What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,636 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
Writing Is Closer to Thought Than Code
Charcoal sketch of a stone archery target: a tight purple arrow cluster cracks the outer ring while quill pens surround the bullseye/images/intent-driven-development.webp/images/intent-driven-development.webp I’ve been having this…
-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, …
-
Google will pay people to use less electricity so its data centres can use more
Google has an answer to some of the electricity supply problems that data center construction is causing : It has signed an agreement with energy supplier Voltus in the US to build what it’s calling a 1-gigawatt virtual power plan…
-
Two States Can Now Restrict Social Media Access—Here’s What To Do Next
Last week, two federal appeals courts issued opinions that will allow Florida and Georgia to start enforcing laws that will age-gate and block young people from accessing social media. The laws do not adequately respect minors’ ri…
-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain compromise…
-
FCC bans two devices with surveillance chips linked to Huawei
The banned items — a wireless video transmitter and dashboard camera — are made with chips manufactured by Huawei subsidiary HiSilicon, which markets its products as “designed for the surveillance market.”
-
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]
-
Knicks sent employees fake offer of championship rings in phishing test: Report
Corporate phishing tests are common, but this one was especially cruel.
-
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Citizen Lab’s AdFection findings have senators pushing for industry improvements, while IAB Europe and Google defend their vetting practices. The post Senators say targeted ads are a security risk. Ad groups say the critics are of…
-
Why Caribbean Threats Cascade Into Global Cyber-Risk
The region is demonstrating what happens when exploits accelerate but assurance does not.
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigatio…
-
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet. The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared firs…
-
UK proposes 14-year jail terms for subsea cable saboteurs
Damaging a cable on the seabed off the UK coast could soon cost someone 14 years of their life behind bars, under plans the British government published this week. The proposal comes from a White Paper by the Department for Digita…
-
Microsoft 365 accounts compromised at 79 organizations, no passwords needed
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. …
-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (ak…
-
On the streets of… Vientiane.
On the main street of Vientiane, the capital of Laos, stands this rather confident-looking structure. What s more… it s of a somewhat unusual design for Southeast Asia: It s called Patuxai, and it turns out it s an Arc de Triomphe…
-
Compromised TLS Certificates
The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys : The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. …
-
Writing Is Closer to Thought Than Code
Charcoal sketch of a stone archery target: a tight purple arrow cluster cracks the outer ring while quill pens surround the bullseye/images/intent-driven-development.webp/images/intent-driven-development.webp I’ve been having this…
-
Weekly Cyber Update: 23 October 2026
Some P2PShell incident response best practices; three new supply chain incidents; and the European Commission investigates Booking.com for fraud. The Cyber Threat Intelligence Briefing is a weekly round-up of the latest cybersecur…
-
Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’
In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders. The post Quest Diagnostics Reports Cyber Breach Affecting Certain P…
-
LiteLLM Compromised in Fresh Supply Chain Attack
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek .
-
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
After a three-month lull, Prince of Persia hid a Tornado C C server on US shared hosting, its first US-based server since 2016. The post Iran s Prince of Persia APT Hosts C C in US for First Time Since 2016 appeared first on Secur…
-
Reflecting on Axon’s legacy on what would have been its 40th anniversary
Over 70 former Axon staff, customers and vendor partners gathered in Auckland this week to celebrate what would have been its 40 th anniversary. By the time it was acquired by Integral in 2010, Axon was one of the largest independ…
-
Canadians Are Running Out Of Time To Oppose The Dangerous C-22 Surveillance Bill
Canada’s Parliament is debating a massive expansion of surveillance powers that will threaten the privacy and security of millions of people. Bill C-22, also called the Lawful Access Act, has already passed the House of Commons, a…
-
Railway warns devs to rotate secrets after potential breach
Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]
-
What We Missed: Feds Lasso Texas Laptop Farms
In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in Operation Lonestar Justice to Staples' gift card bonanza.
-
Disgraced eMudhra drops out of TLS business following certificate debacle
Flubbed key signing "ceremony" allowed minting of Web credentials for any site.
-
Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour
Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.
-
Indian tech company eMudhra announces withdrawal from certificate business after security incident
The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.
-
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight…
-
EMudhra Intermediate CA Certificates Compromised
Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit …
-
The Current Landscape of OAuth Attacks
Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42 .
-
Microsoft shares how to fix broken Exchange Online EWS apps
Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]
-
Unboxing Phishing Kits: Huntress Examines 3 Real Kits
Huntress examines 3 phishing kits that hand beginner attackers everything they need to steal tokens. See what the attacks look like from the inside.
-
eMudhra kills its certificate business after researchers cracked its private keys in under a second
The private keys were so weak they could be guessed in under a second — and one of them was just the number 4. The post eMudhra kills its certificate business after researchers cracked its private keys in under a second appeared f…
-
Hacker Conversations: Corey Thuen and the Evil Bit
Corey Thuen hires hackers for what he calls ‘the evil bit’ — an adversarial streak he believes is either there or it isn’t. The post Hacker Conversations: Corey Thuen and the Evil Bit appeared first on SecurityWeek .
-
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies from 21 cou…
-
Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform
The Amsterdam-based company plans to use the funding for research and development and commercial expansion in Europe and the Middle East. The post Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform appeared firs…
-
M365 Token Spray and Replay Campaign Compromises Business Email Accounts
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
-
Why CISOs Watch YouTube Videos To Find Cybersecurity Vendors
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 22, 2026 – Watch the YouTube Video Where and how do chief information security officers (CISOs) find new cybersecurity vendors? Registerin…
-
Salesforce to buy Braze for US$5.7 billion to boost real-time customer engagement
Salesforce is set to acquire US-headquartered customer engagement software provider, Braze, for US$5.66 billion in an effort to help enterprises personalise customer interactions in real time. Founded in 2011 as Appboy and renamed…
-
South Carolina officials offer assistance after state capital hit with cyberattack
The systems impacted by the attack include the MyColaSC platform that citizens use to pay utility bills, report non-emergency issues and access other city services.
-
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party…
-
Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks
A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell s order domain, passes DKIM and DMARC checks, uses Dell s real template, and confirms a $736.09 purchase of Microsoft Project Standar…
-
Encryption isn’t enough to protect data wherever it goes
Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers. The post Encryption isn’t enough to protect data wh…
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says c…
-
Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question
In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why organizations underestimate speed, the time it takes t…
-
Introducing Our New Surveillance Self-Defense Guide: Online Privacy for Parents and Youth
The internet is a vast and confusing place no matter your age. Trying to help youth engage with it safely and privately is a complicated topic that touches on many different skillsets and ideas. But just because it’s complicated d…
-
Interoperability vs. Security: Why not both?
An open internet where people can freely build, share, and remix each other's work is a powerful engine of grassroots innovation we’ve all benefited from. In recent decades, however, corporations have taken control of an increasin…
-
Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of S…
Last fetch · 0 new