Original: Synology NAS 대상 랜섬웨어 공격 주의 권고
KISA KrCERTCVE-2026-98432 Linux Kernel TCP Flaw
iThome reports that CVE-2026-98432, a 9.8-rated Linux kernel flaw in IPv4 TCP connection handling, affects kernels from 4.4 onward. Remote attackers can reportedly run arbitrary commands as root on servers with MPTCP listeners enabled. Distributions, appliance makers and cloud providers have mixed patch status, with several still investigating or waiting on upstream fixes.
UK NCSC Warns AI-Driven Malware Will Likely Target Critical Infrastructure Ransomware
The UK National Cyber Security Centre assessed that attackers will very likely deploy AI-driven malware for ransomware attacks against UK critical infrastructure by 2028. AI will accelerate exploitation of known vulnerabilities in legacy systems and expand attack surface through newly deployed AI tools, making existing attacks more efficient rather than introducing entirely new methods.
November 2026 Android Security Update Patches 216 Vulnerabilities Across Core
Google released its November Android security update on November 2, patching 216 vulnerabilities: 119 in Android core components and 97 in third-party elements. The update includes 23 critical-severity and 193 high-risk flaws, with the most dangerous vulnerability in the Framework component allowing remote code execution without user interaction.
CISA Warns of Critical Vulnerabilities in EPICS Base Control System Software
CISA released an ICS advisory warning of four vulnerabilities in EPICS Base release 7.0.10 and prior. Successful exploitation could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code across worldwide critical manufacturing deployments. Users are advised to update to release 7.0.11.
AhnLab Analyzes September 2026 APT Shifts Targeting Developer Ecosystems, Cloud Services
South Korean cybersecurity vendor AhnLab reported that advanced persistent threat groups in September 2026 shifted focus toward developer ecosystems, cloud credentials, supply chains, and network trust infrastructure. Attackers exploited legitimate software installers, GitHub, Microsoft 365, OneDrive, Nostr, routers, and TACACS authentication servers across multi-stage attack chains.
Siemens Patches Authentication Bypass Flaw in Mendix SAML Module
Siemens has addressed an authentication bypass vulnerability, tracked as CVE-2026-89209, in its Mendix SAML module. The flaw allows an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens and CISA advise updating affected versions or applying mitigations across Critical Manufacturing and Information Technology environments deployed worldwide.
CISA and International Partners Issue Joint Advisory on SafePay Ransomware Operations
The FBI, CISA, the USSS, and allied German and U.K. authorities released a joint cybersecurity advisory on SafePay ransomware. Active since August 2024, the group has impacted at least 600 separate victims across multiple critical infrastructure sectors in North America, South America, Europe, and Australia using credential theft, edge-device exploits, living-off-the-land tools, and hybrid encryption.
AhnLab Details Suo5 HTTP Tunneling and Pivoting Techniques Across IIS and Jenkins Systems
AhnLab ASEC published an analysis detailing how attackers exploit the Suo5 HTTP and HTTPS tunneling tool for network pivoting and lateral movement. The report documents real-world file deployment on Windows IIS web servers and fileless memory injection within Java-based Jenkins environments, outlining specific execution artifacts and defensive recommendations.
AhnLab Analyzes New Rust-Based Infostealer and Dropper Disguised as Illegal Software
AhnLab identified a new Rust-based information theft malware disguised as illegal programs that first emerged in mid-August and spread widely in September. The malware steals browser, remote access, cloud, and credential data, features sophisticated anti-analysis techniques, and functions as a dropper for additional payloads.
CISA Warns of Critical Flaws in Guangzhou Juan IoT Technology EseeCloud IP Camera Firmware
CISA issued advisory ICSA-26-288-02 regarding three vulnerabilities in Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and Firmware, which could allow an attacker to gain control over affected IP cameras. The vendor did not respond to CISA’s coordination attempts, and the flaws include a critical hard-coded credential vulnerability that allows an attacker to log in to EseeCloud devices across worldwide deployments.