Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
Founded in 2025 by Unit 8200 alumni, Tel Aviv-based Mave uses AI agents to investigate alerts across existing security stacks.
Security Feed
Cybersecurity news & advisories
500 articles 45 of 45 sources updated RSS ↗
Trending
Cross-source coverage · last 72 h
Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations
Bleeping Computer
Cyber Security News
Dark Reading
Huntress
Infosecurity Magazine
+2
Microsoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations with external contacts, where attackers can pose as trusted support staff and ask employees to share sensitive information. Microsoft detailed the change in Message Center notice MC1519866 , published on October 21, 2026. Targeted Release is scheduled to begin in early November and finish by mid-November. Worldwide general availability is expected to start in early December and…
Cyber Security News
Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations
6h ago
Bleeping Computer
Microsoft Teams to get AI-powered, context-aware phishing detection
23 Oct
Bleeping Computer
Microsoft: Windows Server 2016 reaches end of support in January
23 Oct
Dark Reading
AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack
23 Oct
Infosecurity Magazine
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
23 Oct
Dark Reading
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
22 Oct
Huntress
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
22 Oct
Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
CCCS Alerts & Advisories
Cisco Security Advisories
Cyber Security News
Palo Alto Unit 42
+1
CVE-2026-109618 ↗
CVE-2026-109619 ↗
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory on October 24, 2026. It said it was not aware of malicious exploitation against its products. However, Unit 42 has seen proof-of-concept exploits for the wider PHP vulnerabilities, known as PHP2Shell . PHP RCE Vulnerabilities Both flaws involve PHP’s…
Cyber Security News
Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
24 Oct
Cisco Security Advisories
Vulnerabilities in PHP Affecting Cisco Products: October 2026
23 Oct
Palo Alto Unit 42
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)
23 Oct
CCCS Alerts & Advisories
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 1
23 Oct
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
Bleeping Computer
Cyber Security News
SecurityWeek
The Hacker News
+1
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
The Hacker News
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
24 Oct
Cyber Security News
Anthropic’s Claude Mythos 5 AI Agent Tried to Inject Malicious Code and Trick Real Developers
24 Oct
SecurityWeek
LiteLLM Compromised in Fresh Supply Chain Attack
23 Oct
Bleeping Computer
Machine speed attacks require machine speed detection and response
22 Oct
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Microsoft Security
The Hacker News
CVE-2026-102208 ↗
CVE-2026-83862 ↗
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
The Hacker News
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
23 Oct
Microsoft Security
CVE-2026-83862 Windows Network Load Balancing Remote Code Execution Vulnerability
23 Oct
Microsoft Security
CVE-2026-102208 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
23 Oct
Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands
Cyber Security News
Wiz Research
CVE-2026-115547 ↗
Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when the Admin Console processes specially formatted configuration values. An attacker with administrative access can use those values to trigger command execution under the OAG service account. The disclosure does not describe an…
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
CCCS Alerts & Advisories
The Hacker News
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
The Hacker News
The Register Security
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
The Hacker News
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
23 Oct
The Hacker News
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
22 Oct
The Register Security
Max-severity GitLab bug allows remote code execution over 12 years of releases
22 Oct
Quest Diagnostics confirms data breach exposed patient records
Bleeping Computer
SecurityWeek
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
Atlassian Patches 75 Flaws in Data Center and Server Products
CCCS Alerts & Advisories
SecurityWeek
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
The Hacker News
The Register Security
Linus Torvalds is embracing AI to write Linux kernel code, and some people are having fits. He has a message for them. So do I. Roy Schestowitz, editor of Tux Machines, summed up his reaction to the news as "Linus Torvalds Turns to Slop." In the podcast Pivot to AI, podcaster David Gerard agreed: "Linux kernel goes full AI slop code." Meanwhile, in the Tom's Hardware comments section, commenter "LordVile" wrote: "This is a publicity stunt from his AI overlords [The Linux Foundation] who pay his wage." They followed this by saying this is the "same reason he's flipped-flopped on AI." I've…
Microsoft shares how to fix broken Exchange Online EWS apps
Bleeping Computer
Microsoft Security
CVE-2026-96185 ↗
Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working.
Hackers got a four-day head start on epic PHP2Shell vulnerability
Ars Technica Security
Bleeping Computer
Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems. The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were “now being broadly exploited in the wild.” Read full article Comments
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Bleeping Computer
The Hacker News
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. For
Latest
Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations
Microsoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations…
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. "Based on the current…
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight…
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security…
Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds
Threat actors built an AI agent designed to hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval. The Symantec Threat Hunter Team…
An Ancient Virus Explains Why the Human Brain Is Special
Welcome back to the Abstract! Here are the studies this week that invaded our brains, thought fast, swapped coffins, and hit the art gallery. First, an ancient viral pandemic that afflicted many of our primate…
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began.
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli…
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python…
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on…
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to…
Anthropic’s Claude Mythos 5 AI Agent Tried to Inject Malicious Code and Trick Real Developers
Anthropic has revealed how its Claude Mythos 5 AI agent tried to plant malicious code in a real GitHub project and used fake identities to persuade developers to approve it during a cybersecurity test run by the UK AI…
Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have…
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited…
OpenAI AI Agents Bypass Security Isolation, Exploiting 0-Days in Red-Teaming Tests
OpenAI says its AI agents found zero-day flaws, escaped sandboxes, reached the live internet, and exchanged information across isolation boundaries during large red-teaming tests of its research systems. The findings…
Vulnerabilities in PHP Affecting Cisco Products: October 2026
On October 21, the PHP Foundation announced the availability of a Critical PHP Security release addressing two critical vulnerabilities: CVE-2026-109618 - RCE via OOM corruption CVE-2026-109619 - RCE via stale global…
Friday Squid Blogging: Increasing Squid Populations
This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered…
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code…
[R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2
[R1] Stand-alone Security Patch Available for Tenable Enclave Security Versions 1.7.0, 1.8.0, 1.9.1: SC-202610.2 Arnie Cabral Fri, 10/23/2026 - 16:14 Tenable Enclave Security leverages third-party software to help…
(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.
There's a third PHP2Shell bug, but it won't get an emergency fix
As the PHP2Shell chaos continues, researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems. But this one won’t receive an emergency…
[R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2
[R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2, 6.8.0, 6.9.1: SC-202610.2 Arnie Cabral Fri, 10/23/2026 - 15:52 Security Center leverages third-party software to help provide…
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself.
Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack
An independent evaluation of OpenAI's internal misalignment monitoring system revealed that the system was not fit for purpose during a period when the company's bots were breaking into model-hosting platform Hugging…
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
BOTS WIPED OUT? | Threat Wire
Did Ukraine’s drone strikes on Russian data centers really knock bot traffic down by 90%—and what does that mean for online disinformation? This week on Hack5’s Threat Wire, Ali breaks down Cloudflare’s findings…
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026.
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan…
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to the Python Package Index (PyPI) and distributed through official container images. The malicious package added files that Python could execute…
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past…
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team…
FCC bans two devices with surveillance chips linked to Huawei
The banned items — a wireless video transmitter and dashboard camera — are made with chips manufactured by Huawei subsidiary HiSilicon, which markets its products as “designed for the surveillance market.”
AI Tools Are Generating Massive Attacks for Little Cost
One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027.
Knicks sent employees fake offer of championship rings in phishing test: Report
The New York Knicks organization sent employees a phishing email promising free championship rings in a test of its staff's ability to detect scams, The New York Times reported yesterday. “Congratulations, your Employee…
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system.
Podcast: ‘Reverse-Engineer Anything’ Is the Next Wave of AI Slop
We start this week with Jason’s article about how everyone is apparently reverse-engineering everything. After the break, Joseph tells us about a big AI shakeup at consulting giant Accenture. In the subscribers-only…
Senators say targeted ads are a security risk. Ad groups say the critics are off base
Two senators say that revelations about online targeted advertising being used as a vector for spyware infections underscore the need for better security practices in the industry. Some members of the advertising…
Behind the Blog: Brute Forces
This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top stories of the week came together. This week, we discuss reverse engineering and some wild court docs. SAM: I’m using my…
Metasploit Wrap Up: Langflow, MongoDB, and More
This release adds multiple new modules, and 6 of those modules point at a single target: Langflow , the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated…
PHP shares mitigation for new RCE vulnerability with no patch
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.
WhatsApp May Stop Working Without Registered SIM Under New Rules
WhatsApp users in India may face access issues without a registered SIM under new government rules expected to take effect on January 1, 2027. Messaging platforms reportedly have until December 31, 2026, to comply. The…
Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands
Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console. Tracked as CVE-2026-115547, the vulnerability…
HPE Warns Critical Aruba Networking Flaws Could Let Hackers Take Complete Control of Devices
Hewlett Packard Enterprise has released security patches for multiple vulnerabilities in Aruba Networking wireless software that could let attackers take complete control of affected devices. The flaws affect AOS-8 and…
Japanese Game Maker Capcom Has Confirmed – 11,774,247 Customer Records Exposed
Capcom has announced plans to notify customers after unauthorized access to its CAPCOM ID service affected 11,774,247 records worldwide. The Japanese game publisher disclosed the incident on October 22, 2026, saying the…
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.
Multiple Waves of DDoS Attacks Caused This Week’s Outage in North Korea
Multiple waves of DDoS attacks disrupted North Korea’s public internet services this week, knocking major state websites offline. Kentik’s internet analysis director Doug Madory linked the outages to sudden traffic…
New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data
Researchers has demonstrated Node2Shell, a working exploit that lets an attacker run code inside a Node.js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497 , a…
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub…
Why Caribbean Threats Cascade Into Global Cyber-Risk
The region is demonstrating what happens when exploits accelerate but assurance does not.
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this…
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you…
Cyber Insurance's New Reality: Underwriting Isn't Enough
Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.
UK proposes 14-year prison terms for undersea cable sabotage
In an era of hybrid threats, the British government wants to update the Submarine Telegraph Act 1885, which carries a maximum fine of £1,000 and five years’ imprisonment in cases of deliberate damage.
Resident Evil maker Capcom warns of phishing after 11.7 million records exposed
.kadence-column480618_38f885-ca > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column480618_38f885-ca > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm…
No articles found
Try adjusting your search, category, tags, source selection, or date range.