PLANCK기술 소식
보안 · 통신 기술 분야 공식 매체의 RSS에서 매일 8시 · 17시에 제목과 짧은 요약을 모읍니다. 본문은 각 매체 사이트에서 읽으십시오.
- Vulnerability Management Isn't About the Score — It's About How It Applies to You (새 창 · 바깥 사이트)
Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.
EN Dark Reading · 보안 · 2026.10.16 - Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams (새 창 · 바깥 사이트)
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code tem…
EN The Hacker News · 보안 · 2026.10.15 - Is AI pentesting as good as a human pentester? (새 창 · 바깥 사이트)
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security…
EN BleepingComputer · 보안 · 2026.10.15 - Microsoft: Windows Server 2022 reached end of mainstream support (새 창 · 바깥 사이트)
Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. [...]
EN BleepingComputer · 보안 · 2026.10.15 - NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks (새 창 · 바깥 사이트)
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and eac…
EN The Hacker News · 보안 · 2026.10.15 - Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing (새 창 · 바깥 사이트)
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open…
EN The Hacker News · 보안 · 2026.10.15 - Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules (새 창 · 바깥 사이트)
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in it…
EN The Hacker News · 보안 · 2026.10.15 - CISA Malcolm (새 창 · 바깥 사이트)
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm Malcolm CVSS Vendor Equipment v3 8.1 CISA Malcolm 6 Vulnerabilities Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Altern…
EN CISA Advisories · 보안 · 2026.10.15 - CISA Adds One Known Exploited Vulnerability to Catalog (새 창 · 바깥 사이트)
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability This type of vulnerability is a frequ…
EN CISA Advisories · 보안 · 2026.10.15 - Eclipse Foundation Eclipse Milo (새 창 · 바깥 사이트)
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of Eclipse Foundation Ecli…
EN CISA Advisories · 보안 · 2026.10.15 - Guangzhou Juan IoT Technology EseeCloud (새 창 · 바깥 사이트)
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App EseeCloud Firmware CVSS Vendor Equipment v3 9.8 Guang…
EN CISA Advisories · 보안 · 2026.10.15 - J4Care dcm4che (새 창 · 바깥 사이트)
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The following versi…
EN CISA Advisories · 보안 · 2026.10.15 - Thermo Fisher Torrent Suite Software (새 창 · 바깥 사이트)
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software CVSS Vendor Equipment v3 6.5 Thermo Fisher To…
EN CISA Advisories · 보안 · 2026.10.15 - Police arrests 95 suspects in international CSAM crackdown action (새 창 · 바깥 사이트)
Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. [...]
EN BleepingComputer · 보안 · 2026.10.15 - Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early (새 창 · 바깥 사이트)
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure o…
EN The Hacker News · 보안 · 2026.10.15 - Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation (새 창 · 바깥 사이트)
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote co…
EN The Hacker News · 보안 · 2026.10.15 - Why AI Confidence Is Not Validation (새 창 · 바깥 사이트)
AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance…
EN The Hacker News · 보안 · 2026.10.15 - India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 (새 창 · 바깥 사이트)
The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle sp…
EN The Hacker News · 보안 · 2026.10.15 - Microsoft fixes bug causing Windows black screens, Explorer crashes (새 창 · 바깥 사이트)
Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. [...]
EN BleepingComputer · 보안 · 2026.10.15 - GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories (새 창 · 바깥 사이트)
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of abou…
EN The Hacker News · 보안 · 2026.10.15 - Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts (새 창 · 바깥 사이트)
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent com…
EN The Hacker News · 보안 · 2026.10.15 - EU Grocers Pay a Steep Price for Unpatched Fridge Firmware (새 창 · 바깥 사이트)
Hundreds of stores lost millions of euros because they hired third parties to manage the outdated OT firmware running their cooling systems.
EN Dark Reading · 보안 · 2026.10.15 - AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches (새 창 · 바깥 사이트)
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be…
EN The Hacker News · 보안 · 2026.10.15 - ISC Stormcast For Thursday, October 15th, 2026 https://isc.sans.edu/podcastdetail/10138, (Thu, Oct 15th) (새 창 · 바깥 사이트)EN SANS ISC · 보안 · 2026.10.15
- MS 10월 보안 위협에 따른 정기 보안 업데이트 권고 (새 창 · 바깥 사이트)KISA 보호나라 보안공지 · 보안 · 2026.10.15
- Cisco 제품 보안 업데이트 권고 (새 창 · 바깥 사이트)KISA 보호나라 보안공지 · 보안 · 2026.10.15
- Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles (새 창 · 바깥 사이트)
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.
EN Dark Reading · 보안 · 2026.10.15 - Yam Store: The Phishing Network Behind a Billion Messages (새 창 · 바깥 사이트)
A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide.
EN Dark Reading · 보안 · 2026.10.15 - Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat (새 창 · 바깥 사이트)
A bug in Claude Code Desktop's preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens.
EN Dark Reading · 보안 · 2026.10.15 - Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability (새 창 · 바깥 사이트)
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it su…
EN The Hacker News · 보안 · 2026.10.15
제목과 요약의 저작권은 각 매체에 있습니다. PLANCK는 링크만 모아 보여 주며 내용을 고치거나 번역하지 않습니다. 피드(제목 · 링크)