Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes
Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware
Security Feed
Cybersecurity news & advisories
500 articles 45 of 45 sources updated RSS ↗
Trending
Cross-source coverage · last 72 h
Microsoft releases out-of-band Windows fixes with certificate updates
Bleeping Computer
CyberScoop
Elastic Security Labs
Huntress
Infosecurity Magazine
Proofpoint Threat Insight
The Hacker News
The Register Security
+5
Microsoft has released another out-of-band update for Windows, but this one isn't an emergency fix for the latest breakages. This time, it's all about certificates. The non-security out-of-band release applies to supported OSes ranging from Windows 11 and Windows Server 2025, to Windows 10. It's all about updating the current certificate trust list (CTL) of devices that cannot access Microsoft's certificate-update service, or where automatic CTL updates are disabled. It also contains everything in the October 13 update, including the ongoing VPN issues and the change that could break…
The Register Security
Microsoft releases out-of-band Windows fixes with certificate updates
26m ago
The Hacker News
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
46m ago
CyberScoop
What happens when security tools go dark before the ransomware
2h ago
Huntress
AI, Scripts, Operator: Inside the ConnectWise Attack
17h ago
Proofpoint Threat Insight
Proofpoint Joins Microsoft Integrated Cloud Email Security (ICES) Ecosystem
20h ago
The Hacker News
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
21h ago
Bleeping Computer
Microsoft releases emergency .NET patches for critical Brotli flaw
21h ago
Infosecurity Magazine
Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw
26 Oct
The Hacker News
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
26 Oct
Elastic Security Labs
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
26 Oct
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
CyberScoop
Microsoft Security
Rapid7 Blog
Tenable Blog
The Hacker News
Wiz Research
+3
CVE-2026-111497 ↗
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but
Tenable Blog
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
11h ago
CyberScoop
Experts temper emergency-level alarms over critical Brotli defect
12h ago
The Hacker News
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
19h ago
Rapid7 Blog
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
19h ago
Wiz Research
Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
25 Oct
Microsoft Security
CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
25 Oct
Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE
404 Media
Bleeping Computer
Cyber Security News
SANS Internet Storm Center
SecurityWeek
+2
Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of iPad models. The most serious issues sit in WebKit, the engine behind Safari and most in-app browsers on Apple devices. Apple says malicious web content could run code on a device. That is a remote code execution risk, and it is the reason this update should not wait. Apple published the full list in its security content document for iOS 27.2 and iPadOS 27.2 . The company does not report active use of these flaws in real attacks. That does not…
SecurityWeek
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
1h ago
Cyber Security News
Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE
1h ago
Bleeping Computer
Apple backports CoreGraphics zero-day patches to older iPhones
2h ago
Cyber Security News
Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones
3h ago
SANS Internet Storm Center
Apple Patches for October 2026, (Mon, Oct 26th)
10h ago
404 Media
iPhone Duo Users Are Already Seeing a Big Old Crease in the Middle of Their $2,000 Foldable iPhone
20h ago
PHP2Shell: No login, no app code, no warning. What next?
Bleeping Computer
CISA Alerts & Advisories
Cisco Security Advisories
ESET WeLiveSecurity
Tenable Blog
The Register Security
+3
CVE-2026-109618 ↗
CVE-2026-109619 ↗
If you run PHP anywhere in your environment, patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Two critical flaws disclosed last week, CVE-2026-109618 and CVE-2026-109619 (nicknamed "PHP2Shell"), let an unauthenticated attacker run code on a server with nothing more than a crafted web request. Both carry a CVSS v4.0 score of 9.2, every earlier release is affected, and exploitation in the wild has been reported. The patch is the easy part. The hard part is finding every copy of PHP you own, because PHP rarely shows up where you expect it. This post covers what the flaws are, how far…
Cisco Security Advisories
Vulnerabilities in PHP Affecting Cisco Products: October 2026
16h ago
Tenable Blog
Discover and remediate PHP2Shell exposure with Tenable
17h ago
ESET WeLiveSecurity
PHP2Shell: What to know about two critical PHP flaws
23h ago
CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
26 Oct
Bleeping Computer
PHP2Shell security flaws now sucessfully exploited in the wild
26 Oct
The Register Security
PHP2Shell: No login, no app code, no warning. What next?
26 Oct
Worm armed 42 GitHub repos by hiding a payload too big to fail
Dark Reading
Infosecurity Magazine
The Hacker News
The Register Security
Wiz Research
+2
A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to stay hidden from GitHub and automated scanners, according to JFrog researchers. Threat hunters at SafeDep, an open source supply chain security firm, first spotted the “testmetest” npm campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As with earlier npm worms, the…
The Register Security
Worm armed 42 GitHub repos by hiding a payload too big to fail
14h ago
The Register Security
LiteLLM supply chain attack started with an exposed master key
16h ago
Dark Reading
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
18h ago
Infosecurity Magazine
Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens
21h ago
Wiz Research
The Pwn Request Reckoning: What Still Works Against GitHub Actions
23h ago
The Hacker News
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
26 Oct
Wiz Research
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
25 Oct
Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys
Cyber Security News
Infosecurity Magazine
Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break into exposed panels for Cairn, a platform that gives AI agents goals and lets them work on their own. Once inside, the attackers push new tasks into those agents. These tasks install unauthorized SSH keys, download a remote access trojan, and search for stored API keys. The activity started on October 20, 2026, although some signs point to earlier probing. Cairn is built to make AI agents easy to run. A user defines a goal and a starting…
DreamHost Forces Email and FTP Password Resets Following Unexplained Security Incident
Cyber Security News
SecurityWeek
DreamHost forced password resets for affected email and FTP/SFTP accounts after an unexplained incident disrupted webmail and File Manager, preventing sign-ins until new credentials are set. DreamHost said the password resets were precautionary but has not disclosed the cause or confirmed data theft. The incident began on October 23, 2026, with File Manager connectivity issues. Later updates reported webmail errors and expanded the password resets to FTP/SFTP users. By October 26 at 3:35 p.m. PDT, engineers had restored the File Manager. They monitored the fix, but password changes remained…
University of Copenhagen data breach exposes data of 525,000 people
Bleeping Computer
Infosecurity Magazine
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.
Microsoft releases emergency .NET security fixes for Google Brotli bug
CCCS Alerts & Advisories
The Register Security
To address a vulnerability in Google's Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update "as soon as possible" after releasing an out-of-band (OOB) security update. It released new versions for .NET 8, 9, 10, and .NET 11 to patch against the Brotli bug, following similar updates from Node.js, Python, and other projects. Senior program manager Rahul Bhandari said in the October 25 release that the buffer overflow vulnerability in Brotli, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft's advisory…
Industrial Vendors Check Products for PHP2Shell Vulnerabilities
CCCS Alerts & Advisories
SecurityWeek
Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities.
Kali Linux 2026.3 released with 6 new tools, desktop updates
Bleeping Computer
Infosecurity Magazine
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more.
Latest
Microsoft releases out-of-band Windows fixes with certificate updates
Microsoft has released another out-of-band update for Windows, but this one isn't an emergency fix for the latest breakages. This time, it's all about certificates. The non-security out-of-band release applies to…
Simplify User Access Management with SCIM on Rapid7 Command Platform
Managing access to security tools shouldn't require another manual process. As organizations grow, keeping user accounts and permissions up to date becomes increasingly complex. Employees join, change roles, and leave…
The web’s having a rough week. Here’s how to browse safely
You recognize the website. You’ve visited it before. You may even have it bookmarked. Then it asks you to do something unusual: install an update, allow notifications, or run a command to prove you’re human. Stop and…
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account…
Unexplained DreamHost Incident Prompts Email, FTP Password Resets
The company says it reacted to an issue affecting some of its systems, including DreamHost webmail.
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
This article is published for educational purposes only, to raise awareness among information security professionals. The research was part of an official bug bounty program on a major platform. We notified the cloud…
From industry concern to practical action: the value of working with regulators
How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity
Design Tenets for Agent Identity Management Systems
This blog #2 in our series on agentic identity, authentication and authorization. Our other post can be found via Post #1. In our last blog post, we highlighted the essential nature of having fundamentally sound…
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones.
Attack on email hosting provider for German far right party AfD exposed 345k accounts
The cyberattack on Alternative for Germany (AfD), the country’s most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email…
Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit…
Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges
HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes namespace. Tracked as CVE-2026-110720, the flaw affects…
AI-Generated Fake Login Pages Are Making Account Takeovers Easier
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific…
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and…
Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE
Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of iPad models. The most serious issues sit in WebKit, the engine…
Copenhagen University Breach Compromises Data on Half a Million People
Hackers have stolen personal information on over 520,000 people from the University of Copenhagen
Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys
Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break into exposed panels for Cairn, a platform that gives AI agents…
Samsung TVs without mics may listen through soundbars, researcher says
A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent. The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that…
Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
Anthropic presents its own initial public offering as a step toward mitigating the risks it believes AI poses.
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
First ISC2 AI Security Certification Expected for Early 2027
ISC2 is seeking 3000 volunteers to enrol to a pilot exam phase for its upcoming AI security certification
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.
From federal SOCs to Talos: Ryan Fetterman on practical security research
What does it mean to be "blue collar" for the blue team? Amy sat down with security researcher Ryan Fetterman to discuss his journey from federal agency work to his new role at Talos. He shares the realities of…
What happens when security tools go dark before the ransomware
On Oct. 1, threat researchers reported that the China-linked group behind Warlock ransomware, which Microsoft tracks as Storm-2603, had attacked at least four organizations in the prior two months. A water utility and a…
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges.
Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones
Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a CoreGraphics zero-day vulnerability that attackers may have used in targeted attacks. Released on October 26, 2026, the updates bring security fixes to older…
Watchdog Urges Police and Fire Service to Improve Cybersecurity
UK police forces and fire and rescue services have been urged to strengthen cybersecurity as rising cyber threats outpace current defenses
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators…
Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.
Hacker Uses AI to Breach 90 South Korean Organizations and Steal 8.2 Million Records
South Korean police have arrested a 32-year-old man accused of leading an AI-assisted hacking operation that stole personal records and internal files from about 90 organizations, totaling 8.2 million records. Targets…
Alibaba’s Qwen AI Said It Wouldn’t Execute Commands, Then Tried to Send Data to China
Alibaba’s Qwen3.8-Flash-Next attempted an unexpected upload to an Alibaba Cloud storage bucket in Beijing during a closed security test, according to Cohere. The model’s reasoning had just stated that it would not call…
University of Copenhagen Data Breach Exposes 525,000 People’s Personal Data, Including Phone Numbers
The University of Copenhagen has confirmed a data breach that exposed personal information belonging to about 525,000 people after hackers accessed a university test environment. The affected database contained full…
DreamHost Forces Email and FTP Password Resets Following Unexplained Security Incident
DreamHost forced password resets for affected email and FTP/SFTP accounts after an unexplained incident disrupted webmail and File Manager, preventing sign-ins until new credentials are set. DreamHost said the password…
OpenAI Unveils GPT-6.1 Terra, a Faster AI Model With Critical Cybersecurity Capabilities
OpenAI has introduced GPT-6.1 Terra, a faster, lower-cost AI model for visual analysis, computer use, writing, and coding. Released on October 26, the model also carries a Critical cybersecurity capability rating under…
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work…
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by…
Top 10 Best Confidential Computing Platforms in 2026 [Ranked & Scored]
Encryption always had a hole: data must decrypt to compute, and whoever owns the machine cloud admin, hypervisor, intruder with root could watch. Confidential computing closes it with hardware-enforced trusted execution…
Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products.
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with…
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The…
Apple Patches for October 2026, (Mon, Oct 26th)
Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update.
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque and canceled appointments at more than 30 clinics.
Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder…
Japanese virtual desktop cloud hacked so hard it asks to be banned
Japanese ISP GMO Internet has warned customers the cloudy desktop service it offers as an ideal foreign exchange trading environment was compromised by an attacker, and that it had been slow to improve the service's…
So Many AI Security Benchmarks, But None Tell the Whole Story
Measuring AI model security gets complex fast — a growing patchwork of benchmarks targets different variables in the equation, but none replace testing against your own code and workflows.
Experts temper emergency-level alarms over critical Brotli defect
Alarm bells ratcheted up yet again about an AI-discovered vulnerability that could — if exploited in the wild — destabilize vast stretches of the internet. The critical defect — CVE-2026-111497 — affects the…
Worm armed 42 GitHub repos by hiding a payload too big to fail
A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to…
University of Copenhagen data breach exposes data of 525,000 people
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.
Risks & Rewards: How AI Is Redefining the CISO's Role
Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.
Alibaba's Qwen AI caught trying to contact server in China
Open-weight models from China have become very popular, but they've also raised some security suspicions. Cohere, a Canada-based biz that offers AI models to enterprises, says that when it was testing Alibaba's…
Former pentester used ARTEX AI to steal 8.2 million data records
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks.
Texas sues OpenAI for deceiving consumers about safety, seeks sweeping reforms and fines
In an unusual move, the suit — brought under the state’s deceptive trade practices laws — seeks to hold founder and CEO Sam Altman personally liable for the alleged deception.
In-the-Wild Attack Abuses AI Agents' Trust in Markdown
A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.
OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models.
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight…
LiteLLM supply chain attack started with an exposed master key
LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret-stealing part of the incident began when someone uploaded…
Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI
A string of hacking incidents by rogue AI agents also has raised fears the technology will slip free of human control to carry out harmful, life-threatening tasks.
Proton To ‘Re-Interview’ Staff About AI To See Who Gets To Keep Their Job
Proton, the company behind ProtonMail and other privacy-focused products, told staff on Monday it would be ‘re-interviewing’ staff across the company about how they use AI in their jobs, with the implication that the…
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global…
Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell…
DreamHost forces password resets in ongoing "incident"
DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface.
AI, Scripts, Operator: Inside the ConnectWise Attack
Microsoft says an AI agent drove the ConnectWise attack. Huntress telemetry is consistent with that: scripted tooling, steered by an operator.
No articles found
Try adjusting your search, category, tags, source selection, or date range.