Cybersecurity News
Threat intelligence, vulnerabilities, ransomware, breaches and government security alerts. Live from 157 feeds.
- Students develop AI-powered cybersecurity system for water treatment plants and other critical infrastructureTechXplore: security ·
- ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)SANS Internet Storm Center ·
- GridCraft is the open-source Excel clone for Linux I’ve been waiting forLatest news ·
- CVE-2026-114725 - Roundcube Webmail Mail Header Injection VulnerabilityCVEfeed Latest CVEs ·
- CVE-2026-114724 - Roundcube Webmail PHP Object Injection VulnerabilityCVEfeed Latest CVEs ·
- CVE-2026-114723 - Roundcube Webmail Memory Exhaustion VulnerabilityCVEfeed Latest CVEs ·
- CVE-2026-114664 - Frappe before 16.33.0 Blind SQL Injection via get_eventsCVEfeed Latest CVEs ·
- CVE-2026-114662 - Obot before 0.26.0 API Key Theft via CLI Login Token RequestCVEfeed Latest CVEs ·
- CVE-2026-114663 - Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default ArgumentsCVEfeed Latest CVEs ·
- CVE-2026-114661 - OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel EndpointsCVEfeed Latest CVEs ·
- CVE-2026-114659 - Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API RoutesCVEfeed Latest CVEs ·
- CVE-2026-114660 - Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form DirectivesCVEfeed Latest CVEs ·
- CVE-2026-114658 - Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.inviteCVEfeed Latest CVEs ·
- Not impressed with Google Maps? Make Waze your default on Pixel – here’s howLatest news ·
- Flaw in PHP computer language leads to shutdown of websites around worldGuardian (Data and computer security) ·
- CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window/r/netsec ·
- Microsoft Login Phishing: Investigating Domains Potentially Linked to KimsukyMedium: #threat-intelligence ·
- Header Accordions: QPACK amplification attacks against HTTP/3 serversoss-security ·
- Gallery of PHP maintenance pages from today/r/netsec ·
- Smashing Security podcast #489: How a brand new crypto wallet came with a spy insideGraham Cluley ·
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at riskThe Register Security ·
- How a brand new crypto wallet came with a spy insideSmashing Security ·
- Chrome puts insecure sites behind a permission promptHelp Net Security ·
- Statement regarding critical vulnerabilities in PHP affecting websites and online servicesCanadian Cyber Centre ·
- CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE AttacksZscaler ThreatLabz ·
- Re: eMudhra Intermediates Compromiseoss-security ·
- CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous requestoss-security ·
- CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hostsoss-security ·
- Microsoft pins ConnectWise supply-chain attack to China-state aligned threat groupCyberScoop ·
- CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=nooss-security ·
- CVE-2026-113811: Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in searchoss-security ·
- Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by UkraineSecurity Affairs ·
- PHP2Shell (CVE-2026-109618/109619): first exploit requests arrived 5.5 hours before PHP shipped the fix, and the "scanners" carry Mirai-style loaders/r/netsec ·
- CVE-2026-96778Tenable New CVEs ·
- CVE-2026-96638Tenable New CVEs ·
- CVE-2026-96639Tenable New CVEs ·
- CVE-2026-96640Tenable New CVEs ·
- CVE-2026-96641Tenable New CVEs ·
- CVE-2026-96642Tenable New CVEs ·
- CVE-2026-96643Tenable New CVEs ·
- CVE-2026-96644Tenable New CVEs ·
- CVE-2026-96636Tenable New CVEs ·
- CVE-2026-96637Tenable New CVEs ·
- TiDB Breach Exposes Flawed Cloud Security AssumptionsDark Reading ·
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)SANS Internet Storm Center ·
- PHP2Shell: Inside Two Critical PHP RCE Vulnerabilities — and the Public Exploit LandscapeMedium: #threat-intelligence ·
- Apache Pulsar Manager: CVE-2026-105944, missing authentication and admin credential disclosure; end of lifeoss-security ·
- Compromised eMudhra intermediate certificatesCisco Talos ·
- Apache Pulsar: 14 CVEs fixed in 4.0.14, 4.2.5 and 5.0.0 (combined announcement)oss-security ·
- No time to PHP around.CyberWire Daily ·
- Inside a Global AI-Assisted Hacking CampaignZscaler ThreatLabz ·
- Meta on the spot for $25 billion under New Mexico privacy rulingThe Record ·
- The Update Was Legit. The Payload Wasn’t.Medium: #threat-intelligence ·
- Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware SecurityDark Reading ·
- Major Vulnerability Discovered! Found by AI: The Buzz Around PHP and SecurityBing News: AI security vulnerability ·
- Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It HappensDark Reading ·
- Tech trio launches $10 million initiative to help under-resourced utilities bolster cybersecurityThe Record ·
- OpenAI Reports Two Incidents of AI Agents Disabling Their Own OversightSecurity Affairs ·
- AI helped find a critical security flaw affecting 70% of the internetBing News: AI security vulnerability ·
- Websites go dark worldwide as AI exposes critical security flawsBing News: AI security vulnerability ·
- Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueSentinelOne Labs ·
- 'PHP2Shell' Bugs Signal Red Alert for Security IndustryDark Reading ·
- Pillow 13.0.0 fixes long list of vulnerabilitiesoss-security ·
- [Urgent] Critical Vulnerabilities in PHP, Java, Node.js, and Certificate Authorities | A Beginner's Guide to Types of Cyber Attacks and Zero-Day/N-Day AttacksBing News: zero-day vulnerability ·
- The internet is having a very bad cybersecurity daycybersecurity | TechCrunch ·
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of ReleasesThe Hacker News ·
- WhatsApp’s chatbot was given hidden instructions to not mention privacy regulatorsMalwarebytes Labs ·
- Hold onto your old HomePod – an upgrade is on the wayLatest news ·
- Critical Vulnerabilities in PHPMedium: #threat-intelligence ·
- Critical PHP vulnerabilities: What is it, how it can affect websites & what should users know?Bing News: open source security vulnerability ·
- Democrat lawmakers say Russia is aiming to undermine party ahead of midtermsThe Record ·
- AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseMicrosoft Security Blog ·
- LiteLLM supply chain attack hoovers up passwords and secretsThe Register Security ·
- OpenAI’s most powerful AI models turned off safety monitoring – then lied about itLatest news ·
- LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and BackdoorThe Hacker News ·
- Australians face spike in data breaches after AI helps uncover critical website flawBing News: data breach ·
- Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global stateoss-security ·
- PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024The Record ·
- NeedyMantis: How a China-Linked Backdoor Is Quietly Infiltrating High-Value NetworksMedium: #threat-intelligence ·
- Government websites go dark after AI-discovered flaw sparks security scrambleBing News: AI security vulnerability ·