UPDATED
PYMNTS.com · · Medium severity
Fraud attacks can now be assembled with commercially packaged software, distributed across accounts and devices, and altered faster than banks can rewrite a conventional fraud rule. “We’re seeing fraudsters leverage commoditized SaaS...
CXO Insight Middle East · · Medium severity
Cohesity announced that HashiCorp, an IBM Company, has validated the interoperability of Cohesity Data Cloud’s cloud rebuild capabilities with Terraform Self-Managed. Organisations can now quickly recover cloud applications –...
Help Net Security · · Medium severity
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything.
Tech-Economic Times · · Critical severity
Artificial intelligence poses an "unprecedented" threat as foreign governments turn it loose to hack computer networks and critical infrastructure, Australia's cyber security agency warned on Tuesday. "This activity extends beyond...
Help Net Security · · Medium severity
Madhu Shashanka, Chief Scientist at Concentric AI, explains why securing LLM tools and agents depends more on your data than on the model. Controls on model behavior, such as guardrails and injection detection, lower the rate of bad...
ESET WeLiveSecurity · · Medium severity
Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes
Help Net Security · · Medium severity
Amutable opened signups for the private preview of Amutable Foundations, a Linux system in which each machine sends a signed report of the software and configuration it runs, drawing on local hardware to make the report easier to...
The Hacker News · · Critical severity
Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both...
Medianama · · High severity
A reported data breach at the Central Board of Film Certification (CBFC) exposed documents submitted as part of certification applications for more than 500 titles, including dozens of feature films, The Hindu’s Aroon Deep reported on...
CSO Online Security · · Low severity
Cybersecurity research firm Xint on Monday published details of a bug in the OpenAI API that leaks raw reasoning traces from frontier OpenAI models, revealing the risk of other data leaks. OpenAI has confirmed the flaw, mitigated it,...
TechRadar · · Medium severity
Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security. Benedict provides detailed analysis on state-sponsored threat actors, APT...
The Register · · Medium severity
Japanese ISP GMO Internet has warned customers the cloudy desktop service it offers as an ideal foreign exchange trading environment was compromised by an attacker, and that it had been slow to improve the service's security. GMO runs a...
SecurityWeek · · Medium severity
The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque and canceled appointments at more than 30 clinics. The post Cybersecurity Issue Forces a Major New Mexico Hospital to Divert...
Tenable Research · · Critical severity
Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js,...
SmartCompany · · Medium severity
Violent customers could be banned from NSW stores under proposed laws targeting repeat offenders, with breaches carrying up to two years in jail and or a $5,500 fine. The post Retail rage crackdown: NSW businesses could gain powers to...
SANS Internet Storm Center · · Medium severity
Apple today released patches for 304 vulnerabilties. This number is still in line with prior Apple updates, and comes just about a month after the last apple update. Noteworthy Issue: CVE-2026-86950: This is an already exploited...
CISA KEV · · Critical severity
PHP Stale Internal Request-State Vulnerability. PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. Required action: Apply mitigations in accordance with vendor instructions,...
CISA KEV · · Critical severity
PHP Memory Corruption Vulnerability. PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. Required action: Apply mitigations in accordance with vendor instructions, ensuring...
Slashdot · · Critical severity
The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The...
Tenable Research · · Medium severity
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell vulnerabilities (...
GitLab · · Medium severity
GitLab is not affected by CVE-2026-112900 or the other vulnerabilities fixed in Pillow 13.0.0. GitLab products do not include the Pillow library, and our Security team has found no evidence of impact to GitLab-managed infrastructure....
TNW · · Medium severity
Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell on Sunday. They fix CVE-2026-111497, a buffer overflow in Brotli, Google’s widely used compression library, which OpenAI’s Codex Security team reported....
BleepingComputer · · High severity
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.
Gizmodo · · Medium severity
Two More Crypto Hardware Wallet Manufacturers Have Been Hacked
The Register · · Critical severity
LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret-stealing part of the incident began when someone uploaded a poisoned...
Slashdot · · Medium severity
Highway thieves have stolen more than $100 million in data center equipment since June, employing increasingly sophisticated tactics such as forging driver IDs and spoofing GPS tracking systems. NBC News (paywalled) reports that thieves...
BleepingComputer · · Medium severity
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks.
SecurityWeek · · Medium severity
A string of hacking incidents by rogue AI agents also has raised fears the technology will slip free of human control to carry out harmful, life-threatening tasks. The post Anthropic Files for Potentially the Biggest IPO Ever as CEO...
The Hacker News · · Medium severity
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a...
Ars Technica · · Medium severity
Highway thieves are using sophisticated digital tactics that investigators worry make it easy to rob trucks carrying millions in expensive data center equipment. NBC News spoke to “several industry leaders, consultants, and...
AlienVault OTX · · Critical severity
Security researchers identified a sophisticated supply chain attack campaign involving 42 compromised GitHub repositories across 11 legitimate owners connected to the testmetest npm operation. The campaign evolved to use compiled native...
AlienVault OTX · · Medium severity
Adversaries are exploiting Microsoft Teams' default external chat functionality to conduct social engineering attacks and deliver malicious payloads. Analysis of over 400 incidents reveals threat actors consistently impersonate IT...
Cybersecurity Dive - Latest News · · High severity
The professional services firm was the subject of a claim by a known ransomware actor.
darkreading · · Critical severity
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
TechRadar · · Medium severity
Rogue AI agent engages 'Skynet mode' to search the internet for exposed LLMs to hijack and run malware attacks
The Hacker News · · High severity
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation...
The Hacker News · · Medium severity
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP...
The Record by Recorded Future · · Medium severity
Serbian strongman leader Aleksandar Vučić on Sunday admitted defeat in his race for prime minister, a loss that follows a series of incidents of digital repression that galvanized the opposition.
Ubuntu security notices · · Medium severity
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or...
Ubuntu security notices · · Medium severity
It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free