IT Security News: Afternoon roundup, 2026-10-28 Summary The PHP2Shell and Brotli-based Node2Shell/HTTP2Shell flaws dominated this window, with attack write-ups, vendor protections and even insurers' concerns about systemic losses all pointing to the same widely deployed components. A second thread is…
Bank of America kindly asks that you don’t share your banking password with your AI assistant
The banking giant reminds customers that “you’re responsible for activity” resulting from your AI agents’ access.
A week in security (October 19 – October 25)
A list of topics we covered in the week of October 19 to October 25 of 2026
CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure
Bulletin ID: 2026-155-AWS Publication Date: 10/28/2026 15:00 PM PDT Description: AWS is aware of CVE-2026-111497, an issue in the native Brotli…
SBOMs Alone Can’t Reveal the Scope of a Supply Chain Attack
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.
DeepSeek, Huawei Narrow AI Performance Gap With Nvidia
Huawei’s collaboration with start-up DeepSeek and Huawei’s own engineering efforts are paying off in spite of inferior resources, finds study
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security…
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
Russian Hackers Use Experimental Network In Ukraine Strike
Russia-linked groups used Yggdrasil mesh network for communications in attack on Ukraine logistics firm, say researchers
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
The supply chain attack campaign’s shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
The Department of Peace group shared it with Swiss hacker/journalist maia arson crimew and DDoSecrets put it online.
Code-execution flaw in UEFI firmware affects most servers on planet Earth
Critical flaw in EDK2 allows attackers to execute code early in the boot process.
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst…
Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during…
Meta Free Cash Flow Falls Into Red Amid Heavy Spending
Facebook parent raises low-end for this year’s capital expenditures, discloses $825bn in future spending commitments
All the security risks Anthropic is worried about before its IPO
Anthropic has said out-of-control AI poses a threat to the world, but perhaps unsurprisingly suggests that profit will shape those decisions, too.
External Teams Chats Anchor 15-Minute Malware Delivery
Mail bombing is getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.
Before you file that AI bug report, OpenAI has some advice
Open-source maintainers are so overwhelmed by AI-generated security reports that some have stopped accepting them. OpenAI’s Daybreak lead says the fix is…
IT Security News Hourly Summary 2026-10-28 23h : 14 posts
14 posts published in the last hour 21:33Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost 21:32Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail 21:32Scientists overcome a hidden obstacle to more powerful quantum…
Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
New York, NY, 27th October 2026, CyberNewswire
Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail
Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A…
Scientists overcome a hidden obstacle to more powerful quantum computers
Scientists have discovered a way to operate multiple silicon qubits simultaneously with remarkable accuracy, overcoming a major challenge in scaling up…
27 arrests and 248 potential victims identified in action week against labour exploitation
Europol, the European Labour Authority (ELA), and 34 participating countries today announced the results of an action week targeting human trafficking for…
Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters
Italy ’s Parliament cyberattack highlights hybrid warfare risks and the need for transparency, stronger defenses and accountability. The cyberattack…
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal…