NewsThe Register — Security
When the attacker becomes the user: Rethinking account takeover
Teaser from the source
SPONSORED FEATURE: AI makes phishing easier than ever
This is the RSS-feed teaser. Read the full article at the original source.
Read at The Register — SecurityMore on becomes
Other advisories
- CriticalCVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`. `tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
- Not ratedosv:CVE-2026-57492FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
- MediumCVE-2026-85087Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
- MediumCVE-2026-85087Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
- MediumCVE-2026-41916OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload. N…
- MediumCVE-2026-41916OpenClaw: resolvedAuth closure becomes stale after config reload
- CriticalCVE-2026-27588Caddy MatchHost becomes case-sensitive in github.com/caddyserver/caddy/v2
- CriticalCVE-2026-27588Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
Other news entries
- When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer DiagnosisNewsSecurityWeek
- Protecting the vSphere Kubernetes Control Plane: Architecting Zero Trust for Supervisor and VKS with vDefendNewsVMware Security Advisories
- What Security Teams Can Do To Tame Wild CodeNewsThe Hacker News
- When defrost becomes sabotage: 3 OT lessons from France’s supermarket attackNewsCSO Online
- Owner of fashion brands Hobbs and Whistles joins autumn pwned collectionNewsThe Register — Security
- ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More StoriesNewsThe Hacker News
- When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applicationsNewsCSO Online
- US Becomes Top Target in RMM Phishing Campaign Spanning 46 CountriesNewsThe Hacker News
ID