While everyone was distracted by PHP, another RCE has been wrecking the internet, Australia’s ABC wipes some staff devices, a third PHP RCE is incoming…
OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken
The OpenSSL project released version 4.1.0, adding support for DTLS 1.3 and listing four known bugs in the DTLS code that ships with it. DTLS is the…
27 arrests and 248 potential victims identified in action week against labour exploitation
Europol, the European Labour Authority (ELA), and 34 participating countries today announced the results of an action week targeting human trafficking for…
Capcom data breach exposes 11.7 million account records
Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company. The company has disclosed…
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.
AI-assisted attackers breach European government via PHP2Shell
PHP2Shell Hits European Government, New PHP RCE (No Patch Yet), Brotli “Node to Shell,” and Capcom Breach Attackers exploited the PHP2Shell remote code…
UK threatens subsea cable saboteurs with 14 years behind bars
Whitehall wants tougher penalties and new powers over telecoms operators as Russian activity raises alarm
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause
YARA-X 1.22.0 Release, (Sun, Oct 25th)
YARA-X&#;x26;#;39;s 1.22.0 release brings 11 improvements and 9 bugfixes.
Sponsored: Should your threat hunt become a detection?
In this Risky Business sponsored interview James Wilson chats to Nebulock’s Head of Detection Strategy Alex Hurtado about the company’s threat hunting…
Zeabur Breach Exposes 321,810 Accounts: What Customers Should Do Now
Zeabur Breach Exposes 321,810 Accounts: What Customers Should Do Now
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who…
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 5
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial…
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell…
CrowdStrike Achieves NCSC CIR Enhanced Level Assurance
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: CrowdStrike Achieves NCSC CIR Enhanced Level Assurance
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner…
Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers From One Compromised Device
A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers.…
AI coding agents hijacked using AGENTS.md file in Downloads folder
Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue…
LiteLLM Compromised in Fresh Supply Chain Attack
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.
Japan’s Largest Car-Sharing Service Exposes 6.6 Million Accounts in Serious Data Breach
Tokyo – Park24, which operates Times Car through its subsidiary Times Mobility, confirmed late October that attackers had accessed personal data belonging…
APT41 Linked to BlackX Bootkit Attacks on Central Asian Diplomatic Agencies
Cybersecurity researchers have uncovered an espionage campaign, believed to be conducted by APT41, targeting diplomatic organisations in Tajikistan,…
Microsoft Teams to Get AI-Powered Context-Aware Phishing Detection
Microsoft has announced plans to deploy AI-powered phishing detection within Microsoft Teams, extending its security model beyond conventional link- and…
Atlassian Patches 75 Flaws in Data Center and Server Products
Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter…