Thu 29 Oct · updated 08:30 UTC
Today in security
Today’s briefing
07:00 UTC edition
Linux kernel flaw joins PHP exploit chain in firewall attacks
Dream researchers linked CVE-2026-46300, added to CISA’s Known Exploited Vulnerabilities catalogue on 28 October, to an intrusion chain using two PHP flaws against firewall servers. They said the operation reached 25 firewall servers, including a US government-affiliated system, while stopping short of naming a definitive group. The new account extends coverage of the PHP flaws by detailing their use with a kernel privilege-escalation vulnerability; CISA set 31 October 2026 as the remediation deadline for the Linux flaw.
Known exploited22
CISA KEV entries named in the last 48 hours of coverage, by federal deadline
- In CISA KEV
PHPCVE-2026-109618
Federal deadline 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS52 articles
- In CISA KEV
PHPCVE-2026-109619
Federal deadline 29 Oct · In CISA KEV since 26 Oct
9.2Critical99.9% EPSS51 articles
- In CISA KEV
- In CISA KEV
Google BrotliCVE-2026-111497
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.2Critical88% EPSS20 articles
- In CISA KEV
Adobe CommerceCVE-2026-48356
Federal deadline 10 Nov · In CISA KEV since 27 Oct
9.3Critical59% EPSS8 articles
- In CISA KEV
VMware Cloud FoundationCVE-2026-41709
Federal deadline 11 Nov · In CISA KEV since 28 Oct
2.7Low0.3% EPSS6 articles
Show 16 more · federal deadlines passed
- In CISA KEV
Apple iOS and iPadOSCVE-2026-86950
Federal deadline passed 13 Oct · In CISA KEV since 29 Sep
8.8High26% EPSS16 articles
- In CISA KEV
NetScaler ADCCVE-2026-88779
Federal deadline passed 7 Oct · In CISA KEV since 4 Oct
8.7High11% EPSS10 articles
- In CISA KEV
Citrix NetScaler ADCCVE-2026-88771
Federal deadline passed 30 Sep · In CISA KEV since 27 Sep
9.5Critical82% EPSS29 articles
- In CISA KEV
PaperCut NG/MFCVE-2026-81578
Federal deadline passed 14 Sep · In CISA KEV since 31 Aug
8.8High84% EPSS24 articles
- In CISA KEV
PaperCut NG/MFCVE-2026-82078
Federal deadline passed 14 Sep · In CISA KEV since 31 Aug
9.4Critical61% EPSS23 articles
- In CISA KEV
Broadcom VMware vCenterCVE-2026-59310
Federal deadline passed 21 Aug · In CISA KEV since 18 Aug · Used in ransomware campaigns
9.8Critical2.6% EPSS12 articles
- In CISA KEV
Arista VeloCloud OrchestratorCVE-2026-16812
Federal deadline passed 30 Jul · In CISA KEV since 27 Jul
10.0Critical1.0% EPSS9 articles
- In CISA KEV
Oracle E-Business SuiteCVE-2026-46817
Federal deadline passed 18 Jul · In CISA KEV since 15 Jul
9.8Critical12% EPSS9 articles
- In CISA KEV
Oracle PeopleSoft Enterprise PeopleToolsCVE-2026-35273
Federal deadline passed 15 Jun · In CISA KEV since 12 Jun · Used in ransomware campaigns
9.8Critical97% EPSS30 articles
- In CISA KEV
Cisco Catalyst SD-WAN Controller and ManagerCVE-2026-20127
Federal deadline passed 27 Feb · In CISA KEV since 25 Feb
10.0Critical89% EPSS22 articles
- In CISA KEV
Adobe Commerce and MagentoCVE-2025-54236
Federal deadline passed 14 Nov 2025 · In CISA KEV since 24 Oct 2025
9.1Critical95% EPSS5 articles
- In CISA KEV
Oracle E-Business SuiteCVE-2025-61882
Federal deadline passed 27 Oct 2025 · In CISA KEV since 6 Oct 2025 · Used in ransomware campaigns
9.8Critical99.7% EPSS8 articles
- In CISA KEV
Versa DirectorCVE-2024-39717
Federal deadline passed 13 Sep 2024 · In CISA KEV since 23 Aug 2024
6.6Medium4.0% EPSS1 article
- In CISA KEV
Dahua IP Camera FirmwareCVE-2021-33044
Federal deadline passed 11 Sep 2024 · In CISA KEV since 21 Aug 2024
9.8Critical99.9% EPSS7 articles
- In CISA KEV
Dahua IP Camera FirmwareCVE-2021-33045
Federal deadline passed 11 Sep 2024 · In CISA KEV since 21 Aug 2024
9.8Critical99.5% EPSS3 articles
- In CISA KEV
Adobe Commerce and Magento Open SourceCVE-2024-34102
Federal deadline passed 7 Aug 2024 · In CISA KEV since 17 Jul 2024
9.8Critical99.9% EPSS1 article
Latest news61
The last 24 hours, newest first; stories about known exploited CVEs are above
Latest story at 08:01 UTC. Red diamonds mark the 7 stories about exploited CVEs.
- 08:00 UTC. Intel 471 data shows vulnerabilities drive attacks on Italy. 1 outlet.
- 04:05 UTC. Attackers exploit Kerio Connect flaw to steal mailboxes. 1 outlet.
- 03:33 UTC. Apache Kafka fixes 12 flaws, including a cluster access bypass. 1 outlet.
- 03:10 UTC. EDK II flaw risks boot time attacks, while LiteLLM scores CVSS 10. 1 outlet.
- 02:56 UTC. FreeSWITCH flaw exploited to run commands on servers. 1 outlet.
- 02:30 UTC. UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems. 1 outlet. About an exploited CVE.
- 01:22 UTC. FasterXML discloses critical Jackson deserialisation flaw. 1 outlet.
- 00:43 UTC. Dell fixes unauthenticated flaws in PowerProtect appliances. 1 outlet.
- 00:33 UTC. FoxIO discloses three TLS flaws in GoAhead web server. 1 outlet.
- 00:00 UTC. free5GC advisories detail two unpatched 5G core flaws. 1 outlet.
- 22:32 UTC. Jenkins fixes 15 flaws, including remote code execution bugs. 1 outlet.
- 22:21 UTC. Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw. 1 outlet.
- 22:07 UTC. WordPress 7.1.4 fixes 17 flaws, including a core update RCE. 1 outlet.
- 21:42 UTC. Cisco confirms firewall flaw is being exploited to crash VPNs. 1 outlet.
- 20:01 UTC. CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV. 2 outlets. About an exploited CVE.
- 20:01 UTC. CISA flags actively exploited VMware ESX logging flaw in KEV. 3 outlets. About an exploited CVE.
- 19:39 UTC. GhostAction Targets GitHub Again as Operators Remain Active. 1 outlet.
- 18:08 UTC. Volt Typhoon Used Silent Train in Four Zero Day Campaigns. 1 outlet. About an exploited CVE.
- 18:00 UTC. Unit 42 warns retailers of evolving peak season cyber threats. 1 outlet. About an exploited CVE.
- 17:08 UTC. Google lets approved Android app stores install apps with one tap. 1 outlet.
- 16:23 UTC. Researcher details Edge sandbox escape using logic flaws. 1 outlet.
- 16:22 UTC. Juniper fixes 18 flaws in Session Smart routers and Conductor. 1 outlet.
- 16:14 UTC. MrHex builds hack and leak operation targeting US industry. 1 outlet.
- 16:07 UTC. SANS Tracks ClickFix Campaign Spoofing Cloudflare Verification. 1 outlet.
- 16:00 UTC. Microsoft urges CISOs to govern AI agents as adoption grows. 1 outlet.
- 15:49 UTC. GMO Internet warns customers after malware breach. 1 outlet.
- 15:22 UTC. Times Car breach costs Park24 ¥5.5 billion after data leak. 1 outlet.
- 15:15 UTC. Discord to make public server messages searchable on the web. 1 outlet.
- 15:13 UTC. Yoba campaign uses fake AI apps to deliver a crypto miner. 1 outlet.
- 14:37 UTC. Fake AI bots scan organisations for exposed credentials. 1 outlet.
- 14:37 UTC. TrendAI says ad tech firm targeted Starlink users for surveillance. 1 outlet.
- 14:10 UTC. Nvidia’s Weatherford says AI is reshaping the CISO’s role. 1 outlet.
- 14:05 UTC. Engie customers warned of data exposure in supply chain breach. 1 outlet.
- 14:01 UTC. Anthropic’s AI research uncovers flaws across major platforms. 1 outlet.
- 13:39 UTC. Chrome and Firefox updates fix more than 200 security flaws. 1 outlet.
- 13:38 UTC. US banks block AI agents from operating in customer accounts. 1 outlet.
- 13:23 UTC. StepSecurity contrasts Harden Runner with GitHub's egress firewall. 1 outlet.
- 13:10 UTC. FoxIO finds three TLS flaws in widely used GoAhead server. 1 outlet.
- 12:42 UTC. Bithumb probes data leak after internal system breach. 1 outlet.
- 12:31 UTC. GMO tells customers to disconnect PCs after cyberattack. 1 outlet.
- 12:25 UTC. NT Health revises patient count after Darwin Hospital privacy breach. 1 outlet.
- 12:10 UTC. Courts weigh traceability in healthcare data breach claims. 1 outlet.
- 12:03 UTC. Court allows PowerSchool breach claims to proceed. 1 outlet.
- 12:00 UTC. China Linked Hackers Exploit PHP Flaws to Root Firewalls. 3 outlets. About an exploited CVE.
- 12:00 UTC. Whitsett warns residents after town email account is breached. 1 outlet.
- 11:58 UTC. ZenTech ransomware attack delays answers for grieving families. 1 outlet.
- 11:30 UTC. Wazuh adds AI analyst workflows to its security platform. 1 outlet.
- 11:26 UTC. Hive ransomware affiliate sentenced to 70 months in prison. 4 outlets.
- 11:15 UTC. A 16-year-old UEFI flaw puts server firmware at risk. 3 outlets.
- 11:15 UTC. Adobe fixes eight critical Campaign Classic flaws enabling code execution. 1 outlet.
- 11:13 UTC. Chrome and Firefox updates fix hundreds of security flaws. 1 outlet.
- 10:48 UTC. Cipher uncovers four flaws in EPICS control software. 1 outlet.
- 10:30 UTC. Security Questionnaires Persist Despite Buyers’ Lack of Trust. 1 outlet.
- 10:30 UTC. Skyw4lker Uses Device Code Phishing to Target US Organisations. 1 outlet.
- 10:05 UTC. CISA adds Brotli and Magento flaws to its exploited list. 1 outlet. About an exploited CVE.
- 10:01 UTC. Body parser flaw lets one request crash Express servers. 1 outlet.
- 10:00 UTC. Kaspersky Finds Unauthenticated DoS Flaw in Intelbras Cameras. 2 outlets.
- 09:48 UTC. Infisical raises $40 million at a $600 million valuation. 1 outlet.
- 09:14 UTC. Hackers Probe Oracle EBS Flaw After October Patch. 2 outlets.
- Known exploited CVE
- CVE not in KEV
- Other story
- Size: outlets on the story
- Stories an hour
Show as tableHide table
| Time (UTC) | Story | Outlets | Type |
|---|---|---|---|
| 08:00 | Intel 471 data shows vulnerabilities drive attacks on Italy | 1 | Other |
| 04:05 | Attackers exploit Kerio Connect flaw to steal mailboxes | 1 | CVE |
| 03:33 | Apache Kafka fixes 12 flaws, including a cluster access bypass | 1 | CVE |
| 03:10 | EDK II flaw risks boot time attacks, while LiteLLM scores CVSS 10 | 1 | Other |
| 02:56 | FreeSWITCH flaw exploited to run commands on servers | 1 | CVE |
| 02:30 | UAT-11473 implants KeyDrift malware on Cisco SD-WAN systems | 1 | Known exploited |
| 01:22 | FasterXML discloses critical Jackson deserialisation flaw | 1 | CVE |
| 00:43 | Dell fixes unauthenticated flaws in PowerProtect appliances | 1 | CVE |
| 00:33 | FoxIO discloses three TLS flaws in GoAhead web server | 1 | Other |
| 00:00 | free5GC advisories detail two unpatched 5G core flaws | 1 | CVE |
| 22:32 | Jenkins fixes 15 flaws, including remote code execution bugs | 1 | CVE |
| 22:21 | Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw | 1 | CVE |
| 22:07 | WordPress 7.1.4 fixes 17 flaws, including a core update RCE | 1 | Other |
| 21:42 | Cisco confirms firewall flaw is being exploited to crash VPNs | 1 | CVE |
| 20:01 | CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV | 2 | Known exploited |
| 20:01 | CISA flags actively exploited VMware ESX logging flaw in KEV | 3 | Known exploited |
| 19:39 | GhostAction Targets GitHub Again as Operators Remain Active | 1 | Other |
| 18:08 | Volt Typhoon Used Silent Train in Four Zero Day Campaigns | 1 | Known exploited |
| 18:00 | Unit 42 warns retailers of evolving peak season cyber threats | 1 | Known exploited |
| 17:08 | Google lets approved Android app stores install apps with one tap | 1 | Other |
| 16:23 | Researcher details Edge sandbox escape using logic flaws | 1 | CVE |
| 16:22 | Juniper fixes 18 flaws in Session Smart routers and Conductor | 1 | CVE |
| 16:14 | MrHex builds hack and leak operation targeting US industry | 1 | Other |
| 16:07 | SANS Tracks ClickFix Campaign Spoofing Cloudflare Verification | 1 | Other |
| 16:00 | Microsoft urges CISOs to govern AI agents as adoption grows | 1 | Other |
| 15:49 | GMO Internet warns customers after malware breach | 1 | Other |
| 15:22 | Times Car breach costs Park24 ¥5.5 billion after data leak | 1 | Other |
| 15:15 | Discord to make public server messages searchable on the web | 1 | CVE |
| 15:13 | Yoba campaign uses fake AI apps to deliver a crypto miner | 1 | Other |
| 14:37 | Fake AI bots scan organisations for exposed credentials | 1 | Other |
| 14:37 | TrendAI says ad tech firm targeted Starlink users for surveillance | 1 | Other |
| 14:10 | Nvidia’s Weatherford says AI is reshaping the CISO’s role | 1 | Other |
| 14:05 | Engie customers warned of data exposure in supply chain breach | 1 | Other |
| 14:01 | Anthropic’s AI research uncovers flaws across major platforms | 1 | CVE |
| 13:39 | Chrome and Firefox updates fix more than 200 security flaws | 1 | CVE |
| 13:38 | US banks block AI agents from operating in customer accounts | 1 | Other |
| 13:23 | StepSecurity contrasts Harden Runner with GitHub's egress firewall | 1 | Other |
| 13:10 | FoxIO finds three TLS flaws in widely used GoAhead server | 1 | CVE |
| 12:42 | Bithumb probes data leak after internal system breach | 1 | Other |
| 12:31 | GMO tells customers to disconnect PCs after cyberattack | 1 | Other |
| 12:25 | NT Health revises patient count after Darwin Hospital privacy breach | 1 | Other |
| 12:10 | Courts weigh traceability in healthcare data breach claims | 1 | Other |
| 12:03 | Court allows PowerSchool breach claims to proceed | 1 | Other |
| 12:00 | China Linked Hackers Exploit PHP Flaws to Root Firewalls | 3 | Known exploited |
| 12:00 | Whitsett warns residents after town email account is breached | 1 | Other |
| 11:58 | ZenTech ransomware attack delays answers for grieving families | 1 | Other |
| 11:30 | Wazuh adds AI analyst workflows to its security platform | 1 | Other |
| 11:26 | Hive ransomware affiliate sentenced to 70 months in prison | 4 | Other |
| 11:15 | A 16-year-old UEFI flaw puts server firmware at risk | 3 | CVE |
| 11:15 | Adobe fixes eight critical Campaign Classic flaws enabling code execution | 1 | CVE |
| 11:13 | Chrome and Firefox updates fix hundreds of security flaws | 1 | Other |
| 10:48 | Cipher uncovers four flaws in EPICS control software | 1 | CVE |
| 10:30 | Security Questionnaires Persist Despite Buyers’ Lack of Trust | 1 | Other |
| 10:30 | Skyw4lker Uses Device Code Phishing to Target US Organisations | 1 | Other |
| 10:05 | CISA adds Brotli and Magento flaws to its exploited list | 1 | Known exploited |
| 10:01 | Body parser flaw lets one request crash Express servers | 1 | CVE |
| 10:00 | Kaspersky Finds Unauthenticated DoS Flaw in Intelbras Cameras | 2 | Other |
| 09:48 | Infisical raises $40 million at a $600 million valuation | 1 | Other |
| 09:14 | Hackers Probe Oracle EBS Flaw After October Patch | 2 | CVE |
- Intel 471 data shows vulnerabilities drive attacks on Italy
Italy is seeing a disproportionately high level of cyberattacks, with threat activity and attack types that differ markedly from other regions, according to new data. Gianluca Tiepolo, cybercrime analyst at Intel471,…
Dark Reading
- Attackers exploit Kerio Connect flaw to steal mailboxes
Attackers have exploited CVE-2026-112353, a stored cross-site scripting (XSS) flaw in GFI KerioConnect Webmail, to steal user credentials and mailbox contents. The CVE record notes exploitation in the wild as a…
SecurityOnlineCVE-2026-112353
- Apache Kafka fixes 12 flaws, including a cluster access bypass
Daily CyberSecurity reports that Apache Kafka has disclosed fixes for 12 vulnerabilities across its broker and Connect components. The most serious is CVE-2026-110985, which, in unauthenticated SASL/OAUTHBEARER setups…
SecurityOnlineCVE-2026-110985
- EDK II flaw risks boot time attacks, while LiteLLM scores CVSS 10
SANS Internet Storm Center reports that Brad in the Diaries captured another ClickFix campaign that uses fake Cloudflare verification pages and targets both macOS and Windows, with multiple URLs identified for threat…
SANS ISC
- FreeSWITCH flaw exploited to run commands on servers
Attackers have exploited CVE-2026-116779, a critical flaw in FreeSWITCH that allows a single crafted SIP MESSAGE to execute commands on the server. The vulnerability scores 9.8 on CVSS v3.1 and, according to…
SecurityOnlineCVE-2026-116779
- FasterXML discloses critical Jackson deserialisation flaw
FasterXML has published full details and a public proof-of-concept exploit for CVE-2026-110879, a critical deserialisation flaw in jackson-databind with a CVSS v3.1 score of 9.8. Do Son, writing for…
SecurityOnlineCVE-2026-110879
- Dell fixes unauthenticated flaws in PowerProtect appliances
Dell has issued a security advisory, DSA-2026-416, detailing more than 180 CVEs across its PowerProtect Data Domain backup appliances, including 48 Dell-specific vulnerabilities. Four of these are rated CVSS v3.1 at…
SecurityOnlineCVE-2026-86400
- FoxIO discloses three TLS flaws in GoAhead web server
FoxIO has published full details and proof‑of‑concept code for three GoAhead TLS vulnerabilities affecting the embedded web server used in a wide range of devices, including routers, switches, printers and industrial…
SecurityOnline
- EDK II PXE flaw enables remote code execution before boot
The article reports a critical pre-boot remote code execution vulnerability in the TianoCore EDK II PXE driver, tracked as CVE-2026-97631. Discovered by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google, the…
SecurityOnlineCVE-2026-97631
- free5GC advisories detail two unpatched 5G core flaws
Two security advisories from the free5GC project detail two unpatched vulnerabilities in its 5G core that have published proof-of-concept material. The more severe issue, CVE-2026-115926, scores 9.1 on CVSS v3.1 and…
SecurityOnlineCVE-2026-115926
- Jenkins fixes 15 flaws, including remote code execution bugs
The Jenkins project has issued a security advisory on 28 October 2026 announcing fixes for 15 vulnerabilities across Jenkins core and related components. The flaws span remote code execution, file read/write, path…
SecurityOnlineCVE-2026-117612
- Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw
On 20 and 21 October, an attacker attempted to exploit CVE-2026-97229 against Alpine Linux’s GitLab instance. The flaw, rated CVSS 10.0, could allow remote code execution and arises from a specially crafted regular…
SecurityOnlineCVE-2026-97229
- WordPress 7.1.4 fixes 17 flaws, including a core update RCE
WordPress released version 7.1.4 on 28 October 2026, delivering fixes for 17 security issues and including a core update remote‑code‑execution (RCE) race condition. The release also updates bundled root certificates in…
SecurityOnline
- Cisco confirms firewall flaw is being exploited to crash VPNs
Cisco has disclosed a high-severity vulnerability in its Secure Firewall ASA and FTD platforms, tracked as CVE-2026-76418, which is already observed being exploited in the wild. The flaw, disclosed by Cisco PSIRT on 28…
SecurityOnlineCVE-2026-76418
- Hive and Nefilim ransomware affiliate sentenced to 70 months
A Ukrainian national, Artem Aleksandrovych Stryzhak, was sentenced in a Brooklyn federal court to 70 months in prison for involvement in Hive and Nefilim ransomware operations that extorted millions from victims. The…
Security Affairs
- GhostAction Targets GitHub Again as Operators Remain Active
A new wave of GhostAction attacks largely fizzled, but the operators behind the supply chain campaign remain active and adaptable. GhostAction targets GitHub by compromising developer accounts and injecting malicious…
Dark Reading
- Google lets approved Android app stores install apps with one tap
Google has announced a programme allowing third‑party Android app stores to request permission to install apps with a single tap, bypassing Android’s usual confirmation screens, and to update them in the background. To…
The Hacker News
- Researcher details Edge sandbox escape using logic flaws
Orange Tsai of DEVCORE published the full method for a chain of logic flaws in Microsoft Edge that allowed a malicious web page to break out of Edge’s sandbox and run code on a Windows machine, without any memory…
The Hacker NewsCVE-2026-45492
- Juniper fixes 18 flaws in Session Smart routers and Conductor
Juniper Networks has released a security bulletin, JSA112183, confirming 18 vulnerabilities across its Session Smart Router and Session Smart Conductor management platform. Two flaws are rated CVSS v3.1 9.8:…
SecurityOnlineCVE-2026-103406
- MrHex builds hack and leak operation targeting US industry
MrHex and associated handles Mr8ex, MrDarkRoot and Darku3er have been building a hack-and-leak ecosystem advertised on both the darknet and clearnet, according to DomainTools’ research. The group depicts itself as…
dti.domaintools.com
- Attackers exploit MLflow file read flaw as PoC code emerges
SecurityOnline[.]info reports that attackers are actively probing MLflow servers for two newly disclosed vulnerabilities, CVE-2026-116690 and CVE-2026-116692, with PoC code published and exploitation attempts observed…
SecurityOnlineCVE-2026-116690
- SANS Tracks ClickFix Campaign Spoofing Cloudflare Verification
Brad Duncan of the SANS Internet Storm Center reports a new ClickFix campaign observed on 28 October 2026 that spoofs a Cloudflare verification page. The campaign targets both macOS and Windows hosts, but Duncan states…
SANS ISC
- Microsoft urges CISOs to govern AI agents as adoption grows
October is Cybersecurity Awareness Month, and this Microsoft Security blog outlines how the Chief Information Security Officer’s role is changing as enterprises increasingly run on AI and agent-driven workflows. The…
Microsoft
- GMO Internet warns customers after malware breach
GMO Internet’s Onamae[.]com service, a virtual desktop offering used by foreign‑exchange traders, was breached after malicious programs were found in some customers’ server environments. The firm suspended the service…
Infosecurity
- Times Car breach costs Park24 ¥5.5 billion after data leak
Times Car, the Japan-based driver’s‑license data handler run by Park24’s Times Mobility unit, faces a substantial financial fallout after a data breach disclosed in late September. The incident exposed personal data…
DataBreaches
- Discord to make public server messages searchable on the web
Discord has announced an upcoming expansion to its public indexing, with public messages from large discoverable servers set to surface on the open web and be indexed by major search engines such as Google. The rollout…
SecurityOnlineCVE-2026-116690
- Yoba campaign uses fake AI apps to deliver a crypto miner
Check Point researchers have uncovered a campaign in which attackers host fake ChatGPT and Claude desktop applications on GitHub to distribute a malware chain that abuses legitimately signed binaries to bypass security…
Infosecurity
- Nefilim and Hive Affiliate Sentenced to 70 Months in Prison
Artem Aleksandrovych Stryzhak, a 36-year-old Ukrainian national, has been sentenced in the United States to 70 months in prison for his role as an affiliate in the Nefilim ransomware operation and his involvement with…
SecurityWeek
- Fake AI bots scan organisations for exposed credentials
A Cequence Security Cequence CQ Prime Research report details a threat actor that operated behind more than 30 AI bot identities to probe organisations for exposed credentials. The malicious scanner impersonated 32…
Dark Reading
- TrendAI says ad tech firm targeted Starlink users for surveillance
Digital defence firm TrendAI has alleged that an Israeli ad tech company, Discover-Tech, was among the largest providers of online ads shown to SpaceX Starlink users, with the findings suggesting the ads could be used…
Security Affairs
- Nvidia’s Weatherford says AI is reshaping the CISO’s role
Nvidia head of cybersecurity policy Mark Weatherford said the wider use of AI is changing the CISO’s role from security gatekeeper to business-risk translator. Speaking at ISC2 Security Congress 2026 in Denver on 26…
Infosecurity
- Engie customers warned of data exposure in supply chain breach
Engie, the French multinational energy giant, has notified an undisclosed number of customers that their personal data may have been compromised in a recent breach linked to a third-party marketing platform used by its…
Infosecurity
- Anthropic’s AI research uncovers flaws across major platforms
Anthropic has disclosed findings from its AI vulnerability research, detailing five attack chains that led to remote code execution and other impacts across popular platforms. Over several months, an unreleased…
SecurityOnlineCVE-2026-33096
- Upwind raises $400 million as valuation climbs to $3.8 billion
Upwind Security has announced a 400 million dollar Series C funding round, valuing the San Francisco-based cybersecurity platform at 3.8 billion dollars. The capital comes nine months after a 250 million dollar funding…
SecurityWeek
- Chrome and Firefox updates fix more than 200 security flaws
Google and Mozilla released updates to patch more than 200 vulnerabilities in their browsers, with Chrome 156 and Firefox 159 leading the fixes. SecurityWeek reports that Chrome 156 includes patches for 52 security…
SecurityWeekCVE-2026-118306
- US banks block AI agents from operating in customer accounts
Major US banks are reportedly blocking third-party AI agents from operating inside customer accounts, with Axios noting that many banks allow only read-only access or are moving in that direction. The practice involves…
Malwarebytes
- StepSecurity contrasts Harden Runner with GitHub's egress firewall
GitHub’s native egress firewall currently covers GitHub-hosted Linux runners, according to the article’s author. The piece contrasts this with Harden-Runner, StepSecurity’s runtime security agent for CI/CD runners,…
StepSecurity
- FoxIO finds three TLS flaws in widely used GoAhead server
FoxIO has disclosed three vulnerabilities in GoAhead’s TLS handling, affecting a GoAhead Web Server used in hundreds of millions of devices across IoT, OT, firewall, and military sectors. The flaws, attributed to the…
SecurityWeekCVE-2026-115881
- Hackers Target Patched Oracle EBS Flaw for Remote Code Execution
Hacker activity is targeting a recently patched critical flaw in Oracle E-Business Suite (EBS): CVE-2026-101767, described as an unauthenticated SQL injection in the EBS Thin Client Framework servlet that can chain to…
The Hacker NewsCVE-2026-101767
- Bithumb probes data leak after internal system breach
South Korea’s crypto exchange Bithumb is investigating a data leak stemming from a hack of its internal mobile system, discovered on Tuesday. The company has notified the Korea Internet & Security Agency and the…
DataBreaches
- GMO tells customers to disconnect PCs after cyberattack
GMO Group, the Japanese internet conglomerate, disclosed that it suffered a cyberattack in which threat actors installed malware on some customer environments. The report, drawn from DataBreaches[.]net’s summary of…
DataBreaches
- NT Health revises patient count after Darwin Hospital privacy breach
The Northern Territory health department has backtracked on its claim that only five patients were affected by a privacy breach that resulted in pregnant women’s confidential medical information being shared publicly…
DataBreaches
- Courts weigh traceability in healthcare data breach claims
On 28 October 2026, DataBreaches[.]net reports a shift in how courts analyse healthcare data breach claims, driven by recent caselaw discussed by Abbye Alexander, Henry Norwood and Emily Taing of Kaufman Dolowich LLP.…
DataBreaches
- Court allows PowerSchool breach claims to proceed
The article reports that the United States District Court for the Southern District of California recently denied multiple defendants’ motions to dismiss in the multidistrict PowerSchool Holdings, Inc. and PowerSchool…
DataBreaches
- Ukrainian ransomware affiliate sentenced to 70 months in prison
Artem Stryzhak, a 36-year-old Ukrainian national, was sentenced to 70 months in prison by a U.S. court for conspiracy to commit computer fraud in connection with ransomware campaigns that targeted hospitals, government…
DataBreaches
- Whitsett warns residents after town email account is breached
The Town of Whitsett, North Carolina, issued a public alert on 22 October 2026 after detecting unauthorized access to its Town Hall Microsoft 365 account. An email purportedly from townhall@whitsettnc[.]com used Town…
DataBreaches
- ZenTech ransomware attack delays answers for grieving families
A major ransomware incident has been linked to a Dunedin tech firm, Zenith Technologies (ZenTech), with the Ministry of Justice confirming that Coroners Court information was captured in the attack. The breach…
DataBreaches
- UEFI flaw lets attackers run code before Secure Boot on servers
A critical 16-year-old flaw in EDK II, the open-source foundation used by most hardware makers to build UEFI firmware, could allow code to run on a machine before the operating system loads during a network boot. The…
The Hacker NewsCVE-2026-97631
- Wazuh adds AI analyst workflows to its security platform
Wazuh has added AI-enabled workflows to its security operations platform, positioning the Wazuh AI Analyst as a key feature for both Wazuh Cloud subscribers and users who self-host the solution. On the cloud side, the…
The Hacker News
- Hive ransomware affiliate sentenced to 70 months in prison
A US court sentenced Hive ransomware affiliate Artem Stryzhak to 70 months in prison, after he pleaded guilty to two counts of computer fraud conspiracy linked to Hive and Nefilim operations. Court filings show…
SecurityOnline
- A 16-year-old UEFI flaw puts server firmware at risk
CVE-2026-97631 is a critical, 16-year-old vulnerability in the UEFI firmware commonly used to boot servers. The flaw resides in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe) within the TianoCore EDK II open‑source…
Security AffairsCVE-2026-97631
- Adobe fixes eight critical Campaign Classic flaws enabling code execution
Adobe has released patches addressing eight critical flaws in Campaign Classic that could allow arbitrary code execution, security feature bypass, and privilege escalation. The issues are identified by CVEs:…
The Hacker NewsCVE-2026-104351
- Chrome and Firefox updates fix hundreds of security flaws
Google issued a Stable channel update for Chrome on 27 October 2026, bringing versions 156.0.8078.73/.74 for Windows and Mac, and 156.0.8078.73 for Linux. Malwarebytes reports the update includes 52 security fixes,…
Malwarebytes
- Kaspersky finds flaw that can knock Intelbras cameras offline
Kaspersky researchers have disclosed a denial-of-service vulnerability in Intelbras cameras that can be exploited by anyone on the same local Wi‑Fi network. The flaw resides in an unauthenticated firmware update…
SecurityOnline
- Cipher uncovers four flaws in EPICS control software
CISA disclosed four vulnerabilities in EPICS Base, the core of the EPICS control system toolkit used by facilities such as ITER’s fusion reactor and the Advanced Photon Source at Argonne National Laboratory. The flaws…
SecurityWeekCVE-2026-114595
- Security Questionnaires Persist Despite Buyers’ Lack of Trust
SecurityWeek reports that the standard security questionnaire used in B2B deals is widely distrusted by those who fill it, yet remains central to let revenue flow. In the article by Sravish Sridhar, he describes how…
SecurityWeek
- Skyw4lker Uses Device Code Phishing to Target US Organisations
A Skyw4lker device-code phishing campaign, exposed by ANY[.]RUN, targeted American organisations and leveraged legitimate cloud services to compromise Microsoft 365 accounts without harvesting credentials via a…
The Hacker News
- Body parser flaw lets one request crash Express servers
A vulnerability in the body-parser middleware, tracked as CVE-2026-111181, could cause a Node.js/Express server to crash with a single specially crafted request. The CVSS v3.1 score is 7.5 (High). The flaw affects…
SecurityOnlineCVE-2026-111181
- Kaspersky Finds Unauthenticated DoS Flaw in Intelbras Cameras
GReAT researchers report a denial-of-service vulnerability affecting Intelbras IP camera systems, discovered in the firmware update endpoint that is accessible without authentication. A single unauthenticated request…
securelist.com
- Infisical raises $40 million at a $600 million valuation
Infisical, a San Francisco-based secrets management firm, has announced a $40 million Series B round, valuing the company at $600 million. The funding was led by returning investor Elad Gil, with Gradient and Y…
SecurityWeek
- Hackers Probe Oracle EBS Flaw After October Patch
Threat intelligence firm Defused reports that hackers have begun probing a freshly patched Oracle E-Business Suite (EBS) vulnerability, tracked as CVE-2026-101767, which carries a CVSS score of 9.8. The flaw is…
SecurityWeekCVE-2026-101767
CVEs in the news20
Named in the last 24 hours and not in CISA KEV, most covered first
CVE-2026-97631TianoCore EDK2
3 articles today · EDK II PXE flaw enables remote code execution before boot
9.5Critical0.5% EPSS · 4 articlesCVE-2026-101767Oracle Corporation Oracle Application Object Library
2 articles today · Hackers Target Patched Oracle EBS Flaw for Remote Code Execution
9.8Critical0.6% EPSS · 5 articlesCVE-2026-116690mlflow mlflow
2 articles today · Attackers exploit MLflow file read flaw as PoC code emerges
7.5High0.6% EPSS · 2 articlesCVE-2026-97229GitLab GitLab
Attackers Target Alpine Linux GitLab With CVSS 10 RCE Flaw
10.0Critical18% EPSS · 9 articlesCVE-2026-104351Adobe Adobe Campaign Classic
Adobe fixes eight critical Campaign Classic flaws enabling code execution
9.9Critical0.6% EPSS · 2 articlesCVE-2026-110879FasterXML jackson-databind
FasterXML discloses critical Jackson deserialisation flaw
9.8Critical1.2% EPSS · 1 articleCVE-2026-86400Dell PowerProtect Data Domain
Dell fixes unauthenticated flaws in PowerProtect appliances
9.8Critical0.9% EPSS · 1 articleCVE-2026-103406Juniper Networks Session Smart Conductor
Juniper fixes 18 flaws in Session Smart routers and Conductor
9.8Critical1 articleCVE-2026-114595The EPICS Community EPICS Base
Cipher uncovers four flaws in EPICS control software
9.8Critical0.5% EPSS · 1 articleCVE-2026-76418Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
Cisco confirms firewall flaw is being exploited to crash VPNs
8.6High1 articleCVE-2026-112353GFI USA, LLC GFI KerioConnect
Attackers exploit Kerio Connect flaw to steal mailboxes
8.2High0.2% EPSS · 1 articleCVE-2026-33096Microsoft Windows 11 version 23H2
Anthropic’s AI research uncovers flaws across major platforms
7.5High1.2% EPSS · 2 articlesCVE-2026-111181body-parser body-parser
Body parser flaw lets one request crash Express servers
7.5High0.4% EPSS · 1 articleCVE-2026-45492Microsoft Microsoft Edge (Chromium-based)
Researcher details Edge sandbox escape using logic flaws
5.4Medium0.3% EPSS · 1 articleCVE-2026-110985Apache Software Foundation Apache Kafka
Apache Kafka fixes 12 flaws, including a cluster access bypass
Not scored1 articleCVE-2026-116779Vendor not yet named
FreeSWITCH flaw exploited to run commands on servers
Not scored1 articleCVE-2026-115926Vendor not yet named
free5GC advisories detail two unpatched 5G core flaws
Not scored1 articleCVE-2026-117612Jenkins Project Jenkins
Jenkins fixes 15 flaws, including remote code execution bugs
Not scored1 articleCVE-2026-118306Google Chrome
Chrome and Firefox updates fix more than 200 security flaws
Not scored0.2% EPSS · 2 articlesCVE-2026-115881Vendor not yet named
FoxIO finds three TLS flaws in widely used GoAhead server
Not scored3 articles
Developing stories6
Two or more articles in the last 24 hours; each bead is an article
- In CISA KEVCVECVE-2026-109618PHPDevelopinglatest 3 hours ago5 articles3 outlets
- Wed 28 Oct, 12:00 UTC. SecurityWeek, first report. China Linked Hackers Exploit PHP Flaws to Root Firewalls. Cites a CVE in CISA KEV.
- Wed 28 Oct, 16:02 UTC. The Hacker News, its first report on the story. Dream links PHP2Shell attacks to 25 rooted servers. Cites a CVE in CISA KEV.
- Wed 28 Oct, 17:10 UTC. SecurityOnline, its first report on the story. OffSec launches PHP2Shell lab after critical PHP flaws emerge. Cites a CVE in CISA KEV.
- Thu 29 Oct, 02:02 UTC. SecurityOnline. Researchers link PHP2Shell and Fragnesia flaws to 25 firewall compromises. Cites a CVE in CISA KEV.
- Thu 29 Oct, 05:50 UTC. The Hacker News. Attackers exploit PHP flaws on exposed Palo Alto interfaces. Cites a CVE in CISA KEV.
- Threat actorHiveDevelopinglatest 13 hours ago4 articles4 outlets
- Wed 28 Oct, 11:26 UTC. SecurityOnline, first report. Hive ransomware affiliate sentenced to 70 months in prison.
- Wed 28 Oct, 12:01 UTC. DataBreaches, its first report on the story. Ukrainian ransomware affiliate sentenced to 70 months in prison.
- Wed 28 Oct, 15:05 UTC. SecurityWeek, its first report on the story. Nefilim and Hive Affiliate Sentenced to 70 Months in Prison.
- Wed 28 Oct, 20:19 UTC. Security Affairs, its first report on the story. Hive and Nefilim ransomware affiliate sentenced to 70 months.
- In CISA KEVCVECVE-2026-41709VMware Cloud FoundationDevelopinglatest 53 minutes ago3 articles3 outlets
- Wed 28 Oct, 20:01 UTC. CISA, first report. CISA flags actively exploited VMware ESX logging flaw in KEV. Cites a CVE in CISA KEV.
- Thu 29 Oct, 06:22 UTC. The Hacker News, its first report on the story. Warp Panda used VMware flaw to hide attacks on US legal sector. Cites a CVE in CISA KEV.
- Thu 29 Oct, 08:01 UTC. SecurityWeek, its first report on the story. Chinese Hackers Exploited VMware ESXi Logging Flaw as Zero Day. Cites a CVE in CISA KEV.
- CVECVE-2026-97631TianoCore EDK2Developinglatest 9 hours ago3 articles3 outlets
- Wed 28 Oct, 11:15 UTC. Security Affairs, first report. A 16-year-old UEFI flaw puts server firmware at risk.
- Wed 28 Oct, 11:50 UTC. The Hacker News, its first report on the story. UEFI flaw lets attackers run code before Secure Boot on servers.
- Thu 29 Oct, 00:16 UTC. SecurityOnline, its first report on the story. EDK II PXE flaw enables remote code execution before boot.
- In CISA KEVCVECVE-2026-46300LinuxDevelopinglatest 10 hours ago2 articles2 outlets
- Wed 28 Oct, 20:01 UTC. CISA, first report. CISA adds exploited Linux kernel flaw CVE-2026-46300 to KEV. Cites a CVE in CISA KEV.
- Wed 28 Oct, 22:45 UTC. SecurityOnline, its first report on the story. CISA flags Linux and VMware flaws as actively exploited. Cites a CVE in CISA KEV.
- CVECVE-2026-116690mlflowDevelopinglatest 17 hours ago2 articles1 outlet
- Wed 28 Oct, 15:15 UTC. SecurityOnline, first report. Discord to make public server messages searchable on the web.
- Wed 28 Oct, 16:07 UTC. SecurityOnline. Attackers exploit MLflow file read flaw as PoC code emerges.