Tag: data-breach
-
‘PHP2Shell’ Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry
-
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server.The flaws, together called PHP2Shell, sit in the PHP…
-
eMudhra security blunder left trusted CA signing keys exposed to anyone
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/emudhra-certificates-private-keys-compromised/
-
INC and The Gentlemen Ransomware Affiliates Expose 8,257 AI Messages
SOCRadar has found seven exposed servers linked to INC and The Gentlemen ransomware affiliates, holding AI chats, stolen… First seen on hackread.com Jump to article: hackread.com/inc-the-gentlemen-ransomware-affiliates-ai-messages/
-
Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP
Tags: authentication, control, data-breach, exploit, flaw, Internet, update, vulnerability, zero-dayInternet-Facing Systems Now Under Attack; PHP Team Promises Imminent Patch Release. Attackers are exploiting one or more zero-day vulnerabilities in PHP after details of the bugs leaked in advance of patches being released. The flaws can be remotely exploited without authentication to take control of servers that run PHP, which is widely used across numerous…
-
US Government Orders DeepSeek Out of Federal Civilian Systems
PHP prepares emergency patches for two critical RCE flaws, while older, unsupported versions could remain exposed without vendor fixes. The U.S. government ordered federal civilian agencies to remove DeepSeek products from their IT systems and stop buying them. The order also reaches third-party tools and services built with DeepSeek implementations, which is the part most…
-
Cloudflare Warns of Active Exploitation Attempts Against Two Leaked PHP Flaws
Cloudflare has issued a warning about emerging attacks targeting two critical PHP vulnerabilities. In response, the company has implemented emergency web application firewall (WAF) rules while developers await an official security release. The PHP Foundation has provided advance notice, assigning both vulnerabilities a CVSS v4 score of 9.2, indicating the urgent need for affected environments…
-
PHP Prepares Emergency Fixes for Two Critical Remote Code Execution Flaws
PHP will release emergency fixes for two critical RCE flaws rated 9.2, as researchers warn of potential risks to exposed and unsupported systems. PHP is preparing an emergency security release for two critical vulnerabilities that could let attackers execute code remotely on affected servers. The update is scheduled for today, October 21 at 14:00 UTC,…
-
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/critical-php-vulnerabilities-leaked/
-
INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds
Ransomware affiliates associated with INC and The Gentlemen exposed an intrusion ecosystem after leaving operational servers publicly accessible. The investigation began in late September 2026 with open directories on 45.227.254[.]43. Configuration files and credentials led researchers to six additional adversary servers, exposing development infrastructure, command infrastructure and ransomware staging systems. The findings describe an active…
-
Multi-Cloud Blind Spots Are Leaving Security Teams Exposed
Discover how multi-cloud environments create security blind spots, inconsistent access controls, risks and how CCSP strategies help strengthen cloud security. First seen on hackread.com Jump to article: hackread.com/multi-cloud-blind-spots-security-teams-exposed/
-
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
-
Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/
-
Nikkei data breach affected over 1.8 million records
Nikkei disclosed a data breach affecting over 1.8 million records after hackers used stolen credentials to access a cloud service for system development. Japanese media company Nikkei has disclosed a data breach affecting more than 1.8 million records. The company, known for its financial news publications, including The Nikkei and the Financial Times, said attackers…
-
Nikkei data breach affected over 1.8 million records
Nikkei disclosed a data breach affecting over 1.8 million records after hackers used stolen credentials to access a cloud service for system development. Japanese media company Nikkei has disclosed a data breach affecting more than 1.8 million records. The company, known for its financial news publications, including The Nikkei and the Financial Times, said attackers…
-
AfD Email Breach Exposes 421,000 Messages in Anonymous Online Archive
A data breach exposed AfD emails, while an anonymous site published AI summaries of 421,000 messages, raising questions about authenticity and privacy. Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc…
-
(g+) Gesichtserkennung: Einmal erfasst, immer erkennbar?
Tags: data-breachGesichtserkennung ersetzt Bordkarten, kontrolliert Stadionbesucher und scannt Unbeteiligte. Wo die Technik gefährlich wird, was erlaubt ist und warum ein Datenleck besonders schwer wiegt. First seen on golem.de Jump to article: www.golem.de/news/gesichtserkennung-einmal-erfasst-immer-erkennbar-2610-214297.html
-
OpenCode Data Breach Exposes API Keys Linked to Third-Party Services
OpenCode has reported a security breach affecting 1.4% of its Console users, which it attributes to a “large-scale distillation attack.” The company said the affected accounts belong to a subset of users who had connected external providers. However, the public disclosure did not clarify if API keys were extracted or identify which specific credentials were…
-
SBI Data Breach Allegedly Exposes Personal Information of 3.75 Lakh Users
A threat actor known as Siriusim allegedly leaked customer information and documents related to the State Bank of India (SBI), according to a CyberPulse post dated October 16, 2026. The claim involves 375,000 CSV rows and 2,722 PDF documents; however, the authenticity, origin, and extent of this dataset remain unverified. The reported figure should not…
-
Nikkei discloses third data breach in a month, 1.8M records exposed
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/
-
Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners
Attackers exploit Plex2Shell flaws to install crypto miners and proxy software. Admins should update their Plex Media Server. Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who…
-
OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/
-
OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/
-
WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
Tags: data-breachAround 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue. First seen on wired.com Jump to article: www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/
-
Conduent Agrees to Pay $80m to Settle Data Breach Class Action
The 2024 cyber incident affected the healthcare data of 62 million people, who launched a class action lawsuit against the business services firm First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/conduent-settle-data-breach-action/
-
Exploit-Code geleakt: Plex-Server werden attackiert
Wer einen Plex-Media-Server betreibt, sollte diesen dringend auf die neueste Version updaten. Angreifer schleusen mittels Plex2Shell-Angriff Malware ein. First seen on golem.de Jump to article: www.golem.de/news/exploit-code-geleakt-angreifer-schleusen-malware-auf-plex-server-2610-214242.html
-
Exploit-Code geleakt: Angreifer schleusen Malware auf Plex-Server
Wer einen Plex-Media-Server betreibt, sollte diesen dringend auf die neueste Version updaten. Angreifer schleusen mittels Plex2Shell-Angriff Malware ein. First seen on golem.de Jump to article: www.golem.de/news/exploit-code-geleakt-angreifer-schleusen-malware-auf-plex-server-2610-214242.html
-
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said.Console is OpenCode’s optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to…
-
Conduent, Plaintiffs Reach $80M Settlement in 2024 Hack
Data Theft From Back Office Services Firm Affected 62.2 Million. Plaintiffs representing about 62.2 million affected individuals reached a preliminary $80 million settlement of proposed class-action litigation against Conduent stemming from a 2024 hack on the back-office support services firm. The incident was the largest health data breach reported in 2025. First seen on govinfosecurity.com…