[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiJFIZUqMYRnjZCaoKSZqiSoQBnAAKk6p4_WkuRYvyug":3},{"article":4,"iocs":54,"watch_terms":81,"solutions":82,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"3e162bf3-c16c-4eba-9e48-c11272fc99ab","Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION","security-affairs-newsletter-round-602-by-pierluigi-paganini-international-editio-3c8d87","A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog Attackers Exploit Critical Drupal Commerce […]","The Security Affairs newsletter Round 602 highlights a wide array of cybersecurity topics, including CISA advisories for Ivanti, GitLab, Cisco, Linux Kernel, and Adobe Commerce. It also details emerging threats like the Yoba malware hiding crypto miners, nation-state activities attributed to North Korea, and the exploitation of vulnerabilities in Drupal and PHP. The newsletter also touches on data breaches, ransomware, and the growing impact of AI in cyberattacks.","Security Affairs newsletter Round 602 covers diverse cyber threats including CISA alerts, malware, and nation-state","https:\u002F\u002Fsecurityaffairs.com\u002F202200\u002Fbreaking-news\u002Fsecurity-affairs-newsletter-round-602-by-pierluigi-paganini-international-edition.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002Fsecurityaffairs-newsletter.jpg","2026-11-01T13:22:58+00:00","2026-11-01T14:00:24.229771+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Ivanti","vendor",{"name":21,"type":22},"Connect Secure","product",{"name":24,"type":22},"Drupal Commerce",{"name":26,"type":22},"OpenAI",{"name":28,"type":22},"Anthropic",{"name":30,"type":19},"CISA","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,58,62,65,69,72,75,78],{"type":51,"value":56,"context":57},"uCreater","Rentable Android spyware platform",{"type":59,"value":60,"context":61},"cve","CVE-2026-118539","Critical Drupal Commerce Core Vulnerability",{"type":59,"value":63,"context":64},"CVE-2026-97631","16-Year-Old UEFI Flaw",{"type":66,"value":67,"context":68},"domain","deepveindrilling.com","Magento CMS block loader campaign",{"type":51,"value":70,"context":71},"Yoba Malware","Malware hiding a crypto miner",{"type":51,"value":73,"context":74},"PHP2Shell","Suspected North Korean campaign targeting PHP hosts",{"type":51,"value":76,"context":77},"M365 Token Spray and Replay Campaign","Compromises Business Email Accounts",{"type":51,"value":79,"context":80},"Anthropic.claude-code (2.1.313)","Malicious version identified in Cursor Extension Marketplace",[18,30,21],{"controls":83,"vendors":166},[84,113,138],{"slug":85,"name":86,"problem":87,"products":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":114,"name":115,"problem":116,"products":117},"patch-management","Automated patch management","Known holes get closed in days, not months.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":114,"product_name":135,"url":136,"description":137},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":35,"name":139,"problem":140,"products":141},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[142,150,158],{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":159,"vendor_name":160,"vendor_logo":161,"product_slug":162,"product_name":163,"url":164,"description":165},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[167,173,175],{"slug":168,"name":169,"logo_path":170,"roles":171},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[172],"affected",{"slug":159,"name":160,"logo_path":161,"roles":174},[172],{"slug":176,"name":18,"logo_path":177,"roles":178},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[172],{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":191},"multi-vendor-vulnerabilities-and-emerging-threats-demand-proactive-patch-hygiene","Multi-Vendor Vulnerabilities and Emerging Threats Demand Proactive Patch Hygiene","This newsletter roundup underscores a persistent and dangerous pattern: critical vulnerabilities across widely-deployed platforms — including Ivanti, GitLab, Cisco, Linux Kernel, Adobe Commerce, Drupal, and PHP — are being actively exploited while many organizations lag behind on patching. Threat actors, including nation-state groups like North Korea, are capitalizing on these unpatched systems to deploy malware, crypto miners, and ransomware. The presence of threats like the Yoba malware hiding crypto miners demonstrates that attackers are increasingly sophisticated in evading detection. When patches exist but are not applied promptly, organizations essentially leave known doors unlocked — a failure of both technical process and organizational discipline. The growing use of AI in cyberattacks further accelerates the window between vulnerability disclosure and exploitation, making rapid patch cycles non-negotiable.",[184,185,186,187,188,189,190],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":192,"PCI DSS Requirement 6":193,"NIST SP 800-53 SI-2: Flaw Remediation":194,"OWASP A06:2021 Vulnerable and Outdated Components":195,"CIS Control 7: Continuous Vulnerability Management":196,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":197,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":198},"NIS2 mandates incident handling and vulnerability management practices for essential and important entities — the multi-vendor exploitation patterns in this newsletter represent exactly the systemic risk NIS2 aims to mitigate through mandatory security measures.","Requirement 6 mandates the protection of systems and software through timely vulnerability management and patching, directly applicable to the Adobe Commerce exploitation highlighted in this newsletter which targets e-commerce environments handling payment data.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner — a process that would have directly addressed the delayed patching enabling exploitation across multiple platforms in this roundup.","Exploitation of Drupal, PHP, Adobe Commerce, and Linux Kernel vulnerabilities exemplifies the A06 risk of running outdated or vulnerable software components in production environments without adequate lifecycle management.","Actively exploited vulnerabilities in Ivanti, Cisco, Drupal, and PHP would have been detected and remediated sooner under a continuous vulnerability scanning and patching program with enforced deadlines.","This control requires timely identification and remediation of technical vulnerabilities, which would have mandated a structured response to the CISA advisories highlighted across Ivanti, GitLab, and Cisco products.","Nation-state actors exploiting unpatched systems in GitLab and Ivanti often pivot to credential theft and unauthorized access, making strong identity controls a critical compensating measure when patches cannot be applied immediately."]