What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,641 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 3d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 3d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 3d ago
-
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relay…
-
Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
One of the bill’s sponsors told CyberScoop it’s “incredibly expensive” for U.S. AI companies to stay ahead and distillation attacks incentivize stealing over innovation. The post Exclusive: bipartisan bill would develop federal gu…
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
-
EMudhra Intermediate CA Certificates Compromised
Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit …
-
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, Z…
-
The Current Landscape of OAuth Attacks
Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42 .
-
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around t…
-
Navigating Critical PHP Vulnerabilities: Why Real-Time Cybersecurity Program Management Matters
The National Security Agency (NSA) and global cyber authorities recently issued critical advisories regarding major PHP vulnerabilities. Learn more about how to rapidly address this and ways Onyxia can help.
-
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. …
-
I understand that there are people who think we must pass through the Vulnpocalypse to get to Vulnhallah, a ti…
I understand that there are people who think we must pass through the Vulnpocalypse to get to Vulnhallah, a time when all code is written by AI then checked by AI and has no vulns that AI can find, while we sit back and feast. But…
-
Microsoft shares how to fix broken Exchange Online EWS apps
Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]
-
Quoting Armin Ronacher
As fun as AI is, we built so much bad software over the last 30 years, and now the universe is punishing us for our sins. Armin Ronacher Tags: security , generative-ai , armin-ronacher , ai , ai-security-research , llms
-
Hackers got a four-day head start on epic PHP2Shell vulnerability
Hackers were already probing the bug before defenders were told it existed.
-
China-nexus actor linked to attack on ConnectWise Cloud Backup
Researchers said the hackers employed a powerful AI tool to accelerate and scale the attacks against hundreds of Microsoft 365 users.
-
Unboxing Phishing Kits: Huntress Examines 3 Real Kits
Huntress examines 3 phishing kits that hand beginner attackers everything they need to steal tokens. See what the attacks look like from the inside.
-
eMudhra kills its certificate business after researchers cracked its private keys in under a second
The private keys were so weak they could be guessed in under a second — and one of them was just the number 4. The post eMudhra kills its certificate business after researchers cracked its private keys in under a second appeared f…
-
Agentic AI helps hackers level up, even without detailed instructions
Low-skilled hackers are likely to become a lot more dangerous over the next 12 months, CrowdStrike warned.
-
Hacker Conversations: Corey Thuen and the Evil Bit
Corey Thuen hires hackers for what he calls ‘the evil bit’ — an adversarial streak he believes is either there or it isn’t. The post Hacker Conversations: Corey Thuen and the Evil Bit appeared first on SecurityWeek .
-
As AI Risks Grow, Insurers Split on Covering the Damage
Insurers are split on AI risk: some build specialized agentic AI coverage, while major carriers quietly exclude it — leaving enterprises exposed without their knowledge.
-
Machine speed attacks require machine speed detection and response
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, e…
-
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies from 21 cou…
-
Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized
More than 1,400 suspected cybercriminals were arrested across Africa this summer as part of a crackdown on the gangs perpetrating online fraud, ransomware and business email compromise attacks, Interpol said.
-
New Serious PHP Vulnerabilities Released and Patched
PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to upda…
-
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. “LiteLLM got compromised……
-
Amazon says PHP2Shell exploitation began 4 days before patches
Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]
-
Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform
The Amsterdam-based company plans to use the funding for research and development and commercial expansion in Europe and the Middle East. The post Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform appeared firs…
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
-
Why CISOs Watch YouTube Videos To Find Cybersecurity Vendors
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 22, 2026 – Watch the YouTube Video Where and how do chief information security officers (CISOs) find new cybersecurity vendors? Registerin…
-
OpenAI’s coding agents talked themselves out of being monitored
Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it had done no such thing. OpenAI disclosed both episodes in a misalignment repor…
-
Join me at 1100 ET today to discuss the current vulnerabilities in PHP, Node.js, GitLab, and the eMudhra certi…
Join me at 1100 ET today to discuss the current vulnerabilities in PHP, Node.js, GitLab, and the eMudhra certificate signing key debacle. We'll provide actionable advice and cut through the noise in our hour together. https://www.…
-
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Affecting the open source calling library RingRTC, the bug prevented calls from ending properly. The post Signal Vulnerability Lets Malicious Callers Block Hang-Ups appeared first on SecurityWeek .
-
Salesforce to buy Braze for US$5.7 billion to boost real-time customer engagement
Salesforce is set to acquire US-headquartered customer engagement software provider, Braze, for US$5.66 billion in an effort to help enterprises personalise customer interactions in real time. Founded in 2011 as Appboy and renamed…
-
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching. The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on …
-
South Carolina officials offer assistance after state capital hit with cyberattack
The systems impacted by the attack include the MyColaSC platform that citizens use to pay utility bills, report non-emergency issues and access other city services.
-
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an att…
-
Fingerprint uses AI coding tools to automate fraud detection setup
Fingerprint has announced Agentic Installation, the AI-powered onboarding path for companies to deploy device intelligence to their websites or apps in minutes to detect and stop fraud. By running a single prompt in an AI coding t…
-
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. No…
-
GitLab warns of new max severity code execution vulnerability
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...]
-
XTIUM expands XTAI with centralized AI governance and cost management
XTIUM has released the latest version of XTAI (XTIUM Trusted AI), expanding its AI Service Platform with XTAI Orchestrator. The new governance platform brings together managed AI services, AI-powered voice, custom XTAI Agents, man…
-
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.
-
SentinelOne brings runtime threat detection and response to AI agents
SentinelOne has unveiled Singularity Agentic Detection and Response (ADR), a new offering that discovers AI agents, enforces what agents are allowed to do, monitors agent behavior in depth, and detects and stops unintended and mal…
-
Broadcom adds real-time scam detection to 3-D Secure authentication
Broadcom has announced the launch of Arcot Scam Defense, a new feature of Arcot by Broadcom, designed to block social engineering fraud during card-not-present (CNP) transactions. “Financial institutions are experiencing broad inc…
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party…
-
Claude Security can now spot vulnerabilities that reappear in code
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. The service scans codebases for vulnerabilities and suggests patches f…
-
Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks
A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell s order domain, passes DKIM and DMARC checks, uses Dell s real template, and confirms a $736.09 purchase of Microsoft Project Standar…
-
Splunk, SolarWinds Release Fresh Security Updates
Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information. The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek .
-
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add o…
-
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fi…
-
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks. The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek .
-
Encryption isn’t enough to protect data wherever it goes
Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers. The post Encryption isn’t enough to protect data wh…
Last fetch · 0 new