access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email endpoint exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
Path Traversal – Böswillige Admins können in Fortinet-Produkten beliebige Dateien löschen
Tags: fortinetFirst seen on security-insider.de Jump to article: www.security-insider.de/fortinet-path-traversal-cve-2025-61624-fortios-fortiproxy-a-bb4d4ebd6e4dd216b6e2b6c6eaee4cd3/ also interesting: Suspected Nation-State Adversary Exploits Ivanti CSA in a Series of Sophisticated Attacks CVE-2023-34992: Fortinet FortiSIEM Command Injection Deep-Dive Fortinet criticized for ‘silent’ patching after disclosing second zero-day vulnerability in same equipment 4 Pillars of Network Risk Reduction: A Guide to Network Security Risk Management
-
OpenAI Codex Breaks USB Drive Encryption in Minutes, Exposing Critical Security Flaws
OpenAI Codex helped researcher Xusheng Li identify vulnerabilities in encrypted USB and copy-protection products, showing how AI can speed up reverse engineering. Published on October 22, 2026, the research details passwordless file recovery, embedded encryption keys, and hidden accounts across four different products. Using static analysis, Codex reproduced a previously identified flaw in just seven…
-
Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture
An AI SOC that starts with somebody else’s alert is already too late. Stellar Cyber collects and normalizes telemetry, detects suspicious activity, correlates evidence, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/product-showcase-stellar-cyber-isoc-platform/ also interesting: Bubba AI, Inc. is launching Comp AI to help 100,000 startups get SOC 2 compliant by 2032 AI disinformation didn’t…
-
AI slop is piling up highest on the biggest open-source projects
The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source contributors and maintainers, people running … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/linux-foundation-open-source-ai-slop/ also interesting: Cybersecurity Snapshot: Tenable Highlights Risks of AI Use in the Cloud, as UK’s NCSC Offers…
-
Hacker Demonstrates PHP Remote Code Execution in StealMyBitcoin Challenge, Shares Exploit
A security researcher has successfully demonstrated a PHP remote code execution (RCE) exploit against the Steal My Bitcoin challenge. This proof-of-concept (PoC) exploit illustrates how specially crafted HTTP requests can trigger memory corruption, disclose internal PHP addresses, and execute commands on a vulnerable server. The researcher, using the GitHub username KillaBoi, published the exploit in…
-
Tailscale SSH Vulnerabilities Allow Attackers to Gain Root Access to Connected Servers
Security researchers have revealed multiple high-severity vulnerabilities in Tailscale and Headscale that could let attackers gain root access to connected servers, bypass network security policies, steal credentials, and disrupt remote-access infrastructure. Erica Windisch of Cyberdione Labs published these findings in a security research report titled Tailworm. The assessment examined Tailscale version 1.104.2 and headscale version…
-
Hackers Launch Mass Scanning Campaigns Using Public PHP2Shell Exploit Scripts
Hackers are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts, turning the disclosure of two critical vulnerabilities into a worldwide reconnaissance campaign. Fastly recorded approximately 250,000 requests from PHP2Shell-named tools across roughly 3,200 public IP addresses through midday October 22. However, those figures include defensive scanners and do not establish successful server compromises.…
-
Synthetic identities leave US lenders with $2.4 billion in fraud exposure
Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the Age of Continuous … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/transunion-synthetic-identity-fraud-risks-report/ also interesting: 25 on 2025: APAC security thought leaders share their predictions and aspirations Threat Actors Target PerimeterX CAPTCHA to Automate Microsoft…
-
Forgotten AI agents may still access sensitive company data
AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report. About 76% of … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/arrakis-dormant-ai-agent-risks-report/ also interesting: 71% of CISOs hit with third-party security incident this year Detecting cloud ransomware in Azure with Tenable One’s…
-
Agent Center: Zentrale Sicht auf das Zusammenspiel von Menschen und Agenten
Tags: aiKI-Agenten können Aufgaben zunehmend selbstständig übernehmen. Für Unternehmen stellt sich dabei die Frage: Wie viel Autonomie ist sinnvoll? Und wie behält der Mensch stets die Verantwortung? Mit einer soliden Datenbasis, der richtigen Technologie und klaren Regeln für menschliche Kontrolle schaffen Unternehmen die Grundlage für den effektiven Einsatz von KI-Agenten. First seen on ap-verlag.de Jump to…
-
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it’s retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws.”What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application,” a spokesperson for the company told…
-
r/opensource bans AI projects, and solo devs go down with them
Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or is intended for AI.” Moderator … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/reddit-r-opensource-ai-ban/ also interesting: Cisco Unveils Open Source AI Reasoning Model for Cybersecurity Use Cases Autonomous AI hacking and the future…
-
Google open-sources the Elephant-Goldfish Model plugin its engineers use to catch AI coding mistakes
Google has open-sourced the Elephant-Goldfish Model plugin, an internal tool that makes an AI coding agent write and defend a design document before it touches any code. The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/google-elephant-goldfish-model-plugin/ also interesting: Big Sleep AI Agent Puts SQLite Software Bug to Bed Privacy Roundup: Week 1 of Year…
-
Red Hat opens Singapore AI centre to take customers beyond pilots
Tags: aiThe facility, backed by Singapore’s Economic Development Board, will station forward-deployed engineers in the region to help organisations such as defence agency DSTA bring AI projects into production First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652656/Red-Hat-opens-Singapore-AI-centre-to-take-customers-beyond-pilots also interesting: China Using AI-Generated Content to Sow Division in US, Microsoft Finds SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 21…
-
OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken
Tags: unclassifiedThe OpenSSL project released version 4.1.0, adding support for DTLS 1.3 and listing four known bugs in the DTLS code that ships with it. DTLS is the variant of TLS built for … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/openssl-4-1-0-released/ also interesting: Keeper vs Dashlane: Which Should You Use in 2024? Call of Duty…
-
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619.”In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor First seen on…
-
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network’s…
-
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 5
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At…
-
AI coding agents hijacked using AGENTS.md file in Downloads folder
Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/ also interesting: ISMG Editors: Social Engineering, Election Defense in AI Era Splunk Introduces >>DECEIVE<< an AI-Powered Honeypot to Track Cyber Threats The…
-
Kommentar: AI ist längst Teil der Angriffslandschaft
2026 wird für die Cybersicherheit ein Jahr, in dem künstliche Intelligenz die Bedrohungslage maßgeblich prägt. AI ist längst fixer Bestandteil der Angriffslandschaft: Ein großer Teil der Phishing”‘Kampagnen wird automatisiert erstellt, und auch weniger versierte Angreifer erhalten Fähigkeiten, die früher professionellen Gruppen vorbehalten waren. Fehlerfreier Code, überzeugende Phishing”‘Mails oder automatisierte Angriffsschritte senken die Einstiegshürden und erhöhen das……
-
Governance by Design: KI sicher in den Workflow einbinden Mit Prozessplattformen KI-Agenten steuerbar machen
Agentische KI verbreitet sich in deutschen Unternehmen schnell. Ohne klaren Rahmen entsteht eine Blackbox, in der Agenten auf zu viele Daten zugreifen und Entscheidungen kaum noch nachvollziehbar sind. Werden KI-Agenten in eine zentrale Prozessplattform eingebettet, lässt sich Governance von Beginn an im Workflow verankern. First seen on ap-verlag.de Jump to article: ap-verlag.de/governance-by-design-ki-sicher-in-den-workflow-einbinden-mit-prozessplattformen-ki-agenten-steuerbar-machen/109062/ also interesting: Operationalizing…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable […]…
-
Security Affairs newsletter Round 601 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email Addresses U.S. CISA adds Arista VeloCloud Orchestratorflaw to its Known…
-
OpenAI Paused Frontier AI Training After a Security Incident
OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels. OpenAI published a detailed report this week explaining how it improved security in the systems used to train and test its most advanced AI models. The company also described what happened when its AI agents…
-
Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: A critical PHP security release is coming today, so get ready to update! The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/25/week-in-review-php-vulnerabilities-patched-exploited-palo-alto-globalprotect-vpn-flaw/ also interesting: Top 12 ways hackers broke into your systems in 2024 Privacy Roundup: Week 7 of…
-
OpenJDK unter Druck: 53 neue Sicherheitslücken markieren historischen Höchststand
Die vierteljährlichen OpenJDK-Updates, die die Fixes für diese CVEs enthalten, umfassen ausserdem mehr als 150 Codeänderungen ohne Sicherheitsbezug. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/openjdk-unter-druck-53-neue-sicherheitsluecken-markieren-historischen-hoechststand/a46913/ also interesting: âš¡ Weekly Recap: APT Campaigns, Browser Hijacks, AI Malware, Cloud Breaches and Critical CVEs How a 12-year-old bug in Sudo is still haunting Linux users Microsoft patched…
-
Cookie theft: how fraudsters get the digital key to your accounts
‘Session cookies’ are a primary target for hackers letting them hijack and use your accountsYou’ve had a busy morning of life admin, logging into various accounts to check balances and make payments. At the end of a productive few hours you close your laptop and move on to your next job.What you don’t know is…
-
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models.”Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model…
-
Will AI expose the rickety infrastructure of the internet?
The moment you realize the internet is “held together by glue and dreams.” First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/24/will-ai-expose-the-rickety-infrastructure-of-the-internet/ also interesting: Top 7 zero-day exploitation trends of 2024 6 rising malware trends every security pro should know AI Under Control: Link11 Launches AI Management Dashboard for Clean Traffic AWS leans on prior ingenuity…
-
Pierluigi Paganini answers questions about the PHP2Shell flaws
Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data. 1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet,…
-
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online Built-in CODE Server is […] First…
-
SPECTER Attack Uses USB Power Signals to Leak Data From Air-Gapped PCs
Researchers demonstrated SPECTER, a technique that leaks data from compromised air-gapped PCs through USB power controls, phone charging changes and peripherals. First seen on hackread.com Jump to article: hackread.com/specter-usb-power-signals-air-gapped-pcs-leak-data/ also interesting: The biggest data breach fines, penalties, and settlements so far The most notorious and damaging ransomware of all time Dull but dangerous: A guide…
-
PHP-ocalypse: How two critical web bugs almost broke the internet
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet, and it’s unlikely to be the last major software scare. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/ also interesting: Abandoned AWS S3 buckets open door to remote code execution, supply-chain compromises Cybersecurity Snapshot:…
-
Wähleradressen: AfD droht wegen Datenleck Ärger mit dem Datenschutz
Nach einem E-Mail-Leak prüft der Datenschutzbeauftragte, ob die AfD in MV Wählerdaten nicht ausreichend geschützt hat. First seen on golem.de Jump to article: www.golem.de/news/waehleradressen-afd-droht-wegen-datenleck-aerger-mit-dem-datenschutz-2610-214478.html also interesting: The Quiet Rise of the ‘API Tsunami’ Privacy Roundup: Week 11 of Year 2025 How defenders use the dark web Cybercrime Inc.: Wenn Hacker besser organsiert sind als die…
-
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/ also interesting: US eyes ban on TP-Link routers…
-
Usage Intelligence: The Monetization Signal Most AI Companies Are Ignoring
AI companies need usage data to align pricing with costs, improve products, identify churn risks, and grow revenue through informed decisions. The AI Paradox There is a paradox: AI companies exist to extract intelligence from data, yet many have almost no visibility into how their own software is being used. They design complex models, introduce…
-
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began. First seen on wired.com Jump to article: www.wired.com/story/kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable/ also interesting: What is Security Posture Management and Why is it Important? What is Security Posture Management and Why is it Important? What is Security Posture…
-
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services.”You may choose to allow certain Google services, including services like Search or Gemini Apps, to access…
-
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services.”You may choose to allow certain Google services, including services like Search or Gemini Apps, to access…
-
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.”On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key…
-
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google’s Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program’s memory, potentially First…
-
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine.The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free…
-
Capcom Data Breach Exposes 11.7 Million Email Addresses
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses,…
-
Hackers Breached LiteLLM GitHub Repository 11 Days Before Supply Chain Attack
Hackers accessed LiteLLM’s GitHub organization and executed credential-stealing workflows eleven days before the October 21 supply chain attack that distributed malicious litellm==1.107.0 packages. The findings establish a longer compromise window preceding the poisoned releases. Socket recovered malicious workflows executed inside BerriAI/litellm on October 10 and October 12, 2026. Both used the maintenance-style commit message ci:…
-
Hackers Use Fake Chocolatey and Microsoft Activation Websites to Spread New Armorsteal Malware
Hackers are distributing ArmorSteal, a Python-based malware family, through fake Chocolatey and Microsoft Activation-Script websites promoted via search engine poisoning. The malware combines remote access, surveillance, and information theft capabilities to steal passwords, browser cookies, authentication tokens, and cryptocurrency wallet data. Zscaler’s Threat Hunting team identified the campaign in September 2026 and published its findings…
-
OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign. Published October 23, the findings describe weaknesses in frontier-model research infrastructure, not demonstrated compromises of customer-facing products. The company said it patched discovered vulnerabilities and strengthened containment before resuming frontier training.…
-
U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog. VeloCloud Orchestrator (VCO) is the central management system for…
-
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.The critical-severity vulnerabilities are listed below – CVE-2026-110447 (CVSS score: 9.2) – An operating First seen on thehackernews.com…