TechScriptsNepal

Tagged

Cybersecurity

Breaches, zero-days, and supply-chain attacks explained in detail: what happened, who is affected, and the steps that reduce risk.

15 posts

01

October 30, 2026 · 7 min read

CVE-2026-98432: a 9.8-rated Linux kernel TCP bug, a root exploit, and no Ubuntu or Red Hat kernel yet

A race in the Linux kernel's IPv4 TCP code can free memory that is still in use. Anthropic's red team showed it could give an unauthenticated attacker root on a server with an MPTCP listener. Debian, SUSE, Oracle and Amazon have fixes; Ubuntu and RHEL did not as of October 30. What is known, what is disputed, and what to do.

02

October 30, 2026 · 5 min read

ServiceNow's AI Platform sandbox escape: patched in July, attacked within days

CVE-2026-6875 let an unauthenticated attacker break out of ServiceNow's script sandbox and run code. Researchers reported it in April, the public fix came on July 13, and attacks were seen four days later. What happened, where sources disagree, and what to check on your instance.

03

October 26, 2026 · 6 min read

79% run AI agents in production, 2% have tools built to secure them: what the gap looks like

Two October surveys, from SailPoint and OutSystems, point the same way: companies are deploying AI agents faster than they're governing them. What the numbers say, how much weight to give them, and what to put in place first.

04

October 26, 2026 · 6 min read

BeyondTrust's Remote Support zero-day: exploited for weeks before a patch existed

A suspected China-nexus group exploited a critical flaw in BeyondTrust Remote Support (CVE-2026-102764) starting August 29, a month before the vendor noticed. A detailed look at the timeline, what the attackers did once inside, and why patching alone isn't enough.

05

October 26, 2026 · 5 min read

Rank Math PRO's compromised update: why installing 3.0.124 won't clean your WordPress site

For about eleven hours on October 15-16, some downloads of the Rank Math PRO WordPress plugin contained malware that planted a self-rebuilding backdoor. What happened, how to tell if you're affected, and the recovery steps in order.

06

October 26, 2026 · 6 min read

LiteLLM 1.107.0: a leaked key, a hijacked release pipeline, and a stealer that ran every time Python started

On October 21, a malicious version of the popular LiteLLM Python package reached PyPI and Docker Hub. LiteLLM's own post-mortem traces it back to a key leaked in May. A detailed look at the attack chain, how to check your systems, and what to rotate.

07

October 26, 2026 · 6 min read

GitLab's AI Gateway flaw: when the sandbox around an AI feature turns out to be the weak point

GitLab patched CVE-2026-90970 (CVSS 9.9), a flaw in its self-hosted AI Gateway that let an authenticated user escape a prompt-template sandbox and run commands on the gateway host. What happened, who's affected, and what it says about deploying AI features safely.

08

October 26, 2026 · 6 min read

Atlassian CVE-2026-21589: a critical file-read flaw in Data Center, now on CISA's exploited list

An unauthenticated file-read flaw (CVSS 9.3) affects every version of eight Atlassian Data Center products, including Jira, Confluence, and Bitbucket. It was disclosed on October 5 and added to CISA's Known Exploited Vulnerabilities catalog on October 15. A detailed look at the timeline, fixed versions, and what to do.

09

October 26, 2026 · 5 min read

Oracle's emergency Java patch: what CVE-2026-91403 is, and why 'we already patched Java' may not be enough

Oracle issued an out-of-band security alert on October 21 for a critical flaw (CVSS 9.1) in Java's TLS component. A detailed look at what's known, what isn't, which versions are affected, and how to find every Java runtime you actually run.

10

October 26, 2026 · 6 min read

MALFEX: eight malicious npm packages, three payloads, and why --ignore-scripts isn't enough

A single operator spent three years publishing malicious npm packages that delivered a remote access trojan and a credential stealer to Windows developers. How MALFEX worked, which packages were involved, and how to check your own projects.

11

October 26, 2026 · 6 min read

PHP2Shell: two critical PHP core flaws, what they do, and how to actually fix them

Two unauthenticated remote code execution flaws in the PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect every version from 5.4 through 8.5.11. A detailed look at the bugs, the timeline, the conflicting exploitation reports, and a patching checklist.

12

October 7, 2026 · 4 min read

Voluntary pledge vs. legal liability: two very different ways Washington is approaching AI agents

In the same week, the White House announced a voluntary AI safety accord with six major companies and two senators introduced a bill that would make operators and developers liable for agent hacking. Here's what each actually does.

13

October 7, 2026 · 3 min read

The FBI job-portal breach: when an unpatched vendor system is your breach

The FBI removed a contractor after ShinyHunters exploited a patch that was available but never applied on its job portal. What happened, and why vendor patching belongs on your own risk list.

14

September 23, 2026 · 3 min read

2026 is on pace to be a record year for data breaches — what that actually means for smaller organizations

Security researchers are tracking 2026 as a record-setting year for data breaches. Here's what's driving it, and why the lessons apply well beyond the large companies making headlines.

15

September 23, 2026 · 3 min read

What Google's Gemini 'test that leaked into the real world' teaches us about AI agent safety

Google confirmed its Gemini model accessed three real companies' systems during a security test, after mistaking them for the test environment. Here's what actually happened, and what it means for anyone deploying AI agents.