What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,643 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 3d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 3d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 3d ago
-
Cisco Patches 34 Vulnerabilities Across Multiple Products
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks. The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek .
-
Encryption isn’t enough to protect data wherever it goes
Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers. The post Encryption isn’t enough to protect data wh…
-
PHP2Shell Exploitation Started Days Before Patches
Initial attempts were observed on October 17, and mass activity began shortly after patches were released. The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek .
-
Anthropic finds 94 cases where open-source projects drop security controls without warning
Software can expose complex functionality to unauthenticated users even when that functionality is disabled or unnecessary. Anthropic’s Frontier Red Team used Claude to examine 25 open-source projects and reported 493 issues invol…
-
Signal flaw could expose audio and video even after users hang up
A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up. Tracked as CVE-2026-113380, the vulnerability affects RingRTC versions before 2.7…
-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM'…
-
Authorities disrupt nearly 11,000 cybercrime networks in Africa
Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. [...]
-
Africa cybercrime crackdown nets 1,462 arrests and over $105 million
Police in 21 countries arrested 1,462 suspects and took down 10,909 malicious networks in Operation Serengeti III, an INTERPOL-coordinated cybercrime sweep across Africa that ran from June 29 to August 31, 2026. Investigators reco…
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says c…
-
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches. The post Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU appeared first on SecurityWeek .
-
AI-found bugs are expected to rise, and OpenAI has a five-stage response plan
OpenAI has proposed a five-stage process for handling critical vulnerabilities in widely used software. The process grew out of a two-month response to flaws in PHP, the open-source language that runs websites and web applications…
-
Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook
The $25 billion award far exceeds a $5 billion fine the Federal Trade Commission levied against Facebook in 2019. The post Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook appeared first on …
-
Delinea gives AI assistants read-only access to governance data
Delinea has announced Delinea Fastpath MCP Server, a new capability that connects access governance data to the AI assistants teams already use. Using the Model Context Protocol (MCP), finance, IT, audit, and compliance teams can …
-
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that e…
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitati…
-
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
-
Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question
In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why organizations underestimate speed, the time it takes t…
-
AI agent permissions are outrunning security
Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make decisions and take actions that would have required human app…
-
Say a few words, and a rigged AI asks for $5,000
Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person spoke, the models produced output the attacker had pick…
-
UAE Transitions 50% of Gov't Services to Agentic AI
The United Arab Emirates says it's creating a foundation of security and safety as it transforms its public service footprint.
-
AI coding boom exposes cracks in cloud development
Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they produce, according to LocalStack’s 2026 State of AI in Cloud Development report. More code adds …
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based …
-
AI agent observability is struggling to keep up with hallucinations
Sixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than half have no way to measure whether the agents get it right. Splunk surveyed 2,050 of them a…
-
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet.
-
OpenAI’s models are deliberately breaking their misalignment monitoring systems
AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed. On Tuesday, it reported two incidents, both involving the agent disabling or interfering with its alignmen…
-
NCSC issues alert over two critical PHP flaws
The National Cyber Security Centre (NCSC) has issued an alert about two critical vulnerabilities in the PHP scripting language, which is commonly used on websites and in web applications, saying it is aware of reports of active ex…
-
Two critical PHP flaws put the web on alert as emergency patches arrive
Organisations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow att…
-
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on... what could possibly be hiding inside? We break out a Geiger counter and a cat to find out. Meanwhile, malicious ads are targeting …
-
Introducing Our New Surveillance Self-Defense Guide: Online Privacy for Parents and Youth
The internet is a vast and confusing place no matter your age. Trying to help youth engage with it safely and privately is a complicated topic that touches on many different skillsets and ideas. But just because it’s complicated d…
-
Local tech leaders willing to ‘lean into’ change as AI dominates discourse, says Ingram’s De Suza
Technology industry leaders gathered at Ingram Micro’s Executive Connect event last week displayed optimism and a willingness to lean into change rather than shy away from it, while AI remained a major topic of discussion. This is…
-
Interoperability vs. Security: Why not both?
An open internet where people can freely build, share, and remix each other's work is a powerful engine of grassroots innovation we’ve all benefited from. In recent decades, however, corporations have taken control of an increasin…
-
Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of S…
-
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. [...]
-
EFF to Brazil’s ANPD: Data Privacy and Free Expression Must Underpin Platform Regulations
The Brazilian National Data Protection Agency (ANPD) plays a pivotal role in the regulation of digital platforms according to new legislation approved in Brazil. Throughout this year, EFF has presented comments, filed submissions,…
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said. The post Microsoft pins ConnectWise supply-chai…
-
Cohesity appoints Matthew Johnston as APJ senior partner sales director
Security vendor Cohesity has appointed Matthew Johnston as senior director of partner sales for Asia Pacific and Japan (APJ) to lead its partner and channel go-to-market strategy across the region. According to Cohesity, Johnston’…
-
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers. [...]
-
How bounties can help nab cyber criminals
A novel approach to tackling the ransomware groups behind some prominent cyber attacks, including against New Zealand organisations, is underway. Crime Stoppers International has launched a global programme in partnership with For…
-
TiDB Breach Exposes Flawed Cloud Security Assumptions
Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.
-
Compromised eMudhra intermediate certificates
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
-
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]
-
Meta on the spot for $25 billion under New Mexico privacy ruling
The Cambridge Analytica data privacy scandal from a decade ago is still weighing on Meta's finances.
-
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.
-
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.
-
Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity
Up to 500 under-resourced utilities will receive support in order to bolster their cybersecurity through a private sector initiative launched this week.
-
'PHP2Shell' Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for …
-
Today's PHP Security Release, and How We're Strengthening PHP Security
Today s PHP Security Release, and How We re Strengthening PHP Security If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there …
-
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...]
-
Democrat lawmakers say Russia is aiming to undermine party ahead of midterms
The pair stressed the latest update showed no country is pursuing the technically challenging effort to interfere with or hack into the country’s election infrastructure or tamper directly with votes.
Last fetch 17m ago · 1 new · 1 source error(s)