https://www.pk-sharma.com/briefing/google-xcpe-botnet-1-3-million-android-tv-boxes-videostrong-sold-access-what-google-says-and-does-not P.K. Sharma en 2026-11-02T18:44:30Z Google says TV box maker Videostrong built a backdoor into 1.3 million boxes and sold access: its assessment https://www.pk-sharma.com/briefing/control-web-panel-cve-2026-73695-73696-73697-fixed-1-12-and-1-16-changelog-lists-no-1-16 P.K. Sharma en 2026-11-02T18:43:39Z Control Web Panel's three CVEs say fixed in 1.12 and 1.16; the vendor changelog lists no 1.16 and names no CVE https://www.pk-sharma.com/briefing/trigger-dev-attacker-accessed-environment-variables-of-some-organizations-no-count-or-times-stated P.K. Sharma en 2026-11-02T18:42:26Z Trigger.dev says an attacker accessed environment variables of some organisations; no count or times given https://www.pk-sharma.com/briefing/barracuda-esg-cve-2026-116606-cve-record-says-unauthenticated-barracuda-says-admin-access-fixed-9-4-0-030 P.K. Sharma en 2026-11-02T18:41:43Z Barracuda ESG CVE-2026-116606: CVE record says unauthenticated, Barracuda says admin access is required https://www.pk-sharma.com/briefing/langflow-33-cve-records-three-ibm-bulletins-1-13-0-bulletin-pairs-none-of-its-four-themes-with-a-cve P.K. Sharma en 2026-11-02T16:04:43Z Langflow's 33 CVE records are three IBM bulletins, and the 1.13.0 one pairs none of its 4 themes with an ID https://www.pk-sharma.com/briefing/european-supermarket-freezers-second-wave-2-november-what-is-stated-and-what-is-not P.K. Sharma en 2026-11-02T16:02:51Z Reports say supermarket freezers were hit again; 'same method as France' is attributed to one installer https://www.pk-sharma.com/briefing/btcpay-server-hot-wallet-thefts-2-4-1-and-older-via-2-4-2-flaw-method-and-losses-not-stated P.K. Sharma en 2026-11-02T15:56:47Z BTCPay Server says hot wallet thefts hit 2.4.1 and older via the 2.4.2 flaw; method and losses not stated https://www.pk-sharma.com/briefing/synology-warns-of-ransomware-on-outdated-dsm-nas-c3rb3r-patched-in-2024-no-cve-named P.K. Sharma en 2026-11-02T11:59:30Z Synology warns of ransomware attacks on outdated DSM through a flaw patched in 2024, and names no CVE https://www.pk-sharma.com/briefing/deepseek-dsh-superagent-coding-agent-takes-work-from-team-chat-who-can-ask-and-who-merges P.K. Sharma en 2026-11-02T10:28:43Z DeepSeek's repository says lists decide who can ask its coding agent, and its workers run with full access https://www.pk-sharma.com/briefing/aur0ra-ransomware-gold-ogre-ai-agents-mapped-networks-and-hunted-credentials-what-sophos-found P.K. Sharma en 2026-11-02T10:28:39Z Sophos says Aur0ra ransomware operators let AI agents do the network work after a red team cover story https://www.pk-sharma.com/briefing/wso2-cve-2025-11969-system-rest-apis-let-lower-privilege-users-run-administrative-actions P.K. Sharma en 2026-11-02T10:21:11Z WSO2 says low privilege users could run admin actions on its System REST APIs; its advisory is 280 days old https://www.pk-sharma.com/briefing/beta9-three-cvss-9-9-flaws-let-one-tenant-reach-the-worker-as-root-and-its-service-account-token P.K. Sharma en 2026-11-01T21:53:05Z Beta9's three CVSS 9.9 flaws let a workspace token reach the shared worker as root, the CVE records say https://www.pk-sharma.com/briefing/prefab-ui-cve-2026-120338-generative-ui-sandbox-let-llm-written-code-write-files-on-the-host P.K. Sharma en 2026-11-01T21:49:30Z Prefab UI's sandbox for model written code let FastMCP tool callers write host files, CVE-2026-120338 says https://www.pk-sharma.com/briefing/thales-sentinel-keys-server-cve-2026-78403-one-http-request-to-system-on-windows P.K. Sharma en 2026-11-01T14:42:34Z One HTTP request with no login may run code as SYSTEM on Thales Sentinel Keys Server, the CVE record says https://www.pk-sharma.com/briefing/pgadmin-4-9-19-fixes-15-cves-database-role-could-run-commands-on-the-pgadmin-host P.K. Sharma en 2026-11-01T14:41:33Z pgAdmin 4 9.19 fixes 15 CVEs; the worst let an ordinary user's query export run commands on the pgAdmin host https://www.pk-sharma.com/briefing/lxd-microcloud-cve-2026-112816-cvss-10-trusted-client-impersonation-public-certificate-in-chain P.K. Sharma en 2026-11-01T11:06:11Z LXD and MicroCloud trusted any certificate in a client's chain, so a public certificate could log in as it https://www.pk-sharma.com/briefing/fbi-attributes-binance-6-billion-theft-to-north-korea-tradertraitor-laundering-addresses-published P.K. Sharma en 2026-11-01T11:01:18Z FBI says North Korea stole more than $6 billion from Binance and lists 628 addresses to block https://www.pk-sharma.com/briefing/northflank-says-assume-all-environment-variables-decrypted-customers-report-ai-api-key-misuse-no-route-or-count-stated P.K. Sharma en 2026-10-31T20:16:59Z Northflank says assume all environment variables were decrypted; AI key misuse reported, no route or count https://www.pk-sharma.com/briefing/android-sms-of-death-zero-click-wap-push-crash-fix-in-october-source-not-in-bulletin-android-12-13-none-cve-reserved P.K. Sharma en 2026-10-31T20:08:34Z Android 'SMS of Death' exploit is public: fix is in October's code, not Google's bulletin; CVE only reserved