Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build use...
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymark...
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pis...
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certific...
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20 — 21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible comprom...
The FBI says North Korea was behind the massive $6.3 billion crypto heist that hit Binance on October 29th. The FBI labeled the activity "TraderTraitor" and said that it had observed actors it has connected to hack converting the tokens to Ethereum a...
Binance said Saturday that it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in a record crypto theft announced Thursday. Separately, the FBI said late Saturday that it has determined North Korea was re...
After hackers stole a shocking $6.3 billion from Binance customers in a record-breaking crypto heist, the company's CEO says that 90 percent of the funds have been replaced, and the company plans to cover the remaining 10 percent as well. Binance is ...
Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a "logged-in service," offering limited access to visitors without accounts. For the past 20 years, the discussion platform has let users browse almost all it...
Finding a real security flaw and getting paid for it is an appealing goal when you are learning cyber security. Bug bounties give you a chance to test your skills on real software and help its developers make it safer. Headlines about programs closi...
.jpg)
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specia...
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. Northflank is a cloud platform that allows dev...
Blockchain intelligence firm Chainalysis has disclosed a security incident after attackers used what it describes as "offensive agentic techniques" to gain unauthorized access to its internal systems and tools. The company says some customer informa...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. ### The vulner...
American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its...
A Syrian man tied to the Syrian Electronic Army (SEA) has received a 42-month prison sentence in the US, more than 12 years after he was first charged. Ahmad Umar Agha, who used the online handle Th3Pr0, was sentenced on Thursday by a federal court ...
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDo...
- Published Two major blockchain analytics firms say they have robust intelligence pointing to a North Korean state-backed group as the likely culprits in the $6.3bn (£4.7bn) hack of Binance, the world's largest cryptocurrency exchange. The Lazarus...
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. The flaw, tracked as...
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know. A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and...
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bou...
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting...
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls ...
Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. Although the company has not yet received the device to examine ...
The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won't break anything. Their concerns are practical. An IP...
A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers. When managed security service provider Eye Security spotted an odd update process in a client's...
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America. I ricercatori non riescono a spiegare del tutto perché l...
SS7 and Diameter signaling attacks can track, intercept, and impersonate you. Here's how they work and how to stop them. Your phone can be tracked, your SMS two-factor codes can be intercepted, and your number can be impersonated, all without malwar...
The FBI has seized virtualine.net, the domain of a Russian-speaking bulletproof hosting services provider associated with various cybercriminal operations. According to court documents, Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo, a...
For decades, passwords have been one of cybersecurity's most persistent weaknesses. Users forget them, reuse them, share them, and surrender them to convincing phishing sites. Attackers steal credentials, automate credential stuffing, and increasingl...
SecurityWeek's weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories acros...
Threat actors have been hammering servers vulnerable to PHP2Shell for over a week, but only a few successful compromises have been confirmed to date. Standing out are Palo Alto Networks firewalls, which have been rooted by a China-linked hacking gro...
As 2027 approaches, leaders and practitioners are preparing for a slate of cybersecurity conferences that could fill their calendars. Government officials, industry executives and security experts from around the world will convene throughout 2027 to...
Hackers whom researchers have linked to North Korea stole roughly $6.3 billion in cryptocurrency from Binance, in the largest such theft in history, the exchange said on Thursday. The attackers compromised several systems, including a Binance engine...
A suspected China-nexus actor chained flaws in PHP2Shell with a privilege escalation bug in the Linux kernel to gain root access to Palo Alto Networks firewalls, according to researchers at Dream and PAN Unit 42. The attacks reached more than two doz...
Crypto firms and law enforcement are racing to recover more than $6 billion worth of cryptocurrency stolen from Binance before hackers manage to hide the funds. The firms say they're in a "cat and mouse game" against alleged North Korean hackers who...
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core version...
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected system...
Threat actors started exploiting a new high-severity WordPress vulnerability within hours of patches rolling out, Defiant warns. Patched on October 28 in WordPress 7.1.4, the security defect impacts the WordPress update process and can be exploited ...
Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized and le...
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know. As artificial intelligence squeezes early-career learning opportunities, capture-the-flag contests could be one way to help pick up the slack. Artific...
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America. The "FrostyNeighbor" advanced persistent threat (APT) la...
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. Tracked as CVE-2026-118539, this flaw stems from a missing authorization weakness that can be abused by unaut...
Microsoft has resolved Always On VPN connection failures triggered after installing the September 2026 Windows 11 security updates. The Always On VPN remote access solution runs in the background and establishes secure tunnels back to the user's cor...
Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA). Tracked as CVE-2026-97229, this critical security flaw was discovered ...
A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced. Ahmad Umar Agha, also known as "Th3Pr0", was s...
Polymarket halted trading on its international platform on October 29 after users reported unauthorized withdrawals. According to the prediction market's status page, the exchange was first switched to cancel-only mode, with relayer actions suspende...
Drupal is urging online store owners to patch a highly critical access bypass vulnerability in the Commerce Core module, warning that it is being exploited in the wild. Tracked as CVE-2026-118539, the issue affects a contributed module that adds e-c...
A high-severity vulnerability in the popular remote-access tool TeamViewer could be exploited to take over a viewer's (an IT support technician's) system, cybersecurity firm Remedio warns. Tracked as CVE-2026-111585 (CVSS score of 8.8), the flaw is ...
A recent code execution vulnerability in GitLab was exploited one week after disclosure in a failed attack against Alpine Linux's instance. Tracked as CVE-2026-97229 (CVSS score of 10/10), the flaw stems from insufficient regular expression validati...
This is CNBC's Morning Squawk newsletter. Subscribe here to receive future editions in your inbox. Hello, this is Leonie Kidd with today's edition of Morning Squawk. It's a Friday fright for markets before Halloween has even gotten underway. Tech ...
- Published Binance, the world's largest crypto exchange, has been hit by what is believed to be the largest crypto hack ever at $6.3bn (£4.7bn). Crypto is a type of digital asset which does not exist physically like cash or coins. Instead, people ...
Cryptocurrency firms and investigators are racing to freeze and track down billions of dollars of stolen digital cash following what appears to be the largest crypto heist of all time. On Thursday, starting at around 4pm ET, hackers started quickly s...
The world's largest cryptocurrency exchange has been hit by an industry-record $6.3bn (£4.7bn) hack, with experts identifying North Korea as the likely culprit. Binance has scrambled to freeze the affected assets, with about $3bn located so far. The...
Binance has disclosed that $6.3 billion worth of crypto funds have been stolen from the platform, in what's believed to be the biggest cryptocurrency hack on record. In a series of updates posted to X, the crypto exchange said that user funds are saf...
Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so...
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless...
A cryptomining and backdoor campaign that abuses Hugging Face model repositories came back within days of being taken down. Its most popular malicious model was downloaded more than 28,000 times. Separately, researchers flagged a fake Solana starte...
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker...
Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservat...
Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history. If confirmed stolen, the amount would far exceed the $1.5 b...
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know. This installment of the Reporters' Notebook video series discusses some of the trends and topics from Cybersecurity Awareness Month, from using AI for ...
Obvious phishing emails with numerous red flags are somehow getting past some of the industry-leading secure email gateway (SEG) products. Attackers are managing to sneak low-grade phishing emails through brand name email security products, as evide...
Adobe, Veeam, and Juniper Networks have released patches for over three dozen vulnerabilities across their products, including multiple critical-severity code execution flaws. This week, Adobe fixed 12 vulnerabilities in Campaign Classic, Connect, C...
A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that i...
Wired has the story of a superuser cheating scandal. Professional poker is the latest community to reckon with the impact of a high-profile cyberattack. Wired reports that hundreds of online poker players have allegedly been targeted in a malware at...
A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend. ISC2 Strategic Congress 2026 — Denver — A threat model should be a starting organizing principle for any security program. But r...
Microsoft has resolved a known issue that prevents non-admin users from connecting to devices via Remote Desktop when the "Administrator protection" security feature is enabled. When Administrator protection is enabled, it prompts standard users to ...
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. A new report by Socket's...
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. CVE-2026...
A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. Blockchain investigator Iris confirmed that one victi...
The integrity of the US voting system is a continuing concern, involving machine tampering, ballot counting, and voter influence. These all have some cybersecurity relevance. Other concerns include accurate voter registration, differing voter ID requ...
Volt Typhoon, a Chinese state-sponsored APT group that's focused on cyberespionage and United States' critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen's Black Lotus Labs ...
Risk management leaders educate people on measuring exposure, testing assumptions and advising on how best to prepare for incidents they hope won't occur. They know that the absence of a security alert does not stand for safety; that resilience depen...
An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office...
China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the "Fragnesia" Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. Cisco has also confirmed that attac...
They include email addresses and phone numbers of ICE agents and border police. A hacktivist group stole records for more than 41,000 Homeland Security personnel and got help to release it on the web, according to Wired, the Washington Post and NPR....
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in ve...
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, track...
Hackers have stolen the personal information of current and former So-net and Plala internet subscribers in Japan, Sony Network Communications announced on October 27. Nearly 2.6 million records were impacted. The attackers broke into the So-net mem...
More than 8 million people were impacted by a June 2026 data breach at medical equipment provider iRhythm. The company, which specializes in wearable cardiac monitoring technology and is best known for its Zio wearable ECG monitor, disclosed the inc...
Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Tracked as CVE-2026-76418 and assigned a CVSS score of 8.6, the bug r...
A threat actor whose infrastructure overlaps with a covert network used by China's Volt Typhoon exploited a critical Cisco SD-WAN vulnerability to deploy malware designed to harvest encryption keys, Cisco Talos reported on Wednesday. The same day, L...
A threat actor has leaked online a database containing the personal and work information of thousands of US Department of Homeland Security employees. The hacker, who uses the handle Department of Peace, has leaked more than 41,000 records. "They ha...
Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements. KB5127936 is a preview update that adds new features and fixes at the end of e...
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. Tracked as CVE-2026-76418, this...
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America. Researchers can't quite explain why cyber threats look s...
For nearly a quarter of a century, Elon Musk and his essential partner at SpaceX, Gwynne Shotwell, viewed the United States government as El Dorado, the mythical city of gold. Like machete-wielding treasure hunters, Musk and Shotwell hacked through ...
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its...
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Sil...
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. T...
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 2...
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information. A Sony Group Corporation subsidiary, the company provides telecommunications an...
The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit. A new wave of GhostAction attacks has largely failed, but this supply chain campaign operator is well-position...
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Om...
Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. The goal is to surface useful information to the wider internet commun...
Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application. ### An unidenti...
An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office...
GitHub announced a package firewall that checks npm packages against an enterprise's policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewa...
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle A...
Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. ### The list of eight vulnerabil...
A 36-year-old Ukrainian national was sentenced to prison in the US for his role in Nefilim ransomware attacks. The man, Artem Aleksandrovych Stryzhak, who had been living in Barcelona, was arrested in Spain in June 2024 and extradited to the US in A...
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. Discovered in a core component of EBS's Application Object Library and tracked as CVE-2026-101767, thi...
Here's a prediction: we're about to see a stellar quarter for application security companies. PHP2Shell is about to become the strongest budget argument application security vendors have had in years. AI helped researchers find two remote code execut...
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. The fi...
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. This retirement process applies only to Microsoft Entra ID wor...
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. The framework has been dubbed Silen...
Dive Brief: - Hackers are increasingly targeting internet of things devices, including on home networks, in attacks that can serve as launching pads for campaigns against enterprises, security firm Bitdefender and networking vendor Netgear said in a...
The insurance industry is closely monitoring PHP2Shell amid concerns of a systemic event that could overwhelm the sector with billions in cybersecurity risk claims. PHP Foundation and multiple government authorities last week warned about two critic...
Cybersecurity firm FoxIO has disclosed three vulnerabilities in GoAhead's handling of TLS. They could keep revoked client certificates working, let eavesdroppers decrypt some traffic, or help attackers get around a cap on certificate chain length. G...
Google and Mozilla on Tuesday rolled out fresh Chrome and Firefox updates that resolve more than 200 vulnerabilities in the popular browsers. The Chrome 156 update arrives with patches for 52 security defects, including four critical-severity flaws:...
A China-linked threat actor has been exploiting the PHP2Shell vulnerabilities to gain root access to firewalls and deploy webshells for persistent access, cybersecurity firm Dream reports. The hackers have been chaining an exploit for the two PHP fl...
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays on...
The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The move was in response to the service being used to commit and facilitate prolific criminal ac...
Alibaba's Qwen 3.8 Flash Next model arrived at the end of August, promising a preview of a new architecture that would officially debut with the Qwen 4 family. It's a powerful 125B Mixture of Experts model, with 6B active parameters and an additional...
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its...
Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how Tailscale SSH forwards network ...
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today. The company later confirmed ...
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises. ISC2 Strategic Congress 2026 — Denver — Depending on a software bill of materials (SBOM) ...
Main bombing sis getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang. Threat actors are abusing Microsoft Teams' external chat functionality at scale, using IT-support imper...
A vulnerability in Brotli, Google's widely used open-source compression library, is putting a broad range of software at risk. ### About CVE-2026-111497 Alternatively known as "Node2Shell", "Broccoli2Shell" and "Brotli2Shell", CVE-2026-111497 is a ...
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America. Interpol's annual Operation Serengeti, now on its third ...
Nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier, according to its Data Breach Outlook 2026. Businesses rely on outside providers to store information, process transactions and operate so...
The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive federal systems. The report, Transition to Post-Quantum Cryptography Standar...
Tailscale is getting ready to ship a client update that addresses privilege escalation weaknesses in Tailscale SSH. Details of the bugs went public over the weekend. Tailscale provides a mesh VPN service that uses the WireGuard protocol to connect a...
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. On Monday, UNM Health, the university's healthcare provider, began temporarily limiting new pa...
The US cybersecurity agency CISA has added the Brotli vulnerability known as Node2Shell to its Known Exploited Vulnerabilities (KEV) catalog. Separately, two security firms say they have recorded exploitation attempts against their honeypots. Tracke...
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the ...
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that...
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. The KB5134133 update for Win...
Small and rural healthcare organizations are among the most vulnerable critical infrastructure organizations in the nation. The U.S. government will help protect rural hospitals from cybersecurity threats as part of a new pilot program that could ge...
Security researchers and U.S. government authorities have seen what appears to be the first successful exploitation of critical vulnerabilities in PHP. For more than a week, hackers have attempted to exploit a memory-corruption vulnerability, tracke...
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online c...
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-202...
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal'...
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturin...
Apple on Monday released updates for its operating systems, addressing a total of 286 vulnerabilities across the newest versions of iOS and macOS. In addition, the company has backported the fix for an exploited vulnerability to iOS 18. macOS Golden...
Over the weekend, web hosting provider DreamHost suspended its File Manager service and reset some user passwords. The company says it took protective actions in response to "an issue" with its systems, which affected File Manager at files.dreamhost...
HPE last week released patches for 72 vulnerabilities in the AOS-8 and AOS-10 wireless operating systems of its Aruba networking products, including 33 critical-severity flaws. The security updates address eight max-severity bugs: CVE-2026-79844, CV...
Denver Health Medical Plan (DHMP) is notifying 238,000 people that their personal and health information may have been compromised in a data breach. Based in Denver, Colorado, DHMP is a non-profit managed care organization within the Denver Health a...
Threat actors are flooding employees' inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents in which the ...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws. Threat actors without privileges can exploit the two s...
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. ENGIE operates in renewable energy, infrastructure, a...
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. Apple patched the same vulnerability in September for devices run...
Cyber headlines often focus on the flashy attacks, but the ones that actually cause OH $#!T moments are the tactics that abuse the tools and workflows you already trust. If you run a small or mid-sized organization, whether you handle IT yourself or ...
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. Tailscale develops a software-defined mesh virtual private network (...
Sekoia has introduced Sekoia Self-Hosted, a deployment model that brings the Sekoia SOC platform into the customer's own infrastructure. Designed for large organizations, including government agencies, defense organizations, critical infrastructure ...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated...
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, chan...
A major hospital network in New Mexico raced to fix a cybersecurity issue on Monday that forced it to send ambulances to other hospitals and left the state without an emergency department capable of treating the most serious injuries. The University...
Several organizations have teamed up to create Blue Initiative, a public vulnerability database that indexes IT and OT vulnerabilities impacting the maritime industry. Blue Initiative is the work of cybersecurity company Cydome, Japan's ClassNK clas...
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. The educational organization detected the breach last Tuesday and disclosed it on Friday. In a...
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. According to local media citing the Seoul Metropo...
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of ...
DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. The latest update from the web hosting provider notes that all affected account owners have received re...
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deli...
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw...
This Cybersecurity Awareness Month's theme, "Securing the Next 250," asks us to look beyond vulnerabilities and consider what will make our digital systems resilient for generations. ### OPINION When I testified before Congress with my L0pht collea...
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories. An ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer reposit...
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write in the...
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. The security issue is tracked as CVE-2026-111497 and is also known as "Broccoli2Shell" and "N...
The Cybersecurity and Infrastructure Security Agency on Monday laid out an ambitious vision for protecting U.S. government networks and critical infrastructure systems over the next four years. The "CISA 2030: Defend, Harden, Prevail" strategy chart...
PwC on Monday said it was investigating claims that hackers had breached a third-party vendor site the company uses to house employee learning records. The company disclosed the breach amid claims from Everest ransomware that it had stolen 590 gigab...
The internet's mad scramble on Wednesday to patch a pair of critical vulnerabilities in PHP, a widely used web scripting language, was already too late to stop every attack, newly released details reveal. Wednesday's release of fixes for two critica...
Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here. As security teams and web admins scrambled ...
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations...
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the...
Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it...
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, who...
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulne...
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. This Linux distribution is available as an installable OS or as a live environ...
A Chinese national was arraigned in California after being extradited from the Netherlands for his alleged involvement in a cryptocurrency investment scam that stole nearly $37 million from 174 victims in the United States. In these fraud schemes (a...
Industrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities on their products. Several of the...
Customer experience company Genesys says it has contained a cyberattack that involved unauthorized access to data. Headquartered in Menlo Park, California, Genesys is a provider of customer experience and call center technology for mid-sized and lar...
Attackers have successfully exploited the PHP2Shell vulnerabilities to run shell commands on honeypot servers, a researcher reported over the weekend. Tracked as CVE-2026-109618 and CVE-2026-109619, the critical PHP2Shell flaws can be exploited for ...
A threat actor has infected 953 online stores, most of them running Magento, with loader code as part of a long-running campaign, cybersecurity firm Sansec reports. The attacks have been ongoing since July 2025, and the threat actor has used five di...
Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion's Fraud in the Age of Continuous Trust report. Eighty-one percent of suspected digital fraud in its network du...
The OpenSSL project released version 4.1.0, adding support for DTLS 1.3 and listing four known bugs in the DTLS code that ships with it. DTLS is the variant of TLS built for datagram transports such as UDP, and version 1.3 is defined in RFC 9147. Th...
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port ...
Here's an overview of some of last week's most interesting news, articles, interviews and videos: A critical PHP security release is coming today, so get ready to update! The PHP security team has announced an urgent security release for Wednesday,...
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a con...
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. Th...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports ...
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the f...
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The up...
Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more fundamental weaknesses in global internet infrastructure in the months to ...
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in...
Fixing the critical PHP flaws is not as simple as clicking "Update." Here's how to assess your risk, and what you can do to protect yourself. New data shows that organizations aren't moving to patch PHP2Shell as fast as attackers are moving to explo...
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know. Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a l...
Players who signed up for Capcom's online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the a...
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tra...
Damaging a cable on the seabed off the UK coast could soon cost someone 14 years of their life behind bars, under plans the British government published this week. The proposal comes from a White Paper by the Department for Digital, Culture, Media a...
Microsoft says Teams will begin using AI-powered phishing detection in early November 2026 to detect malicious behavior in messages. The rollout is part of a targeted release phase expected to end by mid-November, with the new security feature likel...
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millio...
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a sp...
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate tha...
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred...
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. Windows Server 2016 was released in September 2016 at Microsoft's annual Ignite conference and reached general availability ...
The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. PHP is an open-source web development language used by nearly 70% of all websit...
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. The company learned about the breach on October 21 and deployed its inc...
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America. The region is demonstrating what happens when exploits a...
A China-linked threat actor has been using the open source AI penetration testing framework Artex to automate a recent ConnectWise hacking campaign targeting hundreds of organizations, Microsoft reports. Tracked as Storm-0940 and active since at lea...
Networking solutions provider Arista Networks on Thursday rolled out patches for an exploited zero-day vulnerability in its centralized management tool VeloCloud Orchestrator (VCO). The critical-severity security defect is tracked as CVE-2026-114625...
SecurityWeek's weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories acros...
Two days after PHP rolled out emergency fixes for the PHP2Shell vulnerabilities, threat actors have tried to use the flaws to spread a Mirai botnet. A security firm has also built an exploit that gets past a key memory protection, and an exposed atta...
Security researchers warn that millions of websites remain at risk as exploitation attempts against two critical flaws in PHP have surged. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can enable an attacker to achieve remote-...
Dive Brief: - The size of the cybersecurity insurance market is growing quickly as more businesses try to guard against the damage from a major hacking incident. - "Total U.S. domestic cyber direct written business has nearly tripled since 2020, ma...
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux...
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens b...
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) ob...
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way...
Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself. The relentless evolution of the threat landscape has pushed cyber insurance companies to follow suit with a continuous exp...
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. Also known as AOS, ArubaOS powers Aruba...
Medical laboratory operator Quest Diagnostics said it learned of a cyber breach of one of its systems this week, likely compromising some records for patients. In a Thursday regulatory filing, Quest Diagnostics reported "unauthorized access" to its ...
Japanese gaming company Capcom has disclosed a data breach impacting 11 million email addresses and the personal information of a small number of individuals. The incident, the gaming giant says, was discovered on October 19 and involved unauthorize...
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America. Relatively small data breaches in India can turn quite s...
Prince of Persia, a threat group sponsored by the Iranian government, ran one of its command-and-control (C&C) servers from the United States this year, after a months-long lull in its operations, according to Semperis. The APT actor, also tracked a...
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. "LiteLLM got compromised… again," security r...
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate...
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the o...
Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. The company says its investigation indicates that, in some cases, an ...
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can b...
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to d...
Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. The supply-chain attack affected all PyPI wheels (.whl installation packages) fo...
Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. Apart from emails, exposed data includes account creation date, ...
Internet security and web administration teams around the world are scrambling to prevent widespread disaster. On Wednesday, the developers behind the much-used PHP programming language released emergency security updates designed to fix critical fla...
Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multip...
INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462...
Corey Thuen is a hacker with a hacker mindset that is focused on the right way to do wrong things to get the right result. Corey Thuen is the founder and CEO of Gravwell, a firm with a slight difference: it develops data analytics and vulnerability ...
Signal has resolved a critical-severity vulnerability that could allow a malicious caller to keep audio and video tracks enabled even after the user hung up. The security defect is tracked as CVE-2026-113380 (CVSS score of 9.3) and impacts RingRTC, ...
Tech vendors, cybersecurity companies and government agencies have published advisories, detections and mitigations for the PHP2Shell vulnerabilities, while many software makers are still checking whether their own products are exposed. The two crit...
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. Tracked as CVE-2026-109618 and CVE-2026-109619, the two critical vulnerabilities let a...
Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. EWS is an API for developing apps that can access Exchange mailbox items (e.g., email messages, meetings...
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. VCO is a web-based management portal that helps administrators configure, monitor, and manage...
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker reach pre-aut...
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained ac...
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code...
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to...
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and su...
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. This security issue is tracked as CVE-2026-110264 and was reported by a security res...
Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. Coordinated by Interpol, the operati...
Threat actors started probing for servers affected by two critical remote code execution (RCE) vulnerabilities in PHP four days before the fixes, Amazon reports. Patches for the two flaws, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-20...
A judge on Wednesday ordered Meta to pay New Mexico $25 billion after a jury found the company liable for deceiving users about privacy on Facebook, marking the biggest fine ever against the tech giant. Facebook's deception was intentional and execu...
Cisco on Wednesday announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products. Expressway Series received fixes for 10 vulnerabilities, including a critical-severity remote code execution ...
Splunk and SolarWinds this week released patches for multiple vulnerabilities, including flaws leading to code execution, privilege escalation, denial-of-service (DoS), and information disclosure. On Wednesday, Splunk rolled out security updates for...
Websites around the globe have gone dark after a serious vulnerability was found in a computer language used to build much of the world wide web. Belgian, Dutch, Finnish, French and German sites were among those that governments took down temporaril...
All websites using the common programming language should update to the latest security patch. One of the two major issues impacting web security this morning has had a ripple effect. In the wake of an announcement from the PHP Foundation that it wa...
Critical vulnerabilities in the PHP web scripting language could allow hackers to take control of any website running the widely used software, PHP's developers said on Wednesday, as they released emergency updates that sent website owners scrambling...
An Indian company's serious error in creating high-level encryption certificates has prompted major web browsers to block the certificates before hackers can use them to spoof websites. The issue involves intermediate certificates created by the Ind...
High-severity flaws are exploited faster; ransomware remains the dominant threat; the US is the world's most targeted country, and attacks increasingly involve the use of AI (but largely manually rather than autonomously). Rapid7's threat analysis f...
The tech world is racing to implement fixes after the discovery of critical security vulnerabilities in software used to power much of the internet. The software, known as PHP, is an open-source programming language widely used to power websites and...
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has i...
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who ...
Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization. ### October 21, 2026 ### PRESS RELEASE SEATTLE — (BUSINESS WIRE) — Data loss preve...
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. The company confirmed on October 20 that an unauthorized third party installed "ma...
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts. A pair of critical vulnerabilities tied to open source scripting language PHP appear to have significant conse...
Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost. A breach of an open source database provider may have inadvertently highlighted a serious gap in ...
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure. ### October 21, 2026 ### PRESS RELEASE...
PHP has rolled out patches for two critical-severity vulnerabilities named PHP2Shell that could provide attackers with unauthenticated remote code execution (RCE). The issues are tracked as CVE-2026-109618 (out-of-memory (OOM) corruption) and CVE-20...
Dive Brief: - A Russia-linked hacker group broke into the network of a shipbuilder in a NATO member state during a two-month campaign that also targeted government agencies and other critical manufacturers, Symantec researchers said on Tuesday. - T...
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. The campaign targets South Korean organizations through a "rather complex" infection chain...
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing's Enhan...
Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people's dogs. The "critical vulnerabilities" were discovered in the PHP programming language, which...
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. The two unauthenticated RCE flaws were discovered by Cali...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. The security issues are collectively called Plex2Shell. When chained in an exploit, an atta...
GOG and GOG Galaxy were taken offline following news of critical web vulnerabilities. The reveal of critical vulnerabilities affecting the PHP scripting language used in web development have led a number of major websites and services to go offline ...
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are ...
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM...
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully ...
The FBI and the Cybersecurity and Infrastructure Security Agency warned that SafePay has expanded its attacks against critical infrastructure providers to become one of the world's most active ransomware operations. Since 2024, Safepay has struck mo...
Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities. ### October 21, 2026 ### PRESS RELEASE LEAWOOD, Kan. — Oct. 21, 2026 ...
360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated. ### October 21, 2026 ### PRESS RELEASE Brentwood, TN — October 20, 2026 — 360 Privacy, a digital expo...
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users. GlassWorm threat actors appear to have snagged a big fish. French cloud provider OVHcloud on Monday disclosed that one o...
Both problems could result in large-scale attacks and require massive cleanup. The web is a bit of a hot mess today following the discovery of two severe vulnerabilities, according to security releases seen by Ars Technica. The first involves TLS ce...
Batten down the virtual hatches. The PHP security team has given advanced notice of an upcoming fix for two critical security vulnerabilities, both rated at 9.2 out of 10 on the CVE severity scale. Info about the flaws seems to have leaked ahead of...
Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into c...
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical m...
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. Mouse Button Lock, one of the new mouse tools, makes it easier to select items on screen by locking a mouse button while ...
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 ...
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. In a joint report with the FBI, the U.S. Secret Service (USSS), Germany's ...
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, a...
The private keys associated with eight intermediate certificates issued by Indian certificate authority (CA) eMudhra have been compromised, and root programs and trust stores have started blocking them. The certificates were issued in April 2025, an...
Google on Tuesday announced the promotion of Chrome 156 to the stable channel with patches for 353 vulnerabilities. Most of the resolved security defects were memory safety flaws, including 163 memory corruption bugs, 125 use-after-free issues, and ...
The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer. A new ClickFix attack is leveraging a legacy Window utility to run malicious...
It's morning. The money mule — or lavador, as the cartels call their pet launderers — steers into a sweltering strip mall parking lot somewhere in Miami. He pulls into an open space, looks around, opens his trunk. Before long the adjacent space i...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Sh...
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in ...
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at...
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Parti...
Accenture, Dragos and the SANS Institute on Tuesday announced the Community Cyber Resilience Foundation, which aims to help under-resourced US water, electric and natural gas utilities protect their operational technology (OT) environments. They are...
Details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches. On Tuesday, PHP warned that patches for the critical issues, both with a CVSS score of 9.2, ...
French cloud computing and web hosting company OVHcloud says a hacker used the GitHub account of one of its developers to plant a secret-stealing binary in its official command-line interface (CLI) tool. The supply chain incident occurred on October...
Website admins, brace yourselves. Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere. PHP main...
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websit...
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. TeamUpdraft detected unauthorized acce...
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it's unclear how the keys were compromised. Google, Mozilla, Apple, and the Go programming language project blocked certifi...
Dutch-Belgian grocery giant Ahold Delhaize has restored some of the services impacted by last week's cyberattack and expects more to come back online within days. On October 12, the company took its systems offline in response to "a security issue" ...
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holdi...
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and infor...
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. PHP powers many web...
Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them...
Google is updating Chrome's Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced Enhanced Protection for Chrome's Safe Browsing feature in 2020 to address on...
An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files...
Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet. As of late mo...
The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days bef...
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The agents trie...
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass f...
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS sc...
Between April and July, AOMEI Backupper served malware to its users multiple times in short-burst supply chain compromises, security researchers warn. AOMEI Backupper is Windows backup, sync, and disk cloning software, available in free and paid edi...
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins. Chinese-speaking hackers have largely outsourced a maelstrom of malicious activity...
For agencies responsible for protecting Criminal Justice Information (CJI), meeting CJIS requirements means more than putting security controls in place. Those controls need to work across the systems staff use every day, and agencies need to be able...
Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. Quick machine recovery (QMR) lets IT admins fix critical boot failures with targeted Windows Upda...
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. 40-year-old Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo...
ConnectWise said it suspended access to its Cloud Backup service after a suspected supply chain attack targeting Microsoft 365 users was uncovered in an attack that was first detected on Wednesday. ConnectWise said services for SaaS Security and Clo...
Palo Alto Networks researchers warned that ransomware operators have stepped up exploitation of a high-severity flaw in the company's GlobalProtect portal, months after it was first disclosed. The authentication bypass vulnerability, tracked as CVE-...
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to...
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets ...
Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. Since the incident began, thousands of users on the Downdetector outage tracking platform have reported issues with the Revol...
Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. Right before the cyberattack was disclosed, customers couldn't use websites, apps...
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. The attacker hijacked a developer's GitHub account to gain access to...
Paradigm Healthcare Services has told the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people. San Francisco-based Paradigm processes billing for Medi-Cal, California's Medicaid ...
Japanese media giant Nikkei has disclosed a fresh data breach impacting more than 1.8 million records. According to the company, best known for major financial publications, including The Nikkei and Financial Times, the incident involved a cloud ser...
Mastercard has announced Stablecoin Security, a new risk intelligence solution, with Borderless.xyz and Keyrails as initial partners. As stablecoins play a growing role in cross-border and business-to-business payments, financial institutions need a ...
The problem with set-and-forget devices is that you can, well, set them and then forget about them. It's good in terms of keeping it out of mind, but people can sometimes forget that their device still needs regular updates to stay secure. That's wha...
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery servi...
Dive Brief: - Corporate boards of directors report mixed levels of readiness to oversee their companies' cybersecurity defenses, suggesting trouble ahead as AI continues to upend the threat landscape. - Most directors are confident they're adequate...
Just about everyone should know about the 3-2-1 backup rule by now. If you don't, it's a strategy that says you should have three copies of your files on two different types of media, with one off-site. Only then are your files truly protected from d...
Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. According to the vendor, a limited number of users who downloaded version 3.0.1...
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but m...
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest. An Israeli company that presents itself as a legitimate digital advertising business is helping spyware vend...
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, governmen...
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience. ### OPINION Every year, the lexicographers at Merriam-Webster officially add new words or word usage to the dictionary. I...
.jpg?width=720&quality=80&disable=upscale)
Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed. A threat actor used credentials associated with ConnectWise's Cloud Backup product to authenticat...
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links. Tech support scams seem like a dime a dozen these days, but researchers g...
Sweet Security has announced the release of Virtual Patching, a new capability that protects running cloud and AI applications from specific vulnerabilities the moment they are identified. Security teams can enforce protection in one click while engi...
American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations' Microsoft 365 accounts. The intruders used a compromised credential belong...
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks. The sup...
Windows has great protection built-in, so third-party suites come down to the extras. Windows was not the safest operating system in the early days. Back then, malware and viruses were a risk that you were required to avoid and resolve on your own. ...
In February 2026, the operator of OnlyFake pleaded guilty in the United States for his role in a service that generated more than 10,000 fraudulent digital identity documents. Customers could create passports, driver's licenses, Social Security cards...
Microsoft has fixed a known issue that caused games and Windows 11 apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 preview update (KB5124010). While KB5124010 is an optional update that requires clicking a...
Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company says it has isolated the issue and eradicated the immediate threat. Currently, its team is working to resto...
Siemens revealed on Monday that threat actors have exploited a vulnerability in Siemens Software Center as part of a malware campaign. Siemens Software Center handles the download, installation, activation and updating of software that customers hav...
Users downloaded malicious versions of Rank Math PRO last week, after the WordPress SEO plugin was compromised in a supply chain attack. Some version 3.0.123 packages contained malware that could allow attackers to take over websites if the plugin w...
Drupal has rolled out patches for five vulnerabilities, including two critical-severity bugs that could be exploited for remote code execution (RCE). The first resides in the Entity List module, which allows users to create lists of entities without...
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extor...
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias ...
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. T...
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a sec...
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer me...
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the att...
Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. In a new Windows release health dashboard update over the weekend, Microsoft said users may h...
A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization, Palo Alto Networks reports. The intrusion, attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-09...
ConnectWise is scrambling to restore its Cloud Backup, SaaS Security, and Cloud Management services after hackers abused a compromised credential to access customers' M365 tenants. The company suspended the Cloud Backup service (formerly known as Sk...
Personal information on current and former California public school students was copied from a file transfer system belonging to Educational Testing Service (ETS), according to the California Department of Education (CDE). ETS is a nonprofit that ha...
Threat actors began targeting Plex2Shell, a chain of four Plex Media Server vulnerabilities, one day after technical details and a working exploit went public. The researcher who found the Plex2Shell bugs released a write-up and proof-of-concept (Po...
We know a post-quantum world is likely coming. What we don't know is when. Organizations should begin preparing now for the day quantum computers become commercially available to help evolve security needs for their critical IT assets. No one knows ...
Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely,...
Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026, up from 23% in the previous quarter and roughly four times the share of any other brand. Top 10 most impersonated brands in phi...
Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here. Oh, Canada. The Great White North is the la...
Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines. The security issue is tracked as CVE-...
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microso...
CyberSN's Cybersecurity Jobs Report provides visibility into the US cybersecurity job market. It's a mixed bag. Data for CyberSN's jobs report is aggregated from JobSpikr (with duplicates removed). The various job titles are then analyzed and assign...
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. The security issues impact the software core's Field UI module and the co...
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. Reports of the malicious activity began emerging on Friday, wi...
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by...
Candiru spyware has infected devices at international news network Al Jazeera in zero-click attacks, via targeted advertisements, Canadian internet watchdog group Citizen Lab reports. As part of the operation, dubbed AdFection, ads purchased by Isra...
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized acce...
OpenAI said internal models hacked two more websites, bypassed company-imposed browsing restrictions, and used exposed credentials to draw cryptocurrency from a wallet it couldn't otherwise access, in the latest installment of disclosures of its agen...
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group. A week chock full of new high-severity and actively exploited edge vulnerabilities continues with a Chinese cyb...
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protec...
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. According to e-commerce security firm...
Chicago-area law enforcement officers took part in an undercover probe by Immigration and Customs Enforcement into Minneapolis mutual aid networks last spring as part of the feds' conspiracy investigation into 15 Twin Cities activists facing federal ...
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishin...
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update...
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. Researchers at Citizen Labs investigating the attac...
The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight. ### October 16, 2026 ### OPINION Edward Dubrovsky walked into the Philadelphia Cyber Risk Summit on Oct. 8 with his name on the spons...
SecurityWeek's weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories acros...
Dive Brief: - The open-source software community needs to understand several key lessons in order to improve its cybersecurity posture, according to IBM, which operates a clearinghouse for analyzing and disclosing open-source vulnerabilities. - "Fi...
A suspected China-nexus hacker has exploited a zero-day vulnerability in BeyondTrust Remote Support since late August as part of an espionage campaign, according to a report released Thursday by Google Threat Intelligence Group. The hacker, tracked ...
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026. The vulnerability, tracked...
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. Founded in 1953 in Florida, Burger King is now a multination...
OpenAI has disclosed two incidents in which internal AI models, asked only to look up public figures, instead broke into the live systems hosting that data. The reports, published on October 15, are the latest in a run of misalignment disclosures Op...
Federal bankruptcy courts across the US have been unable to send notices through the Bankruptcy Noticing Center (BNC) for a week. The outage followed a cybersecurity incident affecting the BAE Systems infrastructure that runs the center. The BNC han...
A Chinese APT has been exploiting a BeyondTrust vulnerability as a zero-day since August as part of its state-sponsored espionage operations. The exploited flaw, tracked as CVE-2026-102764 (CVSS score of 9.3), is described as an improper validation ...
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. Smart App Control is a Windows 11 security feature that uses Microsoft's app intelligence services and code i...
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. In a Thursday press release, the Administrative Office of the US Courts said the B...
Hot on the heels of its record Patch Tuesday rollout, Microsoft on Thursday announced patches for over 30 new vulnerabilities. Most of the new fixes address security defects in the Office suite. Two dozen of them patch high-severity remote code exec...
F5 and Juniper Networks have rolled out patches for dozens of vulnerabilities across their products, including critical-severity remote code execution (RCE) flaws. Security and application delivery firm F5 announced fixes for 11 security defects in ...
Attackers are breaking into business email accounts with short messages asking whether a company can quote on an upcoming project, the kind of request sales and procurement staff answer every week. Cadence Riddle, a cybersecurity researcher at Fortr...
Three weeks before Americans vote in the 2026 midterm election, fraudsters are borrowing candidate names, logos and slogans to collect fake donations and harvest personal data, the FBI warned. "The FBI warns the public that scammers could exploit th...
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distribut...
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS sco...
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. Remote Support is the company's enterprise-grade support solution that helps IT service desks...
David Fuhr, CTO at intcube, talks about a security cohort for public administration, where 27 municipalities hardened Windows Server and Active Directory together over 12 weeks. This Help Net Security interview covers how a cohort works, with weekly ...
More than 9.1 million DDoS attacks were recorded globally between January and June 2026, an increase of nearly a quarter year over year, according to Netscout's DDoS Threat Intelligence Report. ### Large attacks and distributed targeting strain defe...
US employers posted 235,786 cybersecurity jobs from January through September 2026. That is the lowest total for those months in the four years that staffing and workforce intelligence firm CyberSN has tracked. They pulled the listings from job data ...
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now...
The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth. ### October 15, 2026 ### PRESS RELEASE TORONTO, Oct. 14, 2026 — SecTor, Canada's largest cyb...
Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime. ### October 15, 2026 ### PRESS RELEASE LOS ANGELES, Oct. 15, 2026 /PRNewswire/ — There ...
Researchers say that mercenary hackers laced ads with zero-click exploits that installed sophisticated malware on the devices of targeted individuals when they did nothing other than load a website or open an installed app. The finding, published Th...
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that's an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can ...
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. The operator installed Pawns.app, a legitimate bandwidth-sharing application that lets users earn ...
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. Multiple administrator reports indicate that attacks began in mid-S...
For most of its history, cybersecurity has been reactive by design. Spot the bad event, shut it down. But as cyberattacks evolve, this thinking must evolve too. In the past, attackers relied on a single dramatic exploit to access the crown jewels. Bu...
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. AUR is a community-maintained, widely-used package index for Arch Linux and derivative distributions that hosts pa...
Microsoft uncovered a criminal marketplace supplying tools and accounts used in phishing scams worldwide. Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the Unite...
Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar "prove you're human" step into a gateway for malware downloads, malicious browser notifications, and commands that victims are tricked into run...
A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim's webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the...
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at le...
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four diff...
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The h...
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and...
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly le...
Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. Microsoft unveiled Windows Server 2022 in March 2021 and made it generally available in September 2021 as ...
Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. The joint acti...
Days after a cyberattack targeting French supermarket refrigerators, thousands of controllers across the globe are visible online and at risk of compromise. Hundreds of grocery stores in France were targeted in a sophisticated attack, in which hacke...
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know. Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments. Organizations are fa...
The cyberattack that disrupted refrigeration at hundreds of French supermarkets this week also affected equipment from Copeland and its Dixell brand, according to France's national cybersecurity agency ANSSI. ANSSI's CERT-FR first warned on October ...
The UK's Legal Aid Agency (LAA) has discovered that records dating back to 1978 were compromised in an April 2025 data breach. In May last year, the UK Ministry of Justice agency said hackers had accessed and exfiltrated the personal information of ...
The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from...
At school James Robinson was more sporty than STEM, but after school he rose from the track to cybersecurity leader at Netskope. ### The journey to becoming a CISO The young James Robinson attended a small high school in Central Illinois and descri...
CenterPoint Energy has notified Texan authorities that the personal information of over 1 million individuals was compromised in a data breach. The notice came one month after the Houston-based public utility told the SEC that customer information h...
A novel RAT uses trojanized replacements of legitimate banking apps to neutralize security controls from inside itself. Hirudo is a remote access banking trojan for Android that combines elements of a traditional banking trojan and a full-featured R...
Darktrace has uncovered a new malware campaign distributing a Rust-based RAT that relies on Discord for command-and-control (C&C). Dubbed CikaBika Bot, the malware has been distributed via document-themed lures, likely as part of phishing attacks, a...
Palo Alto Networks on Wednesday informed customers that it has released patches for a PAN-OS zero-day vulnerability exploited in malicious attacks. The high-severity flaw is tracked as CVE-2026-0322 and it allows remote code execution. It affects th...
The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: - CVE-2026-0322, a high-severity remote code execution (RCE) vulnerability in the management inte...
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the man...
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromi...
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February...
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and C...
Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. As Microsoft explained when it acknowledged the issue last month, affected u...
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. The agency employs around...
On Thursday, researchers from The Citizen Lab at the University of Toronto revealed a worst-case scenario found in the wild: spyware silently infecting targets as they browse past ads in their daily digital lives. Dubbing the attacks "AdFection," th...
GuardOS is an iPhone application that combines device security checks, VPN access, Safari content filtering, QR link scanning, and storage cleanup. It is available through the App Store. ### Getting started The home dashboard organizes tools into i...
83.4% of respondents who use DevOps practices run CI/CD pipelines, making them the most widely adopted practice in that group, according to JetBrains' The State of CI/CD in 2026 report. Adoption exceeds that of containerisation and orchestration, inf...
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. The vulnerability affects the PAN-OS management interface and lets authentica...
A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide. A Chinese-language phishing ecosystem is behind the deployment of more than a billion emails and SMS...
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on. Even when technology vendors discover vulnerabilities before threat...
Industrial giants Siemens, Schneider Electric, and Rockwell Automation have published ICS security advisories this Patch Tuesday. Siemens published 17 new advisories this Patch Tuesday. The company has released patches for some of the vulnerabilitie...
Earlier this week, a mass hack of refrigeration systems at an estimated 700 supermarkets throughout France caused them to suddenly malfunction, causing spoilage of untold tons of perishables and, in some cases, fires. As is now the norm, basic cybers...
Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell ...
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka...
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to halt wallet sales and remove products from shelves while it investigates hardware implant incidents. The company announced the decision in response to discovering that de...
Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment th...
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. Tracked as CVE-2026-76519, this vulnerability stems from a relative path t...
Dive Brief: - The websites and apps for Ahold Delhaize's five U.S. banners remain unavailable Wednesday morning, marking at least the third day the digital platforms have been offline. A handful of Ahold Delhaize's dozen international banners — ...
A suspected criminal hacker is targeting Ivanti Connect Secure customers through a complex exploit chain that combines three high-severity vulnerabilities, according to a report Tuesday by Volexity, a Virginia-based cybersecurity firm. The chain com...
Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake. The call comes in at 4:40 on a Fr...
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 i...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an acti...
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking ...
Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America. The AI-enabled operation used spoofed emails, fake gover...
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. The Always On VPN remote access solution replaced the legacy DirectAccess technology and works with dom...
Microsoft and the health care industry's information sharing and analysis center have teamed up to disrupt a prolific China-based phishing ecosystem. The tech giant and Health-ISAC on Wednesday announced a cooperative effort to dismantle three Chine...
Organizations are reporting that employees face threats of stalking, physical violence, and abduction. But these alarming claims are hard to verify. Ransomware actors have been threatening their victims with physical violence, according to new surve...
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. Researchers identified malicious copies of eight banking apps that use a hooking engine to ...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. Tracked as CVE-2026-104935, this high-severity a...
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. Since the start of the year, more t...
Microsoft and Health-ISAC have seized and redirected domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure. The action was...
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that ar...
Google and Mozilla on Tuesday announced fresh Chrome and Firefox updates that resolve 114 vulnerabilities. The Chrome update was rolled out with fixes for 37 security defects, including seven critical-severity memory issues: a buffer overflow in ANG...
SecurtyWeek's 2026 Zero Trust Strategies Summit kicks off today at 11AM ET as a fully immersive virtual conference and expo. This summit is laser-focused on the next generation of Zero Trust and Identity security, moving beyond theory to deliver act...
Linux has forever been considered above Windows when it comes to security. Part of the reason for that, and what people usually assume, is that Linux doesn't have a meaningful market share for attackers to target with sophisticated malware or attacks...
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal...
The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks. North Korean state-sponsord hackers are spear-phishing government, policy, and academic circ...
The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs. As we progress further into the AI-driven "vulnpocalypse era," Microsoft's October 2026 Patch Tuesday security update blows past last month'...
Google announced Tuesday that it's raising bug bounty rewards for some Chrome vulnerabilities, focusing on memory safety issues. AI has been changing the pace and profile of vulnerability discovery, and the tech giant has been adjusting its bug boun...
Meta is notifying roughly 1,500 people, most of them employees in the US, that their personal information was impacted after hackers got into some of the company's GitHub repositories. The intrusion was detected a few weeks ago. According to the tec...
Ivanti on Tuesday warned customers that a zero-day vulnerability in its Connect Secure (ICS) VPN appliances has been exploited in the wild. Tracked as CVE-2026-104935 and rated high severity, the issue is an authentication bypass that lets a remote,...
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. The flaw was discovered on August 23 by researchers at Defiant'...
Adobe has published 10 new security advisories to inform customers about roughly 140 vulnerabilities found and patched in its products. Adobe ColdFusion updates address 32 vulnerabilities, including critical bugs that can be exploited for code execu...
Months before hackers targeted refrigeration equipment across hundreds of grocery stores in France, a U.S.-based cybersecurity firm discovered high-severity flaws in internet-exposed equipment that could make such an attack possible. Hackers reporte...
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (...
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw...
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected v...
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal th...
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. This Patch Tuesday addresses 70 "Critical" vulnera...
Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. Today's updates are mandatory as they contain the Oct...
Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. If you are running Windows 10 Enterprise LTSC or are enrolled in the ...
Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. However, according to Microsoft's lifecycle policy, Wi...
The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. Established under the Housing Act 1996, the Housing Ombudsman is an executive non-departmental public body sp...
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and score...
Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through the controller tha...
Dutch-Belgian grocery giant Ahold Delhaize has disconnected some of its systems in response to a cyberattack. In a bare-bones notice on its website, the company revealed that it identified a security issue within its network, triggering incident res...
A hardware implant in Ledger signers is blamed for the theft of at least $86 million in cryptocurrency from multiple users. Ledger provides users with a secure cryptocurrency wallet that is backed by a signer, an offline hardware device used to secu...
The XWorm RAT developers have expanded the malware's capabilities with fresh plugins that turn it into a surveillance platform, cybersecurity firm Netskope reports. A sophisticated, multi-functional Windows RAT first observed in 2022, XWorm provides...
In the AI era, phishing remains the top attack vector in both use (17% of breaches) and breach costs (averaging at $5.29 per breach) according to the IBM Cost of a Data Breach Report 2026. AI creates more personalized content for phishing with higher...
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue that, under certain conditions,...
GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab servers. ### About CVE-2026-97229 CVE...
The Cybersecurity and Infrastructure Security Agency on Friday urged organizations to patch their Citrix systems after the company announced another critical vulnerability in NetScaler ADC and NetScaler Gateway. Citrix on Thursday warned of a memory...
Ahold Delhaize announced Monday it is experiencing a security issue within its network and has taken some systems offline "to help protect them." Ahold Delhaize USA's five banner websites — Hannaford, Stop & Shop, Giant Food, Food Lion and The G...
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of t...
Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money. US authorities last week charged a ransomware negotiator over alleged extortion activity — the latest exam...
Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position. SonicWall customers are on the defensive once again, as threat actors are actively exploiting a max...
Norway's Data Protection Authority (Datatilsynet) has fined Xandr, a Microsoft-owned advertising company, $9.6M (NOK 92 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. The data protection autho...
Fahmida Y Rashid will keep the momentum going as she leads Dark Reading. Dark Reading has been a cornerstone of cybersecurity journalism for 20 years, emphasizing deep technical coverage and insights for security professionals charged with defending...
Enterprise cybersecurity technology research that connects the dots. The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink. ### OPINION Enterprises need cyber resilience to ensure...
Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller. On Friday, the company said it was investigating reports of loss of funds fro...
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. Victims include Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, ...
Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing fu...
A critical vulnerability in the Bricksforge WordPress plugin is being exploited in the wild, according to WordPress security company Patchstack. The vulnerability is tracked as CVE-2026-85097 and it has a CVSS score of 9.8. Unauthenticated attackers...
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229, this critical security flaw...
Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it was forced to take some systems offline after a "cybersecurity incident." As a wholesale company and multinational retailer, Ahold Delhaize operates ...
Varonis Threat Labs recently discovered AvisLoader, a new Windows loader named after the Latin word for bird. We found it on an exposed staging server alongside a ClickFix lure, supporting tools, and its Command Center. The attack starts with a fami...
European food retailers have been affected by two separate disruptive cyberattacks: In France, several supermarket chains have had their freezers tampered with and chilled/frozen products destroyed, while in the Netherlands and Belgium workers at sto...
GitLab said Monday that it had fixed a vulnerability that could have allowed an attacker to execute remote code on an affected server. The critical-severity flaw, tracked as CVE-2026-97229, resulted from GitLab Community Edition and Enterprise Editi...
US law enforcement agents obtained authorization to use a controversial surveillance device capable of intercepting cell phone signals to find and arrest a 21-year-old college student who helped produce journalist Don Lemon's coverage of an anti-ICE ...
Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. The announcement follows the end of support for Windows 11 23H2 Home and Pro ed...
Canonical's websites were disrupted last week by a distributed denial-of-service (DDoS) attack, months after a larger attack hit the Ubuntu maker's infrastructure. The company confirmed the attack on October 8 in a post on the Ubuntu Discourse forum...
Websites that rely on Let's Encrypt will soon have to renew their TLS certificates more often. Starting February 10, 2027, the certificate authority will issue certificates valid for 64 days by default, down from 90 days. Subscribers who already use...
Microsoft is advising users and businesses to update Windows devices before digital certificates used to verify Windows Update servers expire in May and June 2027. The certificates expire on May 17 or June 19, depending on the Windows version. Devic...
A dual citizen of Ukraine and Russia pleaded guilty in a US court for his role in a sophisticated money laundering organization used by cybercriminals. The individual, Oleg Korniev, 42, was a leader of Your Mule Cashout (YMCO), an international netw...
People who buy low-cost Android phones from online marketplaces may be carrying malware that was placed on the device before it reached them, Bitdefender has found. The campaign, dubbed Midnight Mimosa, runs on budget Android devices from different ...
Medical equipment provider iRhythm is notifying more than 360,000 people that hackers stole their personal information. The data breach was identified on June 8 and involved third-party-hosted business applications that stored certain iRhythm inform...
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauth...
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a ...
A Canada-based cybersecurity expert was arrested last week in the United States on suspicion of being involved in ShinyHunters attacks, including the recent hacking of FBI systems. FBI director Kash Patel announced on Friday that agents had arrested...
Threat actors started exploiting a recently patched critical vulnerability in SonicWall SMA1000 appliances within days after public disclosure. Tracked as CVE-2026-102255 (CVSS score of 10), the security defect is described as a pre-authenticated se...
France, Belgium, and the Netherlands are reportedly affected. An ongoing cyberattack has reportedly struck major supermarket chains across Europe, disrupting refrigeration control systems. The attack — which has reportedly seen units set to cont...
OrcaRouter has released OrcaCyber Zero 1.5, a model for authorized vulnerability research. The model is the successor to OrcaCyber Zero 1.0, which shipped on September 17, 2026. OrcaCyber Zero 1.5 is a post-trained Orca model for vulnerability reprod...
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and cry...
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kit...
The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive da...
Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. The company is the largest karaoke maker in Japan, operat...
Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. Dubrovsky, 54, has ...
Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks. The technique, dubbed "Adception" by security researchers at Push Security, appea...
Criminal IP by AI SPERA, a cyber threat intelligence platform delivering decision-ready intelligence and attack surface visibility to security teams worldwide, will participate in GovWare 2026 in Singapore. As security operations increasingly move b...
### AI Scramble Drives Cybersecurity M&A Boom Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Many of the buyers are not your typical cybersecurity firms. Sur...
The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network. The hackers who breached ASOS this week unearthed a serious security gap around customer-facing marketing and ...
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know. In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected ShinyHunter...
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know. Those closest to executives must match their security postures because the weakest link in a family can become the entry point for attacks. An attacke...
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thous...
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that t...
Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining Shiny...
A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to...
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radar...
A Kansas City, Missouri man has been sentenced to 32 months in jail for crimes related to a ransom attack against his own company. The DOJ has announced the sentencing of Daniel Rhyne. He had already pleaded guilty to 'extortion in relation to a thr...
SecurityWeek's weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories acros...
Google has disclosed that several of its domains were affected by a recent hijack of third-party country-code top-level domains (ccTLDs). The incident occurred last week and targeted the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTL...
The Department of Justice on Thursday announced the court-ordered seizure of hacking tools used by a China-nexus actor against U.S. and other critical infrastructure providers. The tools, dubbed FishHub and Microscan, were used by a company called I...
Hackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns. A centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS ...
U.S. government agencies are failing to prepare for the transition to post-quantum encryption, creating the risk that their sensitive data will still be vulnerable to decryption by quantum computers whenever those machines are deployed, according to ...
Here's an overview of some of last week's most interesting news, articles, interviews and videos: Three questions a hospital CISO should ask a healthcare fintech vendor In this Help Net Security interview, Drew McCombs, CTO and CISO at Cylerity, ex...
Dive Brief: - Hackers may be using AI more frequently and in more ways, but their top priority is still subverting identity controls, the identity-security firm Okta said in a report published on Wednesday. - The report included data about the freq...
Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to Google's case study, "How much does it cost to maintain a ...
An Immigration and Customs Enforcement agent on the scene of a shooting in upper Manhattan on Thursday has repeatedly been accused in federal court of unlawful arrests and using force during arrests in New York and Minneapolis, a WIRED investigation ...
At a promotional event in Times Square on Wednesday for the security company NordVPN, brand ambassador Shaquille O'Neal said he is eager to raise awareness among regular people about the importance of digital security and personal privacy. "I have a...
The first time we were supposed to meet Anas Hattab, he canceled at the last minute: There was no way to make it from his hometown in Tulkarm, in the northern West Bank, south to Ramallah, where we were meeting, and back before it got dark. That trip...
Automated red-teaming agents discover and autonomously patch theoretical API security vectors in LLM gateway infrastructure.
Attackers hijacked three top-level domains and used their control to mint counterfeit TLS certificates for Google and other large organizations, Google said Tuesday. The attackers launched a series of attacks on the .gh, .sl, and .as country code top...
Asos confirms hackers sent 'unauthorised' notification to app users - Published Asos says it is investigating "unauthorised activity" involving third-party platforms it uses after customers received a notification from its app sent by hackers. Dozens...
Mark Zuckerberg’s Meta is under investigation for a potential breach of the UK’s digital safety laws after launching a Snapchat-style feature on Instagram. The communications watchdog, Ofcom, is investigating whether the $1.9tn (£1.4tn) company infri...
ZDNET’s key takeaways - Microsoft is ending support and updates for Office 2021. - You can upgrade to Office 2024 or subscribe to Microsoft 365. - You can also try a different, free online or desktop office suite. Microsoft continues to offer one-tim...
If you clicked on an HBO Max ad on Reddit over the past week, you might want to check your computer for malware. These so-called “ClickFix” attacks have quickly become one of the rising cybersecurity threats of 2026, and they’re getting both sneakier...
For the best part of a decade, abusive deepfake “pornography” websites have published thousands of nonconsensual videos depicting women, including high-profile celebrities, politicians, and public figures, into sexual situations. Now, in what is like...
ZDNET’s key takeaways - The latest Windows update cuts off the sound on certain audio devices. - The glitch affects older USB devices such as speakers and headsets. - To temporarily fix the problem, switch the audio mode to Stereo. Microsoft’s monthl...
Whether you're worried about the open network at your local coffee shop or want to get around geo-restrictions while traveling, NordVPN can help. A virtual private network (VPN) is like a protective tunnel, keeping your data safe from prying eyes. VP...
Blaming a “significant rise” in AI submissions, Google has paused its open source bug bounty program until next year. Last year, TechCrunch reported that cybersecurity experts were warning of that AI slop posed a serious risk to bug bounty programs. ...
A heap-buffer overflow vulnerability in X.509 certificate validation triggers emergency patch deployments across cloud hyperscalers and web servers.
Federal agencies and financial institutions begin the decade-long transition away from RSA to lattice-based ML-KEM and digital signature algorithms.
Targeting cryptocurrency developers, threat actors plant obfuscated infostealer payloads in popular open source developer package registries.
Following the historic global outage, CrowdStrike redesigns sensor telemetry pipelines to run strictly in user mode with canary rollback rings.
Sophisticated espionage campaign gains deep persistence inside Cisco edge routers to compromise lawful surveillance infrastructure.
Avoiding messy recovery decryption keys, threat actors threaten public regulatory exposure under GDPR and SEC disclosure deadlines to compel payment.
Federal civilian agencies must audit end-of-life network gateways and replace outdated management interfaces within 45 days.
Software Bill of Materials (SBOM) telemetry reveals critical infrastructure remains exposed to single-developer abandonware across modern tech stacks.
Independent security researchers inspect Apple's custom server silicon virtual machines, validating stateless ephemerality and non-retention claims.
Hyper-volumetric UDP amplification attack targeting European hosting providers absorbed autonomously across Anycast edge scrubbing centers.
Disclosed by Citizen Lab, the vulnerability allowed targeted surveillance payloads to execute via iMessage attachment without user interaction.
Adversarial multi-agent networks discover novel prompt injection and multi-turn jailbreak pathways, triggering automated safety alignment updates.
Organizations migrating to passwordless hardware tokens eliminate adversary-in-the-middle session cookie interception attacks completely.
Novel OT malware communicates over Modbus protocols to overwrite firmware registers on electrical substation relays, prompting grid alerts.
Strict enforcement of Form 8-K disclosure deadlines forces publicly traded enterprises to disclose major network compromises within 96 hours.
Rogue Autonomous System prefix advertisement allows attackers to intercept TLS handshakes and drain hot wallets before RPKI validation kicked in.
Pentagon and intelligence contracts mandate memory-safe languages for new systems programming, phasing out legacy C and C++ attack vectors.
Cybercriminals spoof popular database base images with hidden background crypto-mining daemons that activate only during low-load periods.
Uncataloged legacy microservices lack token rate-limiting and authentication gates, serving as the primary vector for unauthorized data scrapes.
Security researchers identify an out-of-bounds memory corruption vulnerability in TLS 1.3 session resumption handshakes affecting millions of servers worldwide.
