• English
  • 简体中文
  • 繁體中文
  • Tiếng Việt
  • ไทย
  • Indonesia
Subscribe
Real-time News
The Iranian Revolutionary Guard Navy stated that if the United States continues to encourage ships to navigate mine-filled waters, Irans countermeasures could extend to US bases in the region.Iranian Revolutionary Guard Navy: Three other ships struck mines and caught fire west of the Strait of Hormuz last night.According to the Financial Times, Turkeys inexpensive Korkut air defense system is selling well, having been deployed in nine countries and reportedly shot down "potentially hundreds" of drones. An undisclosed number of Korkut systems have been deployed to a unit of the Ukrainian Air Force.I. PHP2Shell: Webpage Master Key Copied 1. PHP is a "engine" language for website backends. Many websites (especially content management systems, e-commerce sites, and forums) use it to generate dynamic pages and connect to databases. 2. Two vulnerabilities were exposed that allow remote control of servers without usernames or passwords, affecting almost all versions of PHP from 5.4 to 8.5.11. An official patch was released on October 21st, but no further fixes are provided for versions 8.1 and earlier. II. GitLab: A Perfect 10/10 "Accessless Intrusion" 1. GitLab is a "one-stop shop" for software development. Development teams use it to store code, review modifications, automate testing, and deploy. Many companies install it on their own servers (self-hosted GitLab). 2. Self-hosted GitLabs are affected from version 7.0 onwards. Attackers do not need to log in; they only need to submit a carefully crafted regular expression to execute arbitrary code on the server. An official patch was released on October 21st. III. LiteLLM 1.107.0: Malicious Version Leads to Complete Key Loss 1. LiteLLM is a commonly used toolkit for AI applications. Many AI products and intelligent agents use it to manage keys, allocate requests, and control costs. 2. On October 21, its release process was compromised. A malicious version 1.107.0 was stuck on PyPI and Docker for approximately 1 hour and 44 minutes. Once installed and started, it steals SSH keys, cloud service credentials, and AI tool keys, leaving a backdoor. IV. Node.js: Three Version Lines Have Issues, the Most Serious One Allows Remote Code Execution 1. Node.js is a runtime environment that allows JavaScript to run on servers. Many website backends, real-time applications (chat, collaboration tools), and API services rely on it. 2. A total of 10 vulnerabilities were patched across the Node.js 22, 24, and 26 version lines. The most serious is the Brotli decoder out-of-bounds write vulnerability (CVE-2026-111497), which could lead to remote code execution and is rated "high risk". V. eMudhra: Certificate Authoritys "Lock" Opened in Seconds, HTTPS Trust Foundation Shaken 1. eMudhra is an Indian "Digital Identity/Certificate Authority". 2. The private keys associated with eight intermediate certificates of this authority have serious security vulnerabilities, with abnormally weak key strength, and could be used to forge trusted website certificates. Chrome, Firefox, and Apple have blocked these certificates. VI. Railway: Hosting Platforms "Safe" Pried Open, Some Passwords Leaked 1. Railway is a cloud deployment platform for developers. 2. The Railway hosting platforms encrypted environment variables were accessed, and some have been decrypted. Deployment has been suspended, and the official requirement is for all users to rotate their keys. VII. Agent2Shell: AI Programming Assistant "Execute First, Ask Later" 1. Agent2Shell is a type of attack targeting AI programming assistants. The AI programming tools involved (such as Claude Code, Cursor, Codex, Gemini CLI) are intelligent assistants that help developers automatically write code, modify code, and execute terminal commands. 2. An attacker places a malicious configuration in the repository, and Claude Code, Cursor, Codex, and Gemini will execute the attackers code before the model is invoked and a trust confirmation pop-up appears. VIII. Cisco Expressway: Root Access Without Login 1. Cisco Expressway is Ciscos enterprise video conferencing/unified communications gateway. 2. On October 21, Cisco disclosed a perfect edge-level vulnerability in the Expressway series. Attackers can execute arbitrary operating system commands with root privileges without authentication, as long as they have access to the device, and there are no temporary mitigation measures; only patching is possible. IX. CISA Adds Six Exploited Vulnerabilities 1. On October 20, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its known exploitable vulnerability list, involving products such as Plex Media Server, EG Secure Solutions SiteGuard Server Edition, and Siemens Software Center. Among them, the DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center has been confirmed to be actively exploited.Market news: In an interview, Trump stated that the US "has not" been negotiating with Iran and expects a new development "soon." "Most people seem to think the outcome will be after the election; well see."

WTI anticipates a decline to reach $80 per barrel as global growth predictions diminish

Alina Haynes

Sep 23, 2022 11:58

截屏2022-09-22 下午4.34.43_1024x576.png 

 

West Texas Intermediate (WTI) futures on the New York Mercantile Exchange (NYMEX) are experiencing selling pressure while attempting a positive reversal. Oil prices are hanging at $83, and it is anticipated that they will continue to decline to roughly $80. In a larger sense, the black gold has had a weak performance over the past three weeks after giving up the psychological support of $90.00.

 

Numerous global resisting triggers have caused a severe decline in oil prices. As a result of the hawkish posture of western central banks on their interest rates, the objective of achieving price stability is at the expense of the breadth of economic activity. There is a fall in economic activity because corporations are not investing because cheap money is unavailable. In addition, the delay of expansion plans has reduced demand projections. Eventually, there is a substantial decline in oil demand.

 

The demand for oil in the huge economy of the United States is declining sharply. In the previous four weeks, the daily demand for gasoline in the United States has dropped by 8.5 million barrels. This is the result of intensifying pricing pressures, which have led households to purchase only the necessities.

 

In the meantime, an unaltered policy pronouncement from the People's Bank of China (PBOC) dampened oil price sentiment. As China's total demand is not increasing and pricing pressures are falling, a rate drop was anticipated. However, the oil bulls were undercut by the PBOC's neutral position.

 

On the supply side, OPEC+ has reduced output by 3.58 million barrels per day, corresponding to 3.5% of world demand. Despite a drop in global production, oil stockpiles are increasing, which bolsters the indicators of an impending recession.