2026 January(387) February(431) March(447) April(451) May(495) June(499) July(647) August(1282) September(893) October(949) November(0) December(0) | YEARS(5 865) STATISTICS (0)
DATE |
NAME | Info |
CATEG. |
WEB |
|
28 .10.26 |
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits | An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. | AI | The Hacker News |
|
28 .10.26 |
FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering | The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named | BigBrothers | The Hacker News |
|
28 .10.26 |
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers | Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers | Vulnerebility | The Hacker News |
|
28 .10.26 |
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws | The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who | Exploit | The Hacker News |
|
28 .10.26 |
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and | Hack | The Hacker News |
|
28 .10.26 |
CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets | Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a | AI | The Hacker News |
|
27.10.26 |
GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption | The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a | Vulnerebility | The Hacker News |
|
27.10.26 |
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads | Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The | Exploit | The Hacker News |
|
27.10.26 |
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens | Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such | Vulnerebility | The Hacker News |
|
27.10.26 |
Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verificatin Key | An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said | Incindent | The Hacker News |
|
27.10.26 |
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption | The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three | APT | The Hacker News |
|
27.10.26 |
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers | A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in | CyberCrime | The Hacker News |
|
27.10.26 |
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections | OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models | AI | The Hacker News |
|
27.10.26 |
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell | Exploit | The Hacker News |
|
27.10.26 |
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento | An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July | Hack | The Hacker News |
|
27.10.26 |
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw | PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and | Vulnerebility | The Hacker News |
|
27.10.26 |
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware | Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in whichW | Spam | The Hacker News |
|
26.10.26 |
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes | Two critical flaws in Wasmtime , a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to | Vulnerebility | The Hacker News |
|
26.10.26 |
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts | A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, | Virus | The Hacker News |
|
26.10.26 |
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations | Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle ( AitM ) relay to | Hack | The Hacker News |
|
26.10.26 |
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs | An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the | Hack | The Hacker News |
|
26.10.26 |
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware | A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, | AI | The Hacker News |
|
26.10.26 |
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers | A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher | Vulnerebility | The Hacker News |
|
26.10.26 |
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity | In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European | Exploit | The Hacker News |
|
25.10.26 |
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot | A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. | Exploit | BleepingComputer |
|
25.10.26 |
Abandoned Popcorn Time app exposed millions of devices to RCE attacks | Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. | Incindent | BleepingComputer |
|
25.10.26 |
Microsoft Teams to get AI-powered, context-aware phishing detection | Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. | AI | BleepingComputer |
|
25.10.26 |
Microsoft: Windows Server 2016 reaches end of support in January | Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. | OS | BleepingComputer |
|
25.10.26 |
Quest Diagnostics confirms data breach exposed patient records | American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. | Vulnerebility | BleepingComputer |
|
25.10.26 |
PHP shares mitigation for new RCE vulnerability with no patch | The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. | Vulnerebility | BleepingComputer |
|
25.10.26 |
You gave your AI agent access, but who is giving it orders? | AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub helps protect agents through skill verification, secure connectivity, and runtime controls that intercept dangerous act | AI | BleepingComputer |
|
25.10.26 |
HPE patches eight max severity RCE and auth bypass AOS flaws | Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. | Vulnerebility | BleepingComputer |
|
25.10.26 |
Railway warns devs to rotate secrets after potential breach | Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. | Incindent | BleepingComputer |
|
25.10.26 |
Capcom confirms data breach affecting 11.7 million accounts | Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. | Incindent | BleepingComputer |
|
25.10.26 |
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication | OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and | AI | The Hacker News |
|
25.10.26 |
LiteLLM release pipeline hacked to distribute info-stealer malware | Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. | AI | BleepingComputer |
|
25.10.26 |
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks | Arista patches new VeloCloud Orchestrator zero-day exploited in attacks | Exploit | BleepingComputer |
|
25.10.26 |
Microsoft shares how to fix broken Exchange Online EWS apps | Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. | OS | BleepingComputer |
|
25.10.26 |
Machine speed attacks require machine speed detection and response | Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical. | Hack | BleepingComputer |
|
25.10.26 |
Amazon says PHP2Shell exploitation began 4 days before patches | Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. | Vulnerebility | BleepingComputer |
|
25.10.26 |
GitLab warns of new max severity code execution vulnerability | GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. | Vulnerebility | BleepingComputer |
|
25.10.26 |
Authorities disrupt nearly 11,000 cybercrime networks in Africa | Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. | CyberCrime | BleepingComputer |
|
25.10.26 |
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks | Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. | AI | BleepingComputer |
|
25.10.26 |
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected | Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. | Incindent | BleepingComputer |
|
25.10.26 |
Lazarus hackers use post-quantum cryptography for malware delivery | North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. | APT | BleepingComputer |
|
25.10.26 |
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. | Hack | BleepingComputer |
|
25.10.26 |
OpenAI agents disabled safety monitoring, one lied about it | OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. | AI | BleepingComputer |
|
25.10.26 |
PHP ships emergency patches for critical PHP2Shell flaws | The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. | Vulnerebility | BleepingComputer |
|
25.10.26 |
ClickFix has never been bigger, and AI tools are its most convincing lure yet | ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures. | AI | BleepingComputer |
|
25.10.26 |
Microsoft PowerToys adds CursorHide, Button Lock mouse tools | Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. | OS | BleepingComputer |
|
25.10.26 |
Microsoft says October updates didn’t actually fix VPN issues | Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. | OS | BleepingComputer |
|
25.10.26 |
CISA: SafePay ransomware hit over 600 critical infrastructure orgs | The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. | Ransom | BleepingComputer |
|
25.10.26 |
Stolen UpdraftCentral keys used to backdoor WordPress sites | A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. | Virus | BleepingComputer |
|
25.10.26 |
Mozilla, Google, Apple block compromised eMudhra CA certificates | Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. | Security | BleepingComputer |
|
25.10.26 |
PHP warns admins of two critical flaws, emergency patches coming tomorrow | The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. | Vulnerebility | BleepingComputer |
|
25.10.26 |
Zeabur shutting down after second security breach in two months | Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. | Incindent | BleepingComputer |
|
24.10.26 |
OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code | OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. | AI | BleepingComputer |
|
24.10.26 |
DHS bans DeepSeek products across US federal civilian agencies | The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. | BigBrothers | BleepingComputer |
|
24.10.26 |
CJIS v6.1 Compliance: 5 Practical Priorities for Agencies | CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness. | Security | BleepingComputer |
|
24.10.26 |
Hacker gets 8 years for stealing $3.3 million from taxpayers | A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. | Hack | BleepingComputer |
|
24.10.26 |
Windows Server 2025 gets support for quick machine recovery | Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. | OS | BleepingComputer |
|
24.10.26 |
OVHcloud CLI releases backdoored on GitHub to steal developer secrets | French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. | Virus | BleepingComputer |
|
24.10.26 |
Ahold Delhaize: Cyberattack affects services across US and Europe | Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. | Incindent | BleepingComputer |
|
24.10.26 |
Revolut outage disrupts online banking operations worldwide | Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. | Hack | BleepingComputer |
|
24.10.26 |
Nikkei discloses third data breach in a month, 1.8M records exposed | Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. | Incindent | BleepingComputer |
|
24.10.26 |
WordPress SEO plugin Rank Math compromised to backdoor websites | Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. | Virus | BleepingComputer |
|
24.10.26 |
Hackers hijack AOMEI update servers to secretly spread malware | Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a | Hack | BleepingComputer |
|
24.10.26 |
Bullhorn takes staffing platform offline to contain cyberattack | Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. | Incindent | BleepingComputer |
|
24.10.26 |
OpenCode hack exposes API keys amid AI distillation attacks | The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. | AI | BleepingComputer |
|
24.10.26 |
Microsoft fixes game, app crashes caused by recent Windows update | Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). | OS | BleepingComputer |
|
24.10.26 |
Inside the Underground Market for Know Your Client Services | Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts. | CyberCrime | BleepingComputer |
|
24.10.26 |
F5 releases out-of-band patches for critical NGINX vulnerabilities | F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. | Vulnerebility | BleepingComputer |
|
24.10.26 |
Microsoft fixes classic Outlook bug that hid Copilot buttons | Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users. | OS | BleepingComputer |
|
24.10.26 |
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software | A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the | Vulnerebility | The Hacker News |
|
24.10.26 |
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline | LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed | AI | The Hacker News |
|
24.10.26 |
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads | Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the | AI | The Hacker News |
|
24.10.26 |
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet | Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own | BotNet | The Hacker News |
|
24.10.26 |
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server | Vulnerebility | The Hacker News |
|
24.10.26 |
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations | Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit | Vulnerebility | The Hacker News |
|
24.10.26 |
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws | Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie | Vulnerebility | The Hacker News |
|
24.10.26 |
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions | Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team | AI | The Hacker News |
|
24.10.26 |
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials | Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as | Hack | The Hacker News |
|
24.10.26 |
How practical is 100k requests per second? Introducing h3fuzz | There was some research that the PortSwigger team released in late September that revealed that they were able to reach 100k requests per second over WiFi using HTTP/3. | Security blog | SEARCH LABS |
|
24.10.26 |
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619) | Whenever a new earth shattering vulnerability like php2shell is released on the internet, our research teams are always rushing to determine the best way we can notify our customers about their exposure to it. We’ve had experience with this, both in vulnerabilities discovered by us (wp2shell), but also novel issues such as react2shell, late last year. | Vulnerebility blog | SEARCH LABS |
|
24.10.26 |
Defining a Zero Day Vulnerability | In cybersecurity, “zero day” is frequently diluted and used as a catch-all for any unpatched vulnerability. This article breaks down the three mandatory elements of a true zero day, illustrating why the distinction between a zero day and a known, but unpatched, flaw is critical for effective defense. | Vulnerebility blog | BeyondTrust |
|
24.10.26 |
AOMEI Backupper supply chain attack - METAL by ManageEngine | Detection: On 28 May 2026, ManageEngine EDR recorded AOMEI Backupper installing Radmin, a commercial remote-administration tool. The same execution chain appeared on a second, unrelated customer endpoint in another country within the same window. | Hacking blog | MANAGEENGINE |
|
24.10.26 |
Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App | In Todyl-monitored tenants, an unauthorized party authenticated to Microsoft Graph as the ConnectWise Cloud Backup application. | Hacking blog | Todyl |
|
24.10.26 |
October 2026 Oracle Critical Patch Update Analysis | Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across the affected Oracle product families. | Vulnerebility blog | Fortra Blog |
|
24.10.26 |
Krybit Ransomware: What You Need to Know | Krybit is the name of a ransomware-as-a-service (RaaS) operation that first surfaced in early 2026. The group rents out the ransomware it has developed to affiliates who carry out attacks on its behalf, splitting ransoms extorted from victims 80:20 (80% to affiliates, 20% to the Krybit operators) in exchange for access to the malware, a dashboard, and round-the-clock technical support. | Ransom blog | Fortra Blog |
|
24.10.26 |
The Art of Security Podcast: Episodes 13–17 Recap | You know the line: defenders have to be right every time, but attackers only have to get lucky once. Tyler and Josh wonder if that gives attackers too much credit. They explore how layered security, deception, active defense, preparation, and threat intelligence can tip the scales toward defenders, and whether the cat-and-mouse idea works the same for an enterprise as it does for you at home. | Cyber blog | Fortra Blog |
|
24.10.26 |
Inside Help TDS: Hotejka and Cloudflare Abuse | Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. | Hacking blog | INFOBLOX |
|
24.10.26 |
FlowerStorm detection and 70+ YARA rules: September 2026 | The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape. | Malware blog | VMRAY |
|
24.10.26 |
vulnerability-discovery-to-active-attacks-ai-in-cyber-operations | Recent PHP disclosures and published investigations into ARTEX indicate that AI is being used across vulnerability research and offensive operations. Darktrace telemetry identified failed authentication activity involving infrastructure that Microsoft later publicly associated with the ARTEX campaign. | Hacking blog | darktrace.com |
|
24.10.26 |
Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor - Real-time Open Source Software | The LiteLLM 1.107.0 release on PyPI carries a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) install them as three files in site-packages. Both run when any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them. | AI blog | Supply Chain Security |
|
24.10.26 |
testmetest npm Packages Carry a Miasma-Family Worm - Real-time Open Source Software Supply Chain Security | An operator is testing a Miasma-family npm worm in public. Between 19 and 22 October 2026, npm received 15 packages with names that end in testmetest. The accounts alexjoipamiba and testnewtestme published four of them. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token. | Malware blog | Supply Chain Security |
|
24.10.26 |
PHP2Noise - Two PHP Critical RCEs Patched As Users Scramble for Fix Amid Misinformation - | A critical PHP exploit leaked ahead of its incoming fix, after PHP alerted users such a fix was incoming. Prior to this fix being released with two critical vulnerabilities being fixed, the internet at large responded quickly by creating alleged PoCs within hours of publication, along with fake recommendations for mitigation. | Vulnerebility blog | Checkmarx |
|
24.10.26 |
Eight Compromised Certificate Authority Keys Have Put The Internet At Risk - Checkmarx | What happens when your random function returns just one byte? It depends: if you’re issuing intermediate CA certificates, you create a global security failure, as the Go language maintainers discovered. Learn about the issue, how it impacts your organization, and what to do next. | Security blog | Checkmarx |
|
24.10.26 |
Mini Shai-Hulud in Tensorlake: A Token Monitor That Can Wipe Your Home Directory - Checkmarx | A malware campaign based on the npm Shai-Hulud tactics hit the Tensorlake AI sandboxing ecosystem. Learn about how it worked, how to detect it, and what to do if you’re impacted. | Hacking blog | Checkmarx |
|
24.10.26 |
Comment2XSS: Zero-Click Pre-Auth XSS to Potential RCE in WordPress Core | This blog post is about an unauthenticated stored XSS vulnerability in WordPress core, tracked as CVE-2026-93485. If you use WordPress, please update to at least version 7.1.1, or to the latest release in your branch. The fix was backported to every supported branch down to 4.7.36. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
Mitigating RCE Impact Like in OpenAI Hack with Defense-in-Depth | On 25 July 2026, researchers from HacktronAI achieved remote code execution (RCE) and administrative access on the Discourse web application deployed at community.openai.com. The attack used the image upload feature, where HEIF/AVIF files were processed by ImageMagick and libheif, which contained a previously unknown memory corruption vulnerability. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | Vulnerebility blog | IDNSEC |
|
24.10.26 |
ValleyRAT sideloads through a signed Microsoft profiler | Tax-themed ISOs sideload ValleyRAT through a signed Visual Studio tool. Five months of builds share one transport key and a text file that hands out new servers. | Malware blog | ADAMNET |
|
24.10.26 |
KeyStealth: A $10,000 PhaaS Kit caught in the wild | A construction quote lure led to device code phishing, three rogue Entra devices named iAuthFlow-Device, and seven weeks of mail access before a thread hijack. | Phishing blog | ADAMNET |
|
24.10.26 |
PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Two unauthenticated RCE flaws in PHP, with exploitation attempts reported. Who is affected, how to check, and the fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. | Vulnerebility blog | Hacktron AI |
|
24.10.26 |
Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web | Forever caught live malware on a customer's machine attempting a new kind of attack: a file planted in the Downloads folder that turns your own AI coding agent against you. Here's how it works on Codex and Claude Code, and why the vector stays open. | Hacking blog | OpenSource Malware |
|
24.10.26 |
Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands | Over the past month we collected and analysed 64 Android samples (first seen 2026-09-15 to 2026-10-16) that are all the same thing: a thin dropper that installs a packed second-stage WebSocket RAT. | Malware blog | Forever Security |
|
24.10.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | STAR Labs |
|
24.10.26 |
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619) | PHP fixed two remote code execution bugs on October 21. They affect PHP 5.4 and later. An attack needs specific knowledge of the target server and specific conditions on it, so mass exploitation is less likely than we first expected. Update PHP anyway. | Vulnerebility blog | Sansec |
|
24.10.26 |
skynox7: Proxyjacking Edge Devices Into Residential Proxies | Adversaries have a wide range of mechanisms they can use to obfuscate their public internet protocol (IP) addresses to avoid attribution and reduce their detectable signature. | Hacking blog | GREYNOISE |
|
24.10.26 |
PHP2Shell: Critical PHP RCE CVE-2026-109618 & CVE-2026-109619 - Blackpoint Cyber | APG SitRep: Critical PHP Remote Code Execution Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Vulnerebility blog | Blackpoint Cyber |
|
24.10.26 |
php2shell by Calif Research | This story outlines the details of two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619) discovered by Calif, OpenAI and Wiz, and addressed in PHP October 2026 Security Release. To understand the bugs, first join us on a journey through time... | Vulnerebility blog | CALIF |
|
24.10.26 |
Beyond Day Zero: Akamai's Rapid Response and AI Threat Intelligence | When critical vulnerabilities emerge, protecting applications requires more than a fast response. It demands early intelligence, precision, continuous adaptation, and customer trust. | AI blog | Akamai |
|
24.10.26 |
Understanding PHP2Shell: Everything You Need to Know | On October 20, 2026, PHP announced that they would release a patch on October 21 at 14:00 UTC for two critical vulnerabilities. | Vulnerebility blog | Akamai |
|
24.10.26 |
When DNS Trust Breaks: What the Counterfeit Google Certificates Reveal | Between September 22 and 27, 2026, attackers hijacked the .gh, .sl, and .as country-code TLD registries and obtained 12 publicly trusted TLS certificates for Google and YouTube domains without compromising Google or the issuing certificate authorities. | Cyber blog | Akamai |
|
24.10.26 |
Comply with PCI 6.4.3 & 11.6.1 Through Client-Side Security Tools | The PCI DSS v4 is a critical defense against growing web skimming attacks (also known as e-skimming and digital skimming) and data leakage risks. | Security blog | JSCRAMBLE |
|
24.10.26 |
Why is Preemptive Cyber Defense Important in 2026? | Preemptive cyber defense is a prevention-first security strategy that stops threats before they execute, rather than detecting and responding to them after they have already run. Instead of recognizing an attack in progress, it removes the conditions an attack needs to succeed, blocking malicious code deterministically at the moment of execution. | Cyber blog | Morphisec Blog |
|
24.10.26 |
Same Vulkan Host, Different Payload: Inside VulcanRAT207.B | Our previous investigation traced a WhatsApp-delivered lure through Statement.exe to VulcanRAT207.A, a port 8888 WebSocket RAT running with SYSTEM privileges. Continued analysis of the recovered workspace identified a related Vulkan package that uses the same signed host but follows a different loader, installation, command-and-control (C2), and kernel-driver path. | Malware blog | Morphisec Blog |
|
24.10.26 |
Plug me if you can: Exploiting USB Printer Drivers in Windows | Windows loads the appropriate kernel driver by interpreting USB Descriptor when a USB device is connected. If the data sent by the device is not properly validated, this can lead to kernel-level vulnerabilities. | Exploit blog | Ethiack |
|
24.10.26 |
Vulnerability Analysis of PHP2Shell (CVE-2026-109618 & CVE-2026-109619) | PHP is one of the most widely deployed server-side scripting languages, powering everything from small websites to large commercial applications. Because it typically runs tightly integrated with the web server, a vulnerability in the PHP runtime can affect a broad range of services regardless of the application framework or business logic built on top of it. | Vulnerebility blog | Enki White Hat |
|
24.10.26 |
Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts | LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts. In addition to recent reporting by The Hacker News, our analysis examines the kit's evolving techniques and infrastructure, highlighting key changes observed across analyzed variants. | Phishing blog | LEVELBLUE |
|
24.10.26 |
PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers | On October 21st, two critical memory manipulation vulnerabilities were disclosed in a joint announcement by Wiz Research, Calif, OpenAI, and the PHP team. The two vulnerabilities, combined, are being called PHP2Shell. The vulnerabilities are in PHP Core, which means any web application running on top of PHP is likely vulnerable. Estimates suggest that this is over two-thirds (2/3) of the web. | Vulnerebility blog | LEVELBLUE |
|
24.10.26 |
Now Detecting: CVE-2026-109618/CVE-2026-109619 (php2shell)k | CVE-2026-109618 and CVE-2026-109619 are two remote code execution vulnerabilities in PHP core. The PHP security team rates both CVSS v4.0 9.2 (php.net). The figure of 10.0 that circulated earlier came from the leak, not from PHP. | Vulnerebility blog | Ethiack |
|
24.10.26 |
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials | A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys. | AI blog | Socket |
|
24.10.26 |
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline | PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline. | Vulnerebility blog | Socket |
|
24.10.26 |
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches | The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release. | Vulnerebility blog | Socket |
|
24.10.26 |
PHP2Shell Shows the Shrinking Time to Patch | PHP2Shell, the two critical unauthenticated remote code execution vulnerabilities disclosed Wednesday in PHP, had been hiding in one of the Internet’s most widely used software components for more than a decade. Researchers at Calif and Wiz used frontier AI models during the research that led to their discovery and exploitation. | Vulnerebility blog | GAMBIT |
|
24.10.26 |
Cloudflare deploys protections against php2shell vulnerability | Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic. | Vulnerebility blog | Cloudflare Blog |
|
24.10.26 |
8 eMudhra certificates are compromised. Here's what you need to know | On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and also within Cloudflare. Because the keys themselves are weak, an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic. | Incident blog | Cloudflare Blog |
|
24.10.26 |
Introducing tsrs: a Port of TypeScript to Rust | Cloudflare and VoidZero are now working with Max Schwenk of Owner.com on tsrs, a Rust port of the TypeScript compiler. We are doing this work in close collaboration with the TypeScript team, and incubating tsrs as part of the Oxc JavaScript compiler toolchain. | Cyber blog | Cloudflare Blog |
|
24.10.26 |
Introducing Clairic, a new System One class of extraction models | Today, we're announcing a preview of a new class of System One-style models: extraction models. Our first one, Clairic, is available hosted on Workers AI as @cf/cloudflare/clairic.We intend to release the model open-weights soon. Clairic is an extraction model that is able to extract, compute, estimate, and forecast values from unstructured inputs — all at a significantly higher accuracy, faster latency, and cheaper cost than traditional LLMs. | AI blog | Cloudflare Blog |
|
24.10.26 |
There's always a patient zero: Defending the NetScaler front door before the patch | The recent disclosure of a major vulnerability in Citrix NetScaler pointed to a widespread weak point: a login page is an attack surface that can be used to compromise and access an application server. | Vulnerebility blog | Cloudflare Blog |
|
24.10.26 |
Localizing compliance at scale: Achieving South Korea’s ISMS certification | For ten days, auditors appointed by the Korea Internet & Security Agency (KISA) sat together with us and worked through 80 controls. That is what it took for a company headquartered in the United States, operating a global network serving Korean users, to be certified in South Korea. Cloudflare has now obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework. | Cyber blog | Cloudflare Blog |
|
24.10.26 |
Athena StealthRoute: A Phishing Marketplace with Cloaking and AI Tools | Athena StealthRoute is a previously unreported modular phishing-as-a-service platform offering a marketplace, link cloaking, and AI tools for lures and decoys. | Phishing blog | Abnormal AI |
|
24.10.26 |
The Prompt Is the New Attachment: Sensitive Data in AI | Nearly 40% of employee AI interactions involve sensitive data, which makes the prompt the riskiest thing most employees do with company data, and the email attachment era has lessons for handling it. | AI blog | Abnormal AI |
|
24.10.26 |
Beyond Regex: Governing Sensitive Data in AI Chat | Traditional DLP hunts for patterns like card numbers, but the riskiest content in AI chat has no pattern at all, and some of it is instructions hidden in the data the AI reads. | AI blog | Abnormal AI |
|
24.10.26 |
Major security alert: PHP vulnerable to critical RCE, attacks ongoing | PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs. | Vulnerebility blog | Patchstack |
|
24.10.26 |
Improving navigation experience in v0 with Next.js 16.4 | Previously, we shared how a coding agent used the instant() Playwright test helper to make navigations instant in v0, Vercel's AI app builder. That work focused on the core /chat experience. | Vulnerebility blog | Next.js |
|
24.10.26 |
Php2Shell: Two critical PHP flaws disclosed | Php2Shell is the name for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, patched October 21, 2026. Both memory-safety flaws let unauthenticated attackers run code on any PHP installation serving web requests, including PHP-FPM, Apache mod_php, and php-cgi. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. | Vulnerebility blog | Expel |
|
24.10.26 |
Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-ups | ARTEX uses LLM agents to run attacks with little human involvement. According to Microsoft, Storm-0940 has used it against hundreds of organizations across many industries since September 2026. In multiple cases, the time from initial targeting to privileged cloud access was under three hours. ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse. | APT blog | Expel |
|
24.10.26 |
PHP2Shell (CVE-2026-109618, CVE-2026-109619): Patch Now | PHP2Shell is a family of memory-safety bugs in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and rated CVSS 9.2. The PHP Foundation shipped an emergency fix on October 21, 2026. The flaws allow an unauthenticated attacker to execute code as the PHP web worker or read its process memory, including passwords, tokens, and API keys from other users' requests. | Vulnerebility blog | CYMULATE |
|
24.10.26 |
CVE-2026-85267: Google Cloud Shell OAuth Token Theft | How one-click and zero-click WebSocket attack vectors turned Google Cloud Shell into a tunnel for OAuth token theft. | Vulnerebility blog | CYMULATE |
|
24.10.26 |
eMudhra CA Compromise: Weak Keys and Forged Certificates | Eight eMudhra intermediate CA keys were compromised, some as weak as 3 bits. Learn the code-signing risk and the steps to hunt for misuse and close the gap from TrendAI™. | Incident blog | TrendAI (US) |
|
24.10.26 |
What a Week for CISOs: PHP, eMudhra, and the Questions Your Board Will Ask | Two critical PHP flaws leaked before patches shipped, and the same day Mozilla disclosed weak eMudhra certificate authority keys. In this post, TrendAI™ Global CISO Sundari Parekh gives security leaders a practical playbook. | Vulnerebility blog | TrendAI (US) |
|
24.10.26 |
Two Critical PHP Flaws Leaked Before the Patch: What Organizations Should Do Now | On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon. | Vulnerebility blog | TrendAI (US) |
|
24.10.26 |
ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors | Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs. | APT blog | Wiz Blog |
|
24.10.26 |
QR Codes and Fake AI Tools Expand Mobile Attack Opportunities | A recent threat report highlights how attackers are using QR codes and fraudulent AI tools to evade traditional security controls and reach users across devices. Researchers observed campaigns embedding malicious links in QR codes, requiring users to scan them with smartphones and shifting attacks from protected computers to mobile environments. | AI blog | ZIMPERIUM |
|
24.10.26 |
From Mobile Threat Detection to Autonomous Investigation: Connecting Zimperium with Sekoia | Mobile devices have become essential to how organizations work. Employees use smartphones and tablets to access business applications, authenticate to corporate services, exchange sensitive information, and stay connected from almost anywhere. | Cyber blog | ZIMPERIUM |
|
24.10.26 |
Fake Rewards Messages Use Smishing to Target Mobile Users | A recent phishing campaign uses fraudulent text messages claiming that T-Mobile reward points are about to expire, creating urgency to lure recipients into clicking malicious links. | Malware blog | ZIMPERIUM |
|
24.10.26 |
RemControl Expands Android Banking Fraud Capabilities | A recent investigation uncovered RemControl, an Android banking trojan designed to give attackers extensive control over compromised mobile devices. The malware combines remote access capabilities with techniques for stealing credentials, intercepting sensitive information, and manipulating device activity to support financial fraud. | OS Blog | ZIMPERIUM |
|
24.10.26 |
Beyond the Sandbox: Leveraging Android Intrusion Logs to Expose Advanced Threats | Some of the most important activity on a compromised Android device occurs when a threat attempts to move beyond the normal application sandbox: an unexpected process starts, a shell is opened, or a binary is staged outside the application’s lifecycle. | Cyber blog | ZIMPERIUM |
|
24.10.26 |
OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond | OpenCode reported a breach affecting Console users with linked AI providers. Here is what the vendor has said, and how to find OpenCode on your developer machines. | Incident blog | StepSecurity |
|
24.10.26 |
litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader | litellm 1.107.0 shipped a credential stealer and an hourly remote code loader in all seven PyPI wheels and in the official Docker images, including the latest tags. The release was built from a lookalike GitHub repository. Full analysis, IOCs, and recovery steps for pip and container users. | Malware blog | StepSecurity |
|
24.10.26 |
eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update | On October 20, 2026, Python’s security team advised users to update Python packaging tools following the eMudhra / emSign certificate authority incident. The immediate concern is the certificate trust used when those tools connect to package indexes and other HTTPS services. Python security announcement | Security blog | StepSecurity |
|
24.10.26 |
PHP2Shell Makes PHP Inventory and Patch Ownership Urgent | PHP2Shell is the name being used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution. | Vulnerebility blog | SONATYPE |
|
24.10.26 |
The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation | The Gentlemen uses a double-extortion model. In addition to encrypting files, the ransomware can exfiltrate data from compromised systems. This puts additional pressure on victims to pay the ransom to restore access to their files and prevent the stolen data from being publicly leaked. | Ransom blog | ACRONIS |
|
24.10.26 |
Protecting Against AiTM Attacks: Is Your Microsoft Environment at Risk? | The identity threat landscape has shifted considerably over the past few years. Attackers have steadily moved toward more sophisticated techniques and Adversary-in-the-Middle (AiTM) phishing is near the top of that list. Microsoft observed a 146% rise in AiTM attacks in 2024 and the trend has continued into 2026. | Hacking blog | GuidePoint Security |
|
24.10.26 |
How to Patch PHP2Shell: CVE-2026-109618 & CVE-2026-109619 | The newly released ‘PHP2Shell’ vulnerabilities have become a hot topic hitting the desks, feeds and wires of every cybersecurity professional around the world. Starting October 20th, leaked details, disputed PoCs, conflicting exploitation reports and a patch that was scheduled but not yet released started circulating among security professionals online. | Vulnerebility blog | GuidePoint Security |
|
24.10.26 |
Q3 2026 Threat Update: Attackers Are Exploiting Vulnerabilities Within 3 Days | Three days is the average time between a high-severity vulnerability becoming public and its exploitation, according to the latest Quarterly Threat Landscape Report from Rapid7. And 71% of the exploitation tracked in Q3 occurred within the first seven days. | Vulnerebility blog | RAPID7 |
|
24.10.26 |
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP | On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's privileges. | Vulnerebility blog | RAPID7 |
|
24.10.26 |
Operation Serengeti III: Three Years of Collaboration Against Cybercrime | Participating authorities reportedly recovered an additional $105 million during Operation Serengeti III, targeting cybercrime networks across Africa. In earlier Serengeti operations, INTERPOL recognized Fortinet and the World Economic Forum’s Cybercrime Atlas as operational partners; Fortinet is a founding grantor of the initiative. | CyberCrime blog | Fortinet Blog |
|
24.10.26 |
CodeAIAssistant: The VS Code MCP Install Prompt That Hides Its Payload | The marketplace listing for CodeAIAssistant reads like a hundred others. “AI-powered coding assistant for Visual Studio Code. Provides natural language code understanding, refactoring suggestions, and contextual documentation lookup.” The publisher calls itself Luxiel Security. The README has a Privacy section. It states that the extension “does not collect or transmit code” and that “all analysis runs locally.” | AI blog | Yeeth Security |
|
24.10.26 |
SleepyDuck Registry-Hops: The Fake Solidity Extension Hits the VS Code Marketplace | Pull up the listing and it clears review. The name reads solidity. The description matches the canonical extension word for word, the README is the canonical README with its install badges intact, and the version history holds a single 2.4 KB build that registers a hello-world command. There is nothing on that page to flag. | Hacking blog | Yeeth Security |
|
24.10.26 |
StealC Is Back, and This Time It's a RAT | Four months after Operation Endgame took it down, StealC's seller returns with Stadia, a remote access trojan that shares StealC's code byte for byte. | Malware blog | VARONIS |
|
24.10.26 |
Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL | We uncovered a critical remote code execution vulnerability in Snowflake-managed PostgreSQL, highlighting hidden risks in cloud services. | Vulnerebility blog | VARONIS |
|
24.10.26 |
PHP2Shell: One Upload, Full Server | Varonis Threat Labs' deep dive on the critical PHP2Shell vulnerabilities that allowed remote code execution, affecting millions of websites. | Vulnerebility blog | VARONIS |
|
24.10.26 |
GoodPerson campaign aimed at users bypassing China’s Great Firewall | ThreatLocker Threat Intelligence has identified additional samples in-the-wild that contribute to a family of MSI-based trojans. As a follow up to GoodPersonRAT, these samples share common infrastructure, loader tactics, and final payloads that support attribution to the same operators and broader campaign. | Malware blog | THREATLOCKER |
|
24.10.26 |
ThreatLocker MDR team intercepts Chimera C2 ClickFix attack | On September 28, 2026, ThreatLocker MDR identified and intercepted the implementation of an active C2 framework in a monitored environment. A ClickFix attack persuaded the victim to execute malicious PowerShell commands, leading to machine compromise and the subscription to a Command-and-Control platform titled ChimeraC2. | Hacking blog | THREATLOCKER |
|
24.10.26 |
TRUST#GRAFT: WordPress Admin Attack Deploys PHP Backdoor | The chain should be assessed as a browser-mediated deployment mechanism rather than a traditional server-side exploit. The decisive condition is an already authenticated WordPress administrator browser; that context lets the loader reuse legitimate site-management workflows and turn a successful interaction into persistent server-side access. | Malware blog | SECURONIX |
|
24.10.26 |
eMudhra CA Key Compromise: Weak Keys, Risks and Fixes | The eMudhra CA key compromise is a certificate authority (CA) security incident in which eight intermediate certificates issued by eMudhra, an Indian digital trust provider, carried private keys that anyone can recover from the public certificate. An independent researcher reported the weakness on October 17, 2026, and Chrome and Firefox blocked the intermediates within hours. | Security blog | SOCRADAR |
|
24.10.26 |
AI Pentesting Tool: 30 Questions to Ask Before You Buy | “AI pentesting” now covers very different products. Some platforms plan and run attack chains on their own and return exploitation evidence for every finding. Others are vulnerability scanners with a language model summarizing the output. On a datasheet, or in a scripted demo against a vendor-prepared target, the two can look almost identical. | AI blog | SOCRADAR |
|
24.10.26 |
Japan Data Breaches 2026: Inside the October Surge | Japan is facing a dense wave of breach disclosures. Since late September, at least 20 major Japanese companies have reported breaches, including Times Car, Lawson, Yakiniku King, Sourcenext and Burger King Japan, and a ransomware attack on SoftBank’s IDC Frontier cloud took 495 customer organizations offline. | Incident blog | SOCRADAR |
|
24.10.26 |
Drupal Patches Critical RCEs: CVE-2026-108097 & 108099 | Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
ConnectWise Cloud Backup Breach | ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick, after researchers detected the applications authenticating into customer Microsoft 365 environments. | Incident blog | SOCRADAR |
|
24.10.26 |
ZoomInfo Sale, TryCircle, Vicente López, HDB, and X Leaks | SOCRadar Dark Web Team identified several underground posts, including an alleged ZoomInfo database sale involving 185 million records, an alleged TryCircle customer data leak, and an alleged Vicente López municipal database exposure. Other posts advertised a previously compromised HDB Financial Services dataset and an unverified X (Twitter) user database leak claim. | Incident blog | SOCRADAR |
|
24.10.26 |
CVE-2026-102764: BeyondTrust Zero-Day Exploited | BeyondTrust has disclosed CVE-2026-102764, a critical Remote Support vulnerability exploited as a zero-day weeks before customers received a patch. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
Cisco Secure Email & PAN-OS Zero-Days Exploited | Cisco and Palo Alto Networks have patched two actively exploited zero-day vulnerabilities that can lead to root-level code execution on security appliances. CISA has flagged both vulnerabilities as known exploited flaws, adding them to its Known Exploited Vulnerabilities (KEV) catalog. | Exploit blog | SOCRADAR |
|
24.10.26 |
SOCRadar Splunk Integration: New MSSP and Vulnerability Apps | Your analysts live in Splunk. Your external risk does not: SOCRadar alarms for dozens of managed companies, and vulnerability findings across an attack surface that changes every day. Why should seeing either one still mean another console, another input per customer, or another spreadsheet of CVEs? | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
CVE-2026-105445: Docker Hub PAT Reassignment Flaw | Docker has disclosed CVE-2026-105445, a critical privilege assignment flaw in Docker Hub that could allow an attacker to reuse a personal access token (PAT) after it was reassigned to another user during account-to-organization conversion. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
CVE-2026-114625: VeloCloud Orchestrator Flaw Exploited | Arista has disclosed CVE-2026-114625, a critical SQL injection vulnerability in on-premises VeloCloud Orchestrator deployments. The flaw is being exploited in the wild and allows any authenticated portal user, including an Enterprise Read Only account, to gain local superuser operator privileges. | Vulnerebility blog | SOCRADAR |
|
24.10.26 |
How to find, manage shadow AI: 3 steps to mitigate risk | Shadow AI used to be confined to a few simple scenarios, such as AI chatbots and AI browser extensions. Today, it spans a broad spectrum of complex vectors, making it harder to detect and control. | AI blog | Tenable® |
|
24.10.26 |
Tenable: Single multilingual model, native detection in 10 languages | AI security tools that can only detect threats in English offer limited protection. Here’s how Tenable trained our threat detectors to process nine additional languages and understand thousands more, without the need for a translation model, which increases costs and slows down processing. | AI blog | Tenable® |
|
24.10.26 |
Oracle October 2026 Critical Patch Update 1209 CVEs | Oracle addresses 1209 CVEs in its final quarterly update of 2026 with 1295 patches, including 112 critical updates. | Vulnerebility blog | Tenable® |
|
24.10.26 |
The Adversary Economy: Threat Actors React to PHP2Shell | Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. | Vulnerebility blog | Tenable® |
|
24.10.26 |
PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619 | News of two impending critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP prompted a huge, global overnight effort on Tuesday, October 20 when word of the vulnerabilities' existence leaked ahead of the planned patch release. | Vulnerebility blog | VulnCheck |
|
24.10.26 |
SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename | VulnCheck is disclosing CVE-2026-104085, an OS command injection in odt2spip, a document-import plugin for the SPIP CMS. The plugin lets an author import an office document (.odt, .doc, .docx, .html) into an article. | Vulnerebility blog | VulnCheck |
|
24.10.26 |
Exploring the Risks and Impacts of AI on Vulnerability Discovery and Exploitation | As we hear a lot of noise about AI’s impact on vulnerability discovery and exploitation, I found the need to compartmentalize the risks. So, I took it upon myself to build categories that provide a mental framework for the risks, impact, and evidence AI poses for vulnerabilities and exploitation. | Vulnerebility blog | VulnCheck |
|
24.10.26 |
PHP2Shell: Critical PHP RCE Flaws & Runtime Protection | PHP shipped emergency fixes today for two critical flaws in its core engine that let an unauthenticated attacker run code on a web server. If you run PHP anywhere, the move is the same: upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. | Vulnerebility blog | OLIGO SECURITY |
|
24.10.26 |
Node.js Brotli Vulnerability (CVE-2026-111497): Detection & Mitigation | Patching is a business process that takes time. OLIGO catches exploitation of this flaw as it happens, inside the workload under attack. | Vulnerebility blog | OLIGO SECURITY |
|
24.10.26 |
Three Critical Pillow CVEs: RCE and Heap Overflows in Python’s Imaging Library - CVE-2026-112900 CVE-2026-112393 CVE-2026-112403 | Three CVSS 9.2 vulnerabilities in the Python imaging library, allow remote code execution and heap corruption via a single malicious image upload | Vulnerebility blog | OX Security |
|
24.10.26 |
LiteLLM 1.107.0 Compromised With A RAT InfoStealer | LiteLLM got hijacked again: the AI gateway used to route traffic to dozens of LLM providers shipped a credential stealer with remote access built in | Malware blog | OX Security |
|
24.10.26 |
Node.js Brotli Decoder Out-of-Bounds Write (RCE) - CVE-2026-111497 | On October 21, 2026, Node.js shipped security releases across all supported lines fixing a high-severity out-of-bounds write in the bundled Brotli decoder. A Node.js process that decompresses attacker-controlled Brotli data — including Brotli-encoded HTTP responses it fetches — can be driven to write past the end of its buffer, leaking memory or executing code with the process’s privileges. | Vulnerebility blog | OX Security |
|
24.10.26 |
Industrial Remote Access Credential Exposure in Stealer Logs | A stolen password often leaves work for the person holding it. He or she may still need to identify the service, locate its login page, and establish what the account can reach. For some industrial remote access platforms, however, the stolen browser record already contains much of that context and removes most of that work. In these cases, the stolen record is not just a password but a labeled route to a specific machine. | Malware blog | Flare |
|
24.10.26 |
The Com: How Fear & Bad Attribution Distorted It | Part 1: The Ecosystem and the Actors By Jon DiMaggio, Cybersecurity Researcher The most dangerous thing about The Com isn’t any single group inside of it, but that the ecosystem replaces them faster than law enforcement can arrest the ones already operating. In 2025 and 2026, law enforcement handed down real sentences to real people… | Cyber blog | Flare |
|
24.10.26 |
PHP2Shell Exposure: 73% of 2.2 Million Version-Disclosing PHP Services Run Unsupported Branches | Two critical vulnerabilities in PHP have put renewed attention on a familiar operational question: how many internet-facing PHP services are running versions that no longer receive upstream security fixes?? We examined existing internet-scan records to measure the PHP versions that services disclose to the public internet. The result was 2,220,231 service records across 224 countries. Nearly three quarters advertised a PHP branch no longer supported by the PHP project. | Vulnerebility blog | Flare |
|
24.10.26 |
Does It Stop When Someone Is Watching? The Suspicious Behavior of a New Type of Infostealer | It is already well known that illegal software and cracked programs can be exploited for malware distribution. Recently, AhnLab identified a new type of information theft malware (Infostealer) disguised as an illegal program. | Vulnerebility blog | ASEC |
|
24.10.26 |
PHP2Shell: Responding to Critical PHP Vulnerabilities | PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP web servers. PHP released fixes on October 21, 2026. | Vulnerebility blog | Threat Spotlight |
|
24.10.26 |
Node2Shell: From Brotli Data to Remote Code Execution | Node2Shell is Imperva Red Team’s name for our analysis of CVE-2026-111497, a High severity flaw in Node.js’s bundled Brotli decoder. Node.js says the out-of-bounds write can permit remote code execution and has released fixes for the 22.x, 24.x, and 26.x lines. | Vulnerebility blog | Imperva |
|
24.10.26 |
PHP2Shell: Early Attack Activity Through Imperva’s Lens | Following the public disclosure of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), Imperva Threat Research observed a sharp increase in scanning and exploitation attempts across protected environments. What had been a small number of unsuccessful probes before disclosure quickly grew into widespread automated activity targeting sites across industries and regions. | Vulnerebility blog | Imperva |
|
24.10.26 |
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware | Huntress investigated multiple incidents stemming from an Amazon-themed ClickFix campaign tied to a sponsored Google search result for the keywords "amazon business." The sponsored result leads to a spoofed Amazon login page with an embedded ClickFix (fake CAPTCHA) that downloads a malicious payload from attacker-controlled infrastructure. | Malware blog | Huntress |
|
24.10.26 |
M365 Token Spray and Replay Campaign Compromises Business Email Accounts | Over a ten-week stretch, Huntress tracked a Microsoft 365 campaign that captured sign-in sessions through adversary-in-the-middle (AiTM) relays and replayed the stolen tokens from an IP address block owned by German hosting provider 1337 Services GmbH. We responded to related incidents at 79 organizations, observing at least 497 successful sign-in events against more than 200,000 failed login attempts across our customer environments. | Phishing blog | Huntress |
|
24.10.26 |
Unboxing Phishing Kits: Huntress Examines 3 Real Kits | Teach a noob to phish and they'll be scamming for a lifetime. It has never been easier to steal credentials, thanks to a growing number of phishing kits that give aspiring attackers everything they need in one convenient interface. | Phishing blog | Huntress |
|
24.10.26 |
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks | A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup (formerly SkyKick) has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments. | Hacking blog | Huntress |
|
24.10.26 |
Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online before their coordinated disclosure and before patches were released. | Vulnerebility blog | Huntress |
|
24.10.26 |
Russia Is Tightening Internet Controls, Leading to Operational Risks | Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. Increasingly strict measures targeting virtual private networks (VPNs), state-managed internet shutdowns, limitations on civilian communications platforms, and monitoring of domestic and foreign entities very likely represent an escalation from the approaches to censorship and surveillance pursued prior to 2024. | Cyber blog | Elastic Security Labs |
|
24.10.26 |
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619 | CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to catch this behavior. | Vulnerebility blog | Elastic Security Labs |
|
24.10.26 |
Hunting Leaked PHP2Shell RCE Across Open Directories (CVE-2026-109618, CVE-2026-109619) | Two critical PHP remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, leaked before their scheduled patch on October 21, 2026 at 14:00 UTC. | Vulnerebility blog | HUNT.IO |
|
24.10.26 |
Ukraine’s State Data-Exchange System Targeted by Russian-Speaking Operator via Graylog Log4Shell | Disclosure note: Before publishing this research, we shared our findings and the victim data we recovered with the national CERTs of the affected countries. The CERTs are handling notification of the affected organizations in their jurisdictions. | BigBrother blog | HUNT.IO |
|
24.10.26 |
Sekoia Honeypot Captures an Attack on GenAI Infrastructure | Sekoia's TDR team ran a decoy Flowise server to study attacks on GenAI platforms. One threat actor stole its credentials and tried to misuse its AI agent. | AI blog | SEKOIA |
|
24.10.26 |
Sekoia + Zimperium: Investigate Mobile Threats In Your SOC | Zimperium Mobile Threat Defense now sends its mobile threat telemetry to the Sekoia SOC platform. Sekoia Elevate AI agents investigate each mobile alert alongside identity, cloud and network evidence, so analysts can see what it means for the whole organization. | Cyber blog | SEKOIA |
|
24.10.26 |
SEO Poisoning Campaign Delivers Armorsteal Malware | In September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware family we track as Armorsteal. | Malware blog | ThreatLabz |
|
24.10.26 |
CVE-2026-109618 and CVE-2026-109619: PHP2Shell | On October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both vulnerabilities carry a CVSS v4.0 score of 9.2 out of 10. The PHP security team has released emergency patches and strongly encouraged all PHP users to update immediately. | Vulnerebility blog | ThreatLabz |
|
24.10.26 |
Inside a Global AI-Assisted Hacking Campaign | In October 2026, Zscaler ThreatLabz investigated AI-assisted cyberattacks that combined the ARTEX penetration testing framework with AI coding assistants and custom automation scripts. | AI blog | ThreatLabz |
|
24.10.26 |
CVE-2026-88771: NetScaler RCE Exploitation | On September 27, 2026, Citrix disclosed CVE-2026-88771, a critical remote code execution (RCE) vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. | Vulnerebility blog | ThreatLabz |
|
24.10.26 |
Inside SiriusQT: A Seriously Skilled RAT | SiriusQT is advertised as a Windows RAT, but the analyzed sample in this article shows something more complex than a remote administration tool. Under the name, it offers several capabilities in a single implant: remote access, HVNC, browser automation, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, persistence, anti-analysis checks, and custom encrypted command-and-control traffic. | Malware blog | Group-IB Blog |
|
24.10.26 |
CrowdStrike Uncovers New Agentic AI Campaigns | CrowdStrike Counter Adversary Operations details research into four previously unreported threat actors conducting campaigns in which AI agents make decisions and execute commands. | AI blog | CrowdStrike |
|
24.10.26 |
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell | Two critical memory-corruption RCE vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 have been disclosed in core PHP. | Vulnerebility blog | CrowdStrike |
|
24.10.26 |
BRONZE SANDCASTLE deploys modified Meterpreter shells | Counter Threat Unit™ (CTU) and SophosLabs researchers investigated a cluster of incidents attributed to the BRONZE SANDCASTLE threat group. The most distinctive technical marker for BRONZE SANDCASTLE is its consistent use of Sandboxie DLL sideloading. | APT blog | SOPHOS |
|
24.10.26 |
ConnectWise Cloud Backup application abused in cross-tenant token sweep | On October 15, 2026, Sophos X-Ops researchers identified a series of service principal sign-ins in which a threat actor authenticated as the ConnectWise Cloud Backup application (formerly SkyKick) and requested app-only Microsoft Graph tokens from customer Microsoft 365 tenants. The malicious scanning activity originated from a single virtual private server (VPS) and continued for about 96 minutes | CyberCrime blog | SOPHOS |
|
24.10.26 |
Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion | Traditional business email compromise (BEC) is often thought of as a mailbox problem: a stolen account, unauthorized access to email, forwarding rules, and (sometimes) outgoing mail impersonating the compromised user. But more recent incidents show how far beyond “email only” these intrusions can extend once an attacker gains control of a cloud identity. | Spam blog | SOPHOS |
|
24.10.26 |
Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) | The previous update (October 22 16:18 UTC) reported that Sophos observed successful exploitation of PHP2Shell in customer environments. Upon further analysis, we are correcting that assessment as Sophos customer telemetry shows scanning and a small number of failed exploitation attempts. As of this update, there is no evidence of a successful compromise due to these vulnerabilities. | Exploit blog | SOPHOS |
|
24.10.26 |
Linux Malware Hiding as Kernel Threads: How to Spot It | On September 5, 2026, Sansec, a security firm that investigates attacks on online stores, reported that attackers were exploiting a zero-day in Magento and Adobe Commerce to install a backdoor written in Rust. The vulnerability is tracked as CVE-2026-75650 and is rated Critical, with a CVSS score of 10.0. Early versions of the backdoor ran under the name [kworker/u:8:0], which is meant to look like one of the Linux kernel’s own worker threads. | Malware blog | Eclypsium |
|
24.10.26 |
NVIDIA and Eclypsium Partner for Trusted AI Infrastructure | AI agents are moving from answering questions to taking action. They can read sensitive data, call APIs, write and execute code, use external tools, and coordinate with other agents. In some environments, their decisions may affect physical systems. | AI blog | Eclypsium |
|
24.10.26 |
CVE-2026-20349: Someone Is Crashing Cisco Firewalls. We Need to Talk About Why. | If you run a Cisco Adaptive Security Appliance or a Firepower Threat Defense device with Remote Access SSL VPN enabled, you are exposed to CVE-2026-20349. On August 11, 2026, Cisco published an advisory, scoring the vulnerability as “high” with a CVSS 3.1 score of 8.6. The flaw affects the Remote Access SSL VPN service on most ASA and FTD devices. | Vulnerebility blog | Eclypsium |
|
24.10.26 |
Keys Are In The Browser: Exposure Across AI-Built Websites | Cyble scanned 1.3M+ newly registered domains and found AI-built sites leaking live secrets to the browser: OpenAI keys, Stripe keys, and database tokens. | AI blog | CYBLE |
|
24.10.26 |
PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | Patch now: CVE-2026-109618 and CVE-2026-109619 let unauthenticated attackers run code on web servers running PHP, and details were public before fixes shipped. | Vulnerebility blog | SECURITY.COM |
|
24.10.26 |
Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks | Offensive agent is using unprotected AI models to scan the web, exploit frameworks, steal credentials and mine cryptocurrency for up to 100,000 steps without human input. The model's owner pays for every step. | AI blog | SECURITY.COM |
|
24.10.26 |
Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries | Russian group stole credentials and tunneled into the network during a two-month intrusion at a naval shipbuilder. | APT blog | SECURITY.COM |
|
24.10.26 |
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. | AI blog | Microsoft Security Blog |
|
24.10.26 |
The Current Landscape of OAuth Attacks | As enterprises continue to roll out multi-factor authentication (MFA), attackers have adapted. Rather than only stealing credentials, attackers have shifted to stealing Open Authorization (OAuth) tokens, the keys that govern what applications can do on your behalf. Adversaries are already accelerating these attacks by using dynamic evasion code, phishing-as-a-service (PhaaS) templates and LLM-generated brand impersonations. | Hacking blog | Palo Alto |
|
24.10.26 |
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 | Unit 42 is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0). We encourage reviewing the PHP Group’s security advisory and patching guidance. | Vulnerebility blog | Palo Alto |
|
24.10.26 |
EMudhra Intermediate CA Certificates Compromised | Eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect during the certificate generation process. The private keys in this incident were generated with insufficient randomness, allowing potential attackers to derive the private keys from the public certificates. | Cyber blog | Palo Alto |
|
24.10.26 |
The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations - Check Point Research | Antidetect browsers obscure the digital identity of their users, enabling a single operator to silently manage thousands of isolated accounts across multiple platforms (including Facebook, TikTok, Instagram, and YouTube), while evading detection systems that look for scams and coordinated inauthentic behavior. | AI blog | Check Point Research |
|
24.10.26 |
I had plans for that second | Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset. | Cyber blog | CISCO TALOS |
|
24.10.26 |
Compromised eMudhra intermediate certificates | Cisco Talos is aware of eight compromised intermediate certificates belonging to the intermediate certificate authority, eMudhra. Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromised intermediate CAs to impersonate any website or service. | Cyber blog | CISCO TALOS |
|
24.10.26 |
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers | Legitimate infrastructure has become a powerful delivery mechanism for attackers, carrying the inherent trust they once had to build. As Cisco Talos explored in our previous research on weaponizing software-as-a-service (SaaS) notification pipelines, these platforms are increasingly repurposed as proxies for malicious intent. | CyberCrime blog | CISCO TALOS |
|
24.10.26 |
Two critical RCEs in PHP core | Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key role in the discovery of these vulnerabilities | Vulnerebility blog | CISCO TALOS |
|
24.10.26 |
Is the ad a scam? How to tell before you click | You can trust a social media platform and still get scammed by an ad running on it | Spam blog | Eset |
|
24.10.26 |
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC‑0099-Sandworm collaboration | ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm | Malware blog | Eset |
|
24.10.26 |
PHP2Shell: What defenders need to know about CVE-2026-109618 and CVE-2026-109619 | On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2. They let an unauthenticated attacker run code on a web server, and because the flaws sit in PHP itself rather than in any application or plugin, a site can be exposed even when its own code is secure. | Vulnerebility blog | TRELLIX |
|
24.10.26 |
Dark Web Roast - September 2026 Edition | September delivered another bumper crop of underground incompetence, proving once again that the cybercrime economy runs less on sophistication and more on vibes, typos, and secondhand embarrassment. | CyberCrime blog | TRELLIX |
|
23.10.26 |
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches | PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell | Vulnerebility | The Hacker News |
|
23.10.26 |
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack | The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a | APT | The Hacker News |
|
23.10.26 |
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image | Pillow , the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it | Vulnerebility | The Hacker News |
|
23.10.26 |
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data | Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their " Node2Shell " proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder ( CVE-2026-111497 ). | Exploit | The Hacker News |
|
23.10.26 |
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances | AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, | AI | The Hacker News |
|
23.10.26 |
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware | Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a | Exploit | The Hacker News |
|
23.10.26 |
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks | Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD- | Vulnerebility | The Hacker News |
|
23.10.26 |
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable | eMudhra , an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday . The | Security | The Hacker News |
|
23.10.26 |
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes | Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend | Vulnerebility | The Hacker News |
|
23.10.26 |
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations | Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that | Social | The Hacker News |
|
23.10.26 |
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown | INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than | BigBrothers | The Hacker News |
|
22.10.26 |
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation | Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment | Incindent | The Hacker News |
|
22.10.26 |
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL | A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when | Vulnerebility | The Hacker News |
|
22.10.26 |
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release | LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the | AI | The Hacker News |
|
22.10.26 |
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions | Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug | Vulnerebility | The Hacker News |
|
22.10.26 |
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification | A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed , releasing | Attack | The Hacker News |
|
22.10.26 |
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed | Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws are being broadly exploited in the wild following the release of the patches. | Exploit | The Hacker News |
|
22.10.26 |
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack | Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of | APT | The Hacker News |
|
22.10.26 |
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases | GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every | Vulnerebility | The Hacker News |
|
22.10.26 |
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor | The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and | AI | The Hacker News |
|
22.10.26 |
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So | OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while | AI | The Hacker News |
|
22.10.26 |
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge | PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web | Exploit | The Hacker News |
|
22.10.26 |
Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands | Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced | CyberCrime | The Hacker News |
|
21.10.26 |
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors | Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle | APT | The Hacker News |
|
21 .10.26 |
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports | Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic | AI | The Hacker News |
|
21.10.26 |
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't | You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is | Vulnerebility | The Hacker News |
|
21.10.26 |
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections | Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. | Hack | The Hacker News |
|
21.10.26 |
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert | This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed | Vulnerebility | The Hacker News |
|
21 .10.26 |
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites | Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for | Virus | The Hacker News |
|
21.10.26 |
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases | U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or | BigBrothers | The Hacker News |
|
21.10.26 |
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web | State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web | Incindent | The Hacker News |
|
21 .10.26 |
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities ( | Exploit | The Hacker News |
|
21.10.26 |
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion | A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report | Virus | The Hacker News |
|
21.10.26 |
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert | This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed | Vulnerebility | The Hacker News |
|
21.10.26 |
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software | The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root | Incindent | The Hacker News |
|
21 .10.26 |
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution | Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM | Exploit | The Hacker News |
|
21.10.26 |
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA | Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma | Ransom | The Hacker News |
|
21.10.26 |
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites | A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security | AI | The Hacker News |
|
21 .10.26 |
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election | The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected | Virus | The Hacker News |
|
20.10.26 |
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators | WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's | Social | The Hacker News |
|
20.10.26 |
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns | Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight | Security | The Hacker News |
|
20.10.26 |
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader | The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks | APT | The Hacker News |
|
20.10.26 |
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident | ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting | Incindent | The Hacker News |
|
20.10.26 |
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware | An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on | Hack | The Hacker News |
|
20.10.26 |
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan | Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The | Exploit | The Hacker News |
|
20.10.26 |
Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge | A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an | AI | The Hacker News |
|
20.10.26 |
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware | Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as | Virus | The Hacker News |
|
20.10.26 |
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor | Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day | Exploit | The Hacker News |
|
20.10.26 |
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor | Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as | Hack | The Hacker News |
|
20.10.26 |
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories | The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised | APT | The Hacker News |
|
20.10.26 |
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic | A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm | Virus | The Hacker News |
|
19.10.26 |
Microsoft: October Windows Server updates break Exchange sign-in, mail flow | Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. | OS | BleepingComputer |
|
19.10.26 |
Hackers exploit SiteGuard WAF flaw to run commands as admins | Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers. | Exploit | BleepingComputer |
|
19.10.26 |
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack | ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants | Incindent | BleepingComputer |
|
19.10.26 |
Drupal patches critical RCE flaws, warns exploits may emerge soon | Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. | Vulnerebility | BleepingComputer |
|
19.10.26 |
Critical BlockStrap flaw lets hackers run code on Magento servers | Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. | Vulnerebility | BleepingComputer |
|
19.10.26 |
Targeted ads installed Candiru spyware in zero-click attacks | Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. | Virus | BleepingComputer |
|
19.10.26 |
Employees using personal CatGPT at work? Here's what IT admins need to do | Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. | AI | BleepingComputer |
|
19.10.26 |
Burger King Japan data breach exposes 11 million customer records | Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. | Incindent | BleepingComputer |
|
19.10.26 |
Microsoft: October Windows update may break Smart App Control | Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. | OS | BleepingComputer |
|
19.10.26 |
BAE Systems cyberattack disrupts US federal court operations | The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. | Incindent | BleepingComputer |
|
19.10.26 |
BeyondTrust patches zero-day exploited in attacks since August | BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. | Exploit | BleepingComputer |
|
19.10.26 |
One Parser, Two Bugs,Many Routers | Exploiting Broadcom WiFi Across eCos and Linux | CONGRESS | PRESENTION |
|
19.10.26 |
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers | A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network | Hack | The Hacker News |
|
19.10.26 |
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys | An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had | AI | The Hacker News |
|
19.10.26 |
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants | ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in | Incindent | The Hacker News |
|
18.10.26 |
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers | Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. | Exploit | BleepingComputer |
|
18.10.26 |
Android gets AI defenses against messaging scams, fake calls | Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. | AI | BleepingComputer |
|
18.10.26 |
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth | A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. | Hack | BleepingComputer |
|
18.10.26 |
Fake Arch Linux packages push malware with root privileges | A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. | Virus | BleepingComputer |
|
18.10.26 |
Microsoft: Windows Server 2022 reached end of mainstream support | Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. | OS | BleepingComputer |
|
18.10.26 |
Police arrests 95 suspects in international CSAM crackdown action | Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. | CyberCrime | BleepingComputer |
|
18.10.26 |
Microsoft fixes bug causing Windows black screens, Explorer crashes | Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. | OS | BleepingComputer |
|
18.10.26 |
UK Legal Aid Agency: Hackers stole records dating back to 1978 | The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. | BigBrothers | BleepingComputer |
|
18.10.26 |
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks | Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. | Exploit | BleepingComputer |
|
18.10.26 |
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested | The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. | BigBrothers | BleepingComputer |
|
18.10.26 |
Ledger asks sellers across Asia to halt sales after supply-chain attack | Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. | Hack | BleepingComputer |
|
18.10.26 |
Cisco patches new Secure Email Gateway zero-day exploited in attacks | Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. | Exploit | BleepingComputer |
|
18.10.26 |
Microsoft fixes VPN issues caused by September Windows updates | Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. | OS | BleepingComputer |
|
18.10.26 |
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon | Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign | Virus | The Hacker News |
|
18.10.26 |
Microsoft fixes VPN issues caused by September Windows updates | Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. | OS | BleepingComputer |
|
18.10.26 |
The Blind Spots of Agentic Pentesting and How to Close Them | AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. | AI | BleepingComputer |
|
18.10.26 |
Global takedown hits network behind 1 billion phishing messages | A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. | Phishing | BleepingComputer |
|
18.10.26 |
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. | ICS | BleepingComputer |
|
18.10.26 |
Hirudo Android malware replaces banking apps to evade security checks | A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. | Virus | BleepingComputer |
|
18.10.26 |
Microsoft: Recent Windows updates may trigger Remote Desktop failures | Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. | OS | BleepingComputer |
|
18.10.26 |
OpenAI engineer arrested for allegedly planting spy device in office | A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. | AI | BleepingComputer |
|
18.10.26 |
Ghostscript flaw lets hackers hijack servers via PDF uploads | A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. | Hack | BleepingComputer |
|
18.10.26 |
Anthropic warns self-replicating AI could spread to your smart devices | Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. | AI | BleepingComputer |
|
18.10.26 |
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days | Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. | OS | BleepingComputer |
|
18.10.26 |
Microsoft releases Windows 10 KB5126657 extended security update | Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. | OS | BleepingComputer |
|
18.10.26 |
Microsoft: Windows 11 24H2 Home and Pro reached end of support | Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. | OS | BleepingComputer |
|
18.10.26 |
UK Housing Ombudsman Service investigates 'security incident' | The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. | Incindent | BleepingComputer |
|
18.10.26 |
Windows 11 KB5127648 & KB5126653 cumulative updates released | Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. | OS | BleepingComputer |
|
17.10.26 |
TFG London cyberattack disrupts systems at Hobbs and Whistles retailers | TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. | Incindent | BleepingComputer |
|
17.10.26 |
Ivanti warns of Connect Secure zero-day exploited in attacks | Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. | Exploit | BleepingComputer |
|
17.10.26 |
Docker Hub flaw let attackers impersonate users, tamper with images | Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). | Vulnerebility | BleepingComputer |
|
17.10.26 |
The MFA Gaps Attackers are Still Exploiting | Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps. | Exploit | BleepingComputer |
|
17.10.26 |
SAP warns of maximum severity OAuth2 SSRF security flaw | SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. | Vulnerebility | BleepingComputer |
|
17.10.26 |
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing | Norway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. | Incindent | BleepingComputer |
|
17.10.26 |
Yandex confirms service outage as users lose access to cloud files | Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. | BigBrothers | BleepingComputer |
|
17.10.26 |
Anthropic takes risky AI tests offline after models breach govt sites | Anthropic announced that its internal AI models undergoing "high-risk and cybersecurity evaluations" no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. | AI | BleepingComputer |
|
17.10.26 |
Ledger confirms spy chip implant behind wallet crypto thefts | Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. | Cryptocurrency | BleepingComputer |
|
17.10.26 |
Cyberattack shuts down refrigerators at French supermarkets | Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. | Incindent | BleepingComputer |
|
17.10.26 |
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption | A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. | Virus | BleepingComputer |
|
17.10.26 |
Retail giant Ahold Delhaize takes systems offline after cyberattack | Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it had to take some systems offline in response to a "cybersecurity incident" affecting its network. | Incindent | BleepingComputer |
|
17.10.26 |
GitLab warns of max severity code execution vulnerability | GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. | Vulnerebility | BleepingComputer |
|
17.10.26 |
Microsoft: Windows 11 23H2 reaches end of support in 30 days | Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. | OS | BleepingComputer |
|
17.10.26 |
Nippon Columbia malware incident exposes 8.6 million karaoke fan records | Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. | Incindent | BleepingComputer |
|
17.10.26 |
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants | Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised | Hack | The Hacker News |
|
17.10.26 |
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug | A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate | Vulnerebility | The Hacker News |
|
17.10.26 |
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor | Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at | Virus | The Hacker News |
|
17.10.26 |
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing | Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted | APT | The Hacker News |
|
17.10.26 |
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract | OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case | AI | The Hacker News |
|
17.10.26 |
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers | The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in | APT | The Hacker News |
|
17.10.26 |
CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing | AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and | AI | The Hacker News |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: AI agents running inside restricted evaluation environments had found ways around their network isolation, compromised internal infrastructure, and eventually breached systems at Hugging Face. | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
XWorm Reborn: From infostealer to surveillance platform | In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. | Malware blog | Netskope Threat Labs |
|
17.10.26 |
Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire | A flaw in GoBalance, a load-balancing tool used by many darknet sites, allows anyone to recover a site's master signing scalar from its publicly available data. With that key, an attacker can take over the site and redirect its visitors. | Cyber blog | SEARCHLIGHT |
|
17.10.26 |
A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline | During a security audit of Discourse, a popular open-source forum platform powering over 22,000 communities including OpenAI, Atlassian, and Cloudflare, we discovered two vulnerabilities affecting default configurations. | Security blog | SEARCHLIGHT |
|
17.10.26 |
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE | It has been a little while since we last looked at Adobe Experience Manager (AEM). We had some excellent findings last time but were just shy of full remote code execution. This time we were able to achieve full unauthenticated remote code execution on AEM Cloud. | Vulnerebility blog | SEARCHLIGHT |
|
17.10.26 |
Session Cookie Authentication Bypass: Predictable Signing Secret Enableds Account Impersonations | During a security review of a yard management system (YMS) used to optimize supply chain operations, Resecurity identified an authentication bypass caused by two independent weaknesses in the application's session-cookie design. | Security blog | Resecurity |
|
17.10.26 |
Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem | Resecurity identified and mapped the infrastructure supporting a commercial phishing-kit-as-a-service (PhaaS) operation marketed under the name “Iron Man System.” The kit is sold to criminal buyers as a self-hosted package that deploys pre-built lure pages impersonating postal and courier services, toll and traffic-fine authorities, tax agencies, banks, telecoms and loyalty programmes, then captures the data victims submit. | Phishing blog | Resecurity |
|
17.10.26 |
October 2026 Patch Tuesday Analysi | Today’s Patch Tuesday Alert addresses Microsoft’s October 2026 Security Updates. The FIRE team is actively working on coverage for these vulnerabilities and expect to ship that coverage as soon as it is completed. | OS Blog | Fortra |
|
17.10.26 |
Best KnowBe4 Alternatives & Competitors | Adaptive Security is backed by OpenAI as its first and only cybersecurity investment, and is used by companies including Figma, Ramp, Lennar, and Plaid. | Security blog | Adaptive Security |
|
17.10.26 |
Email Security Statistics 2026: Phishing, BEC & AI | Email security statistics consistently show the human layer rather than the technical stack as the decisive variable in most confirmed breaches, which is why human-layer defense deserves proportionate investment. | Spam blog | Adaptive Security |
|
17.10.26 |
DNS as C2 in Noir, An AI-Developed Crypto Wallet Drainer | We found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages. The loader races three public DNS-over-HTTPS (DoH) services and uses the first valid answer. | Cyber blog | Adaptive Security |
|
17.10.26 |
Inside Help TDS: Hotejka and Cloudflare Abuse | Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. | Security blog | Adaptive Security |
|
17.10.26 |
Run multi-container agent evals on Tensorlake with Harbor | Harbor 0.23.0 can run Docker Compose tasks on Tensorlake. Each task boots as one MicroVM with a Docker daemon inside, so an agent’s MCP server, database, browser, or game server runs next to it as its own container. | BotNet blog | Tensorlake |
|
17.10.26 |
GhostAction Returns: 772 Repos Hit, 30k More in Oct | The GhostAction supply chain campaign hit 772 public GitHub repositories between Aug. 31 and Sept. 30, 2026, targeting 2,577 secrets. Between Oct 8-9 a new burst hit 30k more, and this time the workflows ran. | Hacking blog | GITGUARDEN |
|
17.10.26 |
AI Agent Security: Six Controls From Nine Real Incidents | An AI agent runs with your credentials and acts before you can stop it. Nine incidents show what that costs. Six controls limit the damage: sandbox the agent, scope its credentials, lock its configuration, log every call, scan the workspace first, and deny by default. | AI blog | GITGUARDEN |
|
17.10.26 |
FlowerStorm detection and 70+ YARA rules: September 2026 | The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape. | Malware blog | VMRAY |
|
17.10.26 |
6 Malware Analysis Tasks You Can Automate with AI Agents | A reverse engineer’s week can quickly fill up with work that has already been solved once, whether that means decrypting a familiar string routine or peeling back another dropper stage. Once the underlying scheme is understood, much of this work no longer requires much judgment. | AI blog | VMRAY |
|
17.10.26 |
ontinue.com/1h2026threatintelligencereport/ | 1H 2026 findings reveal growing abuse of trusted identities, AI-assisted tooling, SaaS platforms, and business workflows as attackers achieve greater impact with less effort. | Cyber blog | ONTINUE |
|
17.10.26 |
2026_10_1h2026-TI-Report-Executive-Summary-en.pdf | The first half of 2026 reinforced a significant shift in the threat landscape: the most effective attacks increasingly do not look like attacks at all. They look like a Microsoft Teams message from someone claiming to be in IT, a login prompt from a trusted brand, a software package from a familiar repository, or a routine request that appears legitimate on the surface | Cyber blog | ONTINUE |
|
17.10.26 |
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) | Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. | Vulnerebility blog | labs.watchtow |
|
17.10.26 |
Q3 2026 DDoS, bad bots, and BGP incidents: statistics and overview | As we predicted, botnet sizes returned to growth after a sharp decline in the previous quarter. The largest botnet observed in Q3 2026 comprised 3.56 million devices, up from 2.09 million in Q2. | Cyber blog | QRATORLABS |
|
17.10.26 |
Behind Closed Doors: How Physical Penetration Testing | Protecting confidential conversations takes more than closing a conference room door. Physical penetration testing reveals whether unauthorized people can reach sensitive spaces, interfere with equipment, or leave a device unnoticed. Define the test around the spaces and information you need to protect, then use the results to improve access checks, reporting, and response. | Security blog | Bishop Fox |
|
17.10.26 |
Submit and Execute: Weaponizing Reflected XSS in Siemens | Siemens Teamcenter is one of the most widely deployed product lifecycle management (PLM) platforms in the world, the system of record for the engineering designs, bills of materials, and approval workflows behind aircraft, vehicles, and industrial hardware. We found that a crafted link could execute JavaScript in the browser of a logged-in Teamcenter user. During an authorized assessment, we used it to silently grant one account the ability to act on behalf of another. | Vulnerebility blog | Bishop Fox |
|
17.10.26 |
AI Security Scoping: Define What To Test In Yo | Integrating artificial intelligence into enterprise workflows demands a system view: models are only one component in a chain that includes APIs, orchestration layers, data pipelines, identity, storage, and observability. | AI blog | Bishop Fox |
|
17.10.26 |
The October 2026 Security Update Review | Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). | OS Blog | Zero Day Initiative |
|
17.10.26 |
cikabika-bot-inside-a-discord-rat | Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity. | BotNet blog | darktrace.com |
|
17.10.26 |
Underground AI-as-a-Service: How Cybercriminals are Buying and Selling AI | In under six months, the criminal supply of and demand for AI-powered tools grew into a sophisticated underground economy on hacker forums and platforms, maturing and scaling faster than any market these forums have seen. | AI blog | HALCYON |
|
17.10.26 |
ASOS App Hack: Attackers Used Push Notifications to Send a Ransom Note - Real-time Open Source Software Supply Chain Security | On October 6, 2026, people with the ASOS app got a push notification that said the company had been hacked. Attackers sent it. They had gotten into the third-party tools ASOS uses to message its customers, and they used that access to send an extortion note straight to people’s phones. ASOS has confirmed that names and contact details may have been accessed. The bigger claim, that the attackers “fully compromised” ASOS’s Snowflake data warehouse, is still unproven, and Snowflake says its platform was not breached. | Ransom blog | SAFEDEP |
|
17.10.26 |
tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud - Real-time Open Source Software Supply Chain Security | We found a credential-stealing worm in tensorlake@0.5.144. It runs on install, and npm was serving it as latest for a package with about 106,000 monthly downloads. | Hacking blog | SAFEDEP |
|
17.10.26 |
MALFEX Moves Its npm Loader into a Native Windows DLL - Real-time Open Source Software Supply Chain Security | The npm package imgdecode hides a malicious loader in a compiled Node.js addon. Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub. It decrypts the response and injects the result into a new dllhost.exe process. This code does not need an install script. On 2026-10-13, the package was still available on npm. | Malware blog | SAFEDEP |
|
17.10.26 |
TLD Launch Milestones 2026-2027: What Brand Protection Teams Need to Know | New top-level domain (TLD) launches follow public schedules, giving brand protection teams time to prepare defensive registrations, monitoring, and response plans before new namespaces become broadly available. | Vulnerebility blog | NETCRAFT |
|
17.10.26 |
TRM Labs Supports Microsoft's Disruption of YAM Store, CoGUI, and Iron Man, Three Services Behind Global Scam Operations | | On October 14, 2026, Microsoft's Digital Crimes Unit and Health-ISAC announced that they are dismantling three components of a Chinese-language cybercrime marketplace: YAM Store, CoGUI, and Iron Man. | Cyber blog | TRM Labs |
|
17.10.26 |
MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work - | The MALFEX campaign is a long-running npm supply-chain attack that delivers Remote Access Trojans (RAT), information stealers, or open Node.js processes as payloads. Learn about how the attack works, how to find out if you’re impacted, and what response actions to take. | Malware blog | Checkmarx |
|
17.10.26 |
Malware vs malware: a ClickFix kit at war for your screen | Two ClickFix kits fought over the same screen on hacked WordPress sites. One wrote the fight into its code, in Russian, down to the moment the browser broke. | Malware blog | ADAMNET |
|
17.10.26 |
OFAC Sanctions Tren de Aragua Crypto-Laundering Network | OFAC designated 10 targets in a Tren de Aragua ATM jackpotting scheme that stole at least $40.73 million from U.S. financial institutions. The network used cryptocurrency to launder the proceeds. | Cryptocurrency blog | CHAINALYSIS |
|
17.10.26 |
How Chainalysis Used AI to Trace the $387M Bitget Theft | Since $387 million was stolen from Bitget on September 24, Chainalysis investigators have been working with the exchange and law enforcement partners to trace the stolen funds across multiple blockchains and protocols. | AI blog | CHAINALYSIS |
|
17.10.26 |
Hacking OpenAI | On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors. | AI blog | Hacktron AI |
|
17.10.26 |
Shadow AI Detection for MSPs | Employees have always found and used technology outside the approved IT stack, from unauthorized endpoint applications and browser extensions to personal cloud services. It left a trail: an install, a device on the network, something a scan or an agent could eventually catch. From there, an analyst had to investigate the finding and assess the risk before deciding how to respond. | AI blog | WatchGuard Blog |
|
17.10.26 |
GhostAction Is Now Phishing Open Source Maintainers | GhostAction operators used a targeted GitHub phishing proxy to steal developer credentials and one-time codes using a sophisticated GitHub phishing kit | Hacking blog | OpenSourceMalware |
|
17.10.26 |
GhostAction Attack Escalates By Targeting GitHub Users OpenSourceMalware | OSM has identified a new evolution of the GhostAction attack, which targets GitHub users via malicious CI workflow files and worm-like behaviour | Hacking blog | OpenSourceMalware |
|
17.10.26 |
Threat intel blog | GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farms | Cyber blog | OpenSourceMalware |
|
17.10.26 |
YuanKong RAT: the Android remote-control service that stamps its operators' names into every build | Most Android RATs try hard to hide their server. This one barely hides anything and that turns out to be the interesting part. The dropper leaves the key under the mat: a vault-config.json sitting in assets/ right next to the ciphertext it unlocks, holding the key and IV in cleartext. | Malware blog | STAR Labs |
|
17.10.26 |
Qilin Ransomware: Inside a Rust Encryptor and Its Affiliate Ecosystem | Qilin ransomware combines file encryption with an affiliate operation that manages victims, ransom negotiations, and stolen-data publication. Different intrusion teams deploy its payloads, so identifying Qilin does not automatically identify the attacker or the method used to enter a network. | Ransom blog | Darkatlas |
|
17.10.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | DARKATLAS |
|
17.10.26 |
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) | BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable. | Vulnerebility blog | Sansec |
|
17.10.26 |
Spike in attacks targeting digital video recorders in Ukraine | GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. | BigBrother blog | GRAYNOISE |
|
17.10.26 |
skynox7: Proxyjacking Edge Devices Into Residential Proxies | Adversaries have a wide range of mechanisms they can use to obfuscate their public internet protocol (IP) addresses to avoid attribution and reduce their detectable signature. Adversaries have used various types of nodes and services to proxy their traffic including commercial virtual private networks (VPN), virtual private servers (VPS), co-opted victim infrastructure, and more. | Hacking blog | GRAYNOISE |
|
17.10.26 |
Variola: From ClickFix to a Modular Implant | Blackpoint’s Adversary Pursuit Group (APG) traced a ClickFix intrusion to a previously unclassified modular Windows implant, which APG is tracking as Variola. | Security blog | Blackpoint Cyber |
|
17.10.26 |
Pay Day Piracy: How Attackers Talk Their Way Into Your Payroll System | Using behavioral AI to chain anomalies from the help desk to HR payroll systems. | AI blog | Abnormal AI |
|
17.10.26 |
Detecting AI Attackers in the Cloud: 4 Signals That Work | AI-driven cloud attacks pass posture checks and detection rules because every step looks legitimate, and four signals still catch them when they're read together instead of one at a time. | AI blog | Abnormal AI |
|
17.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
17.10.26 |
Next.js Security Update for Upstream Vulnerabilities | Last week we announced an upcoming out-of-band security update for Next.js, including two fixes postponed from the September security release due to upstream dependency delays. | Vulnerebility blog | Next.js |
|
17.10.26 |
Patch Tuesday: October 2026 (Expel’s version) | Microsoft’s October release is the largest in its history: 1,414 CVEs, 78 rated critical and 1329 rated important. | OS Blog | Expel |
|
17.10.26 |
QuartzLine: A working PDF viewer with a backdoor inside | QuartzLine is a working PDF viewer with a backdoor hidden inside. In public analysis so far, the attacker never sent a command in any traffic researchers could decrypt. | Malware blog | Expel |
|
17.10.26 |
Emsisoft Anti-Malware for macOS stable release | After months of testing, feedback, and refinement, Emsisoft Anti-Malware for macOS is now officially available in a stable release. This release brings several performance improvements and tweaks. | Malware blog | Expel |
|
17.10.26 |
LG webOS sync-demo Preauth RCE - | First, the attacker replays the LG-signed manifest embedded in com.webos.app.sync-demo. SSG trusts the signature and follows the STB_INTERNAL_CONNECTION prompt-skip path, issuing a SECURE-tier client-key without a PIN prompt. Then cmp-client navigates to an attacker-controlled interactiveUrl. The loaded page keeps the app instance bridge and calls Luna services as cmp-client. | Vulnerebility blog | SSD Secure Disclosure |
|
17.10.26 |
Mobile Device Management Alone Cannot Address Every Mobile Security Threat | In an article published by HackRead, the limitations of Mobile Device Management (MDM) are examined as organizations face increasingly sophisticated threats targeting employee smartphones and corporate data. While MDM helps enforce device policies and manage access, it does not eliminate risks from mobile phishing, malicious applications, and compromised devices. | Security blog | ZIMPERIUM |
|
17.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Cryptocurrency blog | ZIMPERIUM |
|
17.10.26 |
Banking Scams Now Primarily Target Mobile Devices | A recent report reveals that 90% of banking scam attempts now occur on mobile devices, highlighting the growing role of smartphones in financial fraud. Researchers found that scammers are increasingly exploiting mobile banking interactions through social engineering, impersonation, and deceptive communications to manipulate victims into authorizing fraudulent transactions. | Spam blog | ZIMPERIUM |
|
17.10.26 |
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories - | On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. | Cyber blog | StepSecurity |
|
17.10.26 |
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD | Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. | Exploit blog | Calif |
|
17.10.26 |
Akamai Named a Leader in IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment | Akamai has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment. This is the second time that Akamai has been recognized as a Leader in this assessment. | Security blog | Akamai |
|
17.10.26 |
Comply with PCI 6.4.3 & 11.6.1 Through Client-Side Security Tools | As the payment landscape evolves, compliance with PCI DSS v4 (v4.0.1 is the latest) is now a reality, with the deadline to adopt the future-dated requirements behind us. It is a critical defense against growing web skimming attacks (also known as e-skimming and digital skimming) and data leakage risks. | Security blog | Akamai |
|
17.10.26 |
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain | A WhatsApp-delivered financial document lure carried Statement.exe into a multistage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process. | Social blog | Morphisec Blog |
|
17.10.26 |
Why is Preemptive Cyber Defense Important in 2026 | Preemptive cyber defense is a prevention-first security strategy that stops threats before they execute, rather than detecting and responding to them after they have already run. Instead of recognizing an attack in progress, it removes the conditions an attack needs to succeed, blocking malicious code deterministically at the moment of execution. | Security blog | Morphisec Blog |
|
17.10.26 |
2026 Financial Sector Cyberattack Chain Analysis & Defense | Between September 30 and October 3, 2026, consecutive customer data leaks were confirmed at several major commercial banks in Korea. In particular, most of the leaks were found to have exploited APIs by targeting authentication and authorization flaws, and there are even concerns about potential automated attacks using AI agents. | BigBrother blog | Enki White Hat |
|
17.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The campaign uses PhantomPolia, a JavaScript loader that retrieves an encrypted configuration from an Ethereum Sepolia smart contract through public Remote Procedure Call (RPC) endpoints. The loader then decrypts the configuration locally using PBKDF2 and AES-GCM, revealing the next-stage command-and-control (C2) domain without exposing it directly on the compromised site. | Cryptocurrency blog | LEVELBLUE |
|
17.10.26 |
Now Detecting: CVE-2026-85706 - Unauthenticated Arbitrary File Read in GitLab | A maximum severity flaw in GitLab's repository commits API allows anonymous attackers to read arbitrary files from self-managed servers. We are already detecting it. | Vulnerebility blog | Ethiack |
|
17.10.26 |
Mythos AI Security Implications: The Complete Guide (2026) | Claude Mythos did not create the AI-security asymmetry between attackers and defenders. Mythos made it undeniable. Anthropic's own Frontier Red Team used the model to autonomously discover thousands of high- and critical-severity zero-day vulnerabilities across every major operating system and every major web browser, and it did so at costs that break the historical economics of vulnerability research. | AI blog | Ethiack |
|
17.10.26 |
Front Lines Podcast: What Founders Get Wrong When Pitching CISOs | On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust. | Cyber blog | Socket |
|
17.10.26 |
Socket for Origin Now Available | Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace. | Cyber blog | Socket |
|
17.10.26 |
Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings | Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes. | AI blog | Socket |
|
17.10.26 |
Suspected Chinese spies hit BeyondTrust via zero-day | A suspected Chinese espionage crew broke into BeyondTrust Remote Support appliances through a flaw nobody knew about, weeks before the vendor disclosed it. Google Threat Intelligence Group (GTIG) and Mandiant say the actor they now call ARMORY CASTLE, previously tracked as UNC5221, exploited CVE-2026-102764 as a zero-day in late August 2026, then used the hijacked appliances to steal credentials and reach the machines those appliances are trusted to manage. | Vulnerebility blog | IntelFusions |
|
17.10.26 |
Deploy with Void | VoidZero's tools such as Vite, Vitest, Oxc, and Rolldown — bundled in one toolchain as Vite+ — have made frontend development faster, but building full-stack applications requires more than just a tooling stack. These applications need server routes, databases, local development environments, and a fast and easy way to deploy ideas to production. | Cyber blog | Cloudflare Blog |
|
17.10.26 |
Cloudflare and OpenAI: making AI discovery better for everyone | Optimizing your site for AI is of little use if AI can't find it. The answer to someone's question may already be on your website: the installation guide you spent a week writing, or a first-hand account of using a product, with the details that make the difference for whether they buy it. As more people turn to AI for help, you want those systems to find your work, represent it accurately, and send interested people your way. You also want control over how they access your site. | AI blog | Cloudflare Blog |
|
17.10.26 |
Yandex outage: data shows that instead of going dark, malicious bots went on the move | Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead. There are two autonomous system numbers (ASNs) associated with Yandex: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services. | BigBrother blog | Cloudflare Blog |
|
17.10.26 |
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug | Hyperdrive support for MySQL is now generally available (GA). Hyperdrive, Cloudflare’s database connection pooler for Workers, initially only supported Postgres. Since we announced the beta for MySQL protocol support last year, we have been working on making our MySQL handling as reliable as our Postgres support. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
A fully programmable secure web gateway | Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of network security for nearly 30 years, and it handles the common case well. But it has a ceiling, and customers with complex environments hit that ceiling regularly. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | On August 18, 2026, Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
Acronis Cyberthreats Update, October 2026 | The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in September 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. | Cyber blog | ACRONIS |
|
17.10.26 |
Acronis AI Copilot: Adoption is high and growing among MSPs | Acronis Cyber Platform has a built-in AI assistant. Type a plain-language question into the console, and it generates an answer or completes a supporting task within the console. | AI blog | ACRONIS |
|
17.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
17.10.26 |
AI and the Shared Responsibility Model: What Changes | Whether you are deploying large language models (LLMs), training custom machine learning models, building agentic workflows or embedding AI into existing applications, the major cloud service providers (CSP) have rolled out dedicated platforms to make it easier than ever to get started. | AI blog | GIUDEPOINT |
|
17.10.26 |
Hiring in the Age of Deepfakes: Synthetic Applicants | It’s tough enough to hire the right person in today’s competitive talent market. Candidates ghost interviewers, skill sets don’t match job descriptions and the race for top technical talent is relentless. | Hacking blog | GIUDEPOINT |
|
17.10.26 |
Silent Ransom Group Leaked Chats: Key Findings by GRIT | The chats appear to be from Silent Ransom Group (SRG) and show an attempt at a deliberate rebrand (to Sleepless Threat) to evade law enforcement. The tradecraft analysis matches the FBI’s May 2025 notice on SRG. We assess with moderate-to-high confidence that the people in this chat operate under or alongside, the SRG name. | Ransom blog | GIUDEPOINT |
|
17.10.26 |
러시아 전쟁의 이면에서 우크라이나를 겨냥한 김수키의 Operation GitPower | Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War | APT blog | GENIANS |
|
17.10.26 |
금융분야 침해사고 이슈 분석 | 본 보고서는 2026년 9월 말부터 10월 초까지 국내 금융권에서 연쇄적으로 발생한 개인정보 침해사고를 대상으로, Genians Security Center(GSC)가 공개 보도, 금융당국 발표, 보안업계 분석을 종합하여 사고 경과, 공격 기법, AI 활용 정황 및 국내외 위협 동향을 정리한 것입니다. | APT blog | GENIANS |
|
17.10.26 |
The zod Near-Miss: Publish-Time Scanning at the npm Registry Boundary — | zod is the kind of dependency you add without thinking about it. The schema validation library sits in millions of TypeScript projects; commenters in GitHub’s incident thread put its weekly downloads above 280 million. On Sunday, September 21, 2026, a commit landed in the public colinhacks/zod repository with the message Fix bugs and improve performance. | Hacking blog | Yeeth Security |
|
17.10.26 |
CVE-2026-89111: Critical SAP Cloud SDK SSRF | SAP has disclosed CVE-2026-89111, a maximum-severity server-side request forgery (SSRF) vulnerability in SAP Cloud SDK for Python that can expose OAuth2 client credentials. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
Top RCE Vulnerabilities: 10 Critical CVEs and Exploits | A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the most common way attackers get in: it was the initial access vector in 31% of breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), up from 20% the year before, and the median time to fully patch rose from 32 to 43 days. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days | Microsoft’s October 2026 Patch Tuesday, released on October 13, 2026, fixes 1,413 vulnerabilities across Windows, Office, Exchange Server, SharePoint, .NET, Azure services, and developer tools. The total surpasses September’s Patch Tuesday (974 flaws) and sets a new monthly record for the second month in a row, a rise Microsoft has tied to AI-assisted vulnerability discovery. | OS Blog | SOCRADAR |
|
17.10.26 |
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks | Ivanti released fixes on October 13, 2026, for CVE-2026-104935, an Ivanti Connect Secure zero-day that attackers exploited before a patch existed. Volexity, which uncovered the activity during an incident investigation, tracks the attacker as UTA0576. According to the published analysis, the actor chained three vulnerabilities to move from an unauthenticated web request to root-level code execution on an ICS VPN appliance running version 22.8R2.4, which was fully patched at the time. | Exploit blog | SOCRADAR |
|
17.10.26 |
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site | A month after its first leak site postings, the n0n extortion group has turned its attention to global shipping. On October 12, 2026, the group added 38 organizations to its Dark Web leak site in one batch: container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, port IT providers in Kuwait, Indonesia and Germany, and a dense cluster of South Korean operators. | APT blog | SOCRADAR |
|
17.10.26 |
French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply | Supermarkets across France opened on Monday, October 12, to warm freezers and spoiled stock. Overnight, attackers had taken control of refrigeration controllers in hundreds of stores and forced them into defrost, heating equipment to as high as 50°C. Prosecutors confirmed fires, retailers estimated losses in the tens of millions of euros, and Coopérative U’s chief executive called the attack unprecedented. | BigBrother blog | SOCRADAR |
|
17.10.26 |
Iran War Cyber Threat Outlook: Conflict Phases and What Comes Next | Since the Iran War began on February 28, 2026, the conflict has moved through phases that most threat frameworks were not built to track. In cyberspace, SOCRadar tracked 1,357 incidents prominent in the first month that spanned 25+ countries, 15+ sectors, and 40+ distinct attack groups. That data does more than record what happened. It reveals a pattern | BigBrother blog | SOCRADAR |
|
17.10.26 |
Behind the scenes of a vishing operation | Okta Threat Intelligence recently obtained material from a sensitive source that provides an inside view of Work Panel, an operator console used by threat actors running vishing campaigns that target customers of multiple identity providers, including Okta. | Phishing blog | Okta Threat Intelligence |
|
17.10.26 |
October 2026 Microsoft Patch Tuesday | Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild. | Vulnerebility blog | Tenable® |
|
17.10.26 |
Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool | VulnCheck is disclosing CVE-2026-49950, a deserialization vulnerability in Xorbits Xoscar that allows for unauthenticated remote code execution. The bug is not in an application endpoint; it is in the transport layer of the actor framework itself. An actor pool is Xoscar's unit of concurrency: a process that hosts actors and exchanges messages with other pools over TCP. | Vulnerebility blog | VulnCheck |
|
17.10.26 |
Expanding Visibility Into Chinese Government-linked Cyber Threat Actors | Some of the joint advisory's IOCs are still live and repurposed. Three IPs were hitting VulnCheck Canaries as recently as May 2026, years after their advisory last-seen dates, but against entirely different vulnerabilities than the advisory lists. | APT blog | VulnCheck |
|
17.10.26 |
SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename | VulnCheck is disclosing CVE-2026-104085, an OS command injection in odt2spip, a document-import plugin for the SPIP CMS. The plugin lets an author import an office document (.odt, .doc, .docx, .html) into an article. It moves the uploaded file to a path built from the raw client-supplied filename, then hands that path to LibreOffice through a shell command. | Hacking blog | VulnCheck |
|
17.10.26 |
5 Key Takeaways From Censys’ State of the Internet Report | New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about where Internet infrastructure lives, how it changes, and what’s exposed. | Cyber blog | Censys |
|
17.10.26 |
The Ultimate Guide to Brand Protection with Censys - Censys Brand Protection & Fraud Takedowns: A Censys Guide | On August 23, 2026, a PowerShell dropper reached out to hxxp://binance-idexchange[.]com/333.mp4 for its next stage. Binance, the world’s largest cryptocurrency exchange with hundreds of millions of users, had nothing to do with it — duh! | Cryptocurrency blog | Censys |
|
17.10.26 |
Frostbitten in France: A Danfoss StoreView Internet Exposure Report | Attackers targeted refrigeration units at hundreds of supermarkets across France over the weekend of October 10, resulting in spoiled food and, in some cases, fires. | Incident blog | Censys |
|
17.10.26 |
Navigating the Waves of AI-Powered Identity Attacks | It’s one of the most famous lines in movie history. Chief Brody, chumming the water off the back of the Orca, a battle-hardened fishing boat, gets his first full look at the nemesis in Jaws. He backs slowly into the cabin in shock and says… | Incident blog | Flare |
|
17.10.26 |
Analysis After the Refrigeration System Attack in France | Overnight between October 11-12, 2026, refrigeration systems at several hundred grocery stores in France were driven into forced defrost. Temperatures in some cases reached 50 degrees Celsius, stock was destroyed, and equipment overheated. | Incident blog | Flare |
|
17.10.26 |
September 2026 Threat Trend Report on APT Groups | APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain. | APT blog | ASEC |
|
17.10.26 |
Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat | Since the original ARTEX GitHub repository disappeared, there has been an increase in independent distributions and customized instances based on the existing ARTEX codebase. These distributions are being redistributed with the product name, UI, filesystem structure, agent settings, and language modified, while retaining traces of ARTEX. | Cyber blog | ASEC |
|
17.10.26 |
ARTokens 5.1.2: Microsoft 365 Device Code Phishing | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | Phishing blog | ZeroBEC |
|
17.10.26 |
ARTEX Attacks on South Korean Financial Institutions | From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions were attacked one after another. | Attack blog | THREATBOOK |
|
17.10.26 |
RedAgents.Ai: The World's First Multi-Agent AI Pentest Platform | Recent news of multiple South Korean banks having their networks breached has once again deepened the industry's alarm over AI attacks. Even when attackers are not technically skilled, they can use AI agents to cause a major security impact. | Malware blog | THREATBOOK |
|
17.10.26 |
MSSP Growth: How to Scale Investigations Without Adding More Work | But growth also brings more alerts, suspicious files and URLs, investigations, escalations, reports, and SLA commitments. And if too much of that work still depends on manual analyst effort, those 10 new clients can put pressure on the SOC faster than expected. | Security blog | ANYRUN BLOG |
|
17.10.26 |
Fake AI Tools Target US Companies: Claude, ChatGPT & Copilot | ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after India. | AI blog | ANYRUN BLOG |
|
17.10.26 |
What Can ANY.RUN Reveal About Your Threat Landscape? | Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with ANY.RUN. Beyond individual investigations, this activity generates valuable data on emerging threats, industry trends, and SOC operational performance. | Security blog | ANYRUN BLOG |
|
17.10.26 |
DORA TLPT Requirements: Where Threat Intelligence Fits | The DORA TLPT requirements push selected EU financial entities beyond standard penetration testing. TLPT must be based on realistic threat scenarios, relevant threat actors, and current intelligence about how attacks are actually carried out. | Security blog | ANYRUN BLOG |
|
17.10.26 |
Russia Is Tightening Internet Controls, Leading to Operational Risks | Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. | BigBrother blog | RECORDEDFUTURE |
|
17.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | Disclosure note: Before publishing, we shared the new infrastructure identified in this research with the relevant national CERTs. This research did not recover victim data. | Cryptocurrency blog | HUNT.IO |
|
17.10.26 |
Inside a PaperCut Attacker’s AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries | Disclosure note: Before publishing this research, we shared our findings and the victim data we recovered with the national CERTs of the affected countries. The CERTs are handling notification of the affected organizations in their jurisdictions. | AI blog | HUNT.IO |
|
17.10.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Exploit blog | Proofpoint US |
|
17.10.26 |
Threat Actors Abuse AI Pentesting Framework | Zscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. | AI blog | ThreatLabz |
|
17.10.26 |
The patch tsunami: Microsoft addresses 1,415 CVEs in Patch Tuesday | For nearly 25 years, Patch Tuesday gave IT teams a predictable stream of patches to manage. In 2026, AI turned that stream into a tidal wave that threatens to overwhelm the organizations that can’t adapt. | OS Blog | ThreatDown |
|
17.10.26 |
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize | Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential theft, ransomware, and an unusual set of psychological harassment capabilities. | Malware blog | Group-IB Blog |
|
17.10.26 |
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling. | AI blog | CrowdStrike |
|
17.10.26 |
How Attackers Can Bypass LLM Safety Classifiers | The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. | AI blog | CrowdStrike |
|
17.10.26 |
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage | CrowdStrike joins Anthropic’s Critical Infrastructure Defense Program, bringing deep cybersecurity expertise in protecting IT and OT environments to help advance AI-powered defense for critical infrastructure. | AI blog | CrowdStrike |
|
17.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). Successful exploitation can cause a denial of service (DoS) condition, potentially disrupting authentication services and remote access functionality. | Vulnerebility blog | SOPHOS |
|
17.10.26 |
Intent-Based Access Control: AI, Risk and the Limits of Inference | In Minority Report, the Department of Precrime promised certainty. Three precognitives saw the future, the system picked the consensus, and police arrested people for murders they hadn't yet committed. The whole machine depended on one buried secret: sometimes the precogs disagreed, and the dissenting vision, the minority report, was quietly deleted. The system held together as long as the precogs agreed, but broke when it removed its own doubt. | AI blog | SOPHOS |
|
17.10.26 |
Vulnerability Discovery and Exploitation Trends in the AI Era | Google Threat Intelligence Group (GTIG) examines vulnerability disclosure and exploitation statistics to evaluate the impact of artificial intelligence (AI) on the vulnerability threat landscape. We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
ARMORY CASTLE Exploits BeyondTrust | On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
AI/ML-Driven Malware Analysis Platforms: Key Features | Malware is becoming increasingly sophisticated, making it difficult for organizations to detect emerging threats using traditional signature-based security tools alone. Attackers use techniques such as code obfuscation, polymorphism, and sandbox evasion to bypass conventional security measures. | AI blog | SEQRITE |
|
17.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | SEQRITE |
|
17.10.26 |
WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack | WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target application. | Exploit blog | SEQRITE |
|
17.10.26 |
Weekly Vulnerability Report: Langflow, N8n, And 54 ICS Flaws | This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS). | Cyber blog | CYBLE |
|
17.10.26 |
Don’t Get Played: TOKEN2049 Security Event Faces Scam Claims | A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded “Don’t Get Played,” was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names “Apex Accelerator” and “Stone Venture.” | Spam blog | CYBLE |
|
17.10.26 |
The GhostX Ecosystem: Forged In Transit, Licensed To Deceive | Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. | Malware blog | CYBLE |
|
17.10.26 |
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | Malware blog | Gen Blogs |
|
17.10.26 |
Aoki: Infostealer Targets AI Coding Assistant Credentials | Newer versions of a little-documented infostealer steal API keys and tokens from ever-growing number of AI coding assistants, including Claude, Codex, Cursor and Gemini. | Malware blog | SECURITY.COM |
|
17.10.26 |
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime | Over the past year, Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators, developers, and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide. | Phishing blog | Microsoft Security Blog |
|
17.10.26 |
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant | Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance. | APT blog | Palo Alto |
|
17.10.26 |
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk | When unusual activity was detected on a European bank’s central IT system, its internal security team quickly recognized that the incident warranted immediate response. They discovered unauthorized VPN-based access attempts that spanned several months. They then engaged Unit 42 to determine the full scope of the intrusion, identify any persistent footholds and secure the environment. | Hacking blog | Palo Alto |
|
17.10.26 |
AI-Powered Espionage Campaign Targets Government Linux Infrastructure | Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. | AI blog | Palo Alto |
|
17.10.26 |
When LLM Gateways Go Wrong: Findings from LiteLLM - Check Point Research | Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. | AI blog | Check Point Research |
|
17.10.26 |
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation | I've been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell (although I'm writing this with 1°C/34°F outside), Vulnpocalypse, Bugmageddon, Bugpocalypse, Breachpocalypse... | Vulnerebility blog | Check Point Research |
|
17.10.26 |
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. | APT blog | CISCO TALOS |
|
17.10.26 |
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware | “AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. | AI blog | CISCO TALOS |
|
17.10.26 |
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." | OS Blog | CISCO TALOS |
|
17.10.26 |
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations | Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war. | APT blog | CISCO TALOS |
|
17.10.26 |
Inbox flooded with sign-up messages? How to handle email bombing | If you’re suddenly being overwhelmed with sign-up emails, it could very well be a sign of something more serious | Spam blog | Eset |
|
17.10.26 |
Medicare Open Enrollment season is here, and so are the scams | Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safe | Spam blog | Eset |
|
17.10.26 |
What to do when a data breach notice tells you almost nothing | Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next. | Security blog | Eset |
|
17.10.26 |
The Unseen Credential Surface: How AI Agents Expose Secrets | There is a quiet assumption behind every AI agent: that when it "just runs a command for you," it handles your credentials as carefully as a good engineer would. It does not. This is not due to malicious intent. It is architectural. | AI blog | TRELLIX |
|
16.10.26 |
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions | A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory- | Vulnerebility | The Hacker News |
|
16.10.26 |
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory | A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A | Vulnerebility | The Hacker News |
|
16.10.26 |
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads | Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that | Virus | The Hacker News |
|
16.10.26 |
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks | The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of | Vulnerebility | The Hacker News |
|
15.10.26 |
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams | A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka , which appears to be a | Spam | The Hacker News |
|
15.10.26 |
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks | NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There | Vulnerebility | The Hacker News |
|
15.10.26 |
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing | Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along | Vulnerebility | The Hacker News |
|
15.10.26 |
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules | Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October | Vulnerebility | The Hacker News |
|
15.10.26 |
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early | Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN | AI | The Hacker News |
|
15.10.26 |
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation | Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. | Vulnerebility | The Hacker News |
|
15.10.26 |
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 | The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with | Mobil | The Hacker News |
|
15.10.26 |
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories | The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and | Hack | The Hacker News |
|
15.10.26 |
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts | Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows | Exploit | The Hacker News |
|
15.10.26 |
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches | Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to | Exploit | The Hacker News |
|
15.10.26 |
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation | Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. | Exploit | The Hacker News |
|
15.10.26 |
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability | Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, | Exploit | The Hacker News |
|
15.10.26 |
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App | Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server , to plant web shells on Nextcloud servers. Three | Vulnerebility | The Hacker News |
|
15.10.26 |
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages | Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the | Phishing | The Hacker News |
|
15.10.26 |
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud | The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme . | BigBrothers | The Hacker News |
|
14.10.26 |
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their | Exploit | The Hacker News |
|
14.10.26 |
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution | A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who | Vulnerebility | The Hacker News |
|
14.10.26 |
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days | A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the | AI | The Hacker News |
|
14.10.26 |
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks | Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking | Virus | The Hacker News |
|
14.10.26 |
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host | A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel | AI | The Hacker News |
|
14.10.26 |
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave | Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the | Vulnerebility | The Hacker News |
|
14.10.26 |
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug | Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities , including one that it said has | OS | The Hacker News |
|
14.10.26 |
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room | A Saudi National and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the | AI | The Hacker News |
|
14.10.26 |
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets | Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens | IoT | The Hacker News |
|
14.10.26 |
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another | A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. | Vulnerebility | The Hacker News |
|
14.10.26 |
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far | An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm | Vulnerebility | The Hacker News |
|
14.10.26 |
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft | A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security | Vulnerebility | The Hacker News |
|
13.10.26 |
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking | GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was | Hack | The Hacker News |
|
13.10.26 |
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation | The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. The | Social | The Hacker News |
|
13.10.26 |
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network | Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or | Vulnerebility | The Hacker News |
|
13.10.26 |
SOCRadar and Torq: Automate Threat Intelligence Response | Your Dark Web monitoring just flagged a set of employee credentials for sale. The alarm is accurate, it is timely, and it is now sitting in a queue. Someone has to read it, confirm the accounts are real, check whether the sessions are active, open a ticket and chase the identity team to rotate the password. | Security blog | SOCRADAR |
|
13.10.26 |
CVE-2026-102255: Critical SonicWall SMA1000 SSRF | SonicWall has patched CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting the WorkPlace interface of SMA1000 appliances. | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
Inside ICMacOS: From an Infostealer to a Persistent RAT | Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly one in three software developers works on macOS. | Malware blog | SOCRADAR |
|
13.10.26 |
Angi, Tour Guy, Healthcare, KPN and CafeMom Leaks | SOCRadar Dark Web Team identified several new underground posts, including an alleged Angi customer database sale, an alleged The Tour Guy breach exposing 3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China. | CyberCrime blog | SOCRADAR |
|
13.10.26 |
CVE-2026-85097: Bricksforge Flaw Exploited for Unauthenticated RCE | Threat actors are actively exploiting CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in the Bricksforge plugin for WordPress. The flaw lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites, resulting in remote code execution (RCE). | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
ARTEX Attacks on South Korean Financial Institutions | From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions were attacked one after another. | Attack blog | THREATBOOK |
|
13.10.26 |
Auditing the auditor: Unmasking Apex Accelerator | REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery. | Security blog | Elastic Security Labs |
|
13.10.26 |
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers | Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing | Incindent | The Hacker News |
|
13.10.26 |
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control | Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges | Vulnerebility | The Hacker News |
|
13.10.26 |
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code | GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software | Vulnerebility | The Hacker News |
|
13.10.26 |
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies | Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly | Virus | The Hacker News |
|
12.10.26 |
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch | Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances | Vulnerebility | The Hacker News |
|
12.10.26 |
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE | A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to | Vulnerebility | The Hacker News |
|
12.10.26 |
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records | Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting | AI | The Hacker News |
|
12.10.26 |
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands | Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword . "Compared | Exploit | The Hacker News |
|
12.10.26 |
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws | Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its | AI | The Hacker News |
|
11.10.26 |
Cyber exec arrested in case allegedly tied to ShinyHunters hackers | Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. | CyberCrime | BleepingComputer |
|
11.10.26 |
ARTEX AI, Claude agents used in cyberattacks on South Korean banks | The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. | AI | BleepingComputer |
|
11.10.26 |
Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management | Traditional attack surface management helps organizations discover exposed assets, but visibility alone is not enough to address threats. Criminal IP introduces AITEM, an AI-powered approach that connects exposure discovery with investigation, risk prioritization, and response. | AI | BleepingComputer |
|
11.10.26 |
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks | Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks | CyberCrime | BleepingComputer |
|
11.10.26 |
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto | Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. | Cryptocurrency | BleepingComputer |
|
11.10.26 |
FBI arrests another suspected ShinyHunters hacker after agency breach | The FBI has arrested another suspected member of the ShinyHunters extortion group believed to be involved in the recent breach of FBI systems, Director Kash Patel announced Friday. | BigBrothers | BleepingComputer |
|
11.10.26 |
Germany arrests alleged core Qilin ransomware member after extradition | Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month. | Ransom | BleepingComputer |
|
11.10.26 |
Max severity SonicWall SMA1000 flaw now exploited in attacks | Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. | Exploit | BleepingComputer |
|
11.10.26 |
Man admits to running network of 15,000 money mules for cybercriminals | A Ukrainian-Russian dual citizen has pleaded guilty to running a massive money laundering operation that laundered millions for cybercriminals worldwide. | CyberCrime | BleepingComputer |
|
11.10.26 |
Microsoft: Outdated Windows devices will stop receiving security updates | Microsoft says devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation. | Security | BleepingComputer |
|
11.10.26 |
Citrix warns admins to patch new NetScaler RCE flaw immediately | Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. | Vulnerebility | BleepingComputer |
|
11.10.26 |
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland | The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. | Congress | BleepingComputer |
|
11.10.26 |
FBI disrupts Chinese hacking tools used to breach critical infrastructure | The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. | BigBrothers | BleepingComputer |
|
11.10.26 |
Ransomware attack disrupts Japan's IDCF Cloud used by govt clients | IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving the eastern part of the country. | Ransom | BleepingComputer |
|
11.10.26 |
Low-cost Android phones ship with residential proxy malware | A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. | OS | BleepingComputer |
|
11.10.26 |
FakeGit malware campaign returns with 17,610 malicious GitHub repos | More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. | Hack | BleepingComputer |
|
11.10.26 |
Cisco warns of critical flaws allowing Nexus switch takeover | Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches | Vulnerebility | BleepingComputer |
|
11.10.26 |
Uranium crypto exchange hacker convicted for stealing $53 million | A Maryland man was found guilty of stealing more than $53 million after hacking the decentralized crypto exchange Uranium Finance twice in April 2021. | Cryptocurrency | BleepingComputer |
|
11.10.26 |
Microsoft Teams to get support for third-party deepfake detection tools | Microsoft will soon introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings. | OS | BleepingComputer |
|
11.10.26 |
ASOS links data breach to social engineering attack, credential theft | ASOS is sending updates to affected customers about the cybersecurity incident it suffered earlier this week, confirming that hackers accessed some personal data. | Incindent | BleepingComputer |
|
11.10.26 |
Owner of Empire cybercrime market gets 40 years in prison | The co-creator of Empire Market, one of the largest dark web marketplaces before its shutdown, has been sentenced to 40 years in prison for facilitating $430 million in illegal transactions from 2018 to 2020. | CyberCrime | BleepingComputer |
|
11.10.26 |
Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland | On the second day of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities. | Congress | BleepingComputer |
|
11.10.26 |
Ransomware recovery CEO charged over secret ransom payments | The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data. | Ransom | BleepingComputer |
|
11.10.26 |
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins | The FBI is warning that FortiBleed attacks are still ongoing, targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways and locking out legitimate administrators. | Hack | BleepingComputer |
|
11.10.26 |
Hackers hijack Google domains after breaching ccTLD registries | Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa, and Sierra Leone after compromising third-party operators and modifying authoritative DNS records. | Hack | BleepingComputer |
|
11.10.26 |
Microsoft Outlook to block MSIX attachments starting November | Microsoft announced that it will add .msix and .msixbundle attachments to the list of blocked attachments in Outlook Web and the new Outlook Windows client starting next month. | OS | BleepingComputer |
|
11.10.26 |
PoeLLM malware infects exposed AI servers in cryptomining attacks | A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads. | Virus | BleepingComputer |
|
11.10.26 |
Ransomware has a new target. Is your backup ready? | Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that attackers cannot easily reach. | Ransom | BleepingComputer |
|
11.10.26 |
Hackers exploit critical Atlassian flaw after public PoC release | A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. | Exploit | BleepingComputer |
|
11.10.26 |
SonicWall warns of max severity SSRF flaw in SMA1000 gateways | SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances. | Vulnerebility | BleepingComputer |
|
10.10.26 |
Musician sent to prison for $10 million streaming fraud using AI bots | A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme. | CyberCrime | BleepingComputer |
|
10.10.26 |
Advantest confirms personal information stolen in ransomware attack | Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data. | Ransom | BleepingComputer |
|
10.10.26 |
Ninja Forms plugin flaw exploited to hack WordPress sites | Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. | Exploit | BleepingComputer |
|
10.10.26 |
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland | On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. | Exploit | BleepingComputer |
|
10.10.26 |
Atlassian warns of critical file-access flaw in Jira, Confluence | Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. | Vulnerebility | BleepingComputer |
|
10.10.26 |
ASOS confirms data breach after “HACKED” in-app notifications | UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. | Incindent | BleepingComputer |
|
10.10.26 |
Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes | A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. | AI | BleepingComputer |
|
10.10.26 |
How to secure RMM software: 8 controls MSPs should test | RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation. | Security | BleepingComputer |
|
10.10.26 |
Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits | The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have been partially responsible for a May outage. | AI | BleepingComputer |
|
10.10.26 |
Nikkei discloses breaches of employees’ Microsoft, Google email accounts | Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails. | Incindent | BleepingComputer |
|
10.10.26 |
Engineer sentenced for locking over 3,000 devices on employer network | A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack. | Incindent | BleepingComputer |
|
10.10.26 |
OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU | OpenAI is preparing to add invisible watermarks to text generated by ChatGPT and Codex in the European Union. | AI | BleepingComputer |
|
10.10.26 |
Rejetto HFS servers now actively scanned for critical RCE flaw | Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). | Vulnerebility | BleepingComputer |
|
10.10.26 |
IQVIA fined $7.8 million for failing to properly anonymize health data | Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7.8M) over poor data-processing practices that the agency says could have put roughly one million patients at risk of data exposure and de-anonymization. | Incindent | BleepingComputer |
|
10.10.26 |
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories | Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source | Hack | The Hacker News |
|
10.10.26 |
FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack | The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X . ShinyHunters is | BigBrothers | The Hacker News |
|
10.10.26 |
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands | Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword . "Compared | Exploit | The Hacker News |
|
10.10.26 |
TP-Link Sued by Four More U.S. States Over Router Security and China Ties | Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with Texas filing a suit in February . Florida, Iowa, | BigBrothers | The Hacker News |
|
10.10.26 |
Dire Wolf Ransomware Attacks: How to Test and Strengthen Your Defenses | Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. | Ransom blog | PICUSSECURITY |
|
10.10.26 |
CISA AA26-281A: How Chinese Government-Linked Actors Steal Sensitive Data | CISA published a joint cybersecurity advisory on October 8, 2026, which describes how Chinese government-linked threat actors combine automated reconnaissance with hands-on intrusion to steal sensitive data. | BigBrother blog | PICUSSECURITY |
|
10.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Malicious Crypto Shell Packages Target RubyGems | A threat actor calling themselves "Ghost Dev" published 42 malicious typo squat packages to the RubyGems registry targeting crypto and web3 packages | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
How to Investigate a GitHub Repo's Real History | Learn to reconstruct what actually happened to a compromised repo using timestamps and logs that the person doing the manipulation doesn't control. | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Novinarya: An Android stealer that hides its live C2 in a shop bio | Scan this sample for a command server and you find nothing: no URL, no IP, nothing to block. That is the whole idea. Behind a fake “Smart System Security” app, this Iranian banking and crypto stealer keeps its server out of the binary and reads it at run time from the bio of a seller’s profile on a legitimate marketplace, rotating it with a single edit no new sample needed. | Malware blog | STAR Labs |
|
10.10.26 |
Runtime AI Defense in a shared responsibility model | This last February, by their own account, an employee at Meta connected an open source agent to their inbox and told it to suggest which emails to archive or delete, and to confirm with them before acting. Despite the guardrails of the prompt, the agent started deleting. Their stop commands didn't work and they had to manually kill the process. | AI blog | Sysdig |
|
10.10.26 |
Spike in attacks targeting digital video recorders in Ukraine | GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. | BigBrother blog | GREYNOISE |
|
10.10.26 |
Why API Security Belongs in ECB Cyber Action Plans | An undocumented partner endpoint or an outdated mobile-banking API can expose customer information even after newer services receive stronger protections. As AI accelerates vulnerability discovery and exploitation, banks need a clearer view of these gaps and a practical way to reduce them. | Vulnerebility blog | Akamai |
|
10.10.26 |
CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | On October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. | Vulnerebility blog | Akamai |
|
10.10.26 |
How Akamai ExAR Contained a LATAM Supply Chain Attack | Akamai Guardicore Segmentation’s Exposure Analysis and Response (ExAR) detected and investigated a multistage intrusion affecting supply chain infrastructure in Latin America (LATAM). The complex intrusion was targeting Linux, OpenShift, and Windows DMZ workloads before significant operational disruption occurred. | Hacking blog | Akamai |
|
10.10.26 |
Open Enrollment Is Where Digital Strategy Gets Tested. Are You Ready? | Most retail purchases come with a return policy. If the sweater doesn't fit, you send it back. But health plan selections work differently. Once a member chooses a plan during open enrollment, they generally keep that plan for the year unless they qualify for a Special Enrollment Period or get coverage another way. | Cyber blog | Akamai |
|
10.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | In recent years, organizations have made real progress here. SBOMs (Software Bill of Materials) are now a standard deliverable. Software Composition Analysis (SCA) tools run in CI/CD. Vendor security questionnaires are longer and more rigorous than ever. | Security blog | JSCRAMBLE |
|
10.10.26 |
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain | A financial-document lure, reported to have arrived over WhatsApp, carried Statement.exe into a multi-stage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process. | Social blog | Morphisec Blog |
|
10.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The LevelBlue Operational Cyber Threat Intelligence (OpsCTI) Team recently observed a ClickFix campaign delivering Remus Stealer through compromised websites. | Malware blog | LEVELBLUE |
|
10.10.26 |
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials | Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces. | Cryptocurrency blog | Socket |
|
10.10.26 |
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack | Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware. | Malware blog | Socket |
|
10.10.26 |
Building an evidence-grounded agentic security operations harness on Cloudflare | Security alerts rarely arrive one at a time. A single alert can cause a spike across the environment, requiring a human analyst to decide which alerts are related and what they mean. When multiple arrive at the same time, it can quickly overwhelm even a seasoned security analyst. Enter the alert paradox. Now, our built-in, multi-AI-agent security operations harness can handle more of this work at Cloudflare scale. | AI blog | Cloudflare Blog |
|
10.10.26 |
Bridging technical depth and usability: The story behind Radar’s redesign | Radar provides a real-time view into global Internet trends, powered by Cloudflare’s global network. We support Cloudflare’s mission to help build a better Internet by making web data visible, clear, and actionable for everyone. Since launching in 2020, Radar has found a natural audience amongst expert users with technical backgrounds, such as network operators and academic researchers who rely on Radar data to observe industry trends and global events. | Security blog | Cloudflare Blog |
|
10.10.26 |
Meet AI Detection Engineer, the Newest Member of Your SOC | AI Detection Engineer investigates, builds, tests, and deploys a tuned detection for confirmed misjudgments your team reports, then shows the verifiable impact. | AI blog | Abnormal AI |
|
10.10.26 |
Four ways back in: the WordPress XSS campaign that hides its own admin account | Two unrelated WordPress plugins, two separate stored Cross-Site Scripting vulnerabilities, one payload. Over the past several days our telemetry has recorded exploitation attempts against both, and every attempt pulls the same JavaScript from imgcdn1.com. Two is what we have confirmed, not what we expect the final count to be. | Vulnerebility blog | Patchstack |
|
10.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
10.10.26 |
Inferno Drainer Is Burning Out | Inferno Drainer and its many derivatives constitute arguably the most notorious cryptodrainer-as-a-service ecosystem ever developed. After months spent reverse-engineering its newest payloads and monitoring the ecosystem in real time, one thing seems clear: the operation is in serious decline, and has been for quite some time. | Cryptocurrency blog | Ransom-ISAC |
|
10.10.26 |
Upcoming Next.js Security Update for Upstream Vulnerabilities | Next Wednesday, October 14, 2026, we plan to publish an out-of-band Next.js security update. It will address three vulnerabilities in upstream dependencies: two Critical and one High. Two of these fixes were postponed from the September security release due to upstream coordination. | Vulnerebility blog | Next.js |
|
10.10.26 |
Oh Noes! is updated and free for Cybersecurity Awareness Month | October means Cybersecurity Awareness Month, which for a lot of security teams means the same routine: send a fake phishing email, see who clicks, remind everyone not to click links from strangers. Again. | Cyber blog | Expel |
|
10.10.26 |
Earth Sirrush: A Russia-Aligned Intrusion Set With 4 Years of Evolving Espionage Tooling | Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns. | APT blog | TrendAI (US) |
|
10.10.26 |
AI and the Evolving Threat Landscape: What Public Sector CISOs Need to Know Now | Public sector CISOs need to grapple with challenges brought about by AI threats: up to 3,600 AI CVEs in 2026, autonomous ransomware, and critical infrastructure risk. | AI blog | TrendAI (US) |
|
10.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Malware blog | TrendAI (US) |
|
10.10.26 |
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It | tensorlake@0.5.144 on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes your home directory. | Malware blog | StepSecurity |
|
10.10.26 |
StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines | AI agent skills live in two places. Developers install them on their own machines, and teams commit them to repositories so everyone who works in the codebase gets them. A skill often travels between the two: a developer installs it, finds it useful, and commits it; everyone who clones the repository then has it. | AI blog | StepSecurity |
|
10.10.26 |
Hijacked TensorLake npm Turned Install Into Credential Risk | The affected npm release included a preinstall hook that starts an obfuscated JavaScript payload through Bun. The package can download Bun 1.3.13 if it is not already available. | Hacking blog | SONATYPE |
|
10.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
10.10.26 |
aws-auth ConfigMap Deprecated: What EKS Teams Need Now | If you’ve been running Amazon Web Services (AWS) Elastic Kubernetes Service (EKS) clusters for any length of time, you’ve probably had that moment. Staring at an aws-auth ConfigMap YAML file at 2 AM, trying to figure out why a new team member can’t access the cluster. | Hacking blog | GUIDESECURITY |
|
10.10.26 |
GRIT Q3 2026 Ransomware Report: Top Takeaways | GuidePoint’s Research and Intelligence Team (GRIT) just unveiled the Q3 GRIT Ransomware and Cyber Threat Insights Report. This quarter, they look at the so-called “vulnpocalypse,” shine a spotlight on the Education industry and ShinyHunters group, analyze the Clop syndicate’s latest activity and assess payment trends in the ransomware space. | Ransom blog | GUIDESECURITY |
|
10.10.26 |
AgentCorruption: One Role to Rule Them Al | Exploring what the agent's default execution role and stolen credentials can actually do, and how they became an entry point to the entire region - discovering and invoking other agents, reading, deleting and hijacking private conversations through chat history tampering, and more. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Credential Theft from AWS's Secrets Manager and More | Up to now, we showed how far we could get once we had the over-privileged role in hand: we were able to pull container images, talk to other agents that we were never allowed to, read private conversations, plant short- and long-term memories to control agents’ behavior and delete user data. All of this stays within the AWS region boundary. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Weaponizing Agent Memory for Persistent Hijacking | How access to AgentCore Memory let us plant instructions that survived beyond the initial compromise, turning an agent's remembered context into a channel for persistent command and control. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Initial IMDS Access | How a single prompt to a public-facing AgentCore agent exposed the instance metadata endpoint, the agent's cloud identity, and its container image: the foothold for everything that follows in this series. | Hacking blog | Zenity Labs |
|
10.10.26 |
DarkSword/Coruna Open Directory Finding Report | Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. | Exploit blog | Censys |
|
10.10.26 |
New on the Map — September 2026: 22 Protocol and Endpoint Scanners | Most organizations do not have a complete picture of what is reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. Attackers scan for these services systematically, every day. | Security blog | Censys |
|
10.10.26 |
Harbor SSRF Vulnerability Exposes Cloud Credentials | OX Research disclosed an SSRF vulnerability in Harbor, the CNCF open-source container registry. Any registered user who can create a project can point a webhook at the cloud metadata endpoint and walk away with the server’s IAM credentials. | Hacking blog | OX SECURITY |
|
10.10.26 |
Leaked AI & MCP Credentials: What They Expose | One record in the corpus carries the argument before we even start counting. It’s a project configuration file for an AI coding assistant that wires several named tool servers behind a single agent. | AI blog | FLARE.IO |
|
10.10.26 |
Healthcare: Cybercrime's Highest-Value Target | Various healthcare and public health reports like the one of IC3 (2025) report that healthcare organizations are among the most targeted critical infrastructure sectors for cyber incidents, with hundreds of reports of ransomware attacks and data breaches reported in a single year. | CyberCrime blog | FLARE.IO |
|
10.10.26 |
Email Security That Reasons About the Request and the Response | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | Phishing blog | ZEROBEC BLOG |
|
10.10.26 |
DDoS Readiness: Is Your Protection Actually On? | Most security controls tell you when they’re broken. A bad firewall rule lets traffic through that shouldn’t be there. An expired certificate generates alerts. A misconfigured WAF starts blocking legitimate users and someone notices pretty quickly. | Attack blog | Imperva |
|
10.10.26 |
From Threat Intelligence to SOC Action | So, what actually makes threat intelligence useful in daily SOC work? During our discussion, we narrowed it to three things: | Security blog | ANY.RUN & Elastic |
|
10.10.26 |
Critical N-able N-central Vulnerability and Active Exploitation | UPDATE 9/6/26: N-able issued [Hotfix 4 (2026.3 HF4)] to address CVE-2026-86218, an actively exploited pre-auth RCE zero-day with a 10.0 CVSS score that supersedes all prior hotfixes. On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw. Hosted (NCOD) instances have already been patched by N-able. | Exploit blog | Huntress |
|
10.10.26 |
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. | Vulnerebility blog | Huntress |
|
10.10.26 |
Japan Adopts Proactive Cyber Defense Strategy | Japan’s Active Cyber Defense (ACD) framework shifts the country from voluntary information sharing and post-incident investigation to mandatory reporting, preventive communications analysis, and limited disruption of attack infrastructure. | BigBrother blog | RECORDEDFUTURE |
|
10.10.26 |
AI SOC automation: Inbox zero for your alert queue | AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your priorities. Nothing changes in your environment without your approval. | AI blog | Elastic Security Labs |
|
10.10.26 |
Semantic Privilege Escalation: The AI Security Threat Your Access Controls Can't See | In 1988, Norm Hardy published a short paper about an incident at Tymshare roughly eleven years earlier. A Fortran compiler lived in a system directory called SYSX, and so it could record usage statistics there, administrators had granted it a "home files license" that let it write any file in that directory. | AI blog | Proofpoint US |
|
10.10.26 |
Trojanized Terraform Provider Campaign | In July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), an advanced persistent threat actor backed by the North Korean government that has targeted the cryptocurrency industry for years. | Malware blog | ThreatLabz |
|
10.10.26 |
Criminal AI, powered by OpenRouter | Kriminal, DadGPT, and WormGPT are three of the most recognizable tools in the criminal AI marketplace today. Kriminal and DadGPT sell themselves as unrestricted AI: no filters, no refusals, built specifically to say “yes” where a mainstream model would say “no.” | AI blog | THREATDOWN |
|
10.10.26 |
How Attackers Can Bypass LLM Safety Classifiers | The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. | AI blog | CROWDSTRIKE |
|
10.10.26 |
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage | CrowdStrike joins Anthropic’s Critical Infrastructure Defense Program, bringing deep cybersecurity expertise in protecting IT and OT environments to help advance AI-powered defense for critical infrastructure. | AI blog | CROWDSTRIKE |
|
10.10.26 |
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. | AI blog | CROWDSTRIKE |
|
10.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). | Vulnerebility blog | SOPHOS |
|
10.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | Seqrite |
|
10.10.26 |
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | Malware blog | GENDIGITAL |
|
10.10.26 |
CVE-2025-7544: Attackers Weaponize Tenda AC1206 Router Vulnerability to Deploy Mirai-Related Malware | MLflow is one of the most widely deployed open-source platforms for managing the machine learning lifecycle, from experiment tracking and model versioning to deployment and registry management. | Vulnerebility blog | SonicWall |
|
10.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Adobe Commerce and Magento StyleSmuggler RCE - CVE-2026-75650 | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-75650, assessed its impact, and developed mitigation measures. The flaw, also known as StyleSmuggler, is a critical vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Blinder Tunnel Campaign Targets Iraqi Infrastructure | We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. Unit 42 tracks the activity as CL-STA-1178. This activity includes a campaign we call “Blinder Tunnel,” that targeted Iraqi critical infrastructure in March 2026, following infrastructure staging that was observed as early as November 2025. | Cyber blog | Palo Alto |
|
10.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. | Vulnerebility blog | Palo Alto |
|
10.10.26 |
Evolution of Web3 in Cloud Supply Chain Attacks | Threat actors have systematically upgraded their command-and-control (C2) infrastructure to use Web3, also known as Web 3.0 or decentralized blockchain web architectures. | Hacking blog | Palo Alto |
|
10.10.26 |
Making sure the checks get printed | My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and compliance, disaster recovery, and investigations. | Cyber blog | CISCO TALOS |
|
10.10.26 |
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware | Just as attackers are adding new capabilities into their toolkits with AI, they are consciously trying to evade the novel AI capabilities levied on them by defenders. In Cisco Talos' findings with CAIRN, we classify this archetype of malware as “A3: AI-Analysis Evasion” — that is, malware that embeds natural-language instructions to influence automated analysis. | AI blog | CISCO TALOS |
|
10.10.26 |
One breach, please, and make no mistakes | For some time now, the cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure (to name a few, Hugging Face, DSEWiki, and RubyGems). | Incident blog | CISCO TALOS |
|
10.10.26 |
Microsoft, Adobe, Apple, and Foxit vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. | Vulnerebility blog | CISCO TALOS |
|
10.10.26 |
Give yourself room to be human | Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. | Cyber blog | CISCO TALOS |
|
10.10.26 |
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. | APT blog | CISCO TALOS |
|
10.10.26 |
MATCHBOIL: New tricks, same old evil intentions | ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026 | Malware blog | Eset |
|
10.10.26 |
Inside a brand deal scam targeting YouTube creators | A plausible-sounding sponsorship offer could mask an attempt to compromise your Google account | Phishing blog | Eset |
|
10.10.26 |
The quest for simplicity: Why SMBs want advanced protection without the complexity | The cybersecurity market is often making it tougher for SMBs to keep threats at bay | Cyber blog | Eset |
|
10.10.26 |
Windows Exploitation Techniques: Dangling COM Object Registrations | This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. | Vulnerebility blog | PROJECT ZERO |
|
9.10.26 |
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access | Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives | Exploit | The Hacker News |
|
9.10.26 |
Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects | Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial | AI | The Hacker News |
|
9.10.26 |
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge | Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and | Exploit | The Hacker News |
|
9.10.26 |
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities | Exploit | The Hacker News |
|
9.10.26 |
GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys | A bug in GoBalance , a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address | Hack | The Hacker News |
|
9.10.26 |
Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own | Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every | Congress | The Hacker News |
|
9.10.26 |
Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments | Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code | Vulnerebility | The Hacker News |
|
9.10.26 |
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions | The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China- | BigBrothers | The Hacker News |
|
9.10.26 |
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails | Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, | APT | The Hacker News |
|
8.10.26 |
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks | Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The | Hack | The Hacker News |
|
8.10.26 |
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML | The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan | Virus | The Hacker News |
|
8.10.26 |
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms | Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial | AI | The Hacker News |
|
8.10.26 |
LINUX DAYS 2026 | Linuxdays 2026. LinuxDays is a Czech Linux conference, which takes place every year on the first weekend of October in Prague. The event was created in 2012 ... | CONGRESS | CONGRESS |
|
8.10.26 |
Q3 2026 Open Source Malware Index: When Compromise Compounds | In the third quarter of 2026, Sonatype identified 149,329 malicious open source packages across ecosystems, bringing the total logged since tracking began in 2017 to 1,960,846. | Malware blog | SONETYPE |
|
8.10.26 |
CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD | NOTE: This is an analysis of the artifacts and samples found during the hunt of SLAPSHOT, WHIPSHOT which is a Python tunneler used to proxy traffic into internal networks. The analysis is done using various AI Models and if you find any irrelevancy, please do report directly. This article is intended for Network Defenders, Threat Analysts, SOC and IT Administrators. | Exploit blog | THE RAVEN FILE |
|
8.10.26 |
AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage | An AI tool that produces only text carries roughly the risk of a badly worded email. A tool that can reach into systems and change things carries the risk of whatever those systems hold. The security question is not how clever the model is. It is which systems and data the model is authorized to access. | AI blog | ACRONIS |
|
8.10.26 |
Caught in 4K: The Gentlemen Files | A Russian-speaking Gentlemen ransomware affiliate called Azazel robbed two dozen victims across six countries, then double-crossed his own gang by publishing the loot on a private leak site and pocketing every dollar. | APT blog | CloudSEK |
|
8.10.26 |
How AI Is Changing the Roles Required in the Security Operations Center | As AI takes on more of the enrichment, correlation, and initial assessment inside the SOC, roles, skills, and KPIs still require deliberate redesign. Security leaders need to decide where automation is dependable, where human judgment should remain decisive, and how teams should be measured when alert handling is no longer the center of the operating model | AI blog | RAPID7 |
|
8.10.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Security blog | RAPID7 |
|
8.10.26 |
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment | The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. | CyberCrime blog | RAPID7 |
|
8.10.26 |
SMTP is the key: BPFDoor and AVERAT hitting the network edge | Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese appliances. | Malware blog | RAPID7 |
|
8.10.26 |
Access Governance: Reducing Attacker Reach in the Age of AI-Accelerated Threats | AI is accelerating vulnerabilities and threats. Learn how to strengthen your organization's data security and access governance to reduce risks effectively with insights from Varonis and PwC. | AI blog | VARONIS |
|
8.10.26 |
Least Privilege for AI Agents: A Practical Guide for Security Leaders | Learn what it means to enforce least privilege for AI agents, and get practical with a six-step implementation plan. | AI blog | VARONIS |
|
8.10.26 |
Rogue AI Agents Abuse urlquery to extract Russian government data | We found additional activity and sandbox circumvention techniques used by rogue AI agent swarms. These include attempting to extract Russian government data, hijacking remote browser services and running Javascript in attempts to extend their capabilities, circumvent networking and sandbox restrictions, and complete their tasks. | AI blog | Zenity Labs |
|
8.10.26 |
How AI Agents Turned One Exposed Endpoint into a Server Takeover Threat Spotlight | ReliaQuest investigated an incident in which, for the first time, we identified an open-source AI agent orchestration platform running on the same IP address that launched the attack. We assess with high confidence that AI agents driven by large language models (LLMs) carried out substantial portions of it. | AI blog | RELIAQUEST |
|
8.10.26 |
5 SOC Pain Points Putting US Security Teams Under Pressure | US SOC teams are under pressure to detect and contain threats faster, but the real challenge is often not a lack of security solutions. It’s the growing amount of alerts, fragmented investigation data, evasive attack techniques, and the time analysts spend connecting the dots. | Security blog | ANYRUN BLOG |
|
8.10.26 |
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs | In September, Huntress observed a phishing campaign where threat actors abused legitimate Power BI domains to make their attack more convincing and evade security controls that trust the service. | Phishing blog | Huntress |
|
8.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | On 31 August 2026 Group-IB described BraZetsu, a Python framework for Windows compiled with Nuitka, and attributed it with high confidence to the Brazilian actor Exilware. The same paper ties the binary to the Infected Marketplace (Banco de Infects), a shop that inventories compromised Windows hosts and sells the access after a deposit of about $5.80 (BRL 30), settled through NowPayments. | Malware blog | HUNT.IO |
|
8.10.26 |
Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia | Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. | Phishing | The Hacker News |
|
8.10.26 |
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases | Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency | Cryptocurrency | The Hacker News |
|
8.10.26 |
U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks | The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft | BigBrothers | The Hacker News |
|
8.10.26 |
MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data | The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors | Ransom | The Hacker News |
|
8.10.26 |
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm | The npm package known as " tensorlake ," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud | Virus | The Hacker News |
|
8.10.26 |
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains | Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, | Hack | The Hacker News |
|
8.10.26 |
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer | Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and | Virus | The Hacker News |
|
8.10.26 |
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances | SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network | Vulnerebility | The Hacker News |
|
8.10.26 |
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely | A critical vulnerability in LMCache , open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run | AI | The Hacker News |
|
8.10.26 |
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet | Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and | AI | The Hacker News |
|
7.10.26 |
Denmark population registry data breach affects 8.8 million people | Denmark's Central Population Register (CPR) is warning of a data breach that exposed the personal information of approximately 8.8 million registered individuals. | Incindent | BleepingComputer |
|
7.10.26 |
New Dell System Update flaw lets hackers gain root privileges | Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. | Vulnerebility | BleepingComputer |
|
7.10.26 |
New Dell System Update flaw lets hackers gain root privileges | Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. | Vulnerebility | BleepingComputer |
|
7.10.26 |
South Korea probes bank breaches amid suspected AI-powered attacks | South Korea's Financial Services Commission (FSC) held an emergency meeting following a series of cyberattacks targeting financial institutions in the country. | AI | BleepingComputer |
|
7.10.26 |
tenfold CE: Our free Identity Governance tool just got 2 new features | tenfold has added shared content governance and real-time event auditing to its free Community Edition for organizations with under 150 users. The new features help teams manage Microsoft 365 sharing and investigate suspicious identity activity. | Security | BleepingComputer |
|
7.10.26 |
Alleged dev of Ploutus ATM malware appears in US court after arrest | The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States. | Virus | BleepingComputer |
|
7.10.26 |
OpenAI will show visual ads in ChatGPT while you generate images | OpenAI is expanding ads in ChatGPT, and one of the first new formats will show visual ads while you're generating images. | AI | BleepingComputer |
|
7.10.26 |
Microsoft: Windows KB5124010 update crashes some games and apps | Microsoft confirmed over the weekend that some games and applications using AC-3 (Dolby Digital) audio decoding will crash after installing the September 2026 KB5124010 Windows 11 preview update. | OS | BleepingComputer |
|
7.10.26 |
Google halts open-source bug bounty program amid AI spam surge | Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. | AI | BleepingComputer |
|
7.10.26 |
Citrix patches NetScaler SAML zero-day exploited in attacks | Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. | Vulnerebility | BleepingComputer |
|
7.10.26 |
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials | The U.S. Federal Bureau of Investigation (FBI) and Secret Service (USSS) on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways. | Vulnerebility | The Hacker News |
|
7.10.26 |
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details | Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to | Exploit | The Hacker News |
|
7.10.26 |
Identity-aware AI data agents with AWS Lake Formation and Trusted Identity Propagation | You’re building a data agent that lets business users ask questions about lakehouse data in natural language. You’ve already built governance policies that control who can access which datasets. The challenge is making the agent respect those rules without rebuilding them in your application code. | AI blog | AWS Security Blog |
|
7.10.26 |
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure | SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. | AI blog | SOCRADAR |
|
7.10.26 |
Investigate Threats Faster | Your SOC runs on Elastic. Detections, logs, cases and dashboards all live in Kibana, and your analysts have built their muscle memory around it. Then an impersonating domain, a leaked credential or a newly exposed asset shows up in a different console, and the investigation starts with a copy-paste. | Hacking blog | SOCRADAR |
|
7.10.26 |
How to mitigate shadow AI risks from employee citizen coders | AI tools let non-technical employees build workplace apps in minutes with natural language prompts. While these AI-generated apps boost productivity, they can create severe security and data risks. As Cybersecurity Awareness Month kicks off, we’re sharing how Tenable adopted a structured governance framework that allows our “citizen coders” to build secure and compliant apps with AI. | AI blog | Tenable® |
|
7.10.26 |
Claude Mythos: When Zero-Day Vulnerabilities Outpace Defenses | Advances in AI are reshaping the cybersecurity landscape in a fundamental way. Modern AI systems are no longer limited to detecting known threats. They are increasingly capable of uncovering previously unknown vulnerabilities buried deep within complex software and systems, including Zero Day vulnerabilities that can be found at lightning speed. | AI blog | FORESCOUT |
|
7.10.26 |
CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery | ClickFix campaigns have become one of the most effective ways to turn a browser session into code execution. The technique is simple: show the victim a fake verification page, place a command on the clipboard, and convince them to paste it into the Windows Run dialog. | Malware blog | Flare |
|
7.10.26 |
IronChain Ransomware Raises Business Data Loss Risk | During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of how a cyber incident can become a business continuity issue. IronChain shows why. It puts business-critical data at risk of permanent loss and can bring operations to a halt. | Ransom blog | ANYRUN BLOG |
|
7.10.26 |
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | In September, the Huntress agent was deployed on an organization that had been hit by an Akira ransomware attack. The post-compromise agent deployment limited Huntress visibility into critical pieces of evidence. | Ransom blog | Huntress |
|
7.10.26 |
Super Intelligence: The Rise of Super-Intelligent Threats | On September 29, 2026, the White House signed an executive order replacing the term "Artificial Intelligence" with "Super Intelligence" across the U.S. executive branch. The stated reasoning is that "Super Intelligence" better conveys "the true capabilities of the technologies being developed today", not merely imitating or automating human intelligence, but empowering citizens “to achieve what was previously impossible.” | AI blog | SEKOIA |
|
7.10.26 |
CVE-2026-88771: Citrix NetScaler Zero-Day Attack Clusters | As early as the beginning of September 2026, eSentire's Threat Response Unit (TRU) observed multiple threat actor clusters exploiting CVE-2026-88771, a zero-day vulnerability later disclosed in Citrix's September 27, 2026 security bulletin CTX697096. | Vulnerebility blog | eSentire |
|
7.10.26 |
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws | Anthropic on Tuesday said it's expanding a program that allows vetted cybersecurity professionals to test its advanced artificial intelligence (AI) models with reduced safeguards and blocking classifiers, as the company claimed its Project Glasswing initiative uncovered at least 129,000 verified software vulnerabilities between April and July 2026. | AI | The Hacker News |
|
7.10.26 |
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer | The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected | Virus | The Hacker News |
|
7.10.26 |
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes | Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial | AI | The Hacker News |
|
7.10.26 |
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan | Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and | Virus | The Hacker News |
|
7.10.26 |
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings | A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before | Vulnerebility | The Hacker News |
|
7.10.26 |
Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies | The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including | AI | The Hacker News |
|
7.10.26 |
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports | Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect | Vulnerebility | The Hacker News |
|
6.10.26 |
47-Day TLS Certificates: 5 Steps to Prepare | Somewhere in your organization is a spreadsheet of certificate expiry dates, and someone who owns it. That is not a caricature. DigiCert’s 2026 research with Omdia surveyed more than 400 senior IT leaders and found that 47% still rely on manual tracking methods such as spreadsheets, and only 34% have a complete, current view of what they hold. | Security blog | Imperva |
|
6.10.26 |
Harvest Now, Decrypt Later: End-to-End PQC TLS | Somewhere, an attacker is recording your encrypted traffic. Not breaking it. Recording it. The bet is patient and simple: store ciphertext today, wait for quantum computers to mature, decrypt at leisure. The industry calls it harvest now, decrypt later (HNDL), and it is the rare security threat with a believable deadline attached: data with a ten-year shelf life, encrypted with algorithms on a countdown. | Security blog | Imperva |
|
6.10.26 |
New Remote DoS Attacks Against GraphQL Java | Imperva Threat Research identified a series of remote denial‑of‑service vulnerabilities in GraphQL Java, one of the most widely used libraries for GraphQL in the Java ecosystem. | Attack blog | Imperva |
|
6.10.26 |
The Hidden DoS Vector in SQL Parsers | SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. | Attack blog | Imperva |
|
6.10.26 |
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage | This article explains how Elastic SIEM uses a monthly automated telemetry pipeline to score prebuilt detection rules across noise, performance, threat, and profile dimensions, helping security teams decide which rules to enable first. | Spam blog | Elastic Security Labs |
|
6.10.26 |
Machine-speed attacks require machine-speed prevention and detection | Artificial intelligence (AI) is transforming the way cyberattacks are handled. Reconnaissance has become faster, phishing is more convincing, and vulnerabilities are identified and exploited sooner, and after initial access, automation can accelerate privilege escalation, lateral movement, and data theft. | Hacking blog | Threatlocker |
|
6.10.26 |
IQUALIF Leak, IUT Breach, SMTP Dump and Struts Exploit | SOCRadar Dark Web Team identified several new underground posts, including an alleged IQUALIF-based French residential data leak, an alleged breach affecting IUT Paris Seine, and an alleged initial access auction for a U.S. manufacturing company. Other posts advertised an alleged 19 million SMTP credential dump and access to servers reportedly compromised through CVE-2017-5638. | Exploit blog | SOCRADAR |
|
6.10.26 |
FortiMail Zero-Day Under Active Exploitation | Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live. | Exploit blog | SOCRADAR |
|
6.10.26 |
CVE-2026-90970: GitLab AI Gateway RCE | GitLab has patched CVE-2026-90970, a critical vulnerability in the Self-Hosted AI Gateway that can allow an authenticated user with Duo Agent Platform access to execute arbitrary commands on the gateway. | Vulnerebility blog | SOCRADAR |
|
6.10.26 |
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure | How ClingSTUN combines vulnerability exploitation, persistence, and STUN-assisted connectivity on Linux devices | Malware blog | FortiGuard Labs |
|
6.10.26 |
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products | A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files | Vulnerebility | The Hacker News |
|
6.10.26 |
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach | The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the | BigBrothers | The Hacker News |
|
6.10.26 |
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account | Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and | Incindent | The Hacker News |
|
6.10.26 |
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits | A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. | Hack | The Hacker News |
|
6.10.26 |
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes | Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as | Vulnerebility | The Hacker News |
|
5.10.26 |
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2 | Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling . " | Exploit | The Hacker News |
|
5.10.26 |
Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access | Apple has announced that it's taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed | OS | The Hacker News |
|
5.10.26 |
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE | A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The | Vulnerebility | The Hacker News |
|
5.10.26 |
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline | Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as | Exploit | The Hacker News |
|
5.10.26 |
Anthropic asks Claude users to share voice data for AI model training | Anthropic has started asking Claude users to voluntarily share their voice conversations to help train and improve its AI models. | AI | BleepingComputer |
|
5.10.26 |
Google Gemini could soon get full access to your Mac’s files, apps and the web | Google's Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time. | AI | BleepingComputer |
|
5.10.26 |
ShinyHunters hacker reportedly detained in Jordan, aiding FBI | A suspected ShinyHunters hacking group member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. | CyberCrime | BleepingComputer |
|
5.10.26 |
Danish university DTU breach exposes data of up to 200,000 people | The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. | Incindent | BleepingComputer |
|
5.10.26 |
Frontline Education breach exposes school district employee data | Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. | Incindent | BleepingComputer |
|
5.10.26 |
Warlock ransomware breach SharePoint in water, telecom operator attacks | The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. | Ransom | BleepingComputer |
|
5.10.26 |
GitLab warns of critical RCE vulnerability in AI Gateway service | GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. | Vulnerebility | BleepingComputer |
|
5.10.26 |
US sanctions Tren de Aragua gang members in ATM hacks crackdown | The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. | CyberCrime | BleepingComputer |
|
5.10.26 |
The EDR blind spot: 3 ways browser attacks evade endpoint telemetry | Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. | Security | BleepingComputer |
|
5.10.26 |
Dell asks admins to patch max severity CSM flaws as soon as possible | Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. | Vulnerebility | BleepingComputer |
|
5.10.26 |
Microsoft’s X account hacked in crypto pump-and-dump scheme | On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. | Social | BleepingComputer |
|
4.10.26 |
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks | Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. | Exploit | BleepingComputer |
|
4.10.26 |
Autonomous AI agents tried to hack US, Canadian government websites | Autonomous AI agents using aggressive strategies attempted to hack U.S. and Canadian government websites to find school and divorce statistics. | AI | BleepingComputer |
|
4.10.26 |
Microsoft says threat actors are ahead in the early AI race | Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace. | AI | BleepingComputer |
|
4.10.26 |
Police dismantle KillSec ransomware gang allegedly led by 16-year-old | An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. | Ransom | BleepingComputer |
|
4.10.26 |
The Day-One Hole in Zero Trust Architecture | Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued. | Security | BleepingComputer |
|
4.10.26 |
Kiteworks patches max severity code injection vulnerability | Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. | Vulnerebility | BleepingComputer |
|
4.10.26 |
Microsoft enables Windows settings backup by default for orgs | Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2. | OS | BleepingComputer |
|
4.10.26 |
Hackers stole Pentagon personnel records of over 3 million people | The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. | Incindent | BleepingComputer |
|
4.10.26 |
Metamask discloses security incident affecting its infrastructure | On Thursday, cryptocurrency wallet provider MetaMask has disclosed an ongoing infrastructure security incident affecting some of its infrastructure. | Cryptocurrency | BleepingComputer |
|
4.10.26 |
Russian state hackers use new RedFlick technique to push malware | The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse backdoor. | APT | BleepingComputer |
|
4.10.26 |
DIVD says Zammad zero-days enabled AI-driven network breach | The Dutch Institute for Vulnerability Disclosure (DIVD) says that the breach of its network was possible by exploiting a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system. | AI | BleepingComputer |
|
4.10.26 |
Over 543,000 valid credentials exposed in public GitHub repositories | More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platform's security measures to prevent accidental leaks of sensitive data. | Incindent | BleepingComputer |
|
4.10.26 |
CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition. | Vulnerebility | BleepingComputer |
|
4.10.26 |
Cisco warns of new SD-WAN zero-day exploited in attacks | Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. | Exploit | BleepingComputer |
|
4.10.26 |
AI's Third Wave: Coworkers Break the Security Model That Worked for Agents | Persistent AI coworkers may operate continuously with standing access, creating identity risks that existing security models were not designed to handle. Token Security explains why these agents need their own identities, owners, scoped permissions, and lifecycle controls. | AI | BleepingComputer |
|
4.10.26 |
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members | A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported , citing three people familiar with the matter. | CyberCrime | The Hacker News |
|
4.10.26 |
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing | A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial | APT | The Hacker News |
|
4.10.26 |
Microsoft to block Entra ID script injection attacks starting October | Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. | Hack | BleepingComputer |
|
4.10.26 |
TeamViewer urges users to patch severe flaws “as soon as possible” | Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software. | Vulnerebility | BleepingComputer |
|
4.10.26 |
Bitget hacked via zero-day in third-party security products | Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products. | Exploit | BleepingComputer |
|
4.10.26 |
Microsoft is rolling out Linux container support to WSL | Microsoft is taking Windows Subsystem for Linux beyond just running Linux distributions, as WSL Containers is now generally available. | OS | BleepingComputer |
|
4.10.26 |
Signal adds encypted local backup support to iOS, desktop apps | Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows). | Social | BleepingComputer |
|
4.10.26 |
Custom ChatGPTs push ClickFix attacks to deploy RAT malware | Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. | AI | BleepingComputer |
|
4.10.26 |
FBI tells ShinyHunters members to turn themselves in after recent arrest | The FBI is warning members of the ShinyHunters extortion group to turn themselves in after Dutch police arrested a man the bureau described as one of the group's alleged leaders. | BigBrothers | BleepingComputer |
|
4.10.26 |
Hackers exploit Citrix NetScaler zero-day to deploy web shells | Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. | Exploit | BleepingComputer |
|
4.10.26 |
Former US Air Force members sent to prison over BEC attacks | Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. | Spam | BleepingComputer |
|
4.10.26 |
Windows 11 2026 Update released, here's everything you need to know | Microsoft has started rolling out Windows 11 26H2 to everyone, and while it's this year's big annual feature update, you probably won't notice a massive difference after installing it. | OS | BleepingComputer |
|
4.10.26 |
New Spectre v2 attack variant leaks Linux root password hash in minutes | A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. | Attack | BleepingComputer |
|
4.10.26 |
Automated AI agent used to breach cybersecurity nonprofit DIVD | The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as "loud and very, very messy." | AI | BleepingComputer |
|
4.10.26 |
Catch threats before they escalate with real-time Identity Telemetry | Identity governance helps control who should have access, but periodic reviews alone may not reveal attacks as they happen. tenfold Software explains how real-time identity telemetry can help security teams investigate suspicious activity before it escalates. | Security | BleepingComputer |
|
4.10.26 |
Vietnamese man charged in $16 million 'pig butchering' crypto scam | A Vietnamese national was charged with money laundering for his role in a massive "pig butchering" scam, which defrauded a victim out of $16 million worth of cryptocurrency. | Cryptocurrency | BleepingComputer |
|
4.10.26 |
Kiteworks patches critical flaw, brings customer systems online | American tech company Kiteworks has lifted a precautionary advisory asking customers to shut down systems after patching a critical vulnerability. | Vulnerebility | BleepingComputer |
|
3.10.26 |
MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics | The U.K.'s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering | BigBrothers | The Hacker News |
|
3.10.26 |
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware | The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both | Ransom | The Hacker News |
|
3.10.26 |
Apple patches CoreGraphics zero-day flaw exploited in attacks | Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. | Vulnerebility | BleepingComputer |
|
3.10.26 |
Japan's Keio confirms ransomware attack disrupted business systems | Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. | Incindent | BleepingComputer |
|
3.10.26 |
Times Car confirms data breach affecting 6.6 million user accounts | Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. | Incindent | BleepingComputer |
|
3.10.26 |
Dutch police confirm arrest in ShinyHunters hacking investigation | Dutch police have confirmed that a 24-year-old Amsterdam man arrested earlier this month was detained as part of an investigation into the ShinyHunters hacking group. | CyberCrime | BleepingComputer |
|
3.10.26 |
Over 16,000 Supabase databases expose PII, passwords, auth tokens | Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens. | Hack | BleepingComputer |
|
3.10.26 |
JadePuffer agentic AI attacks target Azure, destroy cloud resources | The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. | AI | BleepingComputer |
|
3.10.26 |
80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking | Infostealer logs exposed AI account credentials and sessions tied to more than 80,000 corporate domains, creating risks ranging from stolen conversations to LLMjacking. SOCRadar examines the growing market for stolen AI logins and how organizations can identify their exposure. | AI | BleepingComputer |
|
3.10.26 |
Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist | Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals suspended after suspected North Korean hackers breached its systems last week and stole over $350 million. | Cryptocurrency | BleepingComputer |
|
3.10.26 |
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers | A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain | Vulnerebility | The Hacker News |
|
3.10.26 |
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign | Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The | APT | The Hacker News |
|
3.10.26 |
AI-Enabled Cyber Attacks: What They Are and How to Defend Against Them | AI-enabled cyber attacks are malicious operations in which adversaries use AI, most often large language models (LLMs), to plan, carry out, or scale any part of an attack. That includes writing phishing lures and deepfake pretexts, developing and debugging malware, discovering and exploiting vulnerabilities, and running intrusions end to end. | AI blog | PICUSSECURITY |
|
3.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | BotNet blog | CROWDSEC |
|
3.10.26 |
AI-Agentic attacks Optimized Operations | AI is changing cyberattacks from isolated activities into connected operations that require a new level of speed, context, and understanding. | AI blog | WatchGuard Blog |
|
3.10.26 |
PolinRider is A/B Testing its Way Past Your Detections | We've seen fa-solid-400.woff2 become 500 and 900, change from .woff2 to .llf files, move folders, and drop its whitespace padding. | Malware blog | OpenSource Malware Blog |
|
3.10.26 |
Prompt Forcing: The Scarier Sibling of Prompt Injection | Breaking down a newly discovered prompt attack technique that isn't prompt injection. | AI blog | Forever Security |
|
3.10.26 |
Introducing the SysQL Skill: Ask your security graph anything | Dashboards answer the questions someone already decided to build a screen for. Every other question — the one a new CVE just made urgent, or the one no vendor anticipated — waits until someone writes a report or files a ticket. | Vulnerebility blog | Sysdig |
|
3.10.26 |
Swarming Against Citrix 0-Day Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | AI blog | GREYNOISE |
|
3.10.26 |
Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets | GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. These forged automated scanners have been observed requesting files often exposed on misconfigured web servers and by other commonly leaked secret and credential methods. | AI blog | GREYNOISE |
|
3.10.26 |
Separating Signal from Slop: Triaging CVEs in the Age of… | Tools that can read a codebase, identify a vulnerability, and generate a working proof-of-concept have lowered the skill floor for vulnerability research. They also produce a wave of bugs that look terrifying on paper (remote code execution, popular software, no authentication,) yet they often depend on a configuration rarely enabled in real deployments. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
One Port to Root: Weaponizing Check Point Management… | The Check Point management server is the brain of a Check Point firewall estate: it holds the policy every gateway enforces, the administrator credentials, and the certificate authority the whole deployment trusts. A flaw already used in real attacks lets anyone who can reach that server take it over completely without logging in. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
AI-Assisted Attacks Still Leave a Behavioral Trace | AI is increasingly being used to accelerate cyber-attacks, but attackers still leave detectable behavioral traces. This blog explores how Darktrace identified suspicious file delivery, command-and-control communications, beaconing activity, and other anomalies linked to AI-assisted campaigns through behavioral analysis. | AI blog | DARKTRACE |
|
3.10.26 |
DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm - Real-time Open Source Software Supply Chain Security | Nine npm packages hide a self-spreading Linux worm. The npm account dirtyblanket published all nine on September 29, 2026, in 33 minutes. Eight of them copy the popular Express framework. One copies React. | Malware blog | SAFEDEP.IO |
|
3.10.26 |
PolinRider Switches to Ethereum C2 in 30+ Repositories - Real-time Open Source Software Supply Chain Security | The PolinRider loader family has a new way to find its command and control (C2) servers. It reads Ethereum mainnet and looks for small transactions from an operator wallet. The recipient address of each transaction holds the IP address of a C2 server. SafeDep found two operator wallets that use this method. One wallet has sent a transaction about every 51 minutes since 2026-06-23. | Cryptocurrency blog | NETCRAFT |
|
3.10.26 |
'Super Intelligence' Executive Order Fuels Nearly Hundredfold Increase in .si Domain Registrations | We previously reported that registrations of Slovenian .si domains overtook .ai in the 25 hours after President Trump told the UN General Assembly on September 22 that the U.S. would call AI “super intelligence” (SI). | AI blog | NETCRAFT |
|
3.10.26 |
FinCEN Moves to Cut the A7 Network's Sub-Agents Off From the US Financial System | FinCEN issued a finding and NPRM today identifying transactions involving any non-US company controlled by the A7 Network, which the agency calls "Sub-Agents," as a class of transactions of primary money laundering concern. The proposed rule would prohibit every covered US financial institution from sending or receiving funds or crypto involving a Sub-Agent. | AI blog | TRM Labs |
|
3.10.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | OS Blog | IDNSEC |
|
3.10.26 |
CVE-2026-86950: The Great Glyph Grift | Apple recently released iOS 26.7.1 to fix a bug in CoreGraphics (CVE-2026-86950). The security advisory stated that the vulnerability was reported by Meta Product Security and "may have been exploited in an extremely sophisticated attack against specific targeted individuals." For those who are unfamiliar with Apple’s English dialect, it means that the bug was actually exploited in the wild. | Vulnerebility blog | Calif |
|
3.10.26 |
Crypto Scam Extensions Masquerade as High-Profile Investors | LayerX security researchers (now part of Akamai) uncovered a campaign of nearly 30 malicious browser extensions designed to scam cryptocurrency investors by masquerading as legitimate, high-profile financial and/or cryptocurrency investors such as Warren Buffett, Andy Kreiger, Thomas Bulkowski, and others. | Spam blog | Akamai |
|
3.10.26 |
When Productivity Extensions Become Attack Platforms | LayerX Research (now part of Akamai) discovered a coordinated campaign of 32 malicious browser extensions across the Chrome Web Store and Microsoft Edge Add-ons Store, affecting more than 6,150 users. | Security blog | Akamai |
|
3.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | Software supply chain security has a well-defined starting line. It has no finish line, even though most programs are built as if it does. | Cyber blog | JSCRAMBLE |
|
3.10.26 |
Aligning AI Speed with AI Trust: AI Agent Security Insights for CISOs and Security Leaders | AI agent security is the practice of governing two separate things: what an autonomous AI system is allowed to reach, and what it is allowed to do. Most enterprises have built a program for the first one. Almost nobody has built one for the second, and that's where the losses are starting to show up. | AI blog | Morphisec Blog |
|
3.10.26 |
From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat | RATHat's Android malware remained largely static from late 2025 to September 2026, while its Command-and-Control (C2) panel was replaced entirely and went through three generations in six months, rebranded from BlackCat to Panda Workshop. | Malware blog | Cleafy |
|
3.10.26 |
TIKTOUK: Tracing a WordPress Credential Collection Toolkit | TIKTOUK brings together WordPress probing, collection of exposed configuration data, recovery of encrypted email credentials, and JavaScript secret scanning. Its two Python components and Go-based Linux crawler turn website responses into structured results for a central hub: an HTTP service that distributes target tasks and receives collected data and status reports. | Hacking blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators | CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Citrix and security researchers have already documented the vulnerability and its underlying exploitation mechanism. This analysis focuses instead on exploitation activity identified by LevelBlue's Threat Hunt Operations & Research (THOR) team while hunting across multiple customer environments. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler Zero-Day Exploited Globally | On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the Known Exploited Vulnerabilities (KEV) list. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Hackers exploit FortiMail zero-day before a patch exists | Fortinet says attackers are already exploiting a critical flaw in FortiMail, its email security gateway, and the fixed software has not shipped yet. The bug, tracked as CVE-2026-104286 and rated 9.8 on CVSS v3, lets an attacker with no login write arbitrary files to the appliance using crafted HTTP or HTTPS requests. Fortinet rates its impact as executing unauthorized code or commands. | Vulnerebility blog | IntelFusions |
|
3.10.26 |
Introducing Cloudflare Basin: an open, serverless data platform, now generally available | During Birthday Week 2025, we announced the Cloudflare Data Platform, a suite of products that ingest, store, and query your analytical data. Today, we’re announcing that the platform is generally available, and we’re giving it a new name: Cloudflare Basin. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Introducing Clef: our open-source decision models, and new RL fine-tuning platform | Over the last few weeks, there has been lots of buzz around decision models such as Typesafe AI’s Jev System One model. While classifier models have been around for some time, Jev introduces a new decision model concept into the world of AI — a model that produces bounded structured outputs cheaply, quickly and consistently that can be added into a workflow when a decision is required. | AI blog | CLOUDFLARE |
|
3.10.26 |
One year later: Sovereign AI and the fight for choice | It's Birthday Week, when we traditionally ship presents to the Internet. This year, two of them come from Europe: EuroLLM, which covers all 24 official EU languages, and Apertus, Switzerland's fully open model, trained on more than 1,500 languages. Both were built by public universities and research institutions. Both are coming to Workers AI, and you can request access today. | AI blog | CLOUDFLARE |
|
3.10.26 |
Introducing Workers KV Instant — powered by Quicksilver | Today, we’re introducing Workers KV Instant, a new mode for Workers KV that pushes your changes globally for instant availability without cold read penalties. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cloudflare OS: your company’s agent workspace, managed for you | Cloudflare OS gives everyone in your organization an agent workspace that knows how your company works and connects to its data and systems. Today, we're opening the waitlist for fully managed Cloudflare OS deployments. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Announcing Cloudflare K2: serverless event streams | With traditional Remote Procedure Call (RPC) architectures, there exists a core challenge: producers and consumers must align in scale and in time. If your producers send too much data for your consumers to handle or if your consumers or downstream services become unavailable, events are dropped. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
We want you to build the next Git platform on Cloudflare | GitHub was built for a world where humans write code, organize it into repositories, and collaborate through branches, commits, issues, and pull requests. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
AI Search is now generally available | Cloudflare’s AI Search combines Workers AI, Vectorize, R2, and Browser Run into a fully managed index and retrieval pipeline. Since we launched AI Search over a year ago, we’ve seen developers use it to power a wide range of search use cases, from searching internal documentation to powering search for their websites. We use AI Search ourselves to power search on our own blog and developer docs. | AI blog | CLOUDFLARE |
|
3.10.26 |
Support for modern cryptographic algorithms in Workers | Today, Cloudflare Workers is adding support for post-quantum-resistant algorithms within Web Crypto. These are defined in Modern Algorithms in the Web Cryptography API draft community group report, and include: | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cloudflare Impact reaches $100 million in donations | This week, Cloudflare's Impact programs will reach $100 million in donated services. It's a significant milestone, and one that we are proud of because it means that thousands of organizations, like journalism outlets, civil society, state and local governments, election management bodies, and public schools are being protected from cyberattacks. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cut your AI spend with AI Gateway's Auto Router | From our conversations with companies at every stage of their AI adoption journey, we've seen some common patterns. First, there is an exploration period as you bring on every new tool, dole out API keys freely, and let the tokens flow. Then, you converge on the canonical tools for your organization for agentic coding, for non-technical workflows, for running and deploying agents. | AI blog | CLOUDFLARE |
|
3.10.26 |
Detect and send production issues straight to your agent | As agents help us build more complex applications, both humans and agents need a better way to stay on top of what goes wrong in production. Coding agents can already query observability data, navigate a repository, change code, write tests, and open a pull request. | AI blog | CLOUDFLARE |
|
3.10.26 |
Simplifying domains for people and agents | You just thought of your next great idea, and buying the right domain feels like the easiest way to make that first bit of progress. Naturally, you open a new tab in your browser, only to find yourself face-to-face with an experience that feels like a budget airline peppering you with add-ons at checkout: Want security? How about a website? Do you want email? You’re just a few minutes into building your next idea, and it doesn’t feel fun anymore. | AI blog | CLOUDFLARE |
|
3.10.26 |
Monetization Gateway beta: charge AI agents for consumption with HTTP 402 | Today, we’re making the Cloudflare Monetization Gateway available as part of a closed beta, and showcasing four customer use cases that are in production today. Since we announced the plan three months ago, we have been working closely with our customers to make the Gateway fast, flexible, and easy to use. | AI blog | CLOUDFLARE |
|
3.10.26 |
Pay Per Use: when AI uses your work, you should get paid | AI answer engines read a publisher’s page and hand the reader a summary, so the visit, and the revenue that would come with it, never happens. Most publishers will never sign a licensing deal with the companies that use their work in AI products, and no company can negotiate with millions of sites. The web needs a way to say “yes, if you pay.” Pay Per Use is one way to say it, and it's now in beta. | AI blog | CLOUDFLARE |
|
3.10.26 |
Spetsvuzavtomatika Leak Exposes an SVR Cyber Development Ecosystem | The Spetsvuzavtomatika leak found on the darknet exposes a broad Russian cyber research and development program, with seven named projects defining its work. Two of the projects, Felix-23 and HAD, focus on target discovery, scanning, enrichment, and active testing. Another project, Putnik, supports internal-network access and credential theft. | CyberCrime blog | DomainTools Investigations |
|
3.10.26 |
AI Security Strategy: 6 Steps for CISOs | Security teams are used to vetting technology before it arrives. With AI, it was already everywhere before anyone asked them. | AI blog | Abnormal AI |
|
3.10.26 |
Signatures Are the Floor, Not the Ceiling | See why signature-based detection struggles against AI-generated attacks and how behavioral AI uses embeddings to detect novel threats without relying on known indicators. | AI blog | Abnormal AI |
|
3.10.26 |
How Behavioral AI Detects Threats That Look Normal | Attackers are no longer breaking in but blending in, mimicking normal behavior to breach organizations. A founding Abnormal AI engineer explains why we bet on behavioral AI to stop attackers walking through the front door. | AI blog | Abnormal AI |
|
3.10.26 |
XCTDH Adopts Hash Hiding | A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically encoded in Ethereum transaction destination addresses. | Cryptocurrency blog | Ransom-ISAC |
|
3.10.26 |
September 2026 Security Release | An attacker-controlled, allow-listed remote URL can lead to Server-Side Request Forgery (for example to private IP ranges) during Image Optimization. If no images.remotePatterns are configured, your application is not affected. | Security blog | Next.js |
|
3.10.26 |
Beyond Model Alignment: Securing Every Layer of the AI Agent | Alignment makes a model well-intentioned, but it can’t secure the harness, tools, and data an agent touches in production. Real agent security means governing every layer with enforcement the agent itself can’t switch off. | AI blog | Trend Micro |
|
3.10.26 |
ShinyHunters Returns to PeopleSoft With a One-Character WAF Bypass | ShinyHunters is once again exploiting a previously patched vulnerability in PeopleSoft, which we analyzed in June 2026. | Incident blog | Trend Micro |
|
3.10.26 |
Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes | Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise. | Malware blog | StepSecurity |
|
3.10.26 |
Managing Agentic AI: Why the Control Plane Problem Is an AI Problem | On one hand, it’s somewhat befuddling how often people may need that reminder. In reality, it is not that they don’t know that happy mantra, it’s that they struggle to gain the requisite visibility into … everything in their IT and OT environments. | AI blog | GUIDESECURITY |
|
3.10.26 |
Cloud Security Assessments: Set the Right Cadence | While cloud practitioners are accustomed to their fast-moving environments, it’s still common practice to move on to the next priority after the cloud assessment report is delivered and the major findings get remediated. | Cyber blog | GUIDESECURITY |
|
3.10.26 |
New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles | The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs. | Cyber blog | RAPID7 |
|
3.10.26 |
Why One-Time Approval Fails for AI Agent Skills | A review answers one question, once: is this skill, MCP server or plugin allowed in? It never asks again, whether it took six weeks in a ticket queue or six minutes in a governance tool. | AI blog | Manifold |
|
3.10.26 |
Spanish Carding Tutorial: How Fraudsters Think | A 2,200-word tutorial titled “Complete Guide to Carding in Spain (2026)” appeared on the Carder Market forum in April 2026. It is exactly what it sounds like: a beginner’s playbook for credit card fraud targeting the Spanish market, complete with entry fees, expected returns, and step-by-step operational workflows (we are holding back specific names and techniques to execute attacks to prevent these from falling into those with malicious intentions). | CyberCrime blog | FLARE.IO |
|
3.10.26 |
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) | On Wednesday, September 30, Cisco dropped an out-of-band security advisory highlighting CVE-2026-76504, a brand new critical authentication bypass in the SD-WAN vManage line of products that was disclosed as an exploited zero-day vulnerability. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
JCTables for Joomla: When "Already Escaped" Means Injectable | Today VulnCheck is disclosing CVE-2026-76570, an unauthenticated arbitrary SQL read and write in JCTables, the Joomla data-table component published by JoomCode, that chains to remote code execution as the web user. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
CVE-2026-86950: Apple CoreGraphics Zero-Day | Apple has issued an urgent security patch for CVE-2026-86950, a critical zero-day out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution via malicious files. Exploited in targeted, highly sophisticated attacks against specific individuals, this flaw presents an immediate threat across affected Apple platforms. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
CVE-2026-76504: Cisco SD-WAN Flaw Exploited | Cisco has disclosed CVE-2026-76504, a critical authentication bypass vulnerability in Catalyst SD-WAN Manager, formerly known as vManage. The flaw allows an unauthenticated remote attacker to access the management API with administrator privileges. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
TeamViewer Fixes Five Remote Access Flaws | TeamViewer has patched five high-severity vulnerabilities in its Full Client and Host applications for Windows, Linux, and macOS. The flaws include local privilege escalation, potential code execution, and remote session access control bypass. The company strongly recommends that all users update to the latest available version as soon as possible. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
Gotta Breach 'Em All! The Journey Of ShinyHunters | ShinyHunters has outlasted forum takedowns, multiple arrests, and its own founders' convictions. This report traces six years of activity and tactical evolution. From stolen S3 buckets to zero-day exploits, we attempted to explain why the brand keeps surviving what should have ended it. | Cyber blog | SEKOIA |
|
3.10.26 |
The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers | TL;DR: Frontier AI has collapsed the vulnerability exploit window from weeks to mere hours. Attackers now use advanced AI models to reverse-engineer published fixes and generate working exploits faster than human security teams can deploy updates. In the AI era, publishing a patch creates a blueprint for attackers. Surviving this threat requires vendors to tier sensitive disclosures and customers to treat patch application speed as a critical security metric. | AI blog | JFROG |
|
3.10.26 |
ANY.RUN's Threat Coverage Digest: September 2026 | September saw an expansion of detection coverage across network, file, and behavioral activity, providing analysts with additional visibility into suspicious activity. ANY.RUN added 76 behavior signatures, 16 YARA detections, and 1,098 Suricata rules, strengthening coverage across malware activity, suspicious files, and network communications. | Cyber blog | ANYRUN BLOG |
|
3.10.26 |
Copilot has the largest AI attack surface of any tool we tracked | Microsoft Copilot accounts for a disproportionate share of the AI footprint we track, and it’s barely being used. It’s a massive attack surface featuring a minuscule rate of activity. | AI blog | ThreatDown |
|
3.10.26 |
Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy | Milk Dragon, also known as NaiLong is an Adversary-in-the-Middle (AiTM) phishing kit active since October 2025. Unlike conventional phishing tactics that rely on fear and urgency, Milk Dragon lures victims with big discounts on consumer goods distributed via Facebook and TikTok marketplace advertisements. | Phishing blog | GROUP-IB |
|
3.10.26 |
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino | Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace clandestino único, mejorado con IA, para comercializar objetivos comprometidos en Iberoamérica y Latinoamérica. | Malware blog | GROUP-IB |
|
3.10.26 |
Your State’s Scam Reality: What New Research Reveals Across All 50 States | A package notification arrives, and we stop to check whether we actually ordered something. A recruiter reaches out about a job, but before replying, we research the person and the company. A bank alert appears, and instead of tapping the link, we open the banking app ourselves. | Spam blog | McAfee Blog |
|
3.10.26 |
ClickFix Attacks: How They Work and How CrowdStrike Stops Them | Consider this hypothetical scenario: An employee tries to join what looks like a routine video meeting. The page loads, but instead of the meeting, they see an error message along with a helpful fix: Copy the provided command, open the Windows Run dialog, paste it, and press Enter. | Hacking blog | CROWDSTRIKE |
|
3.10.26 |
CrowdStrike Expands Federal SOC Modernization via CISA-Funded SIEMaaS | Falcon Next-Gen SIEM is now part of CISA’s SIEMaaS technology stack, which gives eligible agencies a funded path to modernize security through the CDM DEFEND F shared service. | Cyber blog | CROWDSTRIKE |
|
3.10.26 |
CrowdStrike and NVIDIA Extend Security Across the AI Stack | CrowdStrike and NVIDIA are collaborating on the NVIDIA Open Agent Safety Platform, an open reference design to extend security deeper into the agentic stack and establish stronger boundaries for autonomous AI. | AI blog | CROWDSTRIKE |
|
3.10.26 |
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation | On September 27, 2026, Citrix disclosed eight vulnerabilities affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. Two of these vulnerabilities are critical (CVSS score of 9.5) and can allow an unauthenticated remote attacker to execute code: | Vulnerebility blog | SOPHOS |
|
3.10.26 |
TerminalFix and Lorem Ipsum Loader enable covert tunneling | The activity is linked to a broader campaign that previously used a different delivery mechanism | CyberCrime blog | SOPHOS |
|
3.10.26 |
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond. | AI blog | Google Cloud Blog |
|
3.10.26 |
NVIDIA and Eclypsium Partner for Trusted AI Infrastructure | AI agents are moving from answering questions to taking action. They can read sensitive data, call APIs, write and execute code, use external tools, and coordinate with other agents. In some environments, their decisions may affect physical systems. | AI blog | Trend Micro |
|
3.10.26 |
Inside DragonForce: How a Ransomware Cartel's Payload Actually Runs | DragonForce is a Ransomware-as-a-Service (RaaS) operation that first surfaced in mid-to-late 2023. It initially presented itself as a hacktivist collective before shifting to a profit-driven model. Early payloads were built on leaked LockBit 3.0 source code and later supplemented with code derived from the leaked Conti builder. | Ransom blog | Seqrite |
|
3.10.26 |
Telecom Attack Surface: SS7, BGP & Nation-State Intrusions | SS7 and BGP were built on trust. Here's how nation-state actors exploit that trust, and telecom routers, to stay inside carrier networks for years. | Hacking blog | Cyble |
|
3.10.26 |
Attack Surface Management 2026: Why Point-in-Time Scans Fail | Quarterly scans leave cloud exposures hidden for months. Learn why CISA and FBI data now make continuous attack surface management essential in 2026. | Cyber blog | Cyble |
|
3.10.26 |
Your IP, Their Traffic | You install an app that offers a reward, a premium feature or perhaps a little money in exchange for sharing some of your unused internet bandwidth. It sounds harmless enough. Your connection is idle most of the time anyway. | Cyber blog | GENDIGITAL |
|
3.10.26 |
Warlock Ransomware Attackers Hit Water and Telecom Operators | China-nexus group behind Warlock is still exploiting SharePoint vulnerabilities, attacking organizations in Portuguese and Spanish-speaking countries, hitting critical infrastructure, government, and education organizations. | Ransom blog | SECURITY.COM |
|
3.10.26 |
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 | Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled, without requiring authentication or user interaction. | Vulnerebility blog | Microsoft blog |
|
3.10.26 |
Phishing Abuses RMM Tools for Persistent Access | In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. | Phishing blog | Microsoft blog |
|
3.10.26 |
Safely Securing AI Agents | Learn of the benefits of safely securing AI agents. | AI blog | Trend Micro |
|
3.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
3.10.26 |
SmokeLoader Malware: A Modular Threat with Advanced Evasion and Persistence | This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of SmokeLoader malware. This is a modular program used by a variety of criminal and APT groups to gain a foothold on a system. It has vigorous anti-VM, anti-AV, and anti-analysis checks and capabilities. SmokeLoader can be used with RATs, ransomware, backdoors or botnets and uses both file and fileless methods of persistence. | Malware blog | SonicWall |
|
3.10.26 |
VioletRAT v6.5: From .NET Loader to In-Memory RAT — A Deep Dive into the Infection Chain | Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers VioletRAT v6.5 through a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, an obfuscated batch script, in-memory assembly loading, and process injection into Msbuild.exe before executing the final VioletRAT payload. | Malware blog | SonicWall |
|
3.10.26 |
OperTraitors: How Kubernetes Operators Betray Your Security Posture | Kubernetes operators are coded to drastically reduce operational toil by acting as automated site reliability engineers. However, their reliance on highly privileged service accounts introduces a severe, often overlooked security weak spot. | Hacking blog | Palo Alto |
|
3.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
3.10.26 |
The Fine Art of Frustrating the Adversary | For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation. | Cyber blog | CISCO TALOS |
|
3.10.26 |
Give yourself room to be human | Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. | Cyber blog | CISCO TALOS |
|
3.10.26 |
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor | Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts. | APT blog | CISCO TALOS |
|
3.10.26 |
Securing the keys to the kingdom: Announcing Executive Threat Detection | Attackers are using greater sophistication to gain access to high-yield targets like executives, and company-wide security measures can easily miss these subtle, personal attacks. | Cyber blog | CISCO TALOS |
|
3.10.26 |
Trust and the enticing consultancy offer | In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged access or knowledge of vulnerabilities in each employment or engagement. This trust is valued by those who require our services, but also by threat actors. | Vulnerebility blog | CISCO TALOS |
|
3.10.26 |
The Closed Quorum: Inside the first reported autonomous AI C2 implant | CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025. | AI blog | CISCO TALOS |
|
3.10.26 |
This month in security with Tony Anscombe – September 2026 edition | Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep pace | Cyber blog | Eset |
|
3.10.26 |
Timeshare exit scams: From fake buyers to recovery scams | Con artists are targeting timeshare owners who want out – and some victims are hit twice | Spam blog | Eset |
|
3.10.26 |
The devil is still in the email – but wearing a new mask | When phishing can increasingly pass familiar checks, avoiding or limiting the damage depends on how quickly your company can detect and contain the attack | Spam blog | Eset |
|
3.10.26 |
Is that new (vibe coded) app safe? 5 questions to ask first | As AI lets anyone build software, here’s how to vet that shiny new app before it exposes your data | Cyber blog | Eset |
|
2.10.26 |
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes | Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by | Vulnerebility | The Hacker News |
|
2.10.26 |
OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling | OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street | AI | The Hacker News |
|
2.10.26 |
Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools | Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as | OS | The Hacker News |
|
2.10.26 |
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes | The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its | Exploit | The Hacker News |
|
2.10.26 |
Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers | Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data | CyberCrime | The Hacker News |
|
2.10.26 |
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory | Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure | Virus | The Hacker News |
|
1.10.26 |
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates | OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. | AI | The Hacker News |
|
1.10.26 |
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco | Exploit | The Hacker News |
|
1.10.26 |
Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version | Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon , that it said is being rolled out to a set of trusted cyber defenders through its Fairwind Program. | AI | The Hacker News |
|
1.10.26 |
US soldier gets 70 months in prison for extorting 10 tech, telecom firms | A former U.S. Army soldier has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024. | CyberCrime | BleepingComputer |
|
1.10.26 |
CISA orders feds to patch exploited Citrix flaws by Wednesday | The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. | Exploit | BleepingComputer |
|
1.10.26 |
OpenAI is preparing “o,” an always-on ChatGPT assistant that could handle email | OpenAI is testing a new always-on assistant called "o", and references to the unannounced feature briefly showed up on the company's website. | AI | BleepingComputer |
|
1.10.26 |
Citrix confirms two NetScaler RCE zero-days exploited in attacks | Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. | Exploit | BleepingComputer |
|
1.10.26 |
Cloudflare fixes Containers cross-tenant flaw exposing customer data | Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host. | Vulnerebility | BleepingComputer |
|
1.10.26 |
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path | Security researchers have published the first public proof-of-concept for CVE-2026-86950 , an Apple CoreGraphics flaw Apple says may have been | Social | The Hacker News |
|
1.10.26 |
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft | Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party | Cryptocurrency | The Hacker News |
|
1.10.26 |
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators | MetaMask on Thursday said it's responding to what it described as an "ongoing security incident" impacting part of its infrastructure. "We are | Cryptocurrency | The Hacker News |
|
1.10.26 |
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs | Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. | Exploit | The Hacker News |