Wed 28 Oct · updated 07:00 UTC
Today in security
Latest briefing
Tuesday 27 October edition
CISA adds two exploited PHP flaws to its catalogue
CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue on 26 October, setting a 29 October remediation deadline for federal agencies. Both flaws allow unauthenticated remote code execution, and The Hacker News reported successful exploitation against honeypots before the catalogue update. CISA confirmed active exploitation, while use in ransomware campaigns remains unknown.
Known exploited16
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
PHPCVE-2026-109618
Federal deadline 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS46 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS45 articles
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical55% EPSS16 articles
- In CISA KEV
Adobe CommerceCVE-2026-48356
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.3Critical31% EPSS6 articles
Show 12 more · federal deadlines passed
- In CISA KEV
Apple iOS and iPadOSCVE-2026-86950
Federal deadline passed 13 Oct · In CISA KEV since 29 Sep
8.8High26% EPSS16 articles
- In CISA KEV
NetScaler ADCCVE-2026-88779
Federal deadline passed 7 Oct · In CISA KEV since 4 Oct
8.7High11% EPSS10 articles
- In CISA KEV
Citrix NetScaler ADCCVE-2026-88771
Federal deadline passed 30 Sep · In CISA KEV since 27 Sep
9.5Critical82% EPSS29 articles
- In CISA KEV
PaperCut NG/MFCVE-2026-81578
Federal deadline passed 14 Sep · In CISA KEV since 31 Aug
8.8High84% EPSS24 articles
- In CISA KEV
PaperCut NG/MFCVE-2026-82078
Federal deadline passed 14 Sep · In CISA KEV since 31 Aug
9.4Critical61% EPSS23 articles
- In CISA KEV
Adobe CommerceCVE-2026-75650
Federal deadline passed 11 Sep · In CISA KEV since 8 Sep
10.0Critical3.9% EPSS8 articles
- In CISA KEV
Oracle PeopleSoft Enterprise PeopleToolsCVE-2026-35273
Federal deadline passed 15 Jun · In CISA KEV since 12 Jun · Used in ransomware campaigns
9.8Critical97% EPSS29 articles
- In CISA KEV
Hikvision Multiple ProductsCVE-2017-7921
Federal deadline passed 26 Mar · In CISA KEV since 5 Mar
Not scored99.9% EPSS10 articles
- In CISA KEV
Adobe Commerce and MagentoCVE-2025-54236
Federal deadline passed 14 Nov 2025 · In CISA KEV since 24 Oct 2025
9.1Critical95% EPSS5 articles
- In CISA KEV
Dahua IP Camera FirmwareCVE-2021-33044
Federal deadline passed 11 Sep 2024 · In CISA KEV since 21 Aug 2024
9.8Critical99.9% EPSS7 articles
- In CISA KEV
Dahua IP Camera FirmwareCVE-2021-33045
Federal deadline passed 11 Sep 2024 · In CISA KEV since 21 Aug 2024
9.8Critical99.5% EPSS3 articles
- In CISA KEV
Hikvision Security cameras web serverCVE-2021-36260
Federal deadline passed 24 Jan 2022 · In CISA KEV since 10 Jan 2022
Not scored99.8% EPSS4 articles
Latest news74
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 06:00 UTC. Red diamonds mark the 7 stories about exploited CVEs.
- 06:00 UTC. Interpol operation arrests 1,462 in African cybercrime sweep. 1 outlet.
- 02:30 UTC. ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154, (Wed, Oct 28th). 1 outlet.
- 01:44 UTC. Microsoft Explains Why Clearing Windows 11 Prefetch Files Slows Launches. 1 outlet.
- 01:40 UTC. Google Publishes Linux Kernel Exploit for CVE-2026-23111. 1 outlet.
- 01:28 UTC. Supermicro fixes BMC flaws affecting 392 board models. 1 outlet.
- 01:06 UTC. Moxa discloses three flaws in remote access products. 1 outlet.
- 00:49 UTC. PoC chains libheif flaws to execute code on WordPress servers. 1 outlet.
- 00:47 UTC. Canada Privacy Commissioner investigates Crime Stoppers breach. 1 outlet.
- 00:20 UTC. WatchGuard fixes 18 Fireware flaws, including critical RCE bug. 1 outlet.
- 00:11 UTC. AuthMask flaw lets Android apps steal Microsoft tokens. 1 outlet.
- 00:00 UTC. NVIDIA fixes CVSS 10 flaw in NeMo Agent Toolkit. 1 outlet.
- 23:41 UTC. Veeam fixes five flaws in backup and monitoring software. 1 outlet.
- 21:15 UTC. CISOs urged to document AI risks and vendor agreements. 1 outlet.
- 20:42 UTC. Arctic Wolf uncovers malware campaign abusing Teams chats. 1 outlet.
- 20:36 UTC. Ontario tipline suspensions follow Navigate360 breach concerns. 1 outlet.
- 20:25 UTC. UEFI flaw exposes servers to code execution before boot. 1 outlet.
- 20:01 UTC. CISA adds exploited Google Brotli flaw to KEV catalogue. 2 outlets. About an exploited CVE.
- 19:58 UTC. SBOMs Missed the Scope of a Shai-Hulud Supply Chain Attack. 1 outlet.
- 19:49 UTC. FEC takes filing system offline after hacking attempts. 1 outlet.
- 19:12 UTC. Italy’s Parliament Confirms Intrusion Affecting Three Email Accounts. 1 outlet.
- 19:01 UTC. Moldova Warns of Fraud Risk After Data Breach Exposes Records. 1 outlet.
- 18:59 UTC. Ohio Auditor Takes Server Offline After Cyberattack. 1 outlet.
- 18:53 UTC. Ransomware attack disrupts Kamalnayan Bajaj Hospital. 1 outlet.
- 18:49 UTC. Cyberattack disrupts care at University of New Mexico Health. 1 outlet.
- 18:41 UTC. Australia’s cyber spy chief warns AI will fuel disruption. 1 outlet.
- 18:41 UTC. Phishing Attack Exposes Covered California Agent Data. 1 outlet.
- 18:26 UTC. Trend Micro reports AI driven cyber campaigns targeting Japan. 1 outlet.
- 18:21 UTC. Conduent agrees to $80 million settlement over major breach. 1 outlet.
- 18:21 UTC. Hundreds of Hacked Websites Serve Spyware to iPhone Users. 1 outlet.
- 18:20 UTC. Capcom Says Breach Exposed Data From 11.7 Million Accounts. 1 outlet.
- 18:20 UTC. Sweden blocks ChatGPT and Claude on government computers. 1 outlet.
- 18:20 UTC. Marines Sue Pentagon Over Data Breach and Exposed Records. 1 outlet.
- 18:20 UTC. GitLab patches maximum severity flaw enabling server code execution. 1 outlet.
- 18:20 UTC. Spyware makers used ad network to deliver zero click attacks. 1 outlet.
- 17:43 UTC. AI Reliance Could Erode Cybersecurity Professionals’ Skills. 1 outlet.
- 16:47 UTC. Aokigahara Stealer Targets AI Sessions and Developer Credentials. 1 outlet.
- 16:45 UTC. Cyber incident forces UNM Health to cancel surgeries and divert ambulances. 1 outlet.
- 16:39 UTC. ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution. 1 outlet. About an exploited CVE.
- 16:00 UTC. Sansec finds scanner evasion code on 953 online stores. 3 outlets. About an exploited CVE.
- 15:36 UTC. Malwarebytes warns voters of five election themed scams. 1 outlet.
- 15:26 UTC. Tailscale prepares client patch for wormable SSH flaws. 1 outlet.
- 15:04 UTC. Unit 42 reports YOOtheme Pro flaw exploited for webshells. 1 outlet.
- 15:00 UTC. ISC2 launches coalition to address AI security job needs. 1 outlet.
- 14:00 UTC. ShinyHunters claims FBI breach as Clop leak site is hijacked. 1 outlet.
- 13:59 UTC. GoAhead TLS flaws let revoked certificates bypass checks. 1 outlet.
- 13:59 UTC. Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads. 1 outlet.
- 13:48 UTC. AISI details Claude agent’s attempts to poison public code. 1 outlet.
- 13:30 UTC. Denver Health Says Vendor Key Exposed Data of 238,083 Members. 1 outlet.
- 13:13 UTC. HPE patches 72 flaws across Aruba networking products. 1 outlet.
- 13:03 UTC. Fake AI app downloads deliver cryptominer through signed binaries. 1 outlet.
- 13:00 UTC. AI SPERA Joins INTERPOL Initiative to Share Cybercrime Intelligence. 1 outlet.
- 12:48 UTC. Australia reports 20% rise in cyber incidents in 2025-26. 1 outlet.
- 12:30 UTC. Attackers Breach Organisations Through Microsoft Teams Chats. 1 outlet.
- 12:22 UTC. Malwarebytes warns of fake checks on compromised websites. 1 outlet.
- 12:09 UTC. Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens. 1 outlet.
- 12:02 UTC. DreamHost Resets Some Customer Passwords After System Issue. 1 outlet.
- 12:00 UTC. Kaspersky researchers breach cloud tenant isolation in test. 1 outlet.
- 11:49 UTC. Apple patches 286 flaws and backports fix for exploited bug. 1 outlet. About an exploited CVE.
- 11:49 UTC. Microsoft issues offline trust list updates for Windows 11. 1 outlet.
- 11:46 UTC. Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key. 1 outlet.
- 11:32 UTC. AI-Generated Fake Login Pages Are Making Account Takeovers Easier. 1 outlet.
- 11:32 UTC. Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption. 1 outlet.
- 11:23 UTC. StepSecurity adds inventories to track AI agent plugins. 1 outlet.
- 11:00 UTC. Copenhagen University breach exposes data of 525,000 people. 2 outlets.
- 10:44 UTC. Researcher says Samsung TVs may listen through soundbars. 1 outlet.
- 10:44 UTC. Anthropic filing warns of risks from increasingly capable AI. 1 outlet.
- 10:39 UTC. CISA adds exploited PHP flaws to its KEV catalogue. 3 outlets. About an exploited CVE.
- 10:30 UTC. ISC2 plans first AI security certification for early 2027. 1 outlet.
- 10:02 UTC. Citrix patches NetScaler flaws after active exploitation. 1 outlet. About an exploited CVE.
- 09:56 UTC. Attackers seize Dahua cameras through Easy4IP cloud access. 1 outlet. About an exploited CVE.
- 09:44 UTC. Abandoned Popcorn Time Updater Exposed Millions to Takeover. 1 outlet.
- 09:39 UTC. UK watchdog urges police and fire services to boost cyber defences. 1 outlet.
- 09:33 UTC. Australia disrupts Amadey malware network, cutting off 180,000 PCs. 1 outlet.
- 09:07 UTC. Cohere finds Alibaba’s Qwen AI model attempted to contact China server. 1 outlet.
- 08:50 UTC. Denmark ends trial of open source Collabora office suite. 1 outlet.
- 08:43 UTC. Apple iOS 27.2 update fixes more than 160 security flaws. 1 outlet.
- 08:36 UTC. Microsoft says Windows 11 print bug needs manual repair. 1 outlet.
- 08:22 UTC. Xint Finds OpenAI Compaction Flaw Exposing Hidden Reasoning. 2 outlets.
- 08:13 UTC. Researchers link 60 OffiDocs extensions to URL harvesting. 1 outlet.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 06:00 | Interpol operation arrests 1,462 in African cybercrime sweep | 1 | Other |
| 02:30 | ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154, (Wed, Oct 28th) | 1 | Other |
| 01:44 | Microsoft Explains Why Clearing Windows 11 Prefetch Files Slows Launches | 1 | Other |
| 01:40 | Google Publishes Linux Kernel Exploit for CVE-2026-23111 | 1 | CVE |
| 01:28 | Supermicro fixes BMC flaws affecting 392 board models | 1 | CVE |
| 01:06 | Moxa discloses three flaws in remote access products | 1 | CVE |
| 00:49 | PoC chains libheif flaws to execute code on WordPress servers | 1 | Other |
| 00:47 | Canada Privacy Commissioner investigates Crime Stoppers breach | 1 | Other |
| 00:20 | WatchGuard fixes 18 Fireware flaws, including critical RCE bug | 1 | CVE |
| 00:11 | AuthMask flaw lets Android apps steal Microsoft tokens | 1 | CVE |
| 00:00 | NVIDIA fixes CVSS 10 flaw in NeMo Agent Toolkit | 1 | CVE |
| 23:41 | Veeam fixes five flaws in backup and monitoring software | 1 | CVE |
| 21:15 | CISOs urged to document AI risks and vendor agreements | 1 | Other |
| 20:42 | Arctic Wolf uncovers malware campaign abusing Teams chats | 1 | Other |
| 20:36 | Ontario tipline suspensions follow Navigate360 breach concerns | 1 | Other |
| 20:25 | UEFI flaw exposes servers to code execution before boot | 1 | CVE |
| 20:01 | CISA adds exploited Google Brotli flaw to KEV catalogue | 2 | Known exploited |
| 19:58 | SBOMs Missed the Scope of a Shai-Hulud Supply Chain Attack | 1 | Other |
| 19:49 | FEC takes filing system offline after hacking attempts | 1 | Other |
| 19:12 | Italy’s Parliament Confirms Intrusion Affecting Three Email Accounts | 1 | Other |
| 19:01 | Moldova Warns of Fraud Risk After Data Breach Exposes Records | 1 | Other |
| 18:59 | Ohio Auditor Takes Server Offline After Cyberattack | 1 | Other |
| 18:53 | Ransomware attack disrupts Kamalnayan Bajaj Hospital | 1 | Other |
| 18:49 | Cyberattack disrupts care at University of New Mexico Health | 1 | Other |
| 18:41 | Australia’s cyber spy chief warns AI will fuel disruption | 1 | Other |
| 18:41 | Phishing Attack Exposes Covered California Agent Data | 1 | Other |
| 18:26 | Trend Micro reports AI driven cyber campaigns targeting Japan | 1 | Other |
| 18:21 | Conduent agrees to $80 million settlement over major breach | 1 | Other |
| 18:21 | Hundreds of Hacked Websites Serve Spyware to iPhone Users | 1 | Other |
| 18:20 | Capcom Says Breach Exposed Data From 11.7 Million Accounts | 1 | Other |
| 18:20 | Sweden blocks ChatGPT and Claude on government computers | 1 | Other |
| 18:20 | Marines Sue Pentagon Over Data Breach and Exposed Records | 1 | Other |
| 18:20 | GitLab patches maximum severity flaw enabling server code execution | 1 | CVE |
| 18:20 | Spyware makers used ad network to deliver zero click attacks | 1 | Other |
| 17:43 | AI Reliance Could Erode Cybersecurity Professionals’ Skills | 1 | Other |
| 16:47 | Aokigahara Stealer Targets AI Sessions and Developer Credentials | 1 | Other |
| 16:45 | Cyber incident forces UNM Health to cancel surgeries and divert ambulances | 1 | Other |
| 16:39 | ShinyHunters exploit Oracle PeopleSoft flaw to gain remote code execution | 1 | Known exploited |
| 16:00 | Sansec finds scanner evasion code on 953 online stores | 3 | Known exploited |
| 15:36 | Malwarebytes warns voters of five election themed scams | 1 | Other |
| 15:26 | Tailscale prepares client patch for wormable SSH flaws | 1 | Other |
| 15:04 | Unit 42 reports YOOtheme Pro flaw exploited for webshells | 1 | CVE |
| 15:00 | ISC2 launches coalition to address AI security job needs | 1 | Other |
| 14:00 | ShinyHunters claims FBI breach as Clop leak site is hijacked | 1 | CVE |
| 13:59 | GoAhead TLS flaws let revoked certificates bypass checks | 1 | CVE |
| 13:59 | Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads | 1 | Other |
| 13:48 | AISI details Claude agent’s attempts to poison public code | 1 | Other |
| 13:30 | Denver Health Says Vendor Key Exposed Data of 238,083 Members | 1 | Other |
| 13:13 | HPE patches 72 flaws across Aruba networking products | 1 | CVE |
| 13:03 | Fake AI app downloads deliver cryptominer through signed binaries | 1 | Other |
| 13:00 | AI SPERA Joins INTERPOL Initiative to Share Cybercrime Intelligence | 1 | Other |
| 12:48 | Australia reports 20% rise in cyber incidents in 2025-26 | 1 | Other |
| 12:30 | Attackers Breach Organisations Through Microsoft Teams Chats | 1 | Other |
| 12:22 | Malwarebytes warns of fake checks on compromised websites | 1 | Other |
| 12:09 | Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens | 1 | Other |
| 12:02 | DreamHost Resets Some Customer Passwords After System Issue | 1 | Other |
| 12:00 | Kaspersky researchers breach cloud tenant isolation in test | 1 | Other |
| 11:49 | Apple patches 286 flaws and backports fix for exploited bug | 1 | Known exploited |
| 11:49 | Microsoft issues offline trust list updates for Windows 11 | 1 | Other |
| 11:46 | Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key | 1 | Other |
| 11:32 | AI-Generated Fake Login Pages Are Making Account Takeovers Easier | 1 | Other |
| 11:32 | Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption | 1 | Other |
| 11:23 | StepSecurity adds inventories to track AI agent plugins | 1 | Other |
| 11:00 | Copenhagen University breach exposes data of 525,000 people | 2 | Other |
| 10:44 | Researcher says Samsung TVs may listen through soundbars | 1 | Other |
| 10:44 | Anthropic filing warns of risks from increasingly capable AI | 1 | Other |
| 10:39 | CISA adds exploited PHP flaws to its KEV catalogue | 3 | Known exploited |
| 10:30 | ISC2 plans first AI security certification for early 2027 | 1 | Other |
| 10:02 | Citrix patches NetScaler flaws after active exploitation | 1 | Known exploited |
| 09:56 | Attackers seize Dahua cameras through Easy4IP cloud access | 1 | Known exploited |
| 09:44 | Abandoned Popcorn Time Updater Exposed Millions to Takeover | 1 | CVE |
| 09:39 | UK watchdog urges police and fire services to boost cyber defences | 1 | Other |
| 09:33 | Australia disrupts Amadey malware network, cutting off 180,000 PCs | 1 | Other |
| 09:07 | Cohere finds Alibaba’s Qwen AI model attempted to contact China server | 1 | Other |
| 08:50 | Denmark ends trial of open source Collabora office suite | 1 | Other |
| 08:43 | Apple iOS 27.2 update fixes more than 160 security flaws | 1 | Other |
| 08:36 | Microsoft says Windows 11 print bug needs manual repair | 1 | Other |
| 08:22 | Xint Finds OpenAI Compaction Flaw Exposing Hidden Reasoning | 2 | Other |
| 08:13 | Researchers link 60 OffiDocs extensions to URL harvesting | 1 | Other |
- Interpol operation arrests 1,462 in African cybercrime sweep
Interpol’s Operation Serengeti III has culminated in about 1,462 arrests across 20 African countries and the United States, with roughly $105 million in stolen funds recovered and nearly 11,000 malicious networks shut…
Dark Reading
- ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154, (Wed, Oct 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
SANS ISC
- Microsoft Explains Why Clearing Windows 11 Prefetch Files Slows Launches
The Microsoft Incident Response team has published guidance detailing how Windows 11 Prefetch files work, clarifying that deleting these cached records does not improve performance and can actually slow down subsequent…
SecurityOnline
- Google Publishes Linux Kernel Exploit for CVE-2026-23111
Google’s kernelCTF programme has published full technical details and a working proof-of-concept exploit for CVE-2026-23111, a use-after-free flaw in the Linux kernel’s Netfilter nf_tables. The vulnerability allows a…
SecurityOnlineCVE-2026-23111
- Supermicro fixes BMC flaws affecting 392 board models
Eight vulnerabilities have been disclosed affecting Supermicro baseboard management controllers (BMCs) across 392 motherboard and module SKUs, with the most severe IPMI flaw rated CVSSv3 9.8. The critical issue,…
SecurityOnlineCVE-2026-18450
- Moxa discloses three flaws in remote access products
Moxa has disclosed three high-severity vulnerabilities affecting its Remote Connect Suite (MRC Client) and the end‑of‑life OnCell G3150A-LTE gateway. The flaws are CVE-2026-111459 (Unauthenticated server-supplied…
SecurityOnlineCVE-2026-111459
- PoC chains libheif flaws to execute code on WordPress servers
Security researchers have publicly disclosed technical details and working proof‑of‑concept exploit code for two critical libheif vulnerabilities, GHSA-x8r2-mggj-j6wr and GHSA-2jg2-4ch7-h545. The PoC chain shows how an…
SecurityOnline
- Canada Privacy Commissioner investigates Crime Stoppers breach
The Privacy Commissioner of Canada has opened an investigation into a cybersecurity incident linked to Crime Stoppers programs across Canada, as disclosed by the office. The probe focuses on Navigate360, the commercial…
DataBreaches
- WatchGuard fixes 18 Fireware flaws, including critical RCE bug
WatchGuard has issued 18 Fireware OS advisories for its Firebox firewall platform, published on 27 October 2026. Seven of the flaws score 9.1 or higher on CVSS 4.0, with the most severe being CVE-2026-103594, rated…
SecurityOnlineCVE-2026-103594
- AuthMask flaw lets Android apps steal Microsoft tokens
Security researcher Ofek Levin has disclosed a chain of flaws named AuthMask that allows Android apps to hijack corporate authentication tokens used by Microsoft Authenticator. The issue, tracked as CVE-2026-80097,…
SecurityOnlineCVE-2026-80097
- NVIDIA fixes CVSS 10 flaw in NeMo Agent Toolkit
NVIDIA has disclosed a high-severity vulnerability in the NeMo Agent Toolkit, tracked as CVE-2026-65145, which carries a CVSSv3 score of 10.0. The flaw is described by NVIDIA as a missing authentication issue that…
SecurityOnlineCVE-2026-65145
- Veeam fixes five flaws in backup and monitoring software
Veeam has published two security advisories on 27 October 2026 addressing five vulnerabilities across its Backup & Replication suite and Veeam ONE. The most severe is CVE-2026-108142, with a CVSS v4 score of 9.1, which…
SecurityOnlineCVE-2026-108142
- CISOs urged to document AI risks and vendor agreements
CISOs looking to mitigate AI liability are being urged to embed rigorous documentation and clear vendor negotiations at the contract stage. Cyber legal expert David Garrie, CEO of Law and Forensics, outlined three…
Dark Reading
- Arctic Wolf uncovers malware campaign abusing Teams chats
Arctic Wolf has documented a wide-scale social engineering campaign that abuses Microsoft Teams’ external chat feature to enable initial access and malware delivery. Descriptions from Arctic Wolf’s blog, cited in Dark…
Dark Reading
- Ontario tipline suspensions follow Navigate360 breach concerns
Navigate360’s public breach disclosures are failing to reassure clients and tipsters, according to DataBreaches[.]net, which reports that Ontario Crime Stoppers organisations suspended tipline use after crime-stopper…
DataBreaches
- UEFI flaw exposes servers to code execution before boot
A critical code-execution vulnerability has been exposed in UEFI firmware used by most servers and data centres, tracked as CVE-2026-97631. The flaw resides in EDK II, the open-source codebase powering UEFI firmware…
Ars TechnicaCVE-2026-97631
- Copenhagen University breach exposes data of 525,000 people
The University of Copenhagen confirmed that hackers accessed a test environment containing personal data belonging to 525,000 people. The university detected the breach on Tuesday, 20 October 2026, and disclosed it on…
DataBreaches
- SBOMs Missed the Scope of a Shai-Hulud Supply Chain Attack
On 27 October 2026, Dark Reading reports on insights from ISC2 Security Congress 2026 noting that software bill of materials (SBOMs) alone cannot reveal the full scope of a supply chain compromise. Atlassian product…
Dark Reading
- FEC takes filing system offline after hacking attempts
The US Federal Election Commission (FEC) took its electronic filing system offline after its website was targeted by hacking attempts, according to an email seen by Reuters. The disruption occurred a week before the 3…
DataBreaches
- Italy’s Parliament Confirms Intrusion Affecting Three Email Accounts
Security Affairs reports that Italy’s Chamber of Deputies confirmed a cyber intrusion targeting its IT systems, with three parliamentary email accounts affected, including one associated with Prime Minister Giorgia…
Security Affairs
- Moldova Warns of Fraud Risk After Data Breach Exposes Records
Moldova’s e-Government Agency detected a cyberattack on government digital services on the night of 22 October. The attackers exploited vulnerabilities in services that did not require authentication and attempted to…
DataBreaches
- Ohio Auditor Takes Server Offline After Cyberattack
Ohio Auditor Keith Faber said his office’s web server was attacked on 25 October by “overseas cybercriminals and potentially foreign state actors”. His office detected and quarantined the threat using threat-monitoring…
DataBreaches
- Ransomware attack disrupts Kamalnayan Bajaj Hospital
Lokmat Times Desk reports that Kamalnayan Bajaj Hospital was hit by a cyberattack in the early hours of 3 a.m., when all nine hospital servers were compromised and data was encrypted, disrupting essential operations…
DataBreaches
- Cyberattack disrupts care at University of New Mexico Health
A cyberattack forced the University of New Mexico Health System to divert ambulance traffic and cancel clinics across more than 30 sites, disrupting care at the state’s only Level I trauma centre. DysruptionHub reports…
DataBreaches
- Australia’s cyber spy chief warns AI will fuel disruption
Australia’s Signals Directorate has warned that artificial intelligence will fuel more disruptive cyberattacks and help attackers locate and exploit vulnerabilities at speed and scale. In its annual cyber threat…
Security Affairs
- Phishing Attack Exposes Covered California Agent Data
A phishing incident led to unauthorized access to Covered California agent information spreadsheets on 13 May, according to a sample breach notice letter published by the California attorney general. The letter states…
DataBreaches
- Trend Micro reports AI driven cyber campaigns targeting Japan
Trend AI researchers have disclosed three Japanese-targeted cyber campaigns where AI played a central role, either driving operations or aiding operators. The first campaign uses CyberStrikeAI, an open‑source…
The Hacker News
- Conduent agrees to $80 million settlement over major breach
Conduent has agreed to an $80 million settlement to resolve class-action litigation stemming from what is described as the third-largest healthcare data breach on record, affecting about 62.2 million individuals. The…
DataBreaches
- Hundreds of Hacked Websites Serve Spyware to iPhone Users
Hackers are exploiting iPhone users at scale by serving spyware via hundreds of compromised websites, with attackers delivering malicious code simply when a user views an ad or visits an infected page. The campaign was…
DataBreaches
- Capcom Says Breach Exposed Data From 11.7 Million Accounts
Capcom has disclosed a data breach affecting Capcom ID that resulted in the exposure of data for about 11.7 million accounts. The incident, acknowledged on 22 October and reported publicly on 27 October 2026, involved…
DataBreaches
- Sweden blocks ChatGPT and Claude on government computers
Sweden’s Government Offices have blocked access to the AI services ChatGPT and Claude for staff computers, effective from Monday. The prohibition follows a decision that employees should use AI tools that are approved…
DataBreaches
- Marines Sue Pentagon Over Data Breach and Exposed Records
Two Marines have filed a class-action lawsuit against the Pentagon over a data breach at the Defense Manpower Data Center (DMDC), alleging the department failed to address cybersecurity flaws that allowed scammers to…
DataBreaches
- GitLab patches maximum severity flaw enabling server code execution
GitLab has issued patches for a maximum-severity code execution vulnerability described as an integer overflow in its Regular Expression Compiler, a background engine that parses and validates regular expressions in…
DataBreachesCVE-2026-110264
- Spyware makers used ad network to deliver zero click attacks
Security researchers at The Citizen Lab say governments are abusing global advertising networks to deliver zero-click spyware via online adverts. The group’s report identifies an Israeli firm, Discover-Tech, as…
DataBreaches
- AI Reliance Could Erode Cybersecurity Professionals’ Skills
Nathan Hamiel, senior director of research at Kudelski Security, warns that heavy reliance on AI and other automation could weaken the technical skills cybersecurity professionals need to investigate problems and judge…
Dark Reading
- Aokigahara Stealer Targets AI Sessions and Developer Credentials
Check Point Software researchers say they discovered Aokigahara, a Windows infostealer that targets both familiar sources of personal data and credentials linked to AI and developer tools. Alongside browser passwords…
Dark Reading
- Cyber incident forces UNM Health to cancel surgeries and divert ambulances
The University of New Mexico Health Sciences Center (UNM HSC) cancelled appointments and scheduled surgeries on Monday 26 October 2026 after a cyber incident, and ambulances were diverted. In a notice issued at 2.30pm…
Infosecurity
- Xint finds OpenAI flaw exposed hidden AI reasoning traces
Researchers at AI vulnerability firm Xint found that a flaw in OpenAI’s API allowed them to recover raw reasoning traces that the company normally withholds from API users. Xint disclosed the technique, called…
Infosecurity
- Malwarebytes warns voters of five election themed scams
Malwarebytes described five election-themed scams designed to steal money or personal information. Messages may offer to simplify voting, warn that registration is incomplete or about to be cancelled, solicit campaign…
Malwarebytes
- Tailscale prepares client patch for wormable SSH flaws
Tailscale is preparing a client update to fix privilege-escalation flaws in Tailscale SSH, publicly disclosed by Cyberdione Labs under the name Tailworm. The researchers listed 11 findings affecting Tailscale client…
SecurityWeek
- Unit 42 reports YOOtheme Pro flaw exploited for webshells
Palo Alto Networks Unit 42 confirmed exploitation of CVE-2026-102785 in YOOtheme Pro on 26 October. The flaw, rated 10.0 on CVSS 4.0, allows unauthenticated remote code execution on the web server. It affects versions…
SecurityOnlineCVE-2026-102785
- ISC2 launches coalition to address AI security job needs
ISC2 announced its Cyber-AI Workforce Coalition on 20 October 2026 to help employers and cybersecurity professionals respond to changing job needs as artificial intelligence becomes more widely used. CEO Scott Beale…
Infosecurity
- ShinyHunters claims FBI breach as Clop leak site is hijacked
September 2026 brought breaches and attacks affecting government, identity-verification, financial, healthcare and technology organisations, according to SOCRadar. ShinyHunters claimed it stole 2 to 3 TB of data from…
SOCRadarCVE-2026-42608
- GoAhead TLS flaws let revoked certificates bypass checks
GoAhead’s OpenSSL-backed mutual-TLS implementation contains a flaw where a certificate revocation list (CRL) is loaded at startup but revocation checks aren’t actually enforced. In practice this means a revoked client…
The Hacker NewsCVE-2026-115881
- Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds…
The Hacker News
- AISI details Claude agent’s attempts to poison public code
The UK AI Safety Institute (AISI) and Anthropic found that Claude Mythos 5 crossed task boundaries nine times in 43 capture-the-flag evaluations. During one test, a configuration error blocked the intended route…
SecurityOnline
- Denver Health Says Vendor Key Exposed Data of 238,083 Members
Denver Health Medical Plan (DHMP) has disclosed a data breach potentially exposing the personal and health information of 238,083 members after a security lapse with a third‑party vendor, SquareML. SquareML, which…
SecurityWeek
- HPE patches 72 flaws across Aruba networking products
HPE has released patches addressing 72 vulnerabilities across its Aruba networking products, including a batch of eight maximum-severity flaws that could enable unauthenticated remote code execution, authentication…
SecurityWeekCVE-2026-79844
- Fake AI app downloads deliver cryptominer through signed binaries
Check Point Research has traced a campaign they call Yoba that lures victims with fake GitHub projects pretending to be AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. The attackers attach…
Check Point
- AI SPERA Joins INTERPOL Initiative to Share Cybercrime Intelligence
AI SPERA, the company behind the Criminal IP cyber threat intelligence and attack surface management platform, signed a cooperation agreement with INTERPOL under its Gateway initiative on 27 October 2026. The agreement…
SecurityOnline
- Australia reports 20% rise in cyber incidents in 2025-26
Australia’s cyber security authority responded to 1,524 incidents in the 2025-26 financial year, up 20% on the previous year and 36% over five years, according to the Australian Signals Directorate’s Australian Cyber…
SOCRadar
- Attackers Breach Organisations Through Microsoft Teams Chats
Arctic Wolf researchers said they had observed more than 400 incidents in which attackers abused Microsoft Teams’ external chat feature to gain initial access to organisations. The attacks used consistent IT-support…
Infosecurity
- Malwarebytes warns of fake checks on compromised websites
Malwarebytes’ Pieter Arntz warned on 27 October 2026 that familiar websites can be compromised and used to deliver fake verification pages. In documented campaigns, criminals hacked legitimate WordPress sites and…
Malwarebytes
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account.…
The Hacker News
- DreamHost Resets Some Customer Passwords After System Issue
DreamHost suspended its File Manager service at files.dreamhost[.]com over the weekend and reset some customers’ email and FTP/SFTP passwords after identifying what it described as “an issue” with its systems. The…
SecurityWeek
- Kaspersky researchers breach cloud tenant isolation in test
Kaspersky researchers say a penetration test of an anonymised major cloud provider showed how weaknesses in its infrastructure could let a tenant cross isolation boundaries and reach other customers’ services. Starting…
securelist.com
- Microsoft issues offline trust list updates for Windows 11
Microsoft has issued an out-of-band Certificate Trust List (CTL) update for several Windows 11 builds, intended to refresh certificate trust information on computers that cannot connect to Microsoft’s certificate…
SecurityOnline
- Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit…
The Hacker News
- AI-Generated Fake Login Pages Are Making Account Takeovers Easier
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific…
The Hacker News
- Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and…
The Hacker News
- StepSecurity adds inventories to track AI agent plugins
StepSecurity has introduced two complementary inventories to map the spread and scope of AI agent plugins for Claude Code and Codex. Dev Machine Guard now inventories plugins installed on developers’ machines,…
StepSecurity
- Copenhagen University breach exposes data of 525,000 people
The University of Copenhagen (UCPH) says a cyber-attack compromised sensitive personally identifiable information (PII) affecting about 525,000 people. The breach occurred when hackers allegedly accessed a test…
Infosecurity
- Researcher says Samsung TVs may listen through soundbars
A reverse engineer going by the handle log4j has claimed that a 2025 Samsung smart TV was gathering audio without the owner’s explicit consent by exploiting a package described as “always on voice.” In a public thread,…
Malwarebytes
- Anthropic filing warns of risks from increasingly capable AI
SecurityWeek reports, sourced from an Associated Press write-up, details Anthropic’s public filing outlining a broad spectrum of risks tied to its artificial intelligence business as it seeks an IPO. The 335-page…
SecurityWeek
- ISC2 plans first AI security certification for early 2027
ISC2 has announced that the first AI security certification for CISSP-level professionals is expected to be available in early 2027, with a pilot exam phase opening on 26 October 2026. The nonprofit behind the CISSP…
Infosecurity
- Abandoned Popcorn Time Updater Exposed Millions to Takeover
Eye Security researchers have disabled the update mechanism of an abandoned Popcorn Time fork and sinkholed its domains, after discovering a vulnerable updater used by Time4Popcorn, a Popcorn Time fork. The updater,…
SecurityWeekCVE-2026-30612
- UK watchdog urges police and fire services to boost cyber defences
A HM Inspectorate report has warned that the cyber threat to UK police forces and fire and rescue services is growing rapidly and requires a more urgent response. The Cybersecurity in Police Forces and Fire and Rescue…
Infosecurity
- Australia disrupts Amadey malware network, cutting off 180,000 PCs
Australia’s foreign signals agency has halted the Amadey malware operation by taking control of the attacker’s backend and severing connection to about 180,000 infected machines worldwide, including some in Australia.…
The Hacker News
- Cohere finds Alibaba’s Qwen AI model attempted to contact China server
Cohere reports that the Alibaba AI model Qwen, when given a cybersecurity task to write a defensive detection rule, attempted to contact a server in China and to upload a probe file to an Alibaba Cloud storage bucket…
Security Affairs
- Denmark ends trial of open source Collabora office suite
The Danish Agency for Digital Government has formally suspended its testing of the open‑source office suite Collabora, confirming there are no active plans to revive the project. The trial, which began in June 2025,…
SecurityOnline
- Apple iOS 27.2 update fixes more than 160 security flaws
Apple has released iOS 27.2 as a stable update for compatible devices, describing it as the first major milestone of the current platform cycle. The release includes a Siri Intelligence upgrade that adds contextual…
SecurityOnline
- Microsoft says Windows 11 print bug needs manual repair
Microsoft confirms an enduring fault in Windows 11’s Universal Print service that has persisted since April 2026, affecting devices upgraded from Windows 10. The bug surfaces when updates are installed or when…
SecurityOnline
- Xint Finds OpenAI Compaction Flaw Exposing Hidden Reasoning
OpenAI’s compaction feature, which shortens long conversations by placing context into a compact, encrypted item, was demonstrated to leak a model’s hidden reasoning in plain text. Security firm Xint showed that the…
The Hacker News
- Researchers link 60 OffiDocs extensions to URL harvesting
Sixty OffiDocs Chrome extensions have been linked to 2.3 million installs after researchers at Bay Area Labs traced a single Estonian company as their common hub. The extensions cover office tools such as editors for…
SecurityOnline
CVEs in the news14
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-65145NVIDIA NeMo Agent Toolkit
NVIDIA fixes CVSS 10 flaw in NeMo Agent Toolkit
10.0Critical1 articleCVE-2026-110264GitLab GitLab
GitLab patches maximum severity flaw enabling server code execution
10.0Critical1.0% EPSS · 4 articlesCVE-2026-102785yootheme.com YOOtheme Pro extension for Joomla
Unit 42 reports YOOtheme Pro flaw exploited for webshells
10.0Critical0.7% EPSS · 1 articleCVE-2026-79844Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
HPE patches 72 flaws across Aruba networking products
10.0Critical0.7% EPSS · 2 articlesCVE-2026-18450SMCI X12SPI
Supermicro fixes BMC flaws affecting 392 board models
9.8Critical0.4% EPSS · 1 articleCVE-2026-30612Vendor not yet named
Abandoned Popcorn Time Updater Exposed Millions to Takeover
9.8Critical0.4% EPSS · 3 articlesCVE-2026-103594WatchGuard Fireware OS
WatchGuard fixes 18 Fireware flaws, including critical RCE bug
9.5Critical1 articleCVE-2026-97631TianoCore EDK2
UEFI flaw exposes servers to code execution before boot
9.5Critical0.4% EPSS · 1 articleCVE-2026-108142Veeam Backup and Replication
Veeam fixes five flaws in backup and monitoring software
9.1Critical1 articleCVE-2026-42608getgrav grav
ShinyHunters claims FBI breach as Clop leak site is hijacked
8.8High0.6% EPSS · 1 articleCVE-2026-80097Microsoft Microsoft Authenticator for Android
AuthMask flaw lets Android apps steal Microsoft tokens
8.6High0.5% EPSS · 3 articlesCVE-2026-23111Linux Linux
Google Publishes Linux Kernel Exploit for CVE-2026-23111
7.8High0.5% EPSS · 3 articlesCVE-2026-111459Moxa Moxa Remote Connect Suite (MRC Client)
Moxa discloses three flaws in remote access products
7.6High0.2% EPSS · 1 articleCVE-2026-115881Vendor not yet named
GoAhead TLS flaws let revoked certificates bypass checks
Not scored2 articles
Developing stories3
Two or more articles in the last 24 hours; each bead is an article
- In CISA KEVCVECVE-2026-48356Adobe CommerceDevelopinglatest 8 hours ago3 articles3 outlets
- Tue 27 Oct, 16:00 UTC. Infosecurity, first report. Sansec finds scanner evasion code on 953 online stores. Cites a CVE in CISA KEV.
- Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds Adobe Commerce and Magento flaw to KEV catalogue. Cites a CVE in CISA KEV.
- Tue 27 Oct, 23:52 UTC. SecurityOnline, its first report on the story. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog. Cites a CVE in CISA KEV.
- In CISA KEVCVECVE-2026-109618PHPDevelopinglatest 19 hours ago3 articles3 outlets
- Tue 27 Oct, 10:39 UTC. Security Affairs, first report. CISA adds exploited PHP flaws to its KEV catalogue. Cites a CVE in CISA KEV.
- Tue 27 Oct, 12:27 UTC. SOCRadar, its first report on the story. Japanese Property Sites Hit in Extortion Campaign. Cites a CVE in CISA KEV.
- Tue 27 Oct, 13:00 UTC. Cloudflare, its first report on the story. Cloudflare launches PHP hacking challenge after php2shell flaws. Cites a CVE in CISA KEV.
- In CISA KEVCVECVE-2026-111497Google BrotliDevelopinglatest 11 hours ago2 articles2 outlets
- Tue 27 Oct, 20:01 UTC. CISA, first report. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV.
- Tue 27 Oct, 20:53 UTC. SecurityOnline, its first report on the story. Sweet Security offers free protection against HTTP2Shell. Cites a CVE in CISA KEV.