PHP and Node.js flaws, hacked sites, fake updates, and rogue certificates can put you at risk even on trusted websites. Here’s how to stay safe.
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of…
NVIDIA SkillSpector: Complete Security Scanner for AI Agent Skills & MCP
As developers increasingly rely on autonomous AI agents to write code, manage infrastructure, and execute complex workflows, third-party…
A tiny laser beam could make computer memory 1,000 times faster
Scientists at UC San Diego have developed a surprising new way to store digital information using light instead of magnets, potentially paving the way for…
Simplify User Access Management with SCIM on Rapid7 Command Platform
Managing access to security tools shouldn’t require another manual process. As organizations grow, keeping user accounts and permissions up to date…
A quiet week in infosec <.<
In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node.js has joined in, but underneath it all,…
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected…
Microsoft releases out-of-band Windows fixes with certificate updates
Did you hear the one about eMudhra and the power of 4? Time to get connected to certificate trust list updates
Volt Typhoon hides zero-day attacks using ‘Silent Train’ framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand,…
DreamHost Forces Password Resets After Security Incident
Web hosting provider DreamHost has mandated password resets for a subset of email and FTP/SFTP accounts following a security incident that disrupted its…
Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
An attacker who gained access to Keystone’s website obtained the key that its hardware wallets use to prove they are genuine, the company said in a…
Cloud isolation bypass via Kubernetes vulnerability chain
Security researchers have disclosed a critical vulnerability chain in a major cloud provider’s managed Kubernetes service that enabled complete bypass of…
IT Security News Hourly Summary 2026-10-29 19h : 46 posts
46 posts published in the last hour 17:35Attack on email hosting provider for German far right party AfD exposed 345k accounts 17:35Hackers seize on vulnerable IoT devices to spy, pivot and route traffic 17:35Alibaba AI model tried to send data…
Attack on email hosting provider for German far right party AfD exposed 345k accounts
Alternative für Deutschland swats away scandals as reporters swarm leaked email tranche
Hackers seize on vulnerable IoT devices to spy, pivot and route traffic
Known vulnerabilities with available patches are by far the biggest risk facing connected devices, a new report found.
Alibaba AI model tried to send data to Beijing server, Cohere says
An Alibaba AI model generated an unexpected command to upload data to a Beijing-region cloud storage service during a cybersecurity evaluation, rival…
BYOD cyberattack diverts ambulances and cancels classes at University of New Mexico health center
Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New…
Silent Train: Volt Typhoon’s Sophisticated Infection Chain into US Targets Exposed
For years, government officials have described Volt Typhoon intrusions into US critical infrastructure as highly sophisticated, while providing few…
When AI becomes a hacker: New risks for cyber security
Artificial intelligence (AI) has long been capable of more than just writing text or generating images. The high-profile incidents at Anthropic and OpenAI…
Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles
The scammers affected approximately 800 victims and led to losses of more than half a million dollars, the Justice Department said.
South Korea’s financial industry hit by fresh wave of cyberattacks
South Korea’s financial institutions have been hit by another wave of cyberattacks, highlighting the growing risk of AI-driven hacking in Asia.
Hiding Capabilities in AI Models
Interesting research: “ AI Models Can Provably Hide Arbitrary Capabilities ” Abstract: Capability evaluations aim to surface dangerous model behaviors…
AI-Generated Fake Login Pages Are Making Account Takeovers Easier
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens,…
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
A Kaspersky expert presents a cloud isolation bypass case honored at Russian Pentest Award 2026. Learn how vulnerabilities in Kubernetes, Konnectivity,…