IT Security News: Afternoon roundup, 2026-10-21 Summary The major theme during this reporting period centers on critical emergency patches and active exploitation of foundational software assets, led by widespread remote code execution vulnerabilities in PHP core known as PHP2Shell. Alongside…
Compromised eMudhra intermediate certificates
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
Scammers Abuse Frame.io Notifications to Steal Microsoft 365 Credentials
Ocean Security found a phishing campaign, dubbed Phantom Preview, that abused legitimate Frame.io notifications and hidden PDF links…
PHP Vulnerability Fallout After European Government Websites Go Offline
Critical PHP flaws forced European government websites offline. Here’s what happened, why services were suspended, and what comes next.
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365…
AI Agent Adoption Creates Risk as Oversight Struggles to Keep Pace, Splunk Finds
Rapid adoption of agentic AI comes with potential business benefits. But if done incorrectly it also carries risks around AI activity management and…
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and…
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new…
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns
Go 1.27.3 and Go 1.26.10, released on October 20, make Go’s certificate verifier reject any certificate chain that passes through one of eight…
IT Security News Hourly Summary 2026-10-21 23h : 16 posts
16 posts published in the last hour 20:33Microsoft’s New Security Tools Can Restrict AI Agents That Go Off Track 20:32What Security Teams Can Do To Tame Wild Code 20:32Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss…
Microsoft’s New Security Tools Can Restrict AI Agents That Go Off Track
Microsoft has unveiled security controls to monitor risky AI agents and restrict their access. Here’s what the tools could mean for enterprise IT teams…
What Security Teams Can Do To Tame Wild Code
A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared…
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the…
Inside a Global AI-Assisted Hacking Campaign
IntroductionIn October 2026, Zscaler ThreatLabz investigated AI-assisted cyberattacks that combined the ARTEX penetration testing framework with AI coding…
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting…
RAG Security: Protecting Retrieval-Augmented Generation Systems
This post has no text preview — click the link below to read the original article. This article has been indexed from Hackers Online Club Read the original article: RAG Security: Protecting Retrieval-Augmented Generation Systems
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators
WhatsApp’s help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users…
AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive
A data breach exposed AfD emails, while an anonymous site published AI summaries of 421,000 messages, raising questions about authenticity and privacy.…
HIPAA Security Rule Delayed to 2027: Why Healthcare Can’t Wait
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: HIPAA Security Rule Delayed to 2027: Why Healthcare Can’t Wait
Meta glasses caught recording conversations without wake phrase
Owners reported unexpected recordings of private conversations, but Meta hasn’t explained what went wrong or what happened to the audio.
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of…
‘PHP2Shell’ Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.
Samsung Black Friday 2026: Galaxy Offers to Look Out For
Black Friday 2026 is coming! Explore Samsung Galaxy S25 Ultra, S24, foldable phones, tablets and watches, plus refurbished…
Possible new Cellebrite iPhone Radio Zero-Day
Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to…