Attackers replaced the binary releases of OVHcloud’s open-source CLI tool on GitHub with malicious builds designed to harvest secrets from developer…
PHP devs publish critical bug fix as site owners warned: Pull ’em offline if you’re unpatched
Websites down as precaution as exploits have already been published
Nigerian Hacker Sentenced To Eight Years For Fraud And Identity Theft
A Nigerian man has been sentenced to eight years in a U.S. prison for his role in wide-ranging hacking, tax fraud, identity theft, and investment fraud…
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates…
OpenCode Breach Exposes User API Keys in What Company Calls a Distillation Attack
An intruder broke into a legacy system at OpenCode late on October 16, gaining access to third-party AI provider API keys that users had stored inside…
PHP Releases Emergency Fixes for Critical PHP2Shell Vulnerabilities
PHP releases emergency PHP2Shell fixes for two critical flaws allowing unauthenticated code execution. Website owners and hosting providers…
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.
European and Ecuadorian cooperation leads to 20 arrests in major hit against drug trafficking
The operation, codenamed Operation CANTABRIA, underscores the success of strong cooperation between European and Ecuadorian law enforcement agencies,…
PHP ships emergency patches for critical PHP2Shell flaws
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and…
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Overview In early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1…
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Researchers have uncovered Athena StealthRoute, a phishing-as-a-service platform featuring an AI Studio that generates phishing lures and decoy content…
OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government…
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges…
Salt Security wins three InfoSec Innovator awards
Salt Security has won three categories at Cyber Defense Magazine’s 2026 Top InfoSec Innovators awards, recognising its work in agentic AI and API…
GenAI Security Gateway: An End-to-End Architecture
LLMs are powerful application components, but they should not be exposed directly to untrusted users or unvetted documents. A request can contain an…
Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness
Nearly half of corporate directors think board members need cybersecurity expertise, a new survey found.
AI Use in Connecticut Utilities Faces Security Review
Artificial intelligence is rapidly entering the computer networks that help run and protect the United States’ electric grid, and federal regulators are…
WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the…
DHS to ban DeepSeek from federal civilian agencies
The order cites national security concerns, including sending data to servers in China, the potential for malware and the overall risk to federal IT…
ClickFix has never been bigger, and AI tools are its most convincing lure yet
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into…
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS) , its platform for remotely troubleshooting…
Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report
Critical PHP vulnerabilities expose vast majority of websites to potential compromise
The serious flaws in popular website software prompted government agencies to urge organizations to take their sites offline until they could be fixed.
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch…