A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise…
CYBER BRIEFING | October 23, 2026
Pillow RCE fix, M365 token spraying, Capcom 11.77M breach
Major US Banks Move to Block AI Agents Over Account Access Concerns
Major US banks are restricting AI agents from customer accounts over security concerns, raising questions about credentials, permissions, and financial…
PHP emergency patches, compromised TLS certificates, Signal hot mic bug
PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/…
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator…
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight…
US bans DeepSeek across federal agencies, putting AI supply chains under scrutiny
DeepSeek has been dealt a huge blow in the US, even as it continues to innovate and keep pace with, or in some cases outperform, rival models from…
Sites Go Dark As Admins Rush To Patch PHP Flaw
Governments, other organisations take websites offline after researchers publish fix for critical PHP flaw affecting 70 percent of internet
Siemens WinCC
View CSAF Summary Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user…
Why Caribbean Threats Cascade Into Global Cyber-Risk
The region is demonstrating what happens when exploits accelerate but assurance does not.
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV)…
Token-Spraying Campaign Targets Microsoft 365
A large-scale business email compromise campaign targeting Microsoft 365 environments has been discovered by Huntress researchers, who documented at least…
Attackers Exploit Third Arista VCO Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
One Micron Taiwan Union To Stage Strike, As Another Signs Deal
Union at Micron’s Taoyuan plant to stage strike over profit-sharing, after Taichung union calls off action after reaching agreement
Siemens Capital Embedded AR Classic
View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior,…
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and…
Capcom Data Breach Exposes 11.7M Records
Capcom has confirmed a significant data breach affecting its CAPCOM ID unified account system, with unauthorized access compromising personal information…
Hackers Exploit ‘Basic Flaws’ To Attack French Supermarket Fridges
French cyber-security agency finds lack of basic security precautions enabled attacks that destroyed food, caused fires
Siemens RUGGEDCOM APE1808 Devices
View CSAF Summary Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial…
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The…
Critical Pillow CVE-2026-112900 RCE Flaw
A critical security vulnerability in Pillow, the dominant image processing library for Python, allows attackers to execute arbitrary commands on servers…
UK Regulator Pushes Apple To Open Up Contactless Tech
Current Apple offering for third-party contactless payments not working, says CMA, as it proposes lower fees, broader technical access
Siemens Industrial Edge Device Kit
View CSAF Summary Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial…
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions…