Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches
Nvidia picks OpenShell to tame AI gents
Give your agents freedom to do useful work by locking them down
Delivery bots accused of illegally scanning customers
Two lawsuits allege delivery robots scanned customers’ faces without consent, linked scans to names and addresses, and used them to train AI.
Accenture, Dragos and SANS Launch $10 Million Cybersecurity Program for US Utilities
Accenture, cybersecurity company Dragos and the SANS Institute have announced a $10 million initiative to aid cash-strapped US utilities in protecting…
Infostealers Are Targeting AI: What Aokigahara Infostealer Reveals About the New Developer Attack Surface
AI assistants have quickly become part of everyday work, particularly for developers. Tools such as ChatGPT, Claude, Cursor and GitHub Copilot…
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords,…
PHP exploitation moves at slower-than-expected pace, but millions remain at risk
Security researchers flag botnet activity, but successful compromises have yet to break through.
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI…
EU wants Booking.com to check out of its scam problem
Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses ‘absolutely substandard’
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The…
Signal bug could let someone keep listening after you hang up
A flaw in Signal’s calling library could let another participant keep hearing you after you hang up. Update your app to get the latest fixes.
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer’s Windows or WSL machine when the developer…
She Was the DEA’s Premier Crypto Detective. The Clues Led Straight to Her Own Family
To escape the chaos of her Russian childhood, Lili Infante became an American law enforcement prodigy. She pioneered the DEA’s investigations of the dark…
Siemens SIMATIC S7-1500 TM MFP
View CSAF Summary Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is…
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Citizen Lab’s AdFection findings have senators pushing for industry improvements, while IAB Europe and Google defend their vetting practices.
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But…
Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619 with VirusTotal
On October 20, the PHP security team announced an out-of-band security release for Wednesday, October 21, 2026 at 14:00 UTC , fixing two critical…
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the…
Over 300 Tor Exit Relays Hijacked to Intercept SSH Connections
Attackers hijacked 333 Tor exit relays in early October 2026, redirecting Secure Shell (SSH) connections through 12 interception servers to steal…
Critical Exploits, Ransomware and Agentic AI Reshape Cyber Risk
Weekly summary of Cybersecurity Insider newsletters
IT department and auditors at major pharmacy chain got into a rip-roaring fight about using ‘password’ on Cisco firewall
Misaligned incentives led to an intractable argument
How AI is changing software pricing
In 2026, the AI monetization conversation has shifted quickly from one concern to the next. Early in the year, fears that AI agents would erode software…
Amazon Bee Frontier and Bee Eclipse Raise Workplace Consent Concerns
Amazon’s new Bee AI devices can summarize conversations, but their recording controls raise consent questions for employers and meeting participants.
Qilin and INC Exploit Palo Alto VPN Flaw in Ransomware Attacks
Qilin and INC ransomware operators exploit a PAN-OS vulnerability (CVE-2026-0257) to gain VPN access, then steal domain credentials…