UPDATED
Help Net Security · · Medium severity
The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The...
Hackaday · · Medium severity
I recently got the Amazon Christmas toy book in the mail, and it is definitely the modern version of the Sears Christmas Wish Book for last century’s youth. Or at least the majority of last century’s youth. For the true hacker, we had a...
Phoronix · · Critical severity
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were just released to fix two critical vulnerabilities that can allow for unauthenticated remote code execution. Server administrators are advised to update immediately...
AppleInsider · · Medium severity
Apple has blocked on iOS and iPadOS a set of eight compromised security certificates that were found to be astoundingly weak. It's a bit more complicated on Mac. Apple and others have to deal with many online threats, both severe and...
MacRumors · · Medium severity
The first reviews of the iPhone Duo were published today, providing us with a closer look at the foldable device in action ahead of its launch on Friday. The Verge 's Nilay Patel and Allison Johnson said the iPhone Duo is an expensive,...
Palo Alto Unit 42 · · Medium severity
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619...
darkreading · · Medium severity
The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer.
HackRead · · High severity
SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen…
Malwarebytes Labs · · Medium severity
.kadence-column476672_104e78-a1 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column476672_104e78-a1 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm,...
The Hacker News · · Medium severity
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most...
SecurityWeek · · Medium severity
In two internal incidents, agents read routine coding instructions as permission to weaken monitoring, and one gave a false answer about it. The post OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor appeared...
SANS Internet Storm Center · · Medium severity
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead...
BleepingComputer · · Medium severity
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements.
9to5Mac · · Medium severity
Apple has blocked eight web security certificates that could have been used by scammers to impersonate legitimate websites. However, one cryptography engineer has warned that Macs may continue to trust the compromised certificates...
CSO Online Security · · Medium severity
Attackers are using stolen connection keys exposed in a TeamUpdraft security breach to install malicious plugins on affected WordPress sites and establish persistent access. Sites already compromised may remain at risk even after the...
Analytics India Mag · · Medium severity
Microsoft has called for the deployment of AI security agents to monitor and control other AI agents operating within enterprises, warning that autonomous systems can pose insider threats even when they have not been compromised. In a...
Malwarebytes Labs · · Medium severity
A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 ( CVSS score 9.3 out of 10), affects RingRTC versions earlier...
Infosecurity Magazine · · Critical severity
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks - and both are evolving their tactics in an attempt to outdo one another
The Register · · Critical severity
When it comes to cyberattacks that shut down power grids, drinking-water systems, and other critical infrastructure, AI doesn’t – yet – turn script kiddies into sophisticated, nation-state attackers. But “the potential is there,”...
TechRadar · · Medium severity
Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security. Benedict provides detailed analysis on state-sponsored threat actors, APT...
Help Net Security · · High severity
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and...
Infosecurity Magazine · · Critical severity
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the group’s tactics
Infosecurity Magazine · · Medium severity
Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches
CSO Online Security · · Medium severity
Private keys associated with eight intermediate certificate authorities operated by Indian digital trust provider eMudhra have been compromised, potentially allowing attackers to forge trusted certificates and impersonate websites or...
HackRead · · Medium severity
Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active…
SecurityWeek · · Medium severity
Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable. The post Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor appeared first on SecurityWeek .
Wired · · Medium severity
To escape the chaos of her Russian childhood, Lili Infante became an American law enforcement prodigy. She pioneered the DEA’s investigations of the dark web—never suspecting who she’d find hiding there.
UpGuard Blog · · Medium severity
Intelligent compliance management ensures you comply with relevant regulations while strengthening your resilience against cyberattacks.
UpGuard Blog · · Medium severity
Learn how to conduct an effective cybersecurity audit to manage cyber risk effectively.
UpGuard Blog · · High severity
Learn the differences between data leaks and data breaches and how to apply this understanding to your cybersecurity program in 2022
UpGuard Blog · · Medium severity
Learn how VDPs enhance cybersecurity by allowing organizations to receive reports about vulnerabilities from security researchers.
UpGuard Blog · · Medium severity
Follow a step-by-step guide to cybersecurity risk assessments, including real-world examples, frameworks, and practical tools to help protect your organiza
UpGuard Blog · · Medium severity
Learn what cybersecurity regulations and strategies financial services institutions need to be aware of to protect their third-party attack surface.
The Hacker News · · Medium severity
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the...
Tenable Research · · Critical severity
Two critical PHP remote code execution vulnerabilities will be patched in an emergency release on October 21. Fixes are only expected for supported PHP 8.x branches. Key takeaways CVE-2026-109618 and CVE-2026-109619 are critical...
Analytics India Mag · · Medium severity
Clément Delangue, Co-founder and CEO of Hugging Face , has criticised Netflix’s documentary on the cyberattack involving OpenAI’s AI agents, accusing the filmmakers of exaggerating the risks of artificial intelligence while overlooking...
Help Net Security · · Medium severity
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed...
Infosecurity Magazine · · Critical severity
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident
Help Net Security · · Medium severity
Apple’s new anti-tracking protections in Safari and WebKit, the open-source web engine used by Safari, block connections to identity resolution services that turn email addresses into persistent tracking identifiers. How email addresses...
BleepingComputer · · Critical severity
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024.
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free