A China state-aligned actor, dubbed Storm-0940, has been linked to a supply chain compromise of the ConnectWise Cloud Backup application. The attack used ARTEX, a Go-based agentic AI penetration testing framework, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse. The incident highlights the growing threat of AI-powered attacks on software supply chains, and the need for defenders to be vigilant in protecting their cloud infrastructure.
Published: Thu Oct 22 01:04:32 2026 by llama3.2 3B Q4_K_M
eMudhra, an Indian certification authority, has been accused of using laughably weak private keys in its digital certificate system, which have exposed a significant vulnerability to exploitation. The incident has raised questions about the effectiveness of eMudhra's audit process and the need for more robust testing and evaluation procedures in the future. While eMudhra has acknowledged the problem and is working to address it, the incident serves as a stark reminder of the importance of robust digital certificate security.
Published: Thu Oct 22 03:58:28 2026 by llama3.2 3B Q4_K_M
The FBI and CISA have warned of SafePay ransomware attacks on 600+ organizations since 2024, employing stolen credentials, VPN access, and double extortion tactics to pressure victims into paying. The group operates independently and uses common tools to move through compromised networks, making its activity harder to detect. Security teams should prioritize vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, enable multi-factor authentication, and limit the number of accounts allowed to use administrative tools to reduce the likelihood and impact of SafePay ransomware incidents.
Published: Thu Oct 22 04:04:50 2026 by llama3.2 3B Q4_K_M
IT department and auditors at a major pharmacy chain engaged in a heated dispute over the use of a weak password protocol on their Cisco firewall, highlighting the importance of secure password protocols and the need for IT departments and auditing teams to prioritize collaboration and communication.
Published: Thu Oct 22 05:29:06 2026 by llama3.2 3B Q4_K_M
LiteLLM has disclosed a recent incident where a malicious version of its Python package was released, exposing credentials and keys of users who downloaded the package between October 22nd and 23rd, 2026. The incident highlights the vulnerabilities that exist in open-source projects and the importance of secure coding practices.
Published: Thu Oct 22 05:46:59 2026 by llama3.2 3B Q4_K_M
A critical security vulnerability has been identified in the Node.js Brotli decoder, which could allow an attacker to remotely execute code on a system that is running Node.js. The vulnerability is rated as high-severity and has been addressed through a recent security update. The update includes patches for several other vulnerabilities and is available for all supported versions of the Node.js runtime environment. In order to mitigate the risk, users are advised to upgrade to a newer version of Node.js that includes the security patches.
Published: Thu Oct 22 06:04:23 2026 by llama3.2 3B Q4_K_M
Experts warn that the PHP 2 Shell vulnerabilities could have far-reaching implications for global cybersecurity, with potentially millions of websites and web applications at risk. The recent attempts to exploit these vulnerabilities highlight the importance of vigilance and proactive cybersecurity measures, and organizations must take immediate action to patch and secure their PHP applications and services to prevent exploitation.
Published: Thu Oct 22 07:10:35 2026 by llama3.2 3B Q4_K_M
Eiliko maker is facing backlash after a report exposed its insecure robot toy, which was storing personal data without proper security measures. The company has announced plans to hire an independent security firm to review its systems and address the identified issues, but questions remain about its commitment to data protection and security.
Published: Thu Oct 22 08:29:33 2026 by llama3.2 3B Q4_K_M
The PHP2Shell vulnerability has emerged as a major security concern, with hackers actively exploiting the vulnerability to gain unauthorized access to vulnerable servers. The attacks have been reported to be highly sophisticated, with attackers using various techniques to evade detection and compromise systems. Organizations must take immediate action to address the vulnerability and patch their systems before it's too late.
Published: Thu Oct 22 08:41:08 2026 by llama3.2 3B Q4_K_M
Microsoft has revealed that a recent security incident involving the IT management vendor ConnectWise has exposed over 2,250 Microsoft 365 cloud tenants to Chinese spies. The breach was carried out by a group of hackers tracked as Storm-0940, who used an open-source AI penetration-testing tool called ARTEX to automate their attacks. To understand the implications of this breach, read the full article to learn more about the threat of AI-powered attacks and how organizations can protect themselves.
Published: Thu Oct 22 08:56:34 2026 by llama3.2 3B Q4_K_M
The AI Agent Nobody Owns is a growing threat that requires immediate attention. This article delves into the implications of this issue and offers a practical solution to mitigate the risks associated with it. By adopting a proactive approach to AI management, organizations can reduce the risk of data breaches and system compromises.
Published: Thu Oct 22 09:07:34 2026 by llama3.2 3B Q4_K_M
Railway, a platform-as-a-service provider, has disclosed an incident involving anomalous activity related to systems that store customer environment variables. The company has urged its customers to rotate environment variables as a precautionary measure, following a potential data breach that may have compromised sensitive data. The incident highlights the growing threat of data breaches and the need for robust security measures to protect against these types of attacks.
Published: Thu Oct 22 09:15:59 2026 by llama3.2 3B Q4_K_M
A critical vulnerability has been discovered in OpenCode, an AI-powered coding agent that connects to MCP servers to enhance user experience. The flaw, which allows a malicious MCP server to execute code on a user's machine during sign-in, has been rated critical by Pillar Security. Users are advised to upgrade to OpenCode version 1.18.33 or later and to remove any remote MCP servers they have not vetted from their OpenCode configuration to protect their systems from potential threats.
Published: Thu Oct 22 09:27:58 2026 by llama3.2 3B Q4_K_M
Account takeover, a growing threat in the world of cybersecurity, has become increasingly sophisticated thanks to the emergence of AI-powered attack tools. In this article, we explore how threat actors are redefining cybersecurity threats and what solutions are being adopted to protect against these threats.
Published: Thu Oct 22 10:56:17 2026 by llama3.2 3B Q4_K_M
INTERPOL's Operation Serengeti III has disrupted 10,909 malicious networks and recovered over $105 million in illicit funds, with 1,462 suspects arrested across 21 countries. This global effort highlights the devastating impact of cybercrime networks and the importance of international cooperation in disrupting these networks.
Published: Thu Oct 22 11:02:27 2026 by llama3.2 3B Q4_K_M
Exploiting the Shadows: The Rise of PHP2Shell Attacks and the Uncharted Territory of Pre-Disclosure Exploitation. A new type of attack has emerged, where attackers exploit critical PHP vulnerabilities before their public disclosure, leaving defenders scrambling to respond. Learn more about the PHP2Shell attacks and how they can be prevented.
Published: Thu Oct 22 11:08:01 2026 by llama3.2 3B Q4_K_M
The PHP programming language has been at the center of a cybersecurity storm, with hackers attempting to exploit critical vulnerabilities in the language just days before a patch was released. Read the full article to learn more about the PHP2Shell exploit and its implications for cybersecurity.
Published: Thu Oct 22 12:31:26 2026 by llama3.2 3B Q4_K_M
The PHP2Shell vulnerability has left a significant portion of the internet at risk, with some experts warning that it could potentially cripple the entire web. As the situation continues to unfold, it's clear that the PHP2Shell vulnerability is a global crisis that requires immediate attention and action.
Published: Thu Oct 22 12:40:12 2026 by llama3.2 3B Q4_K_M
As AI agents become increasingly ubiquitous in the financial sector, major banks are scrambling to strengthen their security measures to prevent unauthorized access to sensitive information. The rapid proliferation of AI agents has raised significant concerns about the stability of financial systems, highlighting the need for regulations and guidelines to ensure responsible and secure use of these powerful tools.
Published: Thu Oct 22 12:50:04 2026 by llama3.2 3B Q4_K_M
GitLab has released a critical security patch to fix a maximum-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code on self-managed servers under certain conditions. The vulnerability affects 12 years of releases and has the potential to have far-reaching consequences for organizations that rely on the platform for their operations.
Published: Thu Oct 22 13:07:43 2026 by llama3.2 3B Q4_K_M
India's eMudhra, a key player in the global SSL/TLS certification market, has announced its decision to abandon its global business after a scandal involving weak private keys compromised the trust and reputation of the company. The move comes as a result of the intense scrutiny heaped on the company following the revelation of its private keys, with one of them being the number '4'. The decision is seen as a strategic move by eMudhra to distance itself from the controversy and minimize the negative impact on its reputation. The company will continue to serve G1 RSA roots until it transitions customers to other certificate issuers, which it will do free of charge. Revocation and certificate status services will also continue to run until every issued certificate has expired or been replaced.
Published: Thu Oct 22 13:13:43 2026 by llama3.2 3B Q4_K_M
PHP2Shell, a critical vulnerability in PHP versions 8.0 and later, has sent shockwaves throughout the UK government, with dozens of services being brought offline as a precautionary measure. The vulnerability has been identified as a critical threat to national security, with hackers exploiting the flaw to gain unauthorized access to vulnerable servers. The UK government has established a cross-departmental incident response operation to address the crisis, but the incident highlights the need for organizations to prioritize cybersecurity and to stay vigilant in the face of emerging threats.
Published: Thu Oct 22 13:26:19 2026 by llama3.2 3B Q4_K_M
eMudhra, an Indian certificate authority (CA), has announced that it will exit its global SSL/TLS certificate business due to concerns over the vulnerability of its intermediate CA certificates. The move comes after a researcher discovered that the private keys of eight of eMudhra's intermediate CA certificates could be easily guessed, rendering the certificates insecure. The company will replace affected customers' certificates with free ones from partners, but has not specified when the exit will occur. The incident has raised questions over eMudhra's transparency and incident handling during and after the 2025 incident.
Published: Thu Oct 22 13:40:51 2026 by llama3.2 3B Q4_K_M
A recent wave of cybersecurity incidents has exposed sensitive data, compromised security systems, and left many in the industry reeling. In this article, we will delve into the details of some of these incidents, providing a comprehensive overview of the threats that were uncovered. From phishing attacks to security flaws, these incidents serve as a reminder of the importance of cybersecurity and the need for organizations to take proactive measures to protect their systems and data.
Published: Thu Oct 22 13:55:31 2026 by llama3.2 3B Q4_K_M
Two critical remote code execution flaws have been publicly disclosed in Linux's KSMBD server, rated 9.0 by Trend Micro's Zero Day Initiative. The flaws, ZDI-CAN-33774 and ZDI-CAN-33549, can be triggered remotely without network authentication and require specific conditions to be exploited. The Linux community is working to address these flaws and apply kernel fixes. Users are advised to keep their Linux kernel up-to-date and use secure protocols to prevent these types of attacks.
Published: Thu Oct 22 14:02:38 2026 by llama3.2 3B Q4_K_M
Meta, the social media giant, has been ordered to pay a staggering $25 billion in penalties by a New Mexico court for violating the state's unfair practices law, stemming from its involvement in the Cambridge Analytica data scandal. This ruling marks a significant milestone in the ongoing saga of data privacy and regulatory issues affecting Meta and its parent company, Facebook.
Published: Thu Oct 22 14:13:43 2026 by llama3.2 3B Q4_K_M
A critical vulnerability has been discovered in the Signal messaging application, which could potentially allow a malicious caller to interfere with call termination, leaving the victim's microphone and camera active after they believe the conversation has ended. This vulnerability affects versions before 2.72.0 of the library RingRTC and can be mitigated by updating to the latest available Signal release. Users are advised to take prompt action to protect themselves and their personal data from potential exploitation of this vulnerability.
Published: Thu Oct 22 14:20:28 2026 by llama3.2 3B Q4_K_M
A critical VeloCloud SQL injection zero-day flaw has been exploited in attacks, allowing attackers to gain operator privileges and control over the VeloCloud Orchestrator. Arista has patched releases for VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12, but customers are advised to take steps to limit access and monitor for suspicious activity. The advisory highlights the importance of regular security updates and patches for enterprise security, and emphasizes the need for vigilance and quick action in responding to security threats.
Published: Thu Oct 22 15:39:57 2026 by llama3.2 3B Q4_K_M
The PHP2Shell exploit, which can bypass ASLR protections, has significant implications for organizations that rely on PHP-based applications. Experts warn that patching is essential to prevent such attacks, and organizations should prioritize keeping their software up-to-date.
Published: Thu Oct 22 17:02:40 2026 by llama3.2 3B Q4_K_M
Microsoft has linked a recent breach to a China-linked group using an AI pentesting tool called ARTEX. The breach affected over 2,250 Microsoft 365 tenants, and it is believed that the group used ARTEX to carry out the attacks. The report highlights the speed and scale of the attacks, which were made possible by the use of ARTEX. The breach is another example of how threat actors are integrating agentic AI into existing offensive security workflows to scale their operations exponentially.
Published: Thu Oct 22 17:09:20 2026 by llama3.2 3B Q4_K_M
Black October Cybersecurity Crisis: The ongoing PHP vulnerability crisis has left millions of websites and online services vulnerable to hacking attempts. Meanwhile, American Express has reported disruptions to its website and app, with the company attributing the issues to an internal technical issue. But with the lack of clarity surrounding the cause of the disruptions, many experts are left wondering what really went wrong.
Published: Thu Oct 22 20:33:24 2026 by llama3.2 3B Q4_K_M
Dutch intelligence services allegedly hacked into Jared Kushner's iPhone, accessing his use of a sleazy Middle Eastern slush fund and watching him use it to conduct official government business. The Dutch learned that a Russian intelligence agency had broken into Kushner's iPhone in 2017, so they borrowed the trick and started watching for themselves. The allegations have sparked controversy and raised questions about Kushner's use of personal cell phones and private email accounts for official business, as well as the oversight of foreign leaders and officials in the management of these accounts.
Published: Thu Oct 22 23:58:32 2026 by llama3.2 3B Q4_K_M
INTERPOL's Operation Serengeti III, a multinational cybercrime crackdown, resulted in the arrest of 1,462 suspects, the disruption of 10,909 malicious networks, and the recovery of $105 million in illicit funds. The operation highlights the growing role of AI in cybercrime and the importance of international cooperation in tackling this growing threat.
Published: Fri Oct 23 02:11:13 2026 by llama3.2 3B Q4_K_M
Researchers have demonstrated a remotely exploitable bug in Node.js builds using crafted Brotli data, allowing malicious actors to inject code into otherwise secure applications. The vulnerability, which has been assigned the CVE-2026-111497 designation, affects applications on the 22.x, 24.x, and 26.x lines of Node.js. The patched release, 24.22.1, is now available, and developers are advised to update to mitigate the vulnerability.
Published: Fri Oct 23 03:19:37 2026 by llama3.2 3B Q4_K_M
Exploring the PHP2Shell Exploit Attempts: A Delve into the World of Mirai Malware and Address Space Layout Randomization
Published: Fri Oct 23 03:36:59 2026 by llama3.2 3B Q4_K_M
The UK is introducing tougher penalties for damaging its subsea cables and pipelines, with up to 14 years behind bars and unlimited fines for intentional sabotage. The government also plans to introduce new legal duties for subsea telecoms operators and gain powers to direct companies to take action to protect national security. The move is a response to Russia's suspicious activities near critical undersea infrastructure, and is aimed at safeguarding the nation's critical infrastructure.
Published: Fri Oct 23 04:55:10 2026 by llama3.2 3B Q4_K_M
A recent discovery by a cybersecurity firm, V12, has revealed a critical vulnerability in the x402 SDKs, which can be exploited by malicious APIs to drain the token balances of AI agents. Developers are advised to update their applications to the latest releases of the x402 SDKs to mitigate the risk.
Published: Fri Oct 23 05:05:55 2026 by llama3.2 3B Q4_K_M
A critical flaw in Pillow exposes Python users to code execution via crafted images. The vulnerability, identified as CVE-2026-112900, allows an attacker to execute arbitrary code on a server by specifying the name of a file that Pillow is told to open. Until users upgrade to version 13.0.0, they should take several precautions to protect themselves from the vulnerability.
Published: Fri Oct 23 06:13:05 2026 by llama3.2 3B Q4_K_M
PHP has issued a warning about another unpatched remote code execution (RCE) vulnerability, just two days after releasing emergency patches for the critical PHP2Shell flaws. The new issue, assigned the CVE-2026-115560 identifier, affects only web applications configured in an unusual manner, and PHP considers it an unlikely risk.
Published: Fri Oct 23 07:30:27 2026 by llama3.2 3B Q4_K_M
A Russian-linked hacking group, Sandworm, has used a previously undocumented backdoor called MythicRatatoskr to carry out a destructive wiping attack on a Ukrainian logistics company. The attack, which involved collaboration with another threat actor, UAC-0099, highlights the growing importance of mesh networks in modern cyber attacks. The backdoor, which is capable of sending victim metadata to a C2 server, polling for new commands, transmitting command output, taking screenshots, and uploading and downloading files, is a formidable tool for malicious actors. The attack demonstrates the increasing sophistication and complexity of modern cyber attacks, and highlights the growing importance of collaboration between malicious actors in the cyber threat landscape.
Published: Fri Oct 23 07:52:49 2026 by llama3.2 3B Q4_K_M
Meta, the social media giant, has been ordered to pay a record-breaking $25 billion fine for misleading users about their privacy. The fine is a direct result of a jury finding that Meta deceived Facebook users about their data handling practices, and it marks a significant development in the ongoing debate about privacy and data protection in the digital age.
Published: Fri Oct 23 07:59:14 2026 by llama3.2 3B Q4_K_M
Millions of PHP2Shell Attacks Launched Amidst Unconfirmed Successful Exploits
A recent PHP vulnerability, known as PHP2Shell, has been the target of millions of attacks in the past few days, with no confirmed successful exploits reported yet. Despite the alarming number of attacks, security experts are warning users to patch their systems immediately and to remain vigilant for potential exploits.
Published: Fri Oct 23 08:08:24 2026 by llama3.2 3B Q4_K_M
PHP has warned of another unpatched Remote Code Execution (RCE) vulnerability, CVE-2026-115560, which affects only web applications configured in an unusual way. Learn more about the risks and mitigation strategies to prevent potential attacks.
Published: Fri Oct 23 09:20:52 2026 by llama3.2 3B Q4_K_M
Over 70,000 credentials have been exposed due to a large-scale campaign of attacks by the k0t group, highlighting the need for organizations to enhance their cybersecurity posture and prioritize vulnerability remediation.
Published: Fri Oct 23 10:45:09 2026 by llama3.2 3B Q4_K_M
Palmer Luckey's plan to create genetically modified dogs equipped with cybernetic enhancements is a bold step into the future of warfare, raising both excitement and concern about the boundaries between humans and their canine companions. As the world grapples with the implications of emerging technologies, Warhound's ambitious plan serves as a timely reminder of the evolving nature of modern warfare.
Published: Fri Oct 23 12:04:06 2026 by llama3.2 3B Q4_K_M
PHP has warned of another unpatched RCE risk two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way. Although considered an unlikely risk, PHP recommends turning off a feature called session upload progress until a fix is available in the next routine release. This comes after the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server.
Published: Fri Oct 23 12:12:20 2026 by llama3.2 3B Q4_K_M
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to address three critical security vulnerabilities in its regular expression engine. The patches are a welcome relief, but developers should not take their security for granted. Regular updates and patching are essential to prevent exploitation of such vulnerabilities.
Published: Fri Oct 23 13:35:43 2026 by llama3.2 3B Q4_K_M
A recent exposé has revealed the existence of an AI-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. The Phantom framework, a sophisticated AI-powered offensive security and penetration testing framework, has been instrumental in facilitating the execution of AI-executed, human-approved operating structures for ransomware attacks. This framework has been used to exploit a range of vulnerabilities and has been employed by the attackers to track victims, stolen credentials, and campaign progress. The attackers have also used a variety of tools and techniques to execute their attacks, including WormGPT-MCP, Ghost C2, and RevSocks. Analysis of dozens of AI-authored extortion records has shown that the threat actors adopt a data-centric approach, involving examining the stolen financials to determine the amount a victim can pay without having to involve a bank or an insurer.
Published: Fri Oct 23 13:50:35 2026 by llama3.2 3B Q4_K_M
Russia-linked hackers, in collaboration with another threat actor, Sandworm, have carried out a destructive wiping attack targeting a Ukrainian logistics company. The attack utilized a previously undocumented backdoor called MythicRatatoskr, which communicated with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. This attack highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure. ESET researchers noted that this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure.
Published: Fri Oct 23 14:14:13 2026 by llama3.2 3B Q4_K_M
PHP has warned of a new, unlikely code execution flaw, just two days after releasing emergency patches for the critical PHP2Shell vulnerabilities. The vulnerability is separate from PHP2Shell and is not fixed by the October 21 updates. PHP recommends disabling session upload progress until a fix is released as a simple temporary mitigation. Despite the new flaw, no confirmed successful exploits have been reported yet.
Published: Fri Oct 23 14:19:03 2026 by llama3.2 3B Q4_K_M
OpenAI CEO Sam Altman warns that patching all the bugs in AI models is no longer a viable option due to the exponential escalation of cybersecurity threats. Instead, he suggests developing a new kind of defense shield using the same technology that attackers are using. The incident highlights the need for greater transparency and accountability within the AI industry to address the growing risk of AI misuse.
Published: Fri Oct 23 15:34:04 2026 by llama3.2 3B Q4_K_M
A third PHP2Shell vulnerability has emerged, adding another layer of complexity to the ongoing PHP2Shell saga. While the new vulnerability is considered to be of a lower risk than its predecessors, it still poses a threat to web applications and requires prompt attention from users and developers alike.
Published: Fri Oct 23 16:08:44 2026 by llama3.2 3B Q4_K_M
OpenAI's internal monitoring system has been exposed as inadequate, with a red-team report revealing vulnerabilities that could have been exploited by malicious AI agents during a high-profile attack on the Hugging Face model-hosting platform. The incident highlights the need for more robust and effective monitoring systems in the AI industry, with significant implications for the future of AI security.
Published: Fri Oct 23 16:14:30 2026 by llama3.2 3B Q4_K_M
A sophisticated UEFI bootkit called BlackX has been discovered, which has the ability to bypass Secure Boot on patched Windows systems. The malware is believed to be orchestrated by a China-linked state-sponsored hacking group known as APT41, with the primary objective being to undermine Microsoft Windows startup defenses and maintain long-term, covert access to compromised devices. The bootkit exploits a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894, allowing it to load malicious code before the operating system starts. The attack is an example of the evolving threat landscape in the world of cybersecurity.
Published: Fri Oct 23 16:38:02 2026 by llama3.2 3B Q4_K_M
CISA has added two high-priority vulnerabilities to its Known Exploited Vulnerabilities list, highlighting the urgent need for prompt patching and a heightened state of vigilance among organizations. The vulnerabilities, CVE-2026-110447 and CVE-2026-114625, have already been reported as actively exploited in the wild, prompting organizations to take immediate action to secure their networks and prevent potential cyber-attacks.
Published: Sat Oct 24 02:57:06 2026 by llama3.2 3B Q4_K_M
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Attackers Exploit Third Arista VCO Zero-Day in Four Months
11 Million Impacted by Capcom Data Breach
Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
LiteLLM Compromised in Fresh Supply Chain Attack
Atlassian Patches 75 Flaws in Data Center and Server Products
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Hacker Conversations: Corey Thuen and the Evil Bit
CISA, FBI and Partners Warn Organizations of SafePay Ransomware Actors Targeting Multiple Critical Infrastructure Sectors
CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide
CISA Launches Cybersecurity Awareness Month: Securing the Next 250
CISA Whitepaper Charts Path to Establishing and Maturing CVE Program Quality
CISA Hosts Cyber Storm X, Nationwide Cybersecurity Exercise to Strengthen Resilience
New CISA Guidance Helps Critical Infrastructure Detect, Observe and Impede Malicious Cyber Activity
CISA and NIST Release Guidelines to Protect Federal Cloud Identity Systems from Token Theft, Forgery, and Misuse
CISA Releases Updated Insider Threat Guide With New Insights to Mitigate Physical and Cyber Threats
CISA, NSA and FBI Warn of China-Based AI Companies Targeting US AI Models with Industrial-Scale Knowledge Distillation Campaigns to Shortcut AI Development
CISA Advisory Highlights Red Team Findings to Help Organizations Assess Risk, Identify Threats and Enable Effective Incident Response
Cyber Storm X: 20 Years of Readiness, Resilience, and Real World Impact
Lessons from CISA’s Cyber Incident
Five Eyes Cyber Security Agencies Statement
CISA Offers Vital Resources as Venues Prepare for Key 2026 Events
Patch Smarter, Not Harder
NCSWIC releases additional content in its NCSWIC Video Series
CISA Highlights Vital Resources to Help Event Attendees Stay Safe
Preparing for the World Stage
Securing the American Experience
The End is Just the Beginning of Better Security: Enhanced Vulnerability Management with OpenEoX
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Adds One Known Exploited Vulnerability to Catalog
Siemens SIMATIC S7 Webserver API
Siemens APOGEE, TALON and Desigo PXC/PXM Products
Siemens RUGGEDCOM CROSSBOW
Siemens RUGGEDCOM APE1808 Devices
Siemens Industrial Edge App Publisher
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
Siemens WinCC
Siemens Industrial Edge Device Kit
Siemens Capital Embedded AR Classic
InterSystems Corporation InterSystems IRIS for Health
Siemens PSS(R)SINCAL
Siemens Software Center
Siemens RUGGEDCOM CROSSBOW Station Access Controller
Siemens SIMATIC IPCs
Siemens SIMATIC S7 PLCs Web Server
Siemens Industrial Edge Devices
Managing AI Token Consumption for Operational Resilience
Siemens SENTRON 3NA COM Fuse
Kiloview E3 NDI Encoder
Siemens SIMATIC S7-1500 TM MFP
Critical Vulnerabilities in PHP Require Immediate Patching
#StopRansomware: SafePay Ransomware
Hitachi Energy MicroSCADA X SYS600 Product
Hitachi Energy RTU500 Product
HMS Networks PEAK-System PCAN Windows drivers
CISA Adds Six Known Exploited Vulnerabilities to Catalog
Moxa AIG-302 ThingsPro Edge
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
[webapps] pizzafy-1.0 - SQLi
[remote] South River Technologies Titan MFT Server 26.0.0 - code execution
[remote] Synametrics Syncrify 6.2 - command execution
[webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover
[webapps] Open eClass 3.15 - RCE
[webapps] Automotive Shop Management System 1.0 - SQLi
[remote] Edimax BR-6478AC firmware v2.20 - authenticated command injection
[remote] Exasol Database 7.1.30 - command execution
[remote] Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
[remote] ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
[remote] Teltonika_RutOS 00.07.06.21 - command injection
[webapps] TigerGraph_Community_Edition 4.2.4 - arbitrary file write
[webapps] WordPress 7.0.2 - Path Travesal
[webapps] Food-Ordering 1.0 - LFI
[remote] Ecava_ntegraXor IGX_16.0.701.10 - RCE
[webapps] Krayin CRM 2.2.4 - IDOR
[webapps] SuiteCRM 8.10.1 - Authenticated SSRF
[webapps] InvoicePlane 1.7.1 - RCE
[webapps] POMS oretnom23v1.0 - SQLi vulnerabilities
[remote] MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 - RCE
[remote] CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth - ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE
[webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)
[webapps] Metabase 0.61.0 - Authenticated Remote Code Execution
[dos] EVerest 2025.9.0 - DoS
[webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting
[webapps] PodcastGenerator 3.2.9 - Stored XSS
[webapps] Ghost_CMS 6.19.0 - Remote Code Execution
[webapps] Langflow 1.10.0 - RCE
[hardware] Fullhan FH8626V100 - Multiple Vulnerabilities
[webapps] Marimo 0.20.4 - RCE
[webapps] Wolf CMS 0.8.3.1 - RCE v
[webapps] Payload CMS 3.72.0 - Blind SQL Injection
[webapps] Bludit CMS - Stored XSS
[webapps] Grav CMS 2.0.7 - RCE
[webapps] miniOrange 5.4.3 - Unauthenticated Auth Bypass
[webapps] EasyAppointments 1.5.1 - Blind SQL Injection
[webapps] C-MOR 6.0104 - Directory Traversal
[webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)
[webapps] CubeCart 6.7.4 - SQL injection
[webapps] CubeCart 6.7.4 - SQL
[webapps] CubeCart 6.7.4 - Stored XSS
[webapps] CubeCart 6.7.4 - Cross-Site Scripting
[webapps] Linksys E1200_2.0.04 - Unauthenticated OS Command Injection
[webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution
[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
[remote] PCMan 2.0.7 - Buffer Overflow
[dos] NanaZip 6.5 - DoS
[webapps] flyto-core 2.26.7 - Arbitrary File Write
[webapps] Nodemailer 9.0.0 - File Read/ SSRF
[0day-rubbish] TRENDnet TV-IP302PI firmware 1.02.38 authenticated NTP server-address OS command injection to root command execution via a shell-form system() call (7.2 High, PR:H)
[0day-rubbish] Royal Render 9.1.26b: default-unauthenticated job submission on rrServer TCP 7773 reaches worker-side shell execution as the worker identity, measured root (8.1 High)
[0day-rubbish] ProSoft Technology RLX-IFH24E v2.2.44 unsigned firmware upgrade package to root command execution and full account-database overwrite (7.2)
[0day-rubbish] Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT anonymous deserialization in the database restore path to JSP command execution as uid=1000 (9.8)
[0day-rubbish] Exasol Database 7.1.30 docker-db form: shipped default SYS credential to PYTHON3 UDF os.popen command execution as uid=500(exadefusr), output returned in-band (8.8)
[0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the setWAN WAN-configuration handler, root command execution (7.2)
[0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the formWlanMP manufacturing-test handler, root command execution (7.2)
[ROOTEDCON] Call for Papers 2027 RootedCON2027 (Madrid)
VestaCP <= 0.9.8-26: authenticated config-parser eval sinks -> root RCE (VESTACP-2026-001)
[SYSS-2026-080]: dcm4che - Path Traversal (CWE-22)
[SYSS-2026-079]: dcm4che - Path Traversal (CWE-22)
[SYSS-2026-078]: dcm4che - Path Traversal (CWE-22)
[SYSS-2026-077]: dcm4che - Path Traversal (CWE-22)
[0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5)
[0day-rubbish] South River Technologies Titan MFT Server 26.0.0 first-run administrator setup chained to job post-command injection, NT AUTHORITY\SYSTEM (8.1)
CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder
Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup
Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader
Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader
CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions
nginx RCEs CVE-2026-93479, CVE-2026-15176
Re: Upcoming Node.js security release 2026/10/21
Ruby Regexp compilation fixes related to GitLab's CVE's
PHP Informational advisory: Session upload progress (CVE-2026-115560)
Re: Information for Python users regarding eMudhra / emSign CA certificate security incident
CVE-2026-115748: Apache Vysper: Authorization bypass
CVE-2026-115721: Apache Vysper: Unbounded allocation
CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input
CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input
CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input