← All stories

Vulnerabilities

Microsoft 365 accounts compromised at 79 organizations, no passwords needed

By Help Net Security1 min read

An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress.

Cover for a vulnerabilities story

An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress.

Source: Help Net Security

Cover for a vulnerabilities story

Vulnerabilities

Brotli Compression Bug (CVE-2026-111497) Reaches Far Beyond Node.js

A remotely exploitable out-of-bounds write flaw in Google's widely used Brotli compression library, publicly disclosed by Node.js on October 21, 2026, affects software well beyond the Node.js ecosystem, Help Net Security reported. Attackers who can get an application to decompress crafted Brotli data via node:zlib can corrupt process memory, potentially causing crashes or memory disclosure.

1 min read

AI-written summary Source: Help Net Security · Fetched

Cover for a vulnerabilities story

Vulnerabilities

Hackers Flood Inboxes With Spam, Then Pose as IT Support on Microsoft Teams

Attackers are flooding employees' inboxes with spam and then contacting them on Microsoft Teams posing as IT help desk staff, offering to fix the very problem they created. Arctic Wolf documented more than 400 incidents involving abuse of the Teams external chat feature, Help Net Security reports.

1 min read

AI-written summary Source: Help Net Security · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.