Skip to content

Bits, bytes and breaking security news

At Firewall Pulse you will find daily coverage of cyber attacks, cloud security and vulnerabilities and step-by-step guides written for security operations teams. Bits, bytes and breaking security news. Last updated October 20, 2026.

Firewall Pulse

Vulnerabilities

Pillow Heap Out-of-Bounds Read in TIFF Decoding Exposes Memory

A vulnerability in Pillow allows attackers to extract heap memory by uploading malformed TIFF images, with no authentication required.

Cyber Attacks

FTC: Senior fraud losses hit $3B in 2025, driven by surging investment scams

Oct 20, 2026

Federal Trade Commission data shows fraud losses for adults over 60 surged five-fold since 2020, driven by large investment scheme payouts.

GenAI Powers Ransomware: Faster Social Engineering and Data Discovery

Oct 17, 2026

Microsoft disables 20,000 accounts linked to YAM Store phishing infrastructure

Oct 16, 2026

NodeZero and Torq Auto-Remediate Exploit Paths in Network, Cloud, and Identity

Oct 15, 2026

Passkeys Remain Secure While Attackers Exploit Enrollment and Device Code Flows

Oct 15, 2026

Cloud Security

EasyDMARC and GMO GlobalSign integrate email authentication with verified branding

Cloud Security · Oct 20, 2026

Nscale's $35B Valuation Shakes as Microsoft Cancels 23,000-Chip Essex Deal

Cloud Security · Oct 19, 2026

ASD Essentials Replaces Essential Eight With Broader Cyber Framework

Cloud Security · Oct 16, 2026

Unsecured Cloud Databases: 7 Mistakes Leaving Data Open

Cloud Security · Oct 14, 2026

Vulnerabilities

Vulnerabilities

MCP SDK Vulnerability Allows HTTP Memory Exhaustion via Unbounded Inputs

Attackers can crash Model Context Protocol servers by sending large arrays, causing out-of-memory errors without needing credentials.

Oct 20, 2026

Vulnerabilities

VikRentCar CSRF Flaw in Versions Up to 1.4.8

A high-severity cross-site request forgery vulnerability in VikRentCar allows Cross Site Request Forgery.

Oct 20, 2026

Vulnerabilities

ThreadX Module Manager Use-After-Free Flaw Exposes Kernel Objects

Eclipse ThreadX up to 6.5.1.202602a contains a high-severity memory error allowing deallocation of active kernel control blocks.

Oct 20, 2026

Vulnerabilities

Red Hat Strimzi Console: Arbitrary Image Deployment Enables Cluster-Wide Control-Plane Access

Attackers with create permissions on Console resources can deploy arbitrary images to gain cluster-wide Strimzi control-plane access.

Oct 20, 2026

Data Breaches

Data Classification Mistakes That Expose Your Infrastructure

Credit Freezes: 6 Common Misunderstandings That Leave You Exposed

Email Account Compromise Prevention Checklist for Secure Operations

Password reuse is a security risk: how to break the chain

Latest news

20 Oct
Vulnerabilities

Google Cloud Shell Cross-Site WebSocket Hijacking Patched

An unauthenticated flaw in Cloud Shell allowed session hijacking and token theft. Google patched the issue on 22 July 2026, requiring no customer action.

20 Oct
Vulnerabilities

YS-infoware BA-Workflow SQL Injection Enables Authenticated Users to Delete Database Records

Authenticated users of BA-Workflow versions prior to 3.6 can inject SQL to read, modify, or delete database records, posing a high severity risk.

19 Oct
Vulnerabilities

Pillow PDF rewriting flaw triggers infinite loops and service denial

A logic error in the Python imaging library allows crafted PDFs to lock workers in infinite cycles, risking denial of service for affected applications.

19 Oct
Vulnerabilities

Grav CMS Information Disclosure via Twig Sandbox Bypass in Page Frontmatter

Page editors in Grav CMS versions before 2.2.2 can expose sensitive configuration data to all visitors through a frontmatter directive bypass.

19 Oct
Vulnerabilities

NocoBase SQL Injection Allows Privileged Users to Bypass Validation

A flaw in NocoBase through 2.2.28 lets attackers store unvalidated SQL via the collection plugin, risking database exfiltration.

19 Oct
Vulnerabilities

sqlparse PHP Injection Flaw Allows Remote Code Execution

A high-severity vulnerability in sqlparse allows attackers to inject PHP code via unescaped dollar signs in SQL text, affecting versions through 0.6.0.

19 Oct
Vulnerabilities

Bearer CLI SAST Ranks Code Flaws by Proximity to Health Records for Effective Triage

The free static analysis tool ranks code flaws by their proximity to personal data, helping teams triage findings from standard weakness lists more effectively.

19 Oct
Threat Intelligence

OSINT tools for investigators: spotting the silent traps

Open-source intelligence tools leak investigator identity long before targets notice the active data collection.

About Firewall Pulse

What does Firewall Pulse cover?

Firewall Pulse covers cyber attacks, cloud security, vulnerabilities, data breaches, malware and ransomware, threat intelligence. You get the news first, then 114 guides that show how the attacks and the fixes work.

Where does Firewall Pulse get its information?

Firewall Pulse gets its information from more than 150 sources, led by official advisories, the CISA Known Exploited Vulnerabilities catalog, the National Vulnerability Database, vendor notices and published research. The sources are listed at the end of each article.

How often is Firewall Pulse updated?

Firewall Pulse is updated as soon as a primary source confirms a story, at any hour. The fastest sources are checked every 45 seconds. Short first reports are extended later, and guides are revised when they go out of date.

Is AI used to write Firewall Pulse articles?

Yes. AI has been used to draft Firewall Pulse articles from the listed sources since 2026. Automated checks reject numbers, quotes and claims the sources do not back up. See the editorial policy, or the corrections page to report an error.