IT Security News: Afternoon roundup, 2026-10-22 Summary This period's security developments were heavily dominated by the emergency disclosure and rapid patching of two critical remote code execution vulnerabilities in PHP, collectively known as PHP2Shell, which attackers exploited days prior to…
INTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime Crackdown
INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL…
PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)
Bulletin ID: 2026-143-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 14:30 PM PDT Summary: Two critical…
Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks
Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability…
Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability
Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital…
Srsly Risky Biz: OpenAI’s Kazoo-Grade Spying Incident
Tom Uren and Amberleigh Jack talk about the weird bugging incident at OpenAI. It doesn’t look at all like it was normal state-backed espionage, but there…
U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
This post has no text preview — click the link below to read the original article. This article has been indexed from Blog Read the original article: U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the…
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.
Apple’s iPhone Duo Arrives In Stores, Amid Strong Demand
Lines form hours in advance as Apple’s first foldable iPhone marks rare departure from classic smartphone format
Google opens its cloud to rival OpenAI, promises business data won’t train models
Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6…
Critical Fortinet FortiSIEM Flaw (CVE-2026-106173) Public Exploit Released
HOC Shorts | Security agencies issued urgent advisories for a CVSS 9.8 critical vulnerability (`CVE-2026-106173`) impacting Fortinet FortiSIEM,…
FBI Warns SafePay Ransomware Has Hit 600+ Organizations: Here’s What We Know
FBI and CISA warn SafePay ransomware has hit at least 600 organizations. Learn how the group attacks networks and what security teams can do to prevent…
SoftBank Market Value Halves From Peak Amid AI Rout
SoftBank market capitalisation falls to one-half of peak four months ago, as CoreWeave sees shares plunge amid AI investment scepticism
CVE-2026-115417 – Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
Bulletin ID: 2026-147-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 13:30 PM PDT Description: aws-c-mqtt is a…
PwC Data Breach Claim – Everest Ransomware Group Claims to Have Stolen 590 GB of Data
The Everest ransomware group claims to have stolen 590.69 GB of data from PwC, the global professional services firm. This alleged data theft includes…
eMudhra Exits Global TLS Business Following Critical CA Private Key Generation Failure
HOC Shorts | BREAKING! Major Certificate Authority eMudhra announced its complete withdrawal from the global public WebPKI/TLS certificate…
Drone program compliance: What a CTO says most agencies get wrong
In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a…
Hacker Turned DeepSeek Into an AI Cybercrime Assistant to Attack Universities and Steal Data
A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations…
CVE-2026-115416 – Incorrect authorization checks in Amazon Athena engine version 3 query processing
Bulletin ID: 2026-144-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/22/2026 09:30 AM PDT Description: Amazon Athena is…
Splunk Fixes 24 Security Flaws, Including Four Critical Vulnerabilities in Enterprise and SOAR
Splunk has released security updates for 24 vulnerabilities in Splunk Enterprise and Splunk SOAR, including four critical flaws with CVSS scores from 9.3…
PwC Allegedly Hit by Everest Ransomware Group, 590GB of Data Stolen
The Everest ransomware group has reportedly stolen around 590GB of data linked to PwC, one of the Big Four professional services firms. The claim concerns…
CVE-2026-112408 – Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()
Bulletin ID: 2026-142-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/21/2026 12:30 PM PDT Description: The Amazon…
Quest Diagnostics Hacked – Attackers Accessed the System to Order Tests and View Results
Quest Diagnostics has disclosed a cyberattack involving unauthorized access to its Quanum LSM system, which healthcare clients use to order laboratory…
Critical Unpatched Linux Kernel Vulnerabilities Accidentally Disclosed, Including Two Remote Code Execution Flaws
In October, several unpatched Linux vulnerabilities were disclosed on public mailing lists, revealing technical details before fixes were widely…