Kate Pundyk, Siena Anstis, and Marcus Michaelsen write about the rise of AI-enabled digital transnational repression in their piece for Just Security.
SOC 2 Type 2 : how each Common Criterion is tested in a Secure SDLC
In April I published a mapping of the SOC 2 Type 2 Common Criteria to Secure SDLC requirements. That article answers the question “which criterion touches…
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Linux servers running KSMBD, the kernel’s built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro’s…
WhatsApp May Stop Working Without Registered SIM Under New Rules
WhatsApp users in India may face access issues without a registered SIM under new government rules expected to take effect on January 1, 2027. Messaging…
Friday Squid Blogging: Increasing Squid Populations
This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to…
Hackers got a four-day head start on epic PHP2Shell vulnerability
Hackers were already probing the bug before defenders were told it existed.
Password Rotation: Tips + How to Do It Right
Good password habits now depend more on having a strong, unique password for each account. Changing it every 90 days or so made sense when…
CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory…
PHP2Shell: Log4Shell at AI Speed — A CISO’s Perspective
When the PHP2Shell vulnerabilities became public, my thoughts went back to Log4Shell. Five years ago, Log4Shell showed how difficult it can be to respond…
When DNS Trust Breaks: What the Counterfeit Google Certificates Reveal
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: When DNS Trust Breaks: What the Counterfeit Google Certificates Reveal
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
Fixing the critical PHP flaws is not as simple as clicking “Update.” Here’s how to assess your risk, and what you can do to protect yourself.
Signal Vulnerability Could Keep Calls Alive After Users Hang Up
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical…
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision…
14 Amazon Scams and How to Spot Them
What are Amazon scams? Amazon scams are attempts to trick you by using Amazon’s name or brand. Scammers may contact you through a text, email…
Critical Remote Code Execution Vulnerabilities in PHP Core
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: Critical Remote Code Execution Vulnerabilities in PHP Core
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a…
Naval hack, Muse exposes secrets, Army researching offensive AI hacking
Russian-linked attacks hit naval shipbuilder https://thehackernews.com/2026/10/russian-apt28-breaches-nato-naval.html Muse exposes secrets when sharing…
SEO Poisoning Campaign Delivers New Armorsteal Malware
IntroductionIn September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package…
Paying in ADA: Cardano’s vision for the future of payroll
Cardano payroll could support ADA salaries and automated payments, but employers must address price volatility, tax obligations, wallet security and…
How to conduct a cyber-resilience assessment
Given growing concerns about cyberattacks and the effect of AI on cybersecurity, enterprise CISOs should periodically review and update their…
Disgraced Indian cert issuer leaves the cert issuing business
We didn’t want to issue SSL/TLS certs anyway, eMudhra suggests after one private key turns out to be the number 4
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from…
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges…
Google Gemini AI gains personal intelligence in Android Auto
Google has expanded Gemini AI capabilities in Android Auto and vehicles with Google built-in by integrating Personal Intelligence features that access…