-disa.html https://sentinel-post.pages.dev/item/cve-2026-9705-keycloak-attacker-can-re-enable-and-take-over-disa.html Thu, 29 Oct 2026 16:36:21 GMT Severity: medium. ### Description A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses securit https://sentinel-post.pages.dev/item/ghsa-w9x9-j56r-h98r-eeacms-volto-chatbot-has-unauthenticated-dan.html https://sentinel-post.pages.dev/item/ghsa-w9x9-j56r-h98r-eeacms-volto-chatbot-has-unauthenticated-dan.html Thu, 29 Oct 2026 16:35:48 GMT Severity: high. ## Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot ### Summary `@eeacms/volto-chatbot` exposes an Express middleware route (`**/_v1_da/**`) that accepts unauthenticated HTTP requests from any network client and proxies them to the configured upstream Dans https://sentinel-post.pages.dev/item/cve-2026-61848-crass-non-ascii-characters-cause-superlinear-cpu-.html https://sentinel-post.pages.dev/item/cve-2026-61848-crass-non-ascii-characters-cause-superlinear-cpu-.html Thu, 29 Oct 2026 16:35:29 GMT Severity: medium. ### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumptio https://sentinel-post.pages.dev/item/cve-2026-61847-crass-a-large-number-of-adjacent-css-comments-can.html https://sentinel-post.pages.dev/item/cve-2026-61847-crass-a-large-number-of-adjacent-css-comments-can.html Thu, 29 Oct 2026 16:35:23 GMT Severity: medium. ### Impact When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recurs https://sentinel-post.pages.dev/item/cve-2026-61846-crass-deeply-nested-css-blocks-and-functions-can-.html https://sentinel-post.pages.dev/item/cve-2026-61846-crass-deeply-nested-css-blocks-and-functions-can-.html Thu, 29 Oct 2026 16:35:16 GMT Severity: medium. ### Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage. ### Patches T https://sentinel-post.pages.dev/item/ghsa-c33x-vcv4-vg3g-cedar-json-template-is-in-scope-missing-slot.html https://sentinel-post.pages.dev/item/ghsa-c33x-vcv4-vg3g-cedar-json-template-is-in-scope-missing-slot.html Thu, 29 Oct 2026 16:35:04 GMT Severity: low. Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the `is in` scope condition. This advisory only affects JSON-formatted Cedar policy templates containing `is in` scope conditions that are **malformed** https://sentinel-post.pages.dev/item/cve-2026-62264-sylphx-pdf-reader-mcp-http-transport-accepts-unau.html https://sentinel-post.pages.dev/item/cve-2026-62264-sylphx-pdf-reader-mcp-http-transport-accepts-unau.html Thu, 29 Oct 2026 16:34:35 GMT Severity: high. ### Impact When `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` environment variable and logs `API key authentication enabled (X-API-Key header)` at startup, but it never validated the `X-API-Key` header on incoming requests. The https://sentinel-post.pages.dev/item/cve-2026-61438-praisonai-vulnerable-to-remote-code-execution-via.html https://sentinel-post.pages.dev/item/cve-2026-61438-praisonai-vulnerable-to-remote-code-execution-via.html Thu, 29 Oct 2026 16:34:26 GMT Severity: high. ### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by (a) checking all AST nodes against an allowlist, and (b) providing https://sentinel-post.pages.dev/item/cve-2026-61448-parse-server-vulnerable-to-stored-xss-via-malform.html https://sentinel-post.pages.dev/item/cve-2026-61448-parse-server-vulnerable-to-stored-xss-via-malform.html Thu, 29 Oct 2026 16:33:48 GMT Severity: low. ### Impact Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recogn