PLANCK기술 소식
보안 · 통신 기술 분야 공식 매체의 RSS에서 매일 8시 · 17시에 제목과 짧은 요약을 모읍니다. 본문은 각 매체 사이트에서 읽으십시오.
- Hackers exploit SiteGuard WAF flaw to run commands as admins (새 창 · 바깥 사이트)
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. [...]
EN BleepingComputer · 보안 · 2026.10.18 - Drupal patches critical RCE flaws, warns exploits may emerge soon (새 창 · 바깥 사이트)
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]
EN BleepingComputer · 보안 · 2026.10.17 - BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs (새 창 · 바깥 사이트)
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
EN Dark Reading · 보안 · 2026.10.17 - Critical BlockStrap flaw lets hackers run code on Magento servers (새 창 · 바깥 사이트)
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]
EN BleepingComputer · 보안 · 2026.10.17 - Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug (새 창 · 바깥 사이트)
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, wh…
EN The Hacker News · 보안 · 2026.10.17 - CISA Adds Two Known Exploited Vulnerabilities to Catalog (새 창 · 바깥 사이트)
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoof…
EN CISA Advisories · 보안 · 2026.10.16 - CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support (새 창 · 바깥 사이트)
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade fir…
EN CISA Advisories · 보안 · 2026.10.16 - Scammers clone candidates’ voices to steal cash and voter data ahead of 2026 midterms, FBI warns (새 창 · 바깥 사이트)
Three weeks before Americans vote in the 2026 midterm election, fraudsters are borrowing candidate names, logos and slogans to collect fake donations and harvest personal data, the FBI warned. “The FBI warns the public that scammers could exploit the 2026 US Midterm Election to…
EN Help Net Security · 보안 · 2026.10.16 - Fake Arch Linux AUR packages exploit typos to run malware with root privileges (새 창 · 바깥 사이트)
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted bu…
EN Help Net Security · 보안 · 2026.10.16 - China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers (새 창 · 바깥 사이트)
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked as CVE-2026-102764 (CVSS score…
EN The Hacker News · 보안 · 2026.10.16 - BeyondTrust patches zero-day exploited in attacks since August (새 창 · 바깥 사이트)
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
EN BleepingComputer · 보안 · 2026.10.16 - PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions (새 창 · 바깥 사이트)
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw…
EN The Hacker News · 보안 · 2026.10.16 - Palo Alto Networks 제품 보안 업데이트 권고 (새 창 · 바깥 사이트)KISA 보호나라 보안공지 · 보안 · 2026.10.16
- Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers (새 창 · 바깥 사이트)
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
EN BleepingComputer · 보안 · 2026.10.16 - Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory (새 창 · 바깥 사이트)
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and…
EN The Hacker News · 보안 · 2026.10.16 - ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More (새 창 · 바깥 사이트)
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A truste…
EN The Hacker News · 보안 · 2026.10.16 - Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks (새 창 · 바깥 사이트)
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that mak…
EN The Hacker News · 보안 · 2026.10.16 - Vulnerability Management Isn't About the Score — It's About How It Applies to You (새 창 · 바깥 사이트)
Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.
EN Dark Reading · 보안 · 2026.10.16 - Is AI pentesting as good as a human pentester? (새 창 · 바깥 사이트)
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security…
EN BleepingComputer · 보안 · 2026.10.15 - NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks (새 창 · 바깥 사이트)
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and eac…
EN The Hacker News · 보안 · 2026.10.15 - Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing (새 창 · 바깥 사이트)
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open…
EN The Hacker News · 보안 · 2026.10.15 - Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules (새 창 · 바깥 사이트)
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in it…
EN The Hacker News · 보안 · 2026.10.15 - CISA Malcolm (새 창 · 바깥 사이트)
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm Malcolm CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Altern…
EN CISA Advisories · 보안 · 2026.10.15 - CISA Adds One Known Exploited Vulnerability to Catalog (새 창 · 바깥 사이트)
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability This type of vulnerability is a frequ…
EN CISA Advisories · 보안 · 2026.10.15 - Eclipse Foundation Eclipse Milo (새 창 · 바깥 사이트)
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Ecli…
EN CISA Advisories · 보안 · 2026.10.15 - Guangzhou Juan IoT Technology EseeCloud (새 창 · 바깥 사이트)
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App EseeCloud Firmware CVSS Vendor Equipment v3 9.8 Guang…
EN CISA Advisories · 보안 · 2026.10.15 - J4Care dcm4che (새 창 · 바깥 사이트)
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The following versi…
EN CISA Advisories · 보안 · 2026.10.15 - Thermo Fisher Torrent Suite Software (새 창 · 바깥 사이트)
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software CVSS Vendor Equipment v3 6.5 Thermo Fisher To…
EN CISA Advisories · 보안 · 2026.10.15 - Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation (새 창 · 바깥 사이트)
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote co…
EN The Hacker News · 보안 · 2026.10.15 - Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts (새 창 · 바깥 사이트)
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent com…
EN The Hacker News · 보안 · 2026.10.15
제목과 요약의 저작권은 각 매체에 있습니다. PLANCK는 링크만 모아 보여 주며 내용을 고치거나 번역하지 않습니다. 피드(제목 · 링크)