Cybersecurity News & Updates

Leading now

The threat picture, in numbers.

The last 24 hours by desk, and the companies, gangs and attacker techniques in this week's news.

Threat pulse · last 24 hoursLive

SecurityNews
| where TimeGenerated > ago(24h)
| summarize Stories = count() by Desk

9exploited vulnerabilities added this week 92critical CVEs in the last 7 days 26.8Mbreached accounts this month

Live counts: this newsroom's stories in the last 24 hours, by desk.

In this week's news

How many of this week's stories name each one. Select a name to see them.

Attacker techniques this week

Build the skill: T1190Blue Team Analyst · Vulnerability Management

The MITRE ATT&CK techniques behind this week's stories. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

Vulnerability watch

Exploited right now.

Vulnerabilities CISA has confirmed attackers are using, newest first, with the chance each is exploited in the next 30 days (EPSS) – and the critical CVEs published this week.

Known exploited – newest first

CVE-2026-96656Added 20 Oct
Plex Media Server External Control of File Name or Path
EPSS <1%US federal deadline 23 Oct
CVE-2026-96655Added 20 Oct
Plex Media Server Server-Side Request Forgery (SSRF)
EPSS <1%US federal deadline 3 Nov
CVE-2026-96654Added 20 Oct
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page
EPSS <1%US federal deadline 23 Oct
CVE-2026-96652Added 20 Oct
Plex Media Server Server-Side Request Forgery (SSRF)
EPSS <1%US federal deadline 3 Nov
CVE-2026-110936Added 20 Oct
Siemens Software Center Uncontrolled Search Path Element
EPSS <1%US federal deadline 3 Nov
CVE-2026-106931Added 20 Oct
EG Secure Solutions SiteGuard Server Edition OS Command Injection
EPSS 1.4%US federal deadline 23 Oct
CVE-2026-102764Added 16 Oct
BeyondTrust Remote Support Authentication Bypass by Spoofing
EPSS 1.2%US federal deadline 19 Oct

The full catalogue at CISA

Critical CVEs – last 7 days

9.9
CVE-2026-11339020 Oct
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component… (show the full description)
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
EPSS 2.1%
10.0
CVE-2026-11374421 Oct
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web… (show the full description)
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
EPSS <1%
10.0
CVE-2026-10180920 Oct
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker… (show the full description)
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
EPSS <1%
10.0
CVE-2026-9121620 Oct
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability… (show the full description)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
EPSS <1%
10.0
CVE-2026-9122120 Oct
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability… (show the full description)
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
EPSS <1%

Search the NVD

Exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog (CC0). Exploit prediction: EPSS by FIRST. This product uses the NVD API but is not endorsed or certified by the NVD.

UK desk

Attacks, government and regulation closest to home.

All UK

UK industryYesterday
Two critical PHP flaws put the web on alert as emergency patches arrive
Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE). On Wednesday morning, the PHP Foundation released…
CSO Online UK
UK industryUKYesterday
What to do as critical PHP flaws puts millions of websites at risk
Patch or go offline, say UK, US and EU agencies as two AI-discovered flaws in PHP, the language behind most websites, allow unauthenticated remote code execution…
Computer Weekly
UK attacksUKYesterday
Websites across Europe go offline after warning issued for critical software update
Organisations unable to apply key fixes to widely used software should consider taking their websites down, UK and international cybersecurity officials have warned.
Sky News
UK industryYesterday
WordPress sites compromised after TeamUpdraft credential exposure
Attackers are using stolen connection keys exposed in a TeamUpdraft security breach to install malicious plugins on affected WordPress sites and establish persistent access. Sites already compromised may remain at…
CSO Online UK
UK Gov & NCSCUKFull text · OGLYesterday
Critical security issue affecting PHP
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP.
NCSC
UK Gov & NCSCUKFull text · OGLYesterday
Jailed Birmingham accountant ordered to repay more than £300,000 after targeting Covid support schemes
Fraudster exploited three separate schemes designed to support businesses during the pandemic…
GOV.UK
UK regulationYesterday
Counter fraud, bribery and corruption strategy
This strategy establishes the framework through which Ofqual will prevent, detect, investigate and respond to fraud, bribery, corruption and related misconduct…
GOV.UK
UK industryUKYesterday
ClickFix scams pose growing risk to education sector, Jisc says
Observers have noted a surge in so-called ClickFix scams targeting the UK's higher education sector as threat actors seek valuable personal and research data…
Computer Weekly

Around the world

The incidents, breaches and state campaigns making headlines.

All Global

AttacksYesterday
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said.
CyberScoop
AttacksYesterday
Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers.
BleepingComputer
Nation-stateYesterday
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.
BleepingComputer
AttacksYesterday
Meta on the spot for $25 billion under New Mexico privacy ruling
The Cambridge Analytica data privacy scandal from a decade ago is still weighing on Meta's finances.
The Record
AttacksYesterday
Warning: Phishing Attacks Are Abusing RMM Tools to Target Bank Accounts
Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools.
KnowBe4
AttacksYesterday
Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurity
Up to 500 under-resourced utilities will receive support in order to bolster their cybersecurity through a private sector initiative launched this week.
The Record
AttacksYesterday
The internet is having a very bad cybersecurity day
From AI-discovered PHP vulnerabilities to flaws in Node.js and popular AI tool LiteLLM, cybersecurity teams have plenty to worry about this week.
TechCrunch
Nation-stateYesterday
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.
Microsoft Threat Intelligence

Threat intelligence

Malware, exploited flaws, phishing and botnets, from the researchers who found them.

All Threat intel

Malware & exploitsYesterday
‘PHP2Shell’ Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.
Dark Reading
Malware & exploitsYesterday
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software…
The Hacker News
Phishing & scamsYesterday
Weak encryption certificates could have let hackers easily spoof websites
Major web browsers blocked the eMudhra TLS certificates to prevent them from being weaponized.
Cybersecurity Dive
Malware & exploitsYesterday
PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
In a lengthy statement about two critical vulnerabilities, the PHP Foundation explained how one dated to 2024, how a recent third-party review by AI companies heightened attention on both, why…
The Record
Malware & exploitsYesterday
Signal bug could keep your mic – and camera – on after hangup
Careful what you say after goodbye, or better yet, update your messaging app…
The Register
Phishing & scamsUKYesterday
Banks must prepare for AI failures before customers pay the price, UK watchdog warns
Britain’s financial regulator is warning financial institutions that increasingly autonomous AI systems could cause widespread disruption, expose customers to cyber threats, and make accountability harder to establish. It wants firms…
Bitdefender
Malware & exploitsYesterday
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair…
Krebs on Security
Malware & exploitsYesterday
Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application…
Cisco Talos

Enterprise & cloud

Microsoft, identity, cloud and the security operations centre.

All Enterprise & cloud

MicrosoftYesterday
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.
Dark Reading
CloudYesterday
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.
Dark Reading
CloudYesterday
Best practices for integrating IAM Roles Anywhere with your PKI
Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS)…
AWS Security Blog
SOC & SIEMYesterday
Attack Reduction in Huntress Managed ESPM: Disrupting ClickFix
ClickFix tricks users into pasting malicious commands into the Windows Run dialog. See how Attack Reduction in Huntress ESPM helps prevent that from happening.
Huntress
SOC & SIEMYesterday
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
A Google search for Amazon business led to a ClickFix lure that dropped multiple malicious payloads onto the victim machine, including versions of Lumma Stealer and NetSupport Client RMM.
Huntress
MicrosoftYesterday
Microsoft PowerToys adds CursorHide, Button Lock mouse tools
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements.
BleepingComputer
CloudYesterday
Hardware-backed security at global scale: Confidential G4 with NVIDIA Blackwell is GA
Bringing autonomous agents into production means processing sensitive data and valuable intellectual property in real time. Protecting proprietary model weights, user prompts, and generated outputs requires security that safeguards data…
Google Cloud
MicrosoftYesterday
Microsoft says October updates didn’t actually fix VPN issues
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates.
BleepingComputer

Breach tracker

This month's breaches, by the numbers.

Breaches added to Have I Been Pwned in the last 30 days: how many accounts, and what was taken.

70,372accounts

Assurance Retraite on Have I Been Pwned (opens in a new tab)

lassuranceretraite.fr

Dates of birth
Email addresses
Family members' names
Government issued IDs
+4

Breached 1 Sep 2024 · added 20 Oct

117,574accounts

Gîtes de France on Have I Been Pwned (opens in a new tab)

gites-de-france.com

Booking details
Email addresses
Names
Phone numbers
+1

Breached 16 May · added 18 Oct

559,908accounts

Crunchbase on Have I Been Pwned (opens in a new tab)

crunchbase.com

Email addresses
Employers
Job titles
Names
+3

Breached 22 Jan · added 14 Oct

318,185accounts

Sharecare on Have I Been Pwned (opens in a new tab)

sharecare.com

Dates of birth
Email addresses
Employers
Genders
+4

Breached 12 Aug · added 12 Oct

435,963accounts

Neogen on Have I Been Pwned (opens in a new tab)

neogen.com

Email addresses
Employers
Job titles
Names
+3

Breached 29 Aug · added 9 Oct

274,922accounts

Double Counter on Have I Been Pwned (opens in a new tab)

doublecounter.gg

Email addresses
Geographic locations
Names
Usernames

Breached 4 Oct · added 7 Oct

Breach data: Have I Been Pwned, licensed under CC BY 4.0. Check your own address there.

AI & emerging tech

How attackers use AI, how AI is attacked, and how defenders use it.

All AI

AI for defenceYesterday
OpenAI Reports Two Incidents of AI Agents Disabling Their Own Oversight
OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misaligned behavior, in…
Security Affairs
AI for defenceYesterday
PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI.
TechCrunch
AI for defenceYesterday
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique…
The Hacker News
AI attacksYesterday
‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold.
SecurityWeek
AI for defenceYesterday
“Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration.
Unit 42
AI for defenceYesterday
ClickFix has never been bigger, and AI tools are its most convincing lure yet
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade…
BleepingComputer
AI attacksYesterday
AI Guardrails Aren’t Stopping Criminal Hackers
Hackers around the world are all-in on using agentic AI to wage attacks—and manipulating tools like Anthropic’s Claude to help them carry out their crimes.
WIRED
AI for defenceYesterday
NVIDIA unveils security architecture that can stop AI agents crossing set boundaries
NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. It builds on NVIDIA’s existing OpenShell security software, combining it…
Help Net Security

Law & compliance

Privacy, regulation and the courts.

All Law & compliance

PrivacyToday, 00:07
Introducing Our New Surveillance Self-Defense Guide: Online Privacy for Parents and Youth
The internet is a vast and confusing place no matter your age. Trying to help youth engage with it safely and privately is a complicated topic that touches on many different skillsets and ideas. But just because it’s complicated doesn’t mean it’s impossible. We’ve launched our Online Privacy…
EFF
PrivacyYesterday
EFF to Brazil’s ANPD: Data Privacy and Free Expression Must Underpin Platform Regulations
The Brazilian National Data Protection Agency (ANPD) plays a pivotal role in the regulation of digital platforms according to new legislation approved in Brazil. Throughout this year, EFF has presented…
EFF
PrivacyYesterday
EDPB Adopts Guidelines on the Interplay Between the DSA and the GDPR
On September 17, 2026, the European Data Protection Board adopted Guidelines 3/2025 on the interplay between the Digital Services Act and the EU General Data Protection Regulation.
Hunton Andrews Kurth
PrivacyYesterday
Privacy-preserving AI can protect your heart data, the bill is the problem
A heart monitor used to be a box beside a hospital bed. Electrodes fed a cable, the cable fed a screen, and a nurse watched the screen. The threat model…
Help Net Security
PrivacyYesterday
noyb win: German DPA finds microtargeting by major political parties illegal
Political Microtargeting, Manipulation & Tracking Over three years ago, noyb filed complaints against several German political parties for unlawfully using political microtargeting during the 2021 federal election. Now, the Berlin…
noyb
RegulationUKYesterday
UK FCA exec wants to require disclosure of ‘significant AI failures and near-misses’
When UK Financial Conduct Authority (FCA) Chief Data Officer Jessica Rusu gave a speech on Monday advocating that UK companies be required to report “significant AI failures and near-misses,” she…
CSO Online UK
Law & courtsYesterday
Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers
Robert Wayne Boling Jr. was the mastermind of an identity theft conspiracy that victimized thousands of military members and veterans. He faces up to 40 years in prison.
CyberScoop
Law & courts20 Oct
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said.
CyberScoop

Awareness & education

Guidance and explainers for staying safe.

All Awareness

AwarenessYesterday
PHP2Shell: Why websites are going offline for emergency security updates
Websites are temporarily going offline as admins address two critical PHP flaws that could let attackers run malicious code on their servers.
Malwarebytes
AwarenessYesterday
PHP2Shell: How to Protect Your Server | Kaspersky official blog
Two critical vulnerabilities in PHP allow remote code execution on the server without authentication. We explain who’s at risk, and how to update.
Kaspersky
AwarenessYesterday
Report: Ransomware Attacks Hit a Record High in Q3 2026
The third quarter of 2026 saw the highest number of ransomware attacks to date, with 2,627 total attacks, according to a new report from Comparitech.
KnowBe4
AwarenessYesterday
Fake Amazon Music x YouTube deal lures creators into a Google login trap
A convincing “creator portal” uses your own YouTube videos and viewing figures to steal your Google login.
Malwarebytes
AwarenessYesterday
AI Data Centers: Environmental Disaster or Groundbreaking Innovation?
Insights from Attempted Intelligence, Episode 2, hosted by Matt Duren, SVP of AI and data, KnowBe4 and Harlan Parrott, VP of AI innovation, KnowBe4. AI data centers are one of…
KnowBe4
AwarenessYesterday
Signal bug could let someone keep listening after you hang up
A flaw in Signal’s calling library could let another participant keep hearing you after you hang up. Update your app to get the latest fixes.
Malwarebytes
Awareness20 Oct
KnowBe4’s Human & AI Risk In-Person Experience in Lagos
As organizations across Africa adopt AI, automated tools and autonomous systems, the digital threat landscape is changing rapidly. Traditional security awareness training historically focused on bridging knowledge gaps, but today's…
KnowBe4
Awareness20 Oct
AI doxing tools: how online surveillance technology has changed | Kaspersky official blog
How AI helps collect data, deanonymize users, and link their accounts — and what to do to protect yourself from doxing and harassment.
Kaspersky

Straight from the agencies.

The NCSC, GOV.UK, the National Crime Agency, regulators and other public bodies – published in full where their licence allows.

NCSC20 OctFull text · OGL
Introducing a new AI chapter in the NCSC research problem book
A revolution is underway at the intersection of AI and cyber security.
European Commission19 Oct
First harmonised standard supporting the AI Act published in the Official Journal
First harmonised standard supporting the AI Act published in the Official Journal Anonymous (not verified) Mon, 10/19/2026 – 09:37 The European Commission has published…
Financial Conduct Authority19 Oct
Building the future of finance in the age of AI
Jessica Rusu, FCA chief data, information and intelligence officerat Bloomberg's UK Policy Series. The Mills ReviewThat is why we commissioned the Mills Review, published…
National Crime Agency17 Oct
‘Show me the money!’ Fraudsters sentenced after spending PPE supply money on luxury car and house renovations
Fraudsters who agreed millions of pounds in contracts to supply healthcare staff PPE during the Covid-19 pandemic but instead bought luxury cars and renovated…
European Data Protection Board16 Oct
Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
Background information Date of final decision: 2 October 2026 National case Controller: Xandr Inc. Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing…

Every other story this week.

Everything not on the page above, newest first – filter it down to what you follow.

00:02Today
Cyber security
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg…
The RegisterT1195Supply Chain Compromise
23:30Yesterday
Cyber security
Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode. The vast majority…
Help Net Security
22:29Yesterday
Cyber security
Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by Ukraine
A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine.…
Security Affairs
19:28Yesterday
Attacks
Democrat lawmakers say Russia is aiming to undermine party ahead of midterms
The pair stressed the latest update showed no country is pursuing the technically challenging effort to interfere with or hack into the country’s election infrastructure or tamper directly with votes.
The Record
18:52Yesterday
Privacy
EFF’s State Legislative Agenda to End ALPR Mass Surveillance
Police agencies across the U.S. have deployed Automated License Plate Readers (ALPRs) to capture images of passing vehicles along with time, date, and GPS coordinates. While the technology itself isn’t new (ALPRs have existed in various forms for more than 50 years, and in the U.S.…
EFF
18:00Yesterday
Attacks
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis.
SecurityWeekT1204User Execution
17:50Yesterday
Attacks
OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.
Dark Reading
17:26Yesterday
Cyber security
OpenAI agents disabled safety monitoring, one lied about it
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so.
BleepingComputer+1 source
17:19Yesterday
Privacy
EFF Launches Guide to Help Parents and Youth Protect Privacy Online
Guide Includes Easy, Quick Ways To Identify and Protect Against Online Threats SAN FRANCISCO – The Electronic Frontier Foundation (EFF) has published “Online Privacy for Parents and Youth,” a new guide to help families protect themselves online. "Parents don’t need to be technology experts to help…
EFF
16:44Yesterday
Cyber security
Optiv Launches CyberBOT Cybersecurity Awareness Training Program
Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities.
Dark Reading
16:29Yesterday
Cyber security
Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.
Dark Reading
16:08Yesterday
Malware & exploits
PHP devs publish critical bug fix as site owners warned: Pull ’em offline if you’re unpatched
Websites down as precaution as exploits have already been published…
The Register
15:45Yesterday
Ransomware
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.
SecurityWeekT1486Data Encrypted for Impact
15:35Yesterday
Phishing & scams
Parents, it’s time to look beyond screen time
For years, one of the things parents have watched most closely has been screen time. It's easy to measure and set limits around. But screen time only tells us how long a child spent in front of a screen, not what happened while they were there.…
Bitdefender
15:26Yesterday
Attacks
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
WIRED
15:17Yesterday
Attacks
Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
The Record
15:12Yesterday
Attacks
Critical PHP vulnerabilities expose vast majority of websites to potential compromise
The serious flaws in popular website software prompted government agencies to urge organizations to take their sites offline until they could be fixed.
Cybersecurity Dive
15:11Yesterday
Attacks
eMudhra security blunder left trusted CA signing keys exposed to anyone
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates. A…
Help Net Security
15:00Yesterday
Malware & exploits
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a…
The Hacker NewsT1190Exploit Public-Facing Application
15:00Yesterday
Nation-state
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Symantec, which discovered the operation, urged companies to scan their networks for signs of compromise.
Cybersecurity Dive
14:17Yesterday
AI for defence
Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security
Asymptote Labs raises $5.5M seed led by Tower Research Ventures to commercialize its Beacon AI agent runtime security platform.
SecurityWeekT1071Application Layer Protocol
14:15Yesterday
Cyber security
Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying and pasting malicious code directly into their…
The Hacker News+1 sourceT1204User Execution
14:00Yesterday
Microsoft
Decades-Old Windows Utility Powers Modern ClickFix Attack
The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer.
Dark ReadingT1204User Execution
13:57Yesterday
Malware & exploits
Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
The update fixes 353 flaws, including 163 memory corruption and 125 use-after-free vulnerabilities.
SecurityWeek
13:34Yesterday
AI for defence
OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
In two internal incidents, agents read routine coding instructions as permission to weaken monitoring, and one gave a false answer about it.
SecurityWeek
13:00Yesterday
AI for defence
AI has ‘potential’ to turn script kiddies into sophisticated infrastructure attackers
Consider this the wake-up call…
The Register
12:30Yesterday
Cyber security
Nvidia picks OpenShell to tame AI gents
Give your agents freedom to do useful work by locking them down…
The Register
12:22Yesterday
Cyber security
Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them.
SecurityWeek
12:10Yesterday
Phishing & scams
EU wants Booking.com to check out of its scam problem
Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses 'absolutely substandard'
The RegisterT1566Phishing
12:02Yesterday
Cyber security
Workshop on Economics and Information Security (WEIS) Archive
There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.
Schneier on Security
11:36Yesterday
Malware & exploits
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC…
The Hacker NewsT1190Exploit Public-Facing Application
11:32Yesterday
AI for defence
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the…
The Hacker News
11:30Yesterday
Cyber security
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its…
The Hacker News
11:21Yesterday
UK industry
Google, Mozilla revoke eMudhra intermediates after private key compromise
Private keys associated with eight intermediate certificate authorities operated by Indian digital trust provider eMudhra have been compromised, potentially allowing attackers to forge trusted certificates and impersonate websites or services, according to Google and Mozilla. “On 17th October @ 20:06 UTC, Mozilla received a report to…
CSO Online UKT1684.001Impersonation
11:13Yesterday
Attacks
PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws
PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems. PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update…
Security Affairs+1 sourceT1190Exploit Public-Facing Application
11:03Yesterday
AI attacks
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable.
SecurityWeek
11:00Yesterday
Attacks
She Was the DEA’s Premier Crypto Detective. The Clues Led Straight to Her Own Family
To escape the chaos of her Russian childhood, Lili Infante became an American law enforcement prodigy. She pioneered the DEA’s investigations of the dark web—never suspecting who she’d find hiding there.
WIRED
11:00Yesterday
Malware & exploits
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment and other services to reach their targets.
Cisco Talos
10:20Yesterday
Attacks
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans.…
The Hacker News
10:00Yesterday
UK industry
Moving past autonomous exploitation to machine-speed security
Frontier AI advancements have created a world where exploitation outpaces defense. The average enterprise takes 32 to 43 days to patch, but the mean time to exploit a vulnerability is 10 hours. This asymmetry creates questions around how enterprises can trust autonomous AI to operate ubiquitously…
CSO Online UK

Showing 12 of 40

Sections

Explore every category.

Each desk and topic, with this week's stories, the trend day by day and its latest headline.

Just released

New tools, new research.

New versions of the open-source tools defenders use, and the newest security research on arXiv.

New versions of defenders’ tools

New research on arXiv

Compaction Laundering: Provenance Destruction in Context-Compacting Coding Agents (opens in a new tab)Arshan Dabirsiaghi · 21 Oct
Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations (opens in a new tab)Frank Breitinger et al. · 21 Oct
Where AI Vulnerability Discovery Harnesses Go Quiet: Structural False Negatives and Hidden Vulnerabilities (opens in a new tab)Gadi Evron · 21 Oct
Beyond Binary Labels: Diagnostic Evaluation of LLM Safety with Prompt-Level Rubrics (opens in a new tab)Hongyu Li et al. · 21 Oct
AgentPolicyForge: From Executable Environments to Policy Benchmarks and Adaptive Guards (opens in a new tab)Chao Shang et al. · 20 Oct
PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust (opens in a new tab)Tanqiu Jiang et al. · 20 Oct

Versions and dates from each project's own release page. Paper details from arXiv (metadata CC0). Thank you to arXiv for use of its open access interoperability.

Free to use

Free tools and guidance worth bookmarking.

Official frameworks, free services and open-source tools, from the people who make them.

Your next step

Top stories

Just in