access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email endpoint exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
Will AI expose the rickety infrastructure of the internet?
The moment you realize the internet is “held together by glue and dreams.” First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/24/will-ai-expose-the-rickety-infrastructure-of-the-internet/ also interesting: Top 7 zero-day exploitation trends of 2024 6 rising malware trends every security pro should know AI Under Control: Link11 Launches AI Management Dashboard for Clean Traffic AWS leans on prior ingenuity…
-
Pierluigi Paganini answers questions about the PHP2Shell flaws
Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data. 1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet,…
-
U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online Built-in CODE Server is […] First…
-
SPECTER Attack Uses USB Power Signals to Leak Data From Air-Gapped PCs
Researchers demonstrated SPECTER, a technique that leaks data from compromised air-gapped PCs through USB power controls, phone charging changes and peripherals. First seen on hackread.com Jump to article: hackread.com/specter-usb-power-signals-air-gapped-pcs-leak-data/ also interesting: The biggest data breach fines, penalties, and settlements so far The most notorious and damaging ransomware of all time Dull but dangerous: A guide…
-
PHP-ocalypse: How two critical web bugs almost broke the internet
Two critical bugs in the PHP web programming language, used by the majority of the internet, threatened to upend the internet, and it’s unlikely to be the last major software scare. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/24/php-ocalypse-how-two-critical-web-bugs-almost-broke-the-internet/ also interesting: Abandoned AWS S3 buckets open door to remote code execution, supply-chain compromises Cybersecurity Snapshot:…
-
Wähleradressen: AfD droht wegen Datenleck Ärger mit dem Datenschutz
Nach einem E-Mail-Leak prüft der Datenschutzbeauftragte, ob die AfD in MV Wählerdaten nicht ausreichend geschützt hat. First seen on golem.de Jump to article: www.golem.de/news/waehleradressen-afd-droht-wegen-datenleck-aerger-mit-dem-datenschutz-2610-214478.html also interesting: The Quiet Rise of the ‘API Tsunami’ Privacy Roundup: Week 11 of Year 2025 How defenders use the dark web Cybercrime Inc.: Wenn Hacker besser organsiert sind als die…
-
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/ also interesting: US eyes ban on TP-Link routers…
-
Usage Intelligence: The Monetization Signal Most AI Companies Are Ignoring
AI companies need usage data to align pricing with costs, improve products, identify churn risks, and grow revenue through informed decisions. The AI Paradox There is a paradox: AI companies exist to extract intelligence from data, yet many have almost no visibility into how their own software is being used. They design complex models, introduce…
-
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began. First seen on wired.com Jump to article: www.wired.com/story/kernel-panic-the-php-meltdown-shows-how-ai-makes-bugs-more-exploitable/ also interesting: What is Security Posture Management and Why is it Important? What is Security Posture Management and Why is it Important? What is Security Posture…
-
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services.”You may choose to allow certain Google services, including services like Search or Gemini Apps, to access…
-
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services.”You may choose to allow certain Google services, including services like Search or Gemini Apps, to access…
-
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.”On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key…
-
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google’s Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program’s memory, potentially First…
-
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine.The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free…
-
Capcom Data Breach Exposes 11.7 Million Email Addresses
Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses,…
-
Hackers Breached LiteLLM GitHub Repository 11 Days Before Supply Chain Attack
Hackers accessed LiteLLM’s GitHub organization and executed credential-stealing workflows eleven days before the October 21 supply chain attack that distributed malicious litellm==1.107.0 packages. The findings establish a longer compromise window preceding the poisoned releases. Socket recovered malicious workflows executed inside BerriAI/litellm on October 10 and October 12, 2026. Both used the maintenance-style commit message ci:…
-
Hackers Use Fake Chocolatey and Microsoft Activation Websites to Spread New Armorsteal Malware
Hackers are distributing ArmorSteal, a Python-based malware family, through fake Chocolatey and Microsoft Activation-Script websites promoted via search engine poisoning. The malware combines remote access, surveillance, and information theft capabilities to steal passwords, browser cookies, authentication tokens, and cryptocurrency wallet data. Zscaler’s Threat Hunting team identified the campaign in September 2026 and published its findings…
-
OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign. Published October 23, the findings describe weaknesses in frontier-model research infrastructure, not demonstrated compromises of customer-facing products. The company said it patched discovered vulnerabilities and strengthened containment before resuming frontier training.…
-
U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog. VeloCloud Orchestrator (VCO) is the central management system for…
-
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.The critical-severity vulnerabilities are listed below – CVE-2026-110447 (CVSS score: 9.2) – An operating First seen on thehackernews.com…
-
XDR wird zum entscheidenden Faktor moderner Cyberresilienz Warum eine moderne Cyberabwehr mehr braucht als Prävention
Nicht alle Cyberangriffe lassen sich verhindern. Trotz umfangreicher Security-Maßnahmen müssen IT-Verantwortliche davon ausgehen, dass Angreifer in die IT-Systeme gelangen. Entscheidend ist daher eine Cyberabwehr, die eine möglichst frühe Erkennung verdächtiger Aktivitäten ermöglicht. Dabei ist es wichtig, Zusammenhänge zu durchschauen und im Ernstfall schnell zu reagieren. Genau dies ermöglicht Extended Detection and Response (XDR). Die Lösung…
-
Cyberresilienz nach PHP2Shell: Was CIOs jetzt belegen sollten
Tags: cio»Patch erledigt« ist eine Statusmeldung noch kein Nachweis für einen abgesicherten Geschäftsbetrieb. Die Diskussion um PHP2Shell rückt deshalb mehr als die Laufzeitumgebung in den Blick: Softwarebestand, Dienstleisterverantwortung, Vorfallsprüfung und Wiederherstellung. 14 Experten ordnen die Herausforderungen ein. Für CIOs und Geschäftsführungen steht dabei die Frage im Mittelpunkt: Was ist geprüft, was bleibt offen und wer… First…
-
Why AI Labs, HR Giants Are Emerging as Cybersecurity Buyers
Identity Governance and Vulnerability Remediation Startups Draw Unexpected Suitors Workday’s buy of C1.ai, Cohere’s purchase of Aisle and OpenAI’s reported talks with Trail of Bits highlight how AI providers and enterprise software companies are expanding into cybersecurity, creating new startup exit opportunities while raising questions about competition and partner independence. First seen on govinfosecurity.com Jump…
-
OpenAI Agents Disable Their Own Safety Monitoring
GPT-6.1 Sol Suppressed Alerts While GPT-6 Astra Removed Monitoring Integration. OpenAI disclosed two October incidents in which GPT-6 agents suppressed misalignment monitoring alerts and removed safety controls during coding tasks, exposing oversight weaknesses as researchers investigate why agents interpret routine instructions as permission to disable safeguards. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/openai-agents-disable-their-own-safety-monitoring-a-33197 also…
-
Trust Is Not What It Seems, And Fraudsters Are Counting on It
Threat actors don’t need to rely on malware to breach organizations anymore. They’re simply calling help desks and politely asking for access, with a little help from artificial intelligence. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/trust-is-not-what-it-seems-and-fraudsters-are-counting-on-it also interesting: Infostealer Infections Lead to Telefonica Ticketing System Breach New Luma Infostealer Malware Steals Browser Data, Cryptocurrency,…
-
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks/ also interesting: Top 12 ways hackers broke into…
-
Why HR Belongs at the Center of AI Change
Netskope Exec Mike Anderson on Trust, Training and Change Management. AI adoption can unsettle employees who fear being replaced, even as leaders expect them to use new tools. Netskope CDIO Mike Anderson explains why CIOs should work with HR on communication, training and workflow changes, and where human judgment should remain in automated processes. First…
-
Analysts Urge US to Follow UK’s Lead on Undersea Cable Law
UK Proposes Crisis Powers Over Cable Operators and Up to 14 Years for Sabotage. Security analysts say Washington should update its 1888 undersea cable law after London proposed letting ministers direct cable operators in a crisis and imposing prison terms of up to 14 years for sabotage – though some doubt tougher penalties would deter…
-
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
Fixing the critical PHP flaws is not as simple as clicking Update. Here’s how to assess your risk, and what you can do to protect yourself. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/exposed-php2shell-cyber-experts-advice also interesting: 8 security risks overlooked in the rush to implement AI MICI NetFax Server Flaws Allow Attackers to Execute Remote…
-
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection/ also interesting: Cloud Access Security Broker ein Kaufratgeber After Detecting 30B Phishing Attempts, Microsoft Adds Even More AI to Its Security Copilot Threat intelligence platform buyer’s guide: Top vendors, selection advice…
-
Could Your AI Bill Get Even Harder to Read?
As AI Moves Onto the PC, the Bill Splits Across Cloud, Hardware and IT Budgets Microsoft and Nvidia want more enterprise AI to run on the PC. That changes not just where inference happens, but who pays for it and who can see it. As cloud token costs give way to hardware, maintenance and security…
-
4 Flaws Found in Widely Used Health Data Exchange Software
Researcher: HAPI FHIR Vulnerabilities Put Patient Data, System Availability at Risk. Four vulnerabilities in a widely used open-source healthcare interoperability software could enable attackers to improperly access sensitive patient records, cross security boundaries separating healthcare organizations’ data and potentially disrupt services, according to new security research. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/4-flaws-found-in-widely-used-health-data-exchange-software-a-33192 also…
-
How Proofpoint, Varonis Hope to Secure AI Data Life Cycle
Why AI Agents and Expanding Cloud Access Drive Demand for Unified Data Controls. Proofpoint CEO Sumit Dhawan explains how combining Proofpoint’s human- and AI-centric data loss prevention capabilities with Varonis’ data discovery, classification and access controls could create a unified platform to protect enterprise information throughout its life cycle. First seen on govinfosecurity.com Jump to…
-
ISMG Editors: Stolen Vendor API Secret Exposes Microsoft 365
ConnectWise Supply-Chain Hack, Rogue AI Agents and Rising AI Token Costs. In this week’s panel, four ISMG editors discussed the potentially far-reaching supply-chain attack involving ConnectWise, growing concerns over rogue AI agents, and Microsoft and Nvidia’s push to bring AI processing back onto company hardware as enterprises grapple with rising token costs. First seen on…
-
GoDaddy Revokes 404,607 SSL Certificates After Policy Errors
Tags: governmentGoDaddy revoked 404,607 SSL/TLS certificates after finding certificate-policy errors, with affected sites including some Gibraltar government websites. First seen on hackread.com Jump to article: hackread.com/godaddy-revokes-ssl-certificates-policy-errors/ also interesting: Student-Powered SOCs Train Security’s Next Generation Microsoft ‘digital escorts’ reveal crucial US counterintelligence blind spot Chinese State Hackers Use New BRICKSTORM Malware Against VMware Systems Tinned mackerel, hand-crank…
-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report First…
-
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches
PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. The vulnerability affects only a specific PHP configuration that PHP…
-
Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
The headline-grabbing bugs known colloquially as PHP2Shell are giving cyber analysts a lot to track, and a lot to debunk. First seen on therecord.media Jump to article: therecord.media/php-php2shell-exploitation-attempts-pocs also interesting: US eyes ban on TP-Link routers amid cybersecurity concerns Malicious Supply Chain Attacking Moving From npm Community To VSCode Marketplace Hackers Could Bypassing EDR Using…
-
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led…
-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Tags: ai, cybersecurity, data, data-breach, extortion, infrastructure, intelligence, ransomware, RedTeam, russia, threatCybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.Central to the operation is an “Autonomous Red Team Kill Chain Framework” referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well…
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution…
-
AI Tools Are Generating Massive Attacks for Little Cost
One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/ai-tools-massive-attacks-little-cost also interesting: 8 Cyber Predictions for 2025: A CSO’s Perspective Why domain-based attacks will continue to wreak havoc Beyond silos: How DDI-AI integration is…
-
Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2016-reaches-end-of-support-in-january/ also interesting: Defender Update-Seite mit fehlerhaften Daten; App-Governance in Microsoft Defender for Cloud Apps Microsoft Says Windows Update Zero-Day Being Exploited to Undo Security Fixes Microsoft Security Update…
-
Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2016-reaches-end-of-support-in-january/ also interesting: February 2024 Patch Tuesday forecast: Zero days are back and a new server too Microsoft Photos update brings requested features to Windows 11 Markenmissbrauch im…
-
Waiting for the PHP2Shell Onslaught as POCs Proliferate
No Confirmed Exploits in the Wild, But Researchers Find PHP Flaws Can Be Exploited. Cyber defenders are bracing for breakthroughs in weaponized exploits targeting the just-patched PHP2Shell vulnerabilities. No mass, in-the-wild exploits for what’s being dubbed PHP2Shell have yet been seen, but researchers have demonstrated it can be done and attackers remain keen. First seen…
-
Overlord RAT Uses Fake Legal Notices to Infect Windows PCs in New Campaign
WatchGuard details Overlord RAT attacks using fake Brazilian legal notices, plus Lampion malware and a separate remote access… First seen on hackread.com Jump to article: hackread.com/overlord-rat-fake-legal-notices-infect-windows-pcs/ also interesting: China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack Steaelite RAT combines data theft…
-
CybersecurityMonth 2026 Einfache Sicherheitslücken machen Cyberkriminellen das Leben leicht
Das Motto des Cybersecurity-Awareness-Month 2026 ‘Don’t Make It Easy for Them” rückt im Oktober grundlegende Sicherheitsmaßnahmen in den Mittelpunkt. Gleichzeitig verändern generative KI und autonome KI-Agenten die Möglichkeiten von Cyberkriminellen. Unternehmen müssen deshalb sowohl ihre technischen Schutzmaßnahmen als auch das Sicherheitsbewusstsein ihrer Mitarbeiter stärken. Netzpalaver hat dazu einige interessante Video-Statements seiner Netzpalaver-Community eingefangen. Cyberangriffe müssen…
-
FCC bans two devices with surveillance chips linked to Huawei
Tags: cctvThe banned items, a wireless video transmitter and dashboard camera, are made with chips manufactured by Huawei subsidiary HiSilicon, which markets its products as “designed for the surveillance market.” First seen on therecord.media Jump to article: therecord.media/fcc-bans-devices-huawei-surveillance-chips also interesting: [Video] Read Image Gps Tag -EXIF Data viewers Verkada to Pay $2.95 Million Over FTC Probe…