IT Security News: Afternoon roundup, 2026-10-22 Summary This period's security developments were heavily dominated by the emergency disclosure and rapid patching of two critical remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, which attackers exploited days prior to…
SK Hynix Calls Off Planned IPO For US NAND Unit
South Korean memory maker cancels intended float of former Intel NAND flash memory unit amid opposition from its own investors
Can you ask AI bots to hack a website or a business?
People can certainly ask artificial intelligence (AI) bots to attack a targeted business or website. But most AI chat assistants politely reject these…
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have…
North Korea Hit by Multiple Waves of DDoS Attacks, Knocking Over 40 Websites Offline
Multiple waves of DDoS attacks disrupted North Korea’s internet infrastructure this week, intermittently knocking over 40 official websites offline for…
PHP vulnerabilities update, ConnectWise AI spies, Africa cybercrime takedown
Railway says intruder may have accessed customer secrets https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html Law enforcement…
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai…
Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability…
INTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime Crackdown
INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL…
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical…
Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks
Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability…
Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability
Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital…
Srsly Risky Biz: OpenAI’s Kazoo-Grade Spying Incident
Tom Uren and Amberleigh Jack talk about the weird bugging incident at OpenAI. It doesn’t look at all like it was normal state-backed espionage, but there…
U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the…
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.
Apple’s iPhone Duo Arrives In Stores, Amid Strong Demand
Lines form hours in advance as Apple’s first foldable iPhone marks rare departure from classic smartphone format
Google opens its cloud to rival OpenAI, promises business data won’t train models
Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6…
Critical Fortinet FortiSIEM Flaw (CVE-2026-106173) Public Exploit Released
HOC Shorts | Security agencies issued urgent advisories for a CVSS 9.8 critical vulnerability (`CVE-2026-106173`) impacting Fortinet FortiSIEM,…
FBI Warns SafePay Ransomware Has Hit 600+ Organizations: Here’s What We Know
FBI and CISA warn SafePay ransomware has hit at least 600 organizations. Learn how the group attacks networks and what security teams can do to prevent…
SoftBank Market Value Halves From Peak Amid AI Rout
SoftBank market capitalisation falls to one-half of peak four months ago, as CoreWeave sees shares plunge amid AI investment scepticism
CVE-2026-115417 – Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Bulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT Description: aws-c-mqtt is a…
PwC Data Breach Claim – Everest Ransomware Group Claims to Have Stolen 590 GB of Data
The Everest ransomware group claims to have stolen 590.69 GB of data from PwC, the global professional services firm. This alleged data theft includes…
eMudhra Exits Global TLS Business Following Critical CA Private Key Generation Failure
HOC Shorts | BREAKING! Major Certificate Authority eMudhra announced its complete withdrawal from the global public WebPKI/TLS certificate…