UPDATED
AlienVault OTX · · Medium severity
Since September 15, 2026, an automated campaign named Gheist has been performing mass abuse of compromised GitHub tokens. The attack commits a workflow named sync-check to every accessible repository, designed to print repository...
The Hacker News · · Medium severity
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies,...
BleepingComputer · · Medium severity
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more.
AlienVault OTX · · Critical severity
A Korean-speaking threat actor, tracked as the June 2026 Minjun campaign and linked with moderate confidence to North Korea's Lazarus Group, is actively planning targeted exploitation of two critical PHP vulnerabilities (CVE-2026-109618...
AlienVault OTX · · Medium severity
Aokigahara is a newly identified infostealer with traditional data theft capabilities targeting browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications. Its distinguishing feature is...
AlienVault OTX · · High severity
On October 21, 2026, LiteLLM version 1.107.0 was compromised and distributed through PyPI and official container images. The malicious package leveraged Python startup mechanisms to execute credential-stealing payloads automatically,...
BleepingComputer · · Medium severity
Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more.
SecurityWeek · · Medium severity
An out-of-bounds write in Google’s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution. The post Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages...
Medianama · · Medium severity
The Central Bank of India has filed a complaint with the Mumbai police alleging that 187 unauthorised transfers moved Rs. 13.97 crore from its settlement account with the Reserve Bank of India (RBI) between October 15 and 17, according...
Innovation Village | Technology, Product Reviews, Business · · Medium severity
Young Nigerian tech enthusiasts looking to turn their ideas into real products have a new opportunity to explore, as the Ogun Digital Summit opens applications for a hackathon offering ₦5 million in total prize money. The competition...
CIO.com · · Medium severity
An executive IT dashboard can stay green for a year while the risks it is supposed to surface keep growing. Availability above target every month. Patch compliance climbing quarter over quarter.
The Hacker News · · Medium severity
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79...
BleepingComputer · · Medium severity
Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.
Infosecurity Magazine · · Critical severity
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected
Medianama · · Medium severity
Amagi Media Labs, a media software-as-a-service (SaaS) company that listed on the stock exchanges in January 2026, said it is facing an extortion attempt by a hacker claiming to have obtained operational and network configuration data...
Analytics India Mag · · Medium severity
Whenever a new open-source AI framework is released that claims to outperform existing AI models in efficiency or speed, developers are hailed as heroes on X, Hacker News, and Reddit. And soon, the big AI labs release their own projects...
The Hacker News · · Medium severity
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught...
Malwarebytes Labs · · High severity
Last week on Malwarebytes Labs: Resident Evil maker Capcom warns of phishing after 11.7 million records exposed Crime Stoppers chapter freezes tips after breach breaks anonymity promise Facebook’s misleading privacy claims land Meta a...
CXO Insight Middle East · · Critical severity
Qualys has announced that it is offering its solutions for free as a service to the community to help organisations detect, validate, and mitigate their exposure to PHP2Shell, two critical vulnerabilities in PHP tracked as...
Help Net Security · · Medium severity
Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the Age of Continuous Trust report. Eighty-one percent of suspected digital fraud in...
Tech-Economic Times · · Medium severity
GMO Internet Group said customers would be compensated for losses stemming from unauthorised access following a cyberattack on its foreign exchange trading service, and all customers would receive 5,000 yen ($32) as "an initial gesture...
YourStory RSS Feed · · Medium severity
Dear Reader, The AI boom is fuelling a datacentre expansion, but local communities are pushing back. In the UK, residents are raising concerns about noise, pollution, and blocked sunlight, putting the spotlight on the environmental...
Hackaday · · Medium severity
Some disappointing, but perhaps not entirely unsurprising news this week out of Denmark — after announcing last year that they would transition away from Microsoft’s proprietary software, the realities of making it work seem to have...
MacRumors · · Medium severity
Earlier this month, a security researcher discovered that private cryptographic keys associated with eight of Indian company eMudhra's intermediate certificate authority (CA) certificates were weak. The compromised keys could have...
The Hacker News · · Medium severity
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the...
The Hacker News · · Medium severity
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up...
Hackaday · · Medium severity
Telephony is a bit of a mixed bag. On the one hand, being able to talk to people in far off places is kind of neat, at least in theory. On the other hand, you’re usually reliant on a centralized network, which isn’t ideal to the mindset...
Latest InfoTech News, IT, Information Technology News | The HinduBusinessLine · · Critical severity
On October 21, PHP released fixes for two critical vulnerabilities that could enable unauthenticated remote code execution (RCE), urging users to update to the latest supported PHP 8 versions
YourStory RSS Feed · · Medium severity
Karnataka Chief Minister DK Shivakumar said on Sunday that the state government would take appropriate action if private institutions were found deliberately sidelining Kannadigas in job opportunities. In a post on 'X', Shivakumar said...
TNW · · Medium severity
“I was told that there was a breach of trust because I interacted with a third party through unsanctioned channels,” Tomek Korbak said. Korbak is one of three OpenAI safety researchers fired last month. He spoke to The Wall Street...
Digital Trends · · Medium severity
Chinese AI startup Moonshot AI is deliberately limiting the hacking capabilities of its latest artificial intelligence model, highlighting a growing dilemma for the industry: how do companies make AI more powerful without making...
Hacker News · · Medium severity
Engadget · · High severity
Capcom ID is still available to use, but users may see more phishing scam emails.
Hackaday · · Medium severity
One of the nicest things about the Hackaday community, and the open-source hardware community at large, is the incredible generosity of one hacker to another. But it’s not purely altruism – it’s also just a great feeling to be able to...
The Register · · Medium severity
Threat actors built an AI agent designed to hijack exposed AI models to run autonomous attacks, with instructions allowing it to carry out up to 100,000 steps without human approval. The Symantec Threat Hunter Team uncovered the agent's...
Hacker News · · Medium severity
Inc42 · · Medium severity
PHP, a programming language used to build websites, is at the centre of a major security concern after researchers uncovered two critical flaws that could let hackers take control of vulnerable servers. Called PHP2Shell, the...
The Hacker News · · Medium severity
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May...
Wired Security · · Medium severity
With no accurate Big Tech mapping app to help him, Anas Hattab launched a Telegram group to get himself home at night. Now nearly 350,000 Palestinians rely on it to navigate the occupied West Bank.
Wired Security · · Medium severity
Brenden Cuni, an ICE supervisor, has been accused of excessive force and tackling a pregnant woman to the ground. Several of his arrests were later found to be unlawful in federal court.
Updated's live feed refreshes every 5 minutes with breach alerts, bookmarks, a personalised feed and a Monday digest.
Join Updated free