Thu 29 Oct · updated 03:30 UTC
Today in security
Latest briefing
Wednesday 28 October edition
CISA adds exploited Brotli and Magento flaws to KEV
CISA’s Known Exploited Vulnerabilities catalogue lists CVE-2026-111497 in Google Brotli and CVE-2026-48356 in Adobe Commerce and Magento, both added on 27 October 2026. After Tuesday’s edition centred on two PHP flaws, the new entries widen the focus to a compression component used across products and an e-commerce platform; CISA confirms active exploitation for Brotli, while the available data lists ransomware use as unknown. The other major development is reporting that ShinyHunters exploited a PeopleSoft flaw before Oracle’s June patch, with researchers describing a chain of three vulnerabilities tracked under one CVE.
Known exploited23
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
PHPCVE-2026-109618
Federal deadline 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS51 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS50 articles
- In CISA KEV
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical88% EPSS20 articles
- In CISA KEV
Adobe CommerceCVE-2026-48356
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.3Critical59% EPSS8 articles
- In CISA KEV
VMware Cloud FoundationCVE-2026-41709
Federal deadline 11 Nov · In CISA KEV since 28 Oct
2.7Low0.3% EPSS4 articles
Show 17 more · federal deadlines passed
- In CISA KEV
Apple iOS and iPadOSCVE-2026-86950
Federal deadline passed 13 Oct · In CISA KEV since 29 Sep
8.8High26% EPSS16 articles
- In CISA KEV
NetScaler ADCCVE-2026-88779
Federal deadline passed 7 Oct · In CISA KEV since 4 Oct
8.7High11% EPSS10 articles
- In CISA KEV
Citrix NetScaler ADCCVE-2026-88771
Federal deadline passed 30 Sep · In CISA KEV since 27 Sep
9.5Critical82% EPSS29 articles
- In CISA KEV
PaperCut NG/MFCVE-2026-81578
Federal deadline passed 14 Sep · In CISA KEV since 31 Aug
8.8High84% EPSS24 articles
- In CISA KEV
PaperCut NG/MFCVE-2026-82078
Federal deadline passed 14 Sep · In CISA KEV since 31 Aug
9.4Critical61% EPSS23 articles
- In CISA KEV
Arista VeloCloud OrchestratorCVE-2026-16812
Federal deadline passed 30 Jul · In CISA KEV since 27 Jul
10.0Critical1.0% EPSS9 articles
- In CISA KEV
Oracle E-Business SuiteCVE-2026-46817
Federal deadline passed 18 Jul · In CISA KEV since 15 Jul
9.8Critical12% EPSS9 articles
- In CISA KEV
Oracle PeopleSoft Enterprise PeopleToolsCVE-2026-35273
Federal deadline passed 15 Jun · In CISA KEV since 12 Jun · Used in ransomware campaigns
9.8Critical97% EPSS30 articles
- In CISA KEV
Hikvision Multiple ProductsCVE-2017-7921
Federal deadline passed 26 Mar · In CISA KEV since 5 Mar
Not scored99.9% EPSS10 articles
- In CISA KEV
Cisco Catalyst SD-WAN Controller and ManagerCVE-2026-20127
Federal deadline passed 27 Feb · In CISA KEV since 25 Feb
10.0Critical89% EPSS22 articles
- In CISA KEV
Adobe Commerce and MagentoCVE-2025-54236
Federal deadline passed 14 Nov 2025 · In CISA KEV since 24 Oct 2025
9.1Critical95% EPSS5 articles
- In CISA KEV
Oracle E-Business SuiteCVE-2025-61882
Federal deadline passed 27 Oct 2025 · In CISA KEV since 6 Oct 2025 · Used in ransomware campaigns
9.8Critical99.7% EPSS8 articles
- In CISA KEV
Versa DirectorCVE-2024-39717
Federal deadline passed 13 Sep 2024 · In CISA KEV since 23 Aug 2024
6.6Medium4.0% EPSS1 article
- In CISA KEV
Dahua IP Camera FirmwareCVE-2021-33044
Federal deadline passed 11 Sep 2024 · In CISA KEV since 21 Aug 2024
9.8Critical99.9% EPSS7 articles
- In CISA KEV
Dahua IP Camera FirmwareCVE-2021-33045
Federal deadline passed 11 Sep 2024 · In CISA KEV since 21 Aug 2024
9.8Critical99.5% EPSS3 articles
- In CISA KEV
Adobe Commerce and Magento Open SourceCVE-2024-34102
Federal deadline passed 7 Aug 2024 · In CISA KEV since 17 Jul 2024
9.8Critical99.9% EPSS1 article
- In CISA KEV
Hikvision Security cameras web serverCVE-2021-36260
Federal deadline passed 24 Jan 2022 · In CISA KEV since 10 Jan 2022
Not scored99.8% EPSS4 articles
Latest news69
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 02:30 UTC. Red diamonds mark the 8 stories about exploited CVEs.
- 02:30 UTC. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems. 1 outlet. About an exploited CVE.
- 01:22 UTC. FasterXML discloses critical Jackson deserialisation flaw. 1 outlet.
- 00:43 UTC. Dell fixes unauthenticated flaws in PowerProtect appliances. 1 outlet.
- 00:33 UTC. FoxIO discloses three TLS flaws in GoAhead web server. 1 outlet.
- 00:00 UTC. free5GC advisories detail two unpatched 5G core flaws. 1 outlet.
- 22:32 UTC. Jenkins fixes 15 flaws, including remote code execution bugs. 1 outlet.
- 22:21 UTC. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw. 1 outlet.
- 22:07 UTC. WordPress 7.1.4 fixes 17 security flaws, including an RCE bug. 1 outlet.
- 21:42 UTC. Attackers Exploit Cisco Firewall Flaw to Crash SSL VPN Devices. 1 outlet.
- 20:01 UTC. CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV. 2 outlets. About an exploited CVE.
- 20:01 UTC. CISA flags actively exploited VMware ESX logging flaw in KEV. 1 outlet. About an exploited CVE.
- 19:39 UTC. GhostAction Targets GitHub Again as Operators Remain Active. 1 outlet.
- 18:08 UTC. Volt Typhoon Used Silent Train in Four Zero Day Campaigns. 1 outlet. About an exploited CVE.
- 18:00 UTC. Unit 42 warns retailers of evolving peak season cyber threats. 1 outlet. About an exploited CVE.
- 17:08 UTC. Google lets approved Android app stores install apps with one tap. 1 outlet.
- 16:23 UTC. Researcher details Edge sandbox escape using logic flaws. 1 outlet.
- 16:22 UTC. Juniper fixes 18 flaws in Session Smart routers and Conductor. 1 outlet.
- 16:14 UTC. MrHex builds hack and leak operation targeting US industry. 1 outlet.
- 16:07 UTC. SANS Tracks ClickFix Campaign Spoofing Cloudflare Verification. 1 outlet.
- 16:00 UTC. Microsoft urges CISOs to govern AI agents as adoption grows. 1 outlet.
- 15:49 UTC. GMO Internet warns customers after malware breach. 1 outlet.
- 15:22 UTC. Times Car breach costs Park24 ¥5.5 billion after data leak. 1 outlet.
- 15:15 UTC. Discord to make public server messages searchable on the web. 1 outlet.
- 15:13 UTC. Yoba campaign uses fake AI apps to deliver a crypto miner. 1 outlet.
- 14:37 UTC. Fake AI bots scan organisations for exposed credentials. 1 outlet.
- 14:37 UTC. TrendAI says ad tech firm targeted Starlink users for surveillance. 1 outlet.
- 14:10 UTC. Nvidia’s Weatherford says AI is reshaping the CISO’s role. 1 outlet.
- 14:05 UTC. Engie customers warned of data exposure in supply chain breach. 1 outlet.
- 13:38 UTC. US banks block AI agents from operating in customer accounts. 1 outlet.
- 13:23 UTC. StepSecurity contrasts Harden Runner with GitHub's egress firewall. 1 outlet.
- 13:10 UTC. FoxIO finds three TLS flaws in widely used GoAhead server. 1 outlet.
- 12:42 UTC. Bithumb probes data leak after internal system breach. 1 outlet.
- 12:31 UTC. GMO tells customers to disconnect PCs after cyberattack. 1 outlet.
- 12:25 UTC. NT Health revises patient count after Darwin Hospital privacy breach. 1 outlet.
- 12:10 UTC. Courts weigh traceability in healthcare data breach claims. 1 outlet.
- 12:03 UTC. Court allows PowerSchool breach claims to proceed. 1 outlet.
- 12:00 UTC. China Linked Hackers Exploit PHP Flaws to Root Firewalls. 3 outlets. About an exploited CVE.
- 12:00 UTC. Whitsett warns residents after town email account is breached. 1 outlet.
- 11:58 UTC. ZenTech ransomware attack delays answers for grieving families. 1 outlet.
- 11:30 UTC. Wazuh adds AI analyst workflows to its security platform. 1 outlet.
- 11:26 UTC. Hive ransomware affiliate sentenced to 70 months in prison. 4 outlets.
- 11:15 UTC. A 16-year-old UEFI flaw puts server firmware at risk. 3 outlets.
- 11:13 UTC. Chrome and Firefox updates fix hundreds of security flaws. 1 outlet.
- 10:48 UTC. Cipher uncovers four flaws in EPICS control software. 1 outlet.
- 10:30 UTC. Security Questionnaires Persist Despite Buyers’ Lack of Trust. 1 outlet.
- 10:30 UTC. Skyw4lker Uses Device Code Phishing to Target US Organisations. 1 outlet.
- 10:01 UTC. Body parser flaw lets one request crash Express servers. 1 outlet.
- 10:00 UTC. Kaspersky Finds Unauthenticated DoS Flaw in Intelbras Cameras. 2 outlets.
- 09:48 UTC. Infisical raises $40 million at a $600 million valuation. 1 outlet.
- 09:14 UTC. Hackers Probe Oracle EBS Flaw After October Patch. 2 outlets.
- 08:49 UTC. LiteLLM fixes flaw that could expose proxy master keys. 1 outlet.
- 08:34 UTC. Trend Micro details three AI assisted attacks targeting Japan. 1 outlet.
- 08:15 UTC. Anthropic AI model chains flaws into browser and OS exploits. 2 outlets.
- 08:02 UTC. n0n ransomware operation used AI to support extortion. 1 outlet.
- 07:37 UTC. FBI Seizes Virtualine Domain in International Crime Operation. 1 outlet.
- 07:35 UTC. Adobe patches nine flaws in Campaign Classic and Connect. 2 outlets.
- 07:26 UTC. Google Chrome update fixes 52 flaws, including four critical bugs. 2 outlets.
- 07:22 UTC. TeamViewer patches three flaws enabling code execution and escalation. 1 outlet.
- 07:13 UTC. GMO offers $1 million bounty over cloud service breach. 1 outlet.
- 07:11 UTC. Brazilian Magecart Group Skims Cards in Convertr Supply Chain Attack. 1 outlet.
- 06:24 UTC. Google Ads and Claude Shares Spread Mac Stealer and Windows RAT. 1 outlet.
- 06:20 UTC. Tailscale fixes SSH flaws that could expose root access on servers. 1 outlet.
- 06:04 UTC. ShinyHunters exploited three chained flaws in PeopleSoft. 1 outlet. About an exploited CVE.
- 06:00 UTC. Interpol operation arrests 1,462 in African cybercrime sweep. 1 outlet.
- 05:42 UTC. CISA Adds Two Actively Exploited Flaws to KEV Catalog. 4 outlets. About an exploited CVE.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 02:30 | UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems | 1 | Known exploited |
| 01:22 | FasterXML discloses critical Jackson deserialisation flaw | 1 | CVE |
| 00:43 | Dell fixes unauthenticated flaws in PowerProtect appliances | 1 | CVE |
| 00:33 | FoxIO discloses three TLS flaws in GoAhead web server | 1 | Other |
| 00:00 | free5GC advisories detail two unpatched 5G core flaws | 1 | CVE |
| 22:32 | Jenkins fixes 15 flaws, including remote code execution bugs | 1 | CVE |
| 22:21 | Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw | 1 | CVE |
| 22:07 | WordPress 7.1.4 fixes 17 security flaws, including an RCE bug | 1 | Other |
| 21:42 | Attackers Exploit Cisco Firewall Flaw to Crash SSL VPN Devices | 1 | CVE |
| 20:01 | CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV | 2 | Known exploited |
| 20:01 | CISA flags actively exploited VMware ESX logging flaw in KEV | 1 | Known exploited |
| 19:39 | GhostAction Targets GitHub Again as Operators Remain Active | 1 | Other |
| 18:08 | Volt Typhoon Used Silent Train in Four Zero Day Campaigns | 1 | Known exploited |
| 18:00 | Unit 42 warns retailers of evolving peak season cyber threats | 1 | Known exploited |
| 17:08 | Google lets approved Android app stores install apps with one tap | 1 | Other |
| 16:23 | Researcher details Edge sandbox escape using logic flaws | 1 | CVE |
| 16:22 | Juniper fixes 18 flaws in Session Smart routers and Conductor | 1 | CVE |
| 16:14 | MrHex builds hack and leak operation targeting US industry | 1 | Other |
| 16:07 | SANS Tracks ClickFix Campaign Spoofing Cloudflare Verification | 1 | Other |
| 16:00 | Microsoft urges CISOs to govern AI agents as adoption grows | 1 | Other |
| 15:49 | GMO Internet warns customers after malware breach | 1 | Other |
| 15:22 | Times Car breach costs Park24 ¥5.5 billion after data leak | 1 | Other |
| 15:15 | Discord to make public server messages searchable on the web | 1 | CVE |
| 15:13 | Yoba campaign uses fake AI apps to deliver a crypto miner | 1 | Other |
| 14:37 | Fake AI bots scan organisations for exposed credentials | 1 | Other |
| 14:37 | TrendAI says ad tech firm targeted Starlink users for surveillance | 1 | Other |
| 14:10 | Nvidia’s Weatherford says AI is reshaping the CISO’s role | 1 | Other |
| 14:05 | Engie customers warned of data exposure in supply chain breach | 1 | Other |
| 13:38 | US banks block AI agents from operating in customer accounts | 1 | Other |
| 13:23 | StepSecurity contrasts Harden Runner with GitHub's egress firewall | 1 | Other |
| 13:10 | FoxIO finds three TLS flaws in widely used GoAhead server | 1 | CVE |
| 12:42 | Bithumb probes data leak after internal system breach | 1 | Other |
| 12:31 | GMO tells customers to disconnect PCs after cyberattack | 1 | Other |
| 12:25 | NT Health revises patient count after Darwin Hospital privacy breach | 1 | Other |
| 12:10 | Courts weigh traceability in healthcare data breach claims | 1 | Other |
| 12:03 | Court allows PowerSchool breach claims to proceed | 1 | Other |
| 12:00 | China Linked Hackers Exploit PHP Flaws to Root Firewalls | 3 | Known exploited |
| 12:00 | Whitsett warns residents after town email account is breached | 1 | Other |
| 11:58 | ZenTech ransomware attack delays answers for grieving families | 1 | Other |
| 11:30 | Wazuh adds AI analyst workflows to its security platform | 1 | Other |
| 11:26 | Hive ransomware affiliate sentenced to 70 months in prison | 4 | Other |
| 11:15 | A 16-year-old UEFI flaw puts server firmware at risk | 3 | CVE |
| 11:13 | Chrome and Firefox updates fix hundreds of security flaws | 1 | Other |
| 10:48 | Cipher uncovers four flaws in EPICS control software | 1 | CVE |
| 10:30 | Security Questionnaires Persist Despite Buyers’ Lack of Trust | 1 | Other |
| 10:30 | Skyw4lker Uses Device Code Phishing to Target US Organisations | 1 | Other |
| 10:01 | Body parser flaw lets one request crash Express servers | 1 | CVE |
| 10:00 | Kaspersky Finds Unauthenticated DoS Flaw in Intelbras Cameras | 2 | Other |
| 09:48 | Infisical raises $40 million at a $600 million valuation | 1 | Other |
| 09:14 | Hackers Probe Oracle EBS Flaw After October Patch | 2 | CVE |
| 08:49 | LiteLLM fixes flaw that could expose proxy master keys | 1 | Other |
| 08:34 | Trend Micro details three AI assisted attacks targeting Japan | 1 | Other |
| 08:15 | Anthropic AI model chains flaws into browser and OS exploits | 2 | CVE |
| 08:02 | n0n ransomware operation used AI to support extortion | 1 | Other |
| 07:37 | FBI Seizes Virtualine Domain in International Crime Operation | 1 | Other |
| 07:35 | Adobe patches nine flaws in Campaign Classic and Connect | 2 | CVE |
| 07:26 | Google Chrome update fixes 52 flaws, including four critical bugs | 2 | CVE |
| 07:22 | TeamViewer patches three flaws enabling code execution and escalation | 1 | CVE |
| 07:13 | GMO offers $1 million bounty over cloud service breach | 1 | Other |
| 07:11 | Brazilian Magecart Group Skims Cards in Convertr Supply Chain Attack | 1 | CVE |
| 06:24 | Google Ads and Claude Shares Spread Mac Stealer and Windows RAT | 1 | Other |
| 06:20 | Tailscale fixes SSH flaws that could expose root access on servers | 1 | Other |
| 06:04 | ShinyHunters exploited three chained flaws in PeopleSoft | 1 | Known exploited |
| 06:00 | Interpol operation arrests 1,462 in African cybercrime sweep | 1 | Other |
| 05:42 | CISA Adds Two Actively Exploited Flaws to KEV Catalog | 4 | Known exploited |
- FasterXML discloses critical Jackson deserialisation flaw
FasterXML has published full details and a public proof-of-concept exploit for CVE-2026-110879, a critical deserialisation flaw in jackson-databind with a CVSS v3.1 score of 9.8. Do Son, writing for…
SecurityOnlineCVE-2026-110879
- Dell fixes unauthenticated flaws in PowerProtect appliances
Dell has issued a security advisory, DSA-2026-416, detailing more than 180 CVEs across its PowerProtect Data Domain backup appliances, including 48 Dell-specific vulnerabilities. Four of these are rated CVSS v3.1 at…
SecurityOnlineCVE-2026-86400
- FoxIO discloses three TLS flaws in GoAhead web server
FoxIO has published full details and proof‑of‑concept code for three GoAhead TLS vulnerabilities affecting the embedded web server used in a wide range of devices, including routers, switches, printers and industrial…
SecurityOnline
- EDK II PXE flaw enables remote code execution before boot
The article reports a critical pre-boot remote code execution vulnerability in the TianoCore EDK II PXE driver, tracked as CVE-2026-97631. Discovered by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google, the…
SecurityOnlineCVE-2026-97631
- free5GC advisories detail two unpatched 5G core flaws
Two security advisories from the free5GC project detail two unpatched vulnerabilities in its 5G core that have published proof-of-concept material. The more severe issue, CVE-2026-115926, scores 9.1 on CVSS v3.1 and…
SecurityOnlineCVE-2026-115926
- Jenkins fixes 15 flaws, including remote code execution bugs
The Jenkins project has issued a security advisory on 28 October 2026 announcing fixes for 15 vulnerabilities across Jenkins core and related components. The flaws span remote code execution, file read/write, path…
SecurityOnlineCVE-2026-117612
- Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw
On 20 and 21 October, an attacker attempted to exploit CVE-2026-97229 against Alpine Linux’s GitLab instance. The flaw, rated CVSS 10.0, could allow remote code execution and arises from a specially crafted regular…
SecurityOnlineCVE-2026-97229
- WordPress 7.1.4 fixes 17 security flaws, including an RCE bug
WordPress released version 7.1.4 on 28 October 2026, fixing 17 security issues and updating bundled root certificates following the eMudhra revocation. The fixes include a race condition during core updates that could…
SecurityOnline
- Attackers Exploit Cisco Firewall Flaw to Crash SSL VPN Devices
Cisco says attackers are actively exploiting CVE-2026-76418, a high-severity flaw in Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. The company’s security response team became…
SecurityOnlineCVE-2026-76418
- Hive and Nefilim ransomware affiliate sentenced to 70 months
A Ukrainian national, Artem Aleksandrovych Stryzhak, was sentenced in a Brooklyn federal court to 70 months in prison for involvement in Hive and Nefilim ransomware operations that extorted millions from victims. The…
Security Affairs
- GhostAction Targets GitHub Again as Operators Remain Active
A new wave of GhostAction attacks largely fizzled, but the operators behind the supply chain campaign remain active and adaptable. GhostAction targets GitHub by compromising developer accounts and injecting malicious…
Dark Reading
- Google lets approved Android app stores install apps with one tap
Google has announced a programme allowing third‑party Android app stores to request permission to install apps with a single tap, bypassing Android’s usual confirmation screens, and to update them in the background. To…
The Hacker News
- Researcher details Edge sandbox escape using logic flaws
Orange Tsai of DEVCORE published the full method for a chain of logic flaws in Microsoft Edge that allowed a malicious web page to break out of Edge’s sandbox and run code on a Windows machine, without any memory…
The Hacker NewsCVE-2026-45492
- Juniper fixes 18 flaws in Session Smart routers and Conductor
Juniper Networks has released a security bulletin, JSA112183, confirming 18 vulnerabilities across its Session Smart Router and Session Smart Conductor management platform. Two flaws are rated CVSS v3.1 9.8:…
SecurityOnlineCVE-2026-103406
- MrHex builds hack and leak operation targeting US industry
MrHex and associated handles Mr8ex, MrDarkRoot and Darku3er have been building a hack-and-leak ecosystem advertised on both the darknet and clearnet, according to DomainTools’ research. The group depicts itself as…
dti.domaintools.com
- Attackers exploit MLflow file read flaw as PoC code emerges
SecurityOnline[.]info reports that attackers are actively probing MLflow servers for two newly disclosed vulnerabilities, CVE-2026-116690 and CVE-2026-116692, with PoC code published and exploitation attempts observed…
SecurityOnlineCVE-2026-116690
- SANS Tracks ClickFix Campaign Spoofing Cloudflare Verification
Brad Duncan of the SANS Internet Storm Center reports a new ClickFix campaign observed on 28 October 2026 that spoofs a Cloudflare verification page. The campaign targets both macOS and Windows hosts, but Duncan states…
SANS ISC
- Microsoft urges CISOs to govern AI agents as adoption grows
October is Cybersecurity Awareness Month, and this Microsoft Security blog outlines how the Chief Information Security Officer’s role is changing as enterprises increasingly run on AI and agent-driven workflows. The…
Microsoft
- GMO Internet warns customers after malware breach
GMO Internet’s Onamae[.]com service, a virtual desktop offering used by foreign‑exchange traders, was breached after malicious programs were found in some customers’ server environments. The firm suspended the service…
Infosecurity
- Times Car breach costs Park24 ¥5.5 billion after data leak
Times Car, the Japan-based driver’s‑license data handler run by Park24’s Times Mobility unit, faces a substantial financial fallout after a data breach disclosed in late September. The incident exposed personal data…
DataBreaches
- Discord to make public server messages searchable on the web
Discord has announced an upcoming expansion to its public indexing, with public messages from large discoverable servers set to surface on the open web and be indexed by major search engines such as Google. The rollout…
SecurityOnlineCVE-2026-116690
- Yoba campaign uses fake AI apps to deliver a crypto miner
Check Point researchers have uncovered a campaign in which attackers host fake ChatGPT and Claude desktop applications on GitHub to distribute a malware chain that abuses legitimately signed binaries to bypass security…
Infosecurity
- Nefilim and Hive Affiliate Sentenced to 70 Months in Prison
Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, has been sentenced in the United States to 70 months in prison for his role as an affiliate in the Nefilim ransomware operation and his involvement with…
SecurityWeek
- Fake AI bots scan organisations for exposed credentials
A Cequence Security Cequence CQ Prime Research report details a threat actor that operated behind more than 30 AI bot identities to probe organisations for exposed credentials. The malicious scanner impersonated 32…
Dark Reading
- TrendAI says ad tech firm targeted Starlink users for surveillance
Digital defence firm TrendAI has alleged that an Israeli ad tech company, Discover-Tech, was among the largest providers of online ads shown to SpaceX Starlink users, with the findings suggesting the ads could be used…
Security Affairs
- Nvidia’s Weatherford says AI is reshaping the CISO’s role
Nvidia head of cybersecurity policy Mark Weatherford said the wider use of AI is changing the CISO’s role from security gatekeeper to business-risk translator. Speaking at ISC2 Security Congress 2026 in Denver on 26…
Infosecurity
- Engie customers warned of data exposure in supply chain breach
Engie, the French multinational energy giant, has notified an undisclosed number of customers that their personal data may have been compromised in a recent breach linked to a third-party marketing platform used by its…
Infosecurity
- Anthropic’s AI research uncovers flaws across major platforms
Anthropic has disclosed findings from its AI vulnerability research, detailing five attack chains that led to remote code execution and other impacts across popular platforms. Over several months, an unreleased…
SecurityOnlineCVE-2026-33096
- Upwind raises $400 million as valuation climbs to $3.8 billion
Upwind Security has announced a 400 million dollar Series C funding round, valuing the San Francisco-based cybersecurity platform at 3.8 billion dollars. The capital comes nine months after a 250 million dollar funding…
SecurityWeek
- Chrome and Firefox updates fix more than 200 security flaws
Google and Mozilla released updates to patch more than 200 vulnerabilities in their browsers, with Chrome 156 and Firefox 159 leading the fixes. SecurityWeek reports that Chrome 156 includes patches for 52 security…
SecurityWeekCVE-2026-118306
- US banks block AI agents from operating in customer accounts
Major US banks are reportedly blocking third-party AI agents from operating inside customer accounts, with Axios noting that many banks allow only read-only access or are moving in that direction. The practice involves…
Malwarebytes
- StepSecurity contrasts Harden Runner with GitHub's egress firewall
GitHub’s native egress firewall currently covers GitHub-hosted Linux runners, according to the article’s author. The piece contrasts this with Harden-Runner, StepSecurity’s runtime security agent for CI/CD runners,…
StepSecurity
- FoxIO finds three TLS flaws in widely used GoAhead server
FoxIO has disclosed three vulnerabilities in GoAhead’s TLS handling, affecting a GoAhead Web Server used in hundreds of millions of devices across IoT, OT, firewall, and military sectors. The flaws, attributed to the…
SecurityWeekCVE-2026-115881
- Hackers Target Patched Oracle EBS Flaw for Remote Code Execution
Hacker activity is targeting a recently patched critical flaw in Oracle E-Business Suite (EBS): CVE-2026-101767, described as an unauthenticated SQL injection in the EBS Thin Client Framework servlet that can chain to…
The Hacker NewsCVE-2026-101767
- Bithumb probes data leak after internal system breach
South Korea’s crypto exchange Bithumb is investigating a data leak stemming from a hack of its internal mobile system, discovered on Tuesday. The company has notified the Korea Internet & Security Agency and the…
DataBreaches
- GMO tells customers to disconnect PCs after cyberattack
GMO Group, the Japanese internet conglomerate, disclosed that it suffered a cyberattack in which threat actors installed malware on some customer environments. The report, drawn from DataBreaches[.]net’s summary of…
DataBreaches
- NT Health revises patient count after Darwin Hospital privacy breach
The Northern Territory health department has backtracked on its claim that only five patients were affected by a privacy breach that resulted in pregnant women’s confidential medical information being shared publicly…
DataBreaches
- Courts weigh traceability in healthcare data breach claims
On 28 October 2026, DataBreaches[.]net reports a shift in how courts analyse healthcare data breach claims, driven by recent caselaw discussed by Abbye Alexander, Henry Norwood and Emily Taing of Kaufman Dolowich LLP.…
DataBreaches
- Court allows PowerSchool breach claims to proceed
The article reports that the United States District Court for the Southern District of California recently denied multiple defendants’ motions to dismiss in the multidistrict PowerSchool Holdings, Inc. and PowerSchool…
DataBreaches
- Ukrainian ransomware affiliate sentenced to 70 months in prison
Artem Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in prison by a U.S. court for conspiracy to commit computer fraud in connection with ransomware campaigns that targeted hospitals, government…
DataBreaches
- Whitsett warns residents after town email account is breached
The Town of Whitsett, North Carolina, issued a public alert on 22 October 2026 after detecting unauthorized access to its Town Hall Microsoft 365 account. An email purportedly from townhall@whitsettnc[.]com used Town…
DataBreaches
- ZenTech ransomware attack delays answers for grieving families
A major ransomware incident has been linked to a Dunedin tech firm, Zenith Technologies (ZenTech), with the Ministry of Justice confirming that Coroners Court information was captured in the attack. The breach…
DataBreaches
- UEFI flaw lets attackers run code before Secure Boot on servers
A critical 16-year-old flaw in EDK II, the open-source foundation used by most hardware makers to build UEFI firmware, could allow code to run on a machine before the operating system loads during a network boot. The…
The Hacker NewsCVE-2026-97631
- Wazuh adds AI analyst workflows to its security platform
Wazuh has added AI-enabled workflows to its security operations platform, positioning the Wazuh AI Analyst as a key feature for both Wazuh Cloud subscribers and users who self-host the solution. On the cloud side, the…
The Hacker News
- Hive ransomware affiliate sentenced to 70 months in prison
A US court sentenced Hive ransomware affiliate Artem Stryzhak to 70 months in prison, after he pleaded guilty to two counts of computer fraud conspiracy linked to Hive and Nefilim operations. Court filings show…
SecurityOnline
- A 16-year-old UEFI flaw puts server firmware at risk
CVE-2026-97631 is a critical, 16-year-old vulnerability in the UEFI firmware commonly used to boot servers. The flaw resides in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe) within the TianoCore EDK II open‑source…
Security AffairsCVE-2026-97631
- Adobe fixes eight critical Campaign Classic flaws enabling code execution
Adobe has released patches addressing eight critical flaws in Campaign Classic that could allow arbitrary code execution, security feature bypass, and privilege escalation. The issues are identified by CVEs:…
The Hacker NewsCVE-2026-104351
- Chrome and Firefox updates fix hundreds of security flaws
Google issued a Stable channel update for Chrome on 27 October 2026, bringing versions 156.0.8078.73/.74 for Windows and Mac, and 156.0.8078.73 for Linux. Malwarebytes reports the update includes 52 security fixes,…
Malwarebytes
- Kaspersky finds flaw that can knock Intelbras cameras offline
Kaspersky researchers have disclosed a denial-of-service vulnerability in Intelbras cameras that can be exploited by anyone on the same local Wi‑Fi network. The flaw resides in an unauthenticated firmware update…
SecurityOnline
- Cipher uncovers four flaws in EPICS control software
CISA disclosed four vulnerabilities in EPICS Base, the core of the EPICS control system toolkit used by facilities such as ITER’s fusion reactor and the Advanced Photon Source at Argonne National Laboratory. The flaws…
SecurityWeekCVE-2026-114595
- Security Questionnaires Persist Despite Buyers’ Lack of Trust
SecurityWeek reports that the standard security questionnaire used in B2B deals is widely distrusted by those who fill it, yet remains central to let revenue flow. In the article by Sravish Sridhar, he describes how…
SecurityWeek
- Skyw4lker Uses Device Code Phishing to Target US Organisations
A Skyw4lker device-code phishing campaign, exposed by ANY[.]RUN, targeted American organisations and leveraged legitimate cloud services to compromise Microsoft 365 accounts without harvesting credentials via a…
The Hacker News
- Body parser flaw lets one request crash Express servers
A vulnerability in the body-parser middleware, tracked as CVE-2026-111181, could cause a Node.js/Express server to crash with a single specially crafted request. The CVSS v3.1 score is 7.5 (High). The flaw affects…
SecurityOnlineCVE-2026-111181
- Kaspersky Finds Unauthenticated DoS Flaw in Intelbras Cameras
GReAT researchers report a denial-of-service vulnerability affecting Intelbras IP camera systems, discovered in the firmware update endpoint that is accessible without authentication. A single unauthenticated request…
securelist.com
- Infisical raises $40 million at a $600 million valuation
Infisical, a San Francisco-based secrets management firm, has announced a $40 million Series B round, valuing the company at $600 million. The funding was led by returning investor Elad Gil, with Gradient and Y…
SecurityWeek
- Hackers Probe Oracle EBS Flaw After October Patch
Threat intelligence firm Defused reports that hackers have begun probing a freshly patched Oracle E-Business Suite (EBS) vulnerability, tracked as CVE-2026-101767, which carries a CVSS score of 9.8. The flaw is…
SecurityWeekCVE-2026-101767
- LiteLLM fixes flaw that could expose proxy master keys
BerriAI has fixed a critical vulnerability in LiteLLM Enterprise Proxy that earned a CVSS v3.1 score of 10.0. The issue, tracked as GHSA-w4c7-34wj-hqm8, allows an unauthenticated attacker to read a local file via any…
SecurityOnline
- Trend Micro details three AI assisted attacks targeting Japan
In autumn 2026, Trend Micro researchers studied three attack infrastructures to understand how hackers use AI against Japanese targets. The National Cybersecurity Office in Japan issued a warning on 9 October 2026, and…
Security Affairs
- Anthropic AI model chains flaws into browser and OS exploits
Anthropic’s Frontier Red Team has disclosed an unreleased internal AI model that reportedly chained together multiple separate browser and OS flaws to produce working exploit chains across Chrome, Safari, Windows and…
The Hacker NewsCVE-2026-33096
- n0n ransomware operation used AI to support extortion
SOCRadar Threat Research Unit (STRU) has documented an AI-assisted extortion operation linked to the n0n ransomware group, visible from an exposed staging server in September 2026. The live workspace revealed breach…
SOCRadar
- FBI Seizes Virtualine Domain in International Crime Operation
The U.S. Department of Justice announced the seizure of the Virtualine domain (virtualine[.]net) as part of an international law enforcement operation targeting a bulletproof hosting provider accused of enabling…
The Hacker News
- Adobe patches nine flaws in Campaign Classic and Connect
Adobe has issued security bulletins addressing nine critical vulnerabilities across Adobe Campaign Classic and Adobe Connect, with updates released on 27 October 2026. The flaws include several high-severity code…
SecurityOnlineCVE-2026-104351
- Google Chrome update fixes 52 flaws, including four critical bugs
Google has released Chrome 156.0.8078.73/.74 for Windows and Mac, and 156.0.8078.73 for Linux, in a security update that fixes 52 vulnerabilities, including four rated as critical. The most severe issue,…
SecurityOnlineCVE-2026-118306
- TeamViewer patches three flaws enabling code execution and escalation
TeamViewer has issued security bulletin TV-2026-1011, published on 27 October 2026, noting three high-severity vulnerabilities in the TeamViewer Full Client across Windows, macOS, Linux and Android. The flaws enable…
SecurityOnlineCVE-2026-92372
- GMO offers $1 million bounty over cloud service breach
Japan’s GMO Internet Group has launched a cybercrime bounty programme offering up to $1 million in total for tips that lead to an arrest or an international wanted notice in connection with the Onamae[.]com Desktop…
The Hacker News
- Brazilian Magecart Group Skims Cards in Convertr Supply Chain Attack
On 24 October 2026, a Brazilian Magecart group launched a supply chain attack against Convertr by poisoning the platform’s self-hosted Plausible analytics script. The infection leveraged Plausible Community Edition…
SecurityOnlineCVE-2026-8467
- Google Ads and Claude Shares Spread Mac Stealer and Windows RAT
Gen Digital researchers have uncovered a Claude malware campaign that exploits Claude’s own sharing features and Google Ads to distribute malicious payloads to macOS and Windows users. The operators did not compromise…
SecurityOnline
- Tailscale fixes SSH flaws that could expose root access on servers
Tailscale has released version 1.104.4 to remediate flaws in its built‑in SSH server that could allow a trusted attacker to reach root‑level services and files on other servers. The issues stem from how Tailscale SSH…
The Hacker News
- Interpol operation arrests 1,462 in African cybercrime sweep
Interpol’s Operation Serengeti III has culminated in about 1,462 arrests across 20 African countries and the United States, with roughly $105 million in stolen funds recovered and nearly 11,000 malicious networks shut…
Dark Reading
CVEs in the news19
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-97631TianoCore EDK2
3 articles today · EDK II PXE flaw enables remote code execution before boot
9.5Critical0.5% EPSS · 4 articlesCVE-2026-104351Adobe Adobe Campaign Classic
2 articles today · Adobe fixes eight critical Campaign Classic flaws enabling code execution
9.9Critical0.6% EPSS · 2 articlesCVE-2026-101767Oracle Corporation Oracle Application Object Library
2 articles today · Hackers Target Patched Oracle EBS Flaw for Remote Code Execution
9.8Critical0.6% EPSS · 5 articlesCVE-2026-116690mlflow mlflow
2 articles today · Attackers exploit MLflow file read flaw as PoC code emerges
7.5High0.6% EPSS · 2 articlesCVE-2026-33096Microsoft Windows 11 version 23H2
2 articles today · Anthropic’s AI research uncovers flaws across major platforms
7.5High1.2% EPSS · 2 articlesCVE-2026-118306Google Chrome
2 articles today · Chrome and Firefox updates fix more than 200 security flaws
Not scored0.2% EPSS · 2 articlesCVE-2026-97229GitLab GitLab
Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw
10.0Critical18% EPSS · 9 articlesCVE-2026-110879FasterXML jackson-databind
FasterXML discloses critical Jackson deserialisation flaw
9.8Critical1.2% EPSS · 1 articleCVE-2026-86400Dell PowerProtect Data Domain
Dell fixes unauthenticated flaws in PowerProtect appliances
9.8Critical0.9% EPSS · 1 articleCVE-2026-103406Juniper Networks Session Smart Conductor
Juniper fixes 18 flaws in Session Smart routers and Conductor
9.8Critical1 articleCVE-2026-114595The EPICS Community EPICS Base
Cipher uncovers four flaws in EPICS control software
9.8Critical0.5% EPSS · 1 articleCVE-2026-8467phenixdigital phoenix_storybook
Brazilian Magecart Group Skims Cards in Convertr Supply Chain Attack
9.5Critical2.1% EPSS · 1 articleCVE-2026-92372TeamViewer Full Client
TeamViewer patches three flaws enabling code execution and escalation
8.8High0.4% EPSS · 1 articleCVE-2026-76418Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Attackers Exploit Cisco Firewall Flaw to Crash SSL VPN Devices
8.6High1 articleCVE-2026-111181body-parser body-parser
Body parser flaw lets one request crash Express servers
7.5High0.4% EPSS · 1 articleCVE-2026-45492Microsoft Microsoft Edge (Chromium-based)
Researcher details Edge sandbox escape using logic flaws
5.4Medium0.3% EPSS · 1 articleCVE-2026-115926Vendor not yet named
free5GC advisories detail two unpatched 5G core flaws
Not scored1 articleCVE-2026-117612Jenkins Project Jenkins
Jenkins fixes 15 flaws, including remote code execution bugs
Not scored1 articleCVE-2026-115881Vendor not yet named
FoxIO finds three TLS flaws in widely used GoAhead server
Not scored3 articles
Developing stories6
Two or more articles in the last 24 hours; each bead is an article
- In CISA KEVCVECVE-2026-109618PHPDevelopinglatest 3 hours ago4 articles3 outlets
- Wed 28 Oct, 12:00 UTC. SecurityWeek, first report. China Linked Hackers Exploit PHP Flaws to Root Firewalls. Cites a CVE in CISA KEV.
- Wed 28 Oct, 16:02 UTC. The Hacker News, its first report on the story. Dream links PHP2Shell attacks to 25 rooted servers. Cites a CVE in CISA KEV.
- Wed 28 Oct, 17:10 UTC. SecurityOnline, its first report on the story. OffSec launches PHP2Shell lab after critical PHP flaws emerge. Cites a CVE in CISA KEV.
- Thu 29 Oct, 02:02 UTC. SecurityOnline. Researchers link PHP2Shell and Fragnesia flaws to 25 firewall compromises. Cites a CVE in CISA KEV.
- Threat actorHiveDevelopinglatest 8 hours ago4 articles4 outlets
- Wed 28 Oct, 11:26 UTC. SecurityOnline, first report. Hive ransomware affiliate sentenced to 70 months in prison.
- Wed 28 Oct, 12:01 UTC. DataBreaches, its first report on the story. Ukrainian ransomware affiliate sentenced to 70 months in prison.
- Wed 28 Oct, 15:05 UTC. SecurityWeek, its first report on the story. Nefilim and Hive Affiliate Sentenced to 70 Months in Prison.
- Wed 28 Oct, 20:19 UTC. Security Affairs, its first report on the story. Hive and Nefilim ransomware affiliate sentenced to 70 months.
- In CISA KEVCVECVE-2026-111497Google BrotliDevelopinglatest 19 hours ago4 articles4 outlets
- Wed 28 Oct, 05:42 UTC. The Hacker News, first report. CISA Adds Two Actively Exploited Flaws to KEV Catalog. Cites a CVE in CISA KEV.
- Wed 28 Oct, 07:19 UTC. SecurityOnline, its first report on the story. Broadcom warns of critical VMware SDDC Manager flaw. Cites a CVE in CISA KEV.
- Wed 28 Oct, 08:37 UTC. SecurityWeek, its first report on the story. Researchers report exploitation attempts against Brotli flaw. Cites a CVE in CISA KEV.
- Wed 28 Oct, 10:05 UTC. Security Affairs, its first report on the story. CISA adds Brotli and Magento flaws to its exploited list. Cites a CVE in CISA KEV.
- CVECVE-2026-97631TianoCore EDK2Developinglatest 4 hours ago3 articles3 outlets
- Wed 28 Oct, 11:15 UTC. Security Affairs, first report. A 16-year-old UEFI flaw puts server firmware at risk.
- Wed 28 Oct, 11:50 UTC. The Hacker News, its first report on the story. UEFI flaw lets attackers run code before Secure Boot on servers.
- Thu 29 Oct, 00:16 UTC. SecurityOnline, its first report on the story. EDK II PXE flaw enables remote code execution before boot.
- In CISA KEVCVECVE-2026-46300LinuxDevelopinglatest 6 hours ago2 articles2 outlets
- Wed 28 Oct, 20:01 UTC. CISA, first report. CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV. Cites a CVE in CISA KEV.
- Wed 28 Oct, 22:45 UTC. SecurityOnline, its first report on the story. CISA flags Linux and VMware flaws as actively exploited. Cites a CVE in CISA KEV.
- CVECVE-2026-116690mlflowDevelopinglatest 13 hours ago2 articles1 outlet
- Wed 28 Oct, 15:15 UTC. SecurityOnline, first report. Discord to make public server messages searchable on the web.
- Wed 28 Oct, 16:07 UTC. SecurityOnline. Attackers exploit MLflow file read flaw as PoC code emerges.