UPDATED
The Register · · Medium severity
In a world full of cyber risk, account takeover has emerged as one of the most insidious of all threats. If an attacker can successfully compromise a legitimate email account, they are then able to pose as a trusted individual or...
Ubuntu security notices · · Medium severity
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls....
Malwarebytes Labs · · Medium severity
The warnings are everywhere these days. These messages of caution, however well-intended, are so ubiquitous and constant that it should come as no surprise that some people have started to tune them out. About one in three, according to...
CERT Polska · · Medium severity
W oprogramowaniu MTW CleanShot X wykryto podatność związaną z deserializacją niezaufanych danych (CVE-2026-16477).
DQ : Latest Posts · · Medium severity
Two critical vulnerabilities in the PHP programming language have triggered urgent security warnings, with Palo Alto Networks estimating that approximately 22 million internet-facing instances could be exposed. The flaws, tracked as...
DQ : Latest Posts · · Medium severity
Both are more than news headlines that blew high, and far, in the Internet. They are two sides of the coin which is moving swiftly, deeply and etching new worries (and possibilities) for enterprise security. AI has shown what it can do...
Computerworld · · Medium severity
Private keys associated with eight intermediate certificate authorities operated by Indian digital trust provider eMudhra have been compromised, potentially allowing attackers to forge trusted certificates and impersonate websites or...
IT Security Guru · · Medium severity
Cybersecurity researchers at Forescout are drawing attention to the risks posed by exposed refrigeration control systems, warning that weaknesses in operational technology (OT) could have serious consequences for food supplies, business...
TechCrunch · · Medium severity
The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets.
Infosecurity Magazine · · Medium severity
The EU Commission will assess whether Booking.com has adequately protected customers from phishing attacks
The Record by Recorded Future · · High severity
More than 1,400 suspected cybercriminals were arrested across Africa this summer as part of a crackdown on the gangs perpetrating online fraud, ransomware and business email compromise attacks, Interpol said.
TNW · · Low severity
Microsoft says a China-aligned hacking group used AI agents to breach ConnectWise’s Cloud Backup service, opening a route into customers’ Microsoft 365 accounts. Microsoft Threat Intelligence published its findings on Storm-0940 on...
Schneier on Security · · Critical severity
PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update...
Help Net Security · · Critical severity
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. “LiteLLM got compromised…...
Infosecurity Magazine · · Medium severity
Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil
TNW · · Medium severity
Hackers have made millions of attempts to exploit PHP2Shell since Wednesday’s disclosure, Cloudflare’s chief executive, Matthew Prince, said on X. Officials in Germany, the Netherlands and Japan say they have not seen one succeed. In...
Analytics India Mag · · Medium severity
Bengaluru-based eMudhra will exit its global SSL/TLS certificate business after a security incident prompted Google, Mozilla, and Apple to block affected certificates. The company said on Thursday that its board decided to exit the...
The Record by Recorded Future · · Medium severity
The systems impacted by the attack include the MyColaSC platform that citizens use to pay utility bills, report non-emergency issues and access other city services.
The Register · · Medium severity
China-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, Microsoft says. The Windows giant revealed this week that the attackers, tracked as Storm-0940,...
The Register · · Medium severity
Attackers are hammering servers with millions of attempts to exploit the critical PHP2Shell vulnerabilities , with Amazon revealing that someone was already going after the flaws four days before they were publicly disclosed. Cloudflare...
AppleInsider · · Medium severity
The "Snapintosh" project has launched, making it possible to load macOS onto an Asus A16 laptop. At the moment, audio, cameras, and sleep won't work, and it will be a bit of a climb to make more models compatible....
Help Net Security · · Critical severity
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker...
CSO Online Security · · High severity
Hackers hijacked the software release pipeline of LiteLLM, a popular open-source AI gateway, to distribute credential-stealing malware, marking the project’s second supply chain compromise this year despite security measures introduced...
Digital Trends · · Medium severity
The Nintendo Switch 2 has reportedly been jailbroken with help from OpenAI's Codex, opening the door to homebrew and game modding, but limitations remain.
Ars Technica · · Medium severity
Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday. The hijacking began in late...
Phoronix · · Medium severity
Myrlyn, the package manager GUI that began as YQPkg during a SUSE Hack Week and has evolved quite well, is out with version 1.1 as the first new feature update since the beginning of the year...
MacRumors · · Medium severity
Apple has blocked compromised security certificates on its devices that could help attackers impersonate websites, BleepingComputer reports . The certificates were issued by certificate authority eMudhra. According to Mozilla's...
CSO Online Security · · High severity
A China-state-aligned threat actor compromised a ConnectWise cloud backup application and used an open-source agentic AI framework to turn its stolen credentials against more than 2,250 Microsoft 365 tenants, Microsoft said. Microsoft...
BleepingComputer · · Medium severity
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
CSO Online Security · · Medium severity
Enterprises should be required to report “significant AI failures and near-misses,” UK Financial Conduct Authority (FCA) Chief Data Officer Jessica Rusu said Monday, adding to the drumbeat of demands for some kind of regulatory control...
Analytics India Mag · · Medium severity
JanAI has partnered with four universities to expand access to artificial intelligence (AI) education in rural India and create opportunities for rural youth and entrepreneurs. The company has collaborated with Presidency University,...
Help Net Security · · Medium severity
A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC checks, uses Dell’s real template, and confirms a $736.09 purchase of Microsoft Project Standard 2024...
Help Net Security · · Medium severity
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. The service scans codebases for vulnerabilities and suggests patches for...
AlienVault OTX · · Medium severity
In early 2026, a sophisticated APT campaign targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan deployed BlackX, a UEFI bootkit similar to the notorious BlackLotus. The bootkit exploits the Baton Drop vulnerability...
AlienVault OTX · · Medium severity
Amazon Threat Intelligence discovered PHP2Shell exploitation attempts in MadPot honeypot telemetry on October 17, 2026, four days before the public disclosure of CVE-2026-109618 and CVE-2026-109619. The initial exploit originated from a...
Infosecurity Magazine · · Medium severity
Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform
Help Net Security · · Medium severity
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fixed...
AlienVault OTX · · Critical severity
Two critical remote code execution vulnerabilities in PHP, collectively named PHP2Shell, were disclosed on October 21, 2026. CVE-2026-109618 involves out-of-memory handling corruption that can interrupt PHP while internal request data...
AlienVault OTX · · Critical severity
LiteLLM version 1.107.0 was compromised through a supply chain attack affecting both PyPI packages and Docker images. The malicious release contains Python startup files that automatically execute upon Python initialization, stealing...
HackRead · · Critical severity
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials…
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free