UPDATED
BleepingComputer · · Medium severity
Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.
The Register · · Critical severity
Unknown crims compromised LiteLLM's release process on Wednesday, distributing a malicious version (1.107.0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary...
Ubuntu security notices · · Medium severity
It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.
Hacker News · · Medium severity
The Hacker News · · Critical severity
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise...
PYMNTS.com · · Medium severity
A hacking group known as CyberCartel reportedly used artificial intelligence (AI) agents from several high profile tech companies to automate cyberattacks on Latin American businesses. That’s according to a report Wednesday (Oct. 21)...
The Register · · Medium severity
Make sure you don’t say anything mean or secret after hanging up a call on Signal, as a bug in the encrypted messaging app’s calling library could prevent a call from ending properly, potentially leaving audio and possibly video active....
Exploit-DB · · Medium severity
ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
Exploit-DB · · Medium severity
Edimax BR-6478AC firmware v2.20 - authenticated command injection
darkreading · · Medium severity
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.
SecurityWeek · · Medium severity
The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications. The post PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors appeared first on SecurityWeek .
Malwarebytes Labs · · Medium severity
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking...
Gizmodo · · Medium severity
'Reboot' and 'Malware' turn up the pressure as a new villain emerges.
Gizmodo · · Medium severity
Two critical PHP security flaws could wreak havoc across millions of websites.
Ubuntu security notices · · Medium severity
USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P.
Hacker News · · Medium severity
Ubuntu security notices · · Medium severity
USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original...
All CISA Advisories · · Critical severity
CISA strongly urges organizations to immediately patch the recently disclosed critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619 . These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code...
Cybersecurity Dive - Latest News · · Critical severity
The group has been linked to a 2025 attack targeting technology firm Ingram Micro.
The Register · · Critical severity
PHP developers have released emergency updates for two critical vulnerabilities after cybersecurity authorities warned organizations to patch immediately or consider taking exposed applications offline. PHP 8.5.12, 8.4.27, 8.3.36, and...
IT Pro · · Critical severity
Nikkei admits millions of records stolen after reporting third breach in a month
TechRepublic · · Medium severity
Australia is preparing legal action against Meta, TikTok, Snap, and Google over alleged breaches of its under-16 social media ban. The post Australia Prepares to Sue Meta, TikTok Over Under-16 Social Media Ban appeared first on...
SecurityWeek · · High severity
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents. The post High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7 appeared...
Ubuntu security notices · · Medium severity
It was discovered that Unbound incorrectly handled certain TCP connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04...
Hacker News · · Medium severity
Ubuntu blog · · Critical severity
Introduction Two critical security vulnerabilities affecting PHP have been identified that result in unauthenticated remote code execution (RCE) for any PHP application. The vulnerabilities have been assigned the CVE-2026-109618 and...
The Record by Recorded Future · · Medium severity
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
TechRadar · · Medium severity
State Bank of India reports cyberattack — thousands of customer records affected, here's what we know
Ubuntu security notices · · Medium severity
It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed...
Palo Alto Unit 42 · · Medium severity
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute...
BleepingComputer · · Medium severity
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses...
BleepingComputer · · Critical severity
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.
Wired · · Medium severity
Hackers around the world are all-in on using agentic AI to wage attacks—and manipulating tools like Anthropic’s Claude to help them carry out their crimes.
Help Net Security · · Medium severity
The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The...
Hackaday · · Medium severity
I recently got the Amazon Christmas toy book in the mail, and it is definitely the modern version of the Sears Christmas Wish Book for last century’s youth. Or at least the majority of last century’s youth. For the true hacker, we had a...
Phoronix · · Critical severity
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were just released to fix two critical vulnerabilities that can allow for unauthenticated remote code execution. Server administrators are advised to update immediately...
AppleInsider · · Medium severity
Apple has blocked on iOS and iPadOS a set of eight compromised security certificates that were found to be astoundingly weak. It's a bit more complicated on Mac. Apple and others have to deal with many online threats, both severe and...
MacRumors · · Medium severity
The first reviews of the iPhone Duo were published today, providing us with a closer look at the foldable device in action ahead of its launch on Friday. The Verge 's Nilay Patel and Allison Johnson said the iPhone Duo is an expensive,...
Palo Alto Unit 42 · · Medium severity
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619...
darkreading · · Medium severity
The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer.
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free