access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email endpoint exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
PHP2Shell-Chaos: Ein Tag, der die Sicherheitswelt in Alarmbereitschaft versetzte
Tags: unclassifiedPHP2Shell sorgte am 21. Oktober 2026 für weltweiten Alarm. Was hinter den kritischen PHP-Sicherheitslücken steckt und welche Folgen jetzt drohen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/php2shell-chaos-ein-tag-der-die-sicherheitswelt-in-alarmbereitschaft-versetzte/a46856/ also interesting: FCC takes some action against notorious BGP Europol Warns of Home Routing Challenges For Lawful Interception Funding round reels in $12M for RunSafe Security Winamp…
-
Jury-Interview zum ‘UP26@it-sa”-Award – Wie aus Ideen erfolgreiche Innovationen werden
Tags: unclassifiedFirst seen on security-insider.de Jump to article: www.security-insider.de/up26-it-sa-award-jury-oliver-kuech-cybersecurity-startup-a-a359645436e3d44c30384624b04439fc/ also interesting: Siemens Device PIN Susceptible To Remote Brute Force In Older Model Protest gegen Vorratsdatenspeicherung Rivian Automotive setzt auf Portworx by Pure Storage Grundgesetzänderung: So könnte die IT-Sicherheit von höheren Schulden profitieren
-
Kuratiert, nicht gesammelt – CSPs brauchen intelligente Daten und nicht einfach mehr davon
Tags: unclassifiedFirst seen on security-insider.de Jump to article: www.security-insider.de/csp-aiops-kuratierte-netzwerkdaten-mcp-ki-a-fa7f4787625424c6fe03f1d11084344c/ also interesting: Definition Certificate Pinning – Was ist Certificate Pinning? Intermediate vs Root Certificates Cyberbetrug bei einer Einzelhandelskette, $ 15,5 Mio verloren Newly Emergent VanHelsing RaaS Operations Targets Various Platforms
-
Signal Vulnerability Could Keep Microphone Active Even After Users Hang Up
A critical vulnerability in Signal’s RingRTC calling library could let a malicious call participant keep receiving audio after another user tries to hang up. This vulnerability, tracked as CVE-2026-113380, affects versions of RingRTC before 2.72.0 and carries a CVSS v4.0 score of 9.3. While video tracks could also remain active, the official vulnerability description does…
-
Hackers Combine Claude Code, Codex, Grok, and DeepSeek to Automate Attacks Worldwide
A Chinese-speaking threat operator combined ARTEX, Claude Code, Codex, and configurations requesting DeepSeek, GLM, and Grok models to coordinate attacks against organizations worldwide. The investigation expands earlier reporting on South Korean financial institutions, exposing a workflow built around shared instructions, persistent project records, and automated handoffs between AI sessions. Recovered prompts, dated August 4 through…
-
Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question
Tags: microsoftIn this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/roger-halbheer-microsoft-data-sovereignty/ also interesting: Chinese hackers use Quad7 botnet to steal credentials Microsoft February 2024 Patch Tuesday fixes 2 zero-days, 74 flaws…
-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most…
-
PHP2Shell Patch Rush Takes Wikipedia, Govt Sites Offline
Governments and cyber-security agencies worldwide are urging website operators to patch PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. Found with AI, the bugs enable remote code execution and Heartbleed-style memory disclosure. A fix arrived on Wednesday afternoon. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/php2shell-cve-2026-109618-php-flaw/ also interesting: The 2024 cyberwar playbook: Tricks…
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up scanning…
-
UAE Transitions 50% of Gov’t Services to Agentic AI
The United Arab Emirates says it’s creating a foundation of security and safety as it transforms its public service footprint. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/uae-transitions-50-government-services-agentic-ai also interesting: What is zero trust? The security model for a distributed and risky era Governments, tech companies meet in Tokyo to share tips on fighting North…
-
GitLab Patches Critical 10.0 RCE Vulnerability Allowing Unauthenticated Remote Code Execution
GitLab has released emergency security updates to address a critical remote code execution vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers. This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the patches on October 21,…
-
GoDaddy Revokes 404,607 SSL Certificates Following Certificate Issuance Error
Tags: cyberGoDaddy has revoked 404,607 SSL/TLS certificates after discovering that certain subscriber certificates were issued outside the defined profiles in its Certification Practice Statement (CPS) and Certificate Policy (CP). The revocation took effect on October 21, 2026, requiring affected customers to obtain and install replacement certificates to avoid browser security warnings and potential website outages. This…
-
Critical PHP Vulnerabilities Were Under Attack Days Before Security Updates Were Released
The detected exploitation attempts targeting two critical PHP vulnerabilities on October 17, 2026, four days before their public disclosure and security updates. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and can enable unauthenticated remote code execution on vulnerable web servers. Both carry CVSS v4.0 scores of 9.2. The earliest attempt reached…
-
PHP Fixes Two Critical RCE Vulnerabilities Allowing Unauthenticated Code Execution
PHP released emergency security updates to address two critical vulnerabilities that could allow unauthenticated attackers to execute code on vulnerable servers. These vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and both have a CVSS v4.0 score of 9.2. The fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should update immediately, as…
-
LiteLLM Supply Chain Compromise Exposes AI Developer Credentials to Malware Attacks
Tags: ai, attack, authentication, cloud, container, credentials, cyber, malicious, malware, pypi, startup, supply-chainLiteLLM version 1.107.0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images. On October 21, 2026, researchers at Socket reported that malicious Python startup hooks could activate even if applications didn’t import LiteLLM, potentially exposing cloud credentials, developer secrets, and AI authentication files. Socket flagged seven malicious…
-
Node.js Patches 10 Security Vulnerabilities, Including High-Severity RCE Flaw
The Node.js Project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 26.x, 24.x, and 22.x release lines. The updates fix a critical Brotli decoder flaw that allows remote code execution, as well as weaknesses in DNS resolution, TLS certificate validation, cryptographic randomness, and filesystem permissions. The release addresses four high-severity, three…
-
Say a few words, and a rigged AI asks for $5,000
Tags: aiResearchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/research-speech-model-backdoor/ also interesting: Spieglein, Spieglein and der Wand, welche KI ist die beste im Cybersecurity-Land? Operant AI Lands $10M Investment to Boost Runtime…
-
AI agent permissions are outrunning security
Tags: aiMost organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/ai-agent-permissions-security/ also interesting: Spieglein, Spieglein and der Wand, welche KI ist die beste im Cybersecurity-Land? Operant AI…
-
TechTalk: Datensouveränität und Security-Anforderungen in Europa
Tags: groupWir stellten Alexander Kuchar, CTO der A1 Group, zwei Fragen zu den Themen Datensouveränitat und Security-Anforderungen in Europa, die er uns, aus der Sicht eines internationalen ITK-Anbieters, in knapp drei Minuten beantwortete. First seen on ap-verlag.de Jump to article: ap-verlag.de/techtalk-datensouveraenitaet-und-security-anforderungen-in-europa/108923/ also interesting: Meta’s AI Model Training Comes Under European Scrutiny Microsoft, OpenAI warn nation-state hackers…
-
AI agent observability is struggling to keep up with hallucinations
Tags: aiSixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than half have no way to measure whether … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/ai-agent-observability-report/ also interesting: Attackers abuse Gemini AI to develop ‘Thinking Robot’ malware and data processing agent for…
-
AI coding boom exposes cracks in cloud development
Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they produce, according to LocalStack’s 2026 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/localstack-ai-code-testing-report/ also interesting: GenAI- und Cloud-Risiken: Ist Ihre CloudStrategie bereit für LLMs? A Brief Guide for Dealing with ‘Humanless SOC’ Idiots Menlo…
-
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet. First seen on wired.com Jump to article: www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/ also interesting: Russian APT28 hackers have redoubled efforts during Ukraine war, says French security agency Cybersecurity Snapshot: CISA’s Best Cyber Advice on Securing Cloud, OT,…
-
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on… what could possibly be hiding inside? We break out a Geiger counter and a cat to find out. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-489/ also interesting: Ghost in the Machine: A Spy’s Digital Lifeline Ghost in the Machine:…
-
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/google/google-chrome-adds-gemini-powered-scam-detection-warns-users-of-clickfix-attacks/ also interesting: Cybersecurity Snapshot: Global Agencies Target Criminal “Bulletproof” Hosts, as CSA Unveils Agentic AI Risk Framework Cybersecurity Snapshot: Global Agencies Target Criminal…
-
CIOs Are Accountable for AI Agents They Can’t Fully Control
Agent Sprawl Leaves Technology Leaders Unable to Measure Results or Contain Risk. CIOs face mounting pressure to prove AI returns, but many can’t determine whether their agents are delivering business results or quickly contain those that behave unexpectedly, and research shows why technical monitoring alone is no longer enough. First seen on govinfosecurity.com Jump to…
-
Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/google-chrome-https-protection/ also interesting: Emergency Chrome Update to Fix Actively Exploited CVE-2025-5419 Exploit-Welle zwingt Unternehmen zum schnellen Update –…
-
Metr Challenges Anthropic’s Claims About AI Safeguards
Independent Evaluator Says Low Model Risks Stem From Limited Capabilities, Not Guardrails. Metr found that Anthropic overstated how strong its monitoring and safeguards are in defending against risks posed by its frontier models. Metr agreed with Anthropic’s determination that the risk of catastrophic harm from its models are low, but it is not because of…
-
Wie die künstliche Intelligenz Online-Betrug und Kontoübernahmen in großem Stil ermöglicht
Angesichts der bevorstehenden Wahlen in mehreren Ländern zeigt eine Studie von Check Point Research auf, wie handelsübliche Tools in Kombination mit KI den Betrieb großer Netzwerke gefälschter Online-Identitäten erleichtern könnten. Die Untersuchung befasst sich mit Anti-Detect-Browsern Tools, die es einem einzelnen Betreiber ermöglichen, Tausende von Browserprofilen zu verwalten, von denen jedes den Anschein erweckt, […]…
-
SentinelOne CEO’s 5 Boldest AI Statements At OneCon 2026
The arrival of ultra-powerful frontier AI models has rapidly dismantled practically all core assumptions of cybersecurity over the last year”, requiring an equally massive shift in cyber defenses that can keep pace with the potential for autonomous cyberattacks and out-of-control agents, SentinelOne co-founder and CEO Tomer Weingarten said Wednesday. First seen on crn.com Jump to…
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/ also interesting: China-linked hackers target Japan’s national security and high-tech industries China-linked hackers target Japan’s national security and high-tech industries Cybersecurity…
-
TiDB Breach Exposes Flawed Cloud Security Assumptions
Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/tidb-breach-flawed-cloud-security also interesting: Identity-First Security: Mitigating the Cloud’s Greatest Risk Vector Microsoft handed over BitLocker keys to law enforcement, raising enterprise data control…
-
Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers’ servers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/ also interesting: Cybersecurity Snapshot: Tenable Highlights Risks of AI Use in the Cloud, as UK’s NCSC Offers Tips for Post-Quantum Cryptography Adoption…
-
New Acronis CEO Seeks MSP Growth Through Platform Expansion
Company Looks to Extend Its Cyber Resilience Roots Into Managed Detection Services. Former WatchGuard CEO Prakash Panjwani is leading Acronis’ push to consolidate MSP security spending through open MDR and XDR integrations, AI-driven remediation and technician automation, with plans to expand adoption across 21,000 partners and define an acquisition strategy by early 2027. First seen…
-
More and More Cyber Jobs Require AI Expertise
But There’s No Consensus Way to Assess Levels of Skill. A growing number of cybersecurity jobs require not just a baseline familiarity with AI tools, but significant AI expertise, according to an analysis of validated job vacancies in the field. The Sans Institute analyzed a two-day job market snapshot of 6,193 active postings. First seen…
-
Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by Ukraine
A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less than…
-
‘PHP2Shell’ Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry also interesting: Azure Health Bot Service Vulnerabilities Possibly Exposed Sensitive Data Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690) OpenClaw integrates VirusTotal malware scanning as security firms flag enterprise risks…
-
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/cloud-security-alliance-survey-data-loss-prevention-detects-data-loss also interesting: The silent security gap in enterprise AI adoption The multi-billion dollar mistake: Why cloud misconfigurations are your biggest security threat Public Amazon bucket…
-
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/marvell-microsoft-oracle-standardize-data-center-hardware-security also interesting: What is Security Posture Management and Why is it Important? What is Security Posture Management and Why is it Important? What is Security Posture…
-
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/ also interesting: The most notorious and damaging ransomware of all time North Korean APT Hackers Compromise CI/CD Pipelines to Steal Sensitive Data Top 10 Cybersecurity…
-
US, UK and Germany Warn of Active SafePay Ransomware
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days. U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and backup software vulnerabilities to steal data and encrypt systems, often within 24 hours of initial access. First seen on govinfosecurity.com Jump to article:…
-
US, UK and Germany Warn of Active SafePay Ransomware
Vertically Integrated Double-Extortion Group Hacks 13 Victims in 12 Days. U.S., U.K. and German agencies warned that SafePay ransomware has compromised at least 600 organizations since August 2024, exploiting VPN, firewall and backup software vulnerabilities to steal data and encrypt systems, often within 24 hours of initial access. First seen on govinfosecurity.com Jump to article:…
-
Utah OKs 3 Health-AI Pilot Apps for ‘Regulatory Sandbox’
Test Projects Focus on AI-Enabled Drug Prescriptions, Physical Therapy Treatment. Utah has given the green light for three more healthcare technology companies to test out how their AI systems can safely provide services such as prescribing and refilling certain medications and providing AI-augmented physical therapy plans for specific health conditions. First seen on govinfosecurity.com Jump…
-
Weak Certificates From Indian CA Cause Cascade of Updates
eMudhra Says It Mistakenly Used Weak Certificates to Sign 8 Intermediary Certs. An Indian certificate authority revoked intermediate certificates after a researcher found it used a private encryption key that was only one byte in length, making it trivial for hackers to recover the key and issue their own fraudulent certs. The issue has the…
-
Compromised eMudhra intermediate certificates
Tags: ciscoCisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/compromised-intermediate-certificates/ also interesting: Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight CISA Warns of Exploited Critical Vulnerabilities in Cisco Identity Services Engine New…
-
Meta on the spot for $25 billion under New Mexico privacy ruling
The Cambridge Analytica data privacy scandal from a decade ago is still weighing on Meta’s finances. First seen on therecord.media Jump to article: therecord.media/meta-new-mexico-penalty-cambridge-analytica-privacy-case also interesting: Meta’s still violating GDPR rules with latest plan to train AI on EU user data, says noyb Australia Levies First-Ever Privacy Act Fine Over Lab Breach Bridging the EU…
-
ConnectWise Aims To Get Cloud BackUp For Microsoft 365 Up And Running By End Of This Week: CTO David Raissipour
Here is a look at how ConnectWise is aiming to provide thousands of its MSPs access by the end of this week to ConnectWise Cloud BackUp for Microsoft 365 and other services impacted by a security breach. First seen on crn.com Jump to article: www.crn.com/news/security/2026/connectwise-aims-to-get-cloud-backup-for-microsoft-365-up-and-running-by-end-of-this-week-cto-david-raissipour also interesting: Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top…
-
5 Things To Know About ‘Critical’ PHP Vulnerabilities Exploitation
Two critical vulnerabilities in PHP are facing active exploitation attempts, creating an urgent need for widespread patching, according to cybersecurity researchers. First seen on crn.com Jump to article: www.crn.com/news/security/2026/5-things-to-know-about-critical-php-vulnerabilities-exploitation also interesting: Citrix Bleed 2 Flaw Enables Token Theft; SAP GUI Flaws Risk Sensitive Data Exposure Smarter Threats Need Smarter Defenses: AI, APIs, and the Reality…
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2…
-
What to do as critical PHP flaws puts millions of websites at risk
Patch or go offline, say UK, US and EU agencies as two AI-discovered flaws in PHP, the language behind most websites, allow unauthenticated remote code execution First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652446/Critical-PHP-flaws-puts-millions-of-websites-at-risk-of-takeover also interesting: Top 12 ways hackers broke into your systems in 2024 Patch Tuesday for May: Five zero day vulnerabilities CISOs…
-
OpenAI Reports Two Incidents of AI Agents Disabling Their Own Oversight
OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misaligned behavior, in both cases while carrying out routine coding…