View CSAF Summary RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow…
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working…
Multiple Waves of DDoS Attacks Caused This Week’s Outage in North Korea
Multiple waves of DDoS attacks disrupted North Korea’s public internet services this week, knocking major state websites offline. Kentik’s internet…
Shares Of South Korean Data Centre Firm Plummet On Debut
South Korea’s Elice sees shares drop nearly one-third on their first day of trading, as higher borrowing costs dent AI enthusiasm
Cyber Insurance’s New Reality: Underwriting Isn’t Enough
Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.
Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on Fully Patched Systems
A new UEFI bootkit called BlackX has been used in cyberespionage attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The…
Hacker leaks 281 GB of data from Germany’s far-right AfD party
The AfD has confirmed that hackers breached its hosting provider. A leak site now claims to offer 421,179 of the party’s internal emails, and shows…
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by…
PHP warns it plans to release 2 emergency patches imminently
Unconfirmed report claims PHP2Shell exploit remotely executes code on PHP sites.
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise…
CYBER BRIEFING | October 23, 2026
Pillow RCE fix, M365 token spraying, Capcom 11.77M breach
Major US Banks Move to Block AI Agents Over Account Access Concerns
Major US banks are restricting AI agents from customer accounts over security concerns, raising questions about credentials, permissions, and financial…
PHP emergency patches, compromised TLS certificates, Signal hot mic bug
PHP rushes out emergency fixes for PHP2Shell https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/…
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator…
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight…
US bans DeepSeek across federal agencies, putting AI supply chains under scrutiny
DeepSeek has been dealt a huge blow in the US, even as it continues to innovate and keep pace with, or in some cases outperform, rival models from…
Sites Go Dark As Admins Rush To Patch PHP Flaw
Governments, other organisations take websites offline after researchers publish fix for critical PHP flaw affecting 70 percent of internet
Siemens WinCC
View CSAF Summary Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user…
Why Caribbean Threats Cascade Into Global Cyber-Risk
The region is demonstrating what happens when exploits accelerate but assurance does not.
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV)…
Token-Spraying Campaign Targets Microsoft 365
A large-scale business email compromise campaign targeting Microsoft 365 environments has been discovered by Huntress researchers, who documented at least…
Attackers Exploit Third Arista VCO Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
One Micron Taiwan Union To Stage Strike, As Another Signs Deal
Union at Micron’s Taoyuan plant to stage strike over profit-sharing, after Taichung union calls off action after reaching agreement
Siemens Capital Embedded AR Classic
View CSAF Summary The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior,…