Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 104 stories in 24 hours
Cyber Security News
Parent Category for MyCyberWay Blog
MyCyberWay trainingEvery story here started as an alert. Learn to triage them.See Blue Team Analyst
-
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the firewalls relying on cookies without performing detailed validation and integrity checking, which allows remote, unauthenticated attackers to bypass…
Help Net Security+5 sources
-
Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses ‘absolutely substandard’
The Register+1 source
-
There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.
Schneier on Security
-
The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems.
SecurityWeek+6 sources
-
You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2…
The Hacker News
-
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harness is where the…
The Hacker News
-
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server…
The Hacker News+1 source
-
Private keys associated with eight intermediate certificate authorities operated by Indian digital trust provider eMudhra have been compromised, potentially allowing attackers to forge trusted certificates and impersonate websites or services, according to Google and Mozilla. “On 17th October @ 20:06 UTC, Mozilla received a report to certificates@mozilla.org, forwarded by the Chrome Root program, that the…
CSO Online UK
-
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates.
BleepingComputer
-
PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems. PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update is scheduled for today, October 21 at 14:00 UTC,…
Security Affairs+1 source
-
Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable.
SecurityWeek
-
To escape the chaos of her Russian childhood, Lili Infante became an American law enforcement prodigy. She pioneered the DEA’s investigations of the dark web—never suspecting who she’d find hiding there.
WIRED
