UPDATED
The Record by Recorded Future · · Medium severity
CISA added the widely publicized PHP vulnerabilities to the KEV, but didn't specify what kind of exploitation it was observing.
SecurityWeek · · Critical severity
Eight max-severity security defects could lead to remote code execution and authentication bypass. The post HPE Patches Dozens of Critical Flaws in Networking Products appeared first on SecurityWeek .
Checkpoint Research · · Medium severity
Key Points Check Point Research discovered a campaign we track as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol ,...
Malwarebytes Labs · · Medium severity
You may even have it bookmarked. Then it asks you to do something unusual: install an update, allow notifications, or run a command to prove you’re human. A website you trust can still display instructions you shouldn’t follow.
Help Net Security · · Medium severity
Exeon Analytics has introduced Exeon.AgentGuard, a new AI security solution designed to give organizations visibility into approved and shadow AI use, autonomous agent activity and the data flows created through connected tools and...
CSO Online Security · · Critical severity
A vulnerability in Google’s Brotli compression library could allow attackers to execute arbitrary code in applications that use an affected Brotli decoder to process compressed data. Tracked as CVE-2026-111497 , the high-severity flaw...
Help Net Security · · High severity
University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a...
Infosecurity Magazine · · High severity
Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware
The Hacker News · · Medium severity
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication...
The Hacker News · · Medium severity
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass...
The Hacker News · · Medium severity
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the...
SecurityWeek · · Medium severity
The company says it reacted to an issue affecting some of its systems, including DreamHost webmail. The post Unexplained DreamHost Incident Prompts Email, FTP Password Resets appeared first on SecurityWeek .
SiliconANGLE · · Medium severity
today extended its cyber resilience portfolio into identity systems with PowerProtect software that can restore a compromised identity platform to a clean, trusted state after an attack. Identity is one of three fronts in the release....
SecurityWeek · · Critical severity
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones. The post iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 appeared first on...
The Register · · Medium severity
The cyberattack on Alternative for Germany (AfD), the country’s most prominent far-right political party, exposed hundreds of thousands of confidential emails and attachments, as well as more than 345,000 unique email addresses. Have I...
MEDIANAMA · · Medium severity
After denying a breach on October 22, CoinDCX, an India-based cryptocurrency exchange, confirmed three days later that it had lost 15.99 million USDT from a deprecated wallet linked to a previous cyberattack. The Mumbai-based crypto...
Help Net Security · · Medium severity
The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal data...
TechRadar · · Medium severity
Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security. Benedict provides detailed analysis on state-sponsored threat actors, APT...
TechAfrica News · · High severity
An INTERPOL -coordinated cybercrime operation involving law enforcement agencies in 21 countries has resulted in the arrest of 1,462 suspects, the disruption of 10,909 malicious networks and the recovery of more than $105 million in...
Schneier on Security · · Medium severity
Interesting research: “ AI Models Can Provably Hide Arbitrary Capabilities ” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden...
Help Net Security · · Medium severity
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token,...
BleepingComputer · · Critical severity
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.
TechAfrica News · · Medium severity
Ghana’s Cyber Security Authority (CSA) and the National Information Technology Agency (NITA) have issued a joint cybersecurity alert warning government institutions, businesses, website owners, hosting providers and operators of...
TechRadar · · Medium severity
Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security. Benedict provides detailed analysis on state-sponsored threat actors, APT...
Infosecurity Magazine · · Medium severity
UK police forces and fire and rescue services have been urged to strengthen cybersecurity as rising cyber threats outpace current defenses
SecurityWeek · · Critical severity
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon. The post This is Fine: What NetScaler Zero-Days Tell Us about the New Normal appeared first on SecurityWeek .
The Hacker News · · Medium severity
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to...
CXO Insight Middle East · · Critical severity
A ransomware attack encrypts every shared drive overnight. A storage array fails during quarter-end. Record rainfall floods an office, as parts of the UAE saw in April 2024.
SecurityWeek · · Medium severity
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek .
BleepingComputer · · High severity
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners.
CERT Polska · · Medium severity
CERT Polska otrzymał zgłoszenie dotyczące 3 podatności (od CVE-2026-107145 do CVE-2026-107147) wykrytych we wtyczce twofactor_gauthenticator dla Roundcube.
· · Medium severity
Rand Mutual Assurance investigates a possible cyber security breach after a threat actor claimed to have stolen 366GB of data.
La santísima trinidad del 'cloud': muchos logos, poco gobierno | CIO · · Critical severity
“Are we exposed?” CIOs and CTOs heard that question all last week. On Tuesday, PHP shipped emergency fixes for two pre-authentication remote code execution flaws that date back to 2004. By Wednesday, Palo Alto Networks said every...
MEDIANAMA · · High severity
This article was first published here and has been cross-posted here. The beginning It’s October 2026, and a few things happened: eMudhra was found to be using trivial numbers, a single byte, as their private keys PHP CVE-2026-109619...
CSO Online Security · · High severity
The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks. In 2026, the median...
Hackaday · · Medium severity
We’re big fans of pushing hardware into situations it wasn’t designed for here at Hackaday, but sometimes you’ve got to appreciate a nicely designed gadget doing more or less exactly what it was intended for — especially when it’s...
BleepingComputer · · Critical severity
Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.
PYMNTS.com · · Medium severity
Fraud attacks can now be assembled with commercially packaged software, distributed across accounts and devices, and altered faster than banks can rewrite a conventional fraud rule. “We’re seeing fraudsters leverage commoditized SaaS...
CXO Insight Middle East · · Medium severity
Cohesity announced that HashiCorp, an IBM Company, has validated the interoperability of Cohesity Data Cloud’s cloud rebuild capabilities with Terraform Self-Managed. Organisations can now quickly recover cloud applications –...
Help Net Security · · Medium severity
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything.
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free