ThreatSignal

Unavailable right now: BleepingComputer

• SecurityWeek·11m agoNation-state

  China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

  The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments. The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek .

• Infosecurity Magazine·12m agoBreachPhishing

  Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise

  Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering

• SANS ISC·17m ago

  ISC Stormcast For Friday, October 23rd, 2026 https://isc.sans.edu/podcastdetail/10148, (Fri, Oct 23rd)

  (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

• Ransomware.live·22m agoRansomware

  🏴‍☠️ Rhysida has just published a new victim : Line2Line Coatings

  Line2Line Coatings 796,433 files - 641.0 GB~20 years of email: 34 mailboxes (PST/OST), 107,279 messages, 13,068 contacts - including the president's own mailbox (4.0 GB).The entire QuickBooks history: 1,232 backups (.QBB) + 174 live company files (.QBW...

• Ransomware.live·24m agoRansomware

  🏴‍☠️ Pear has just published a new victim : Fresh Farms

  Offers a wide range of top-quality products that meet the needs of customers in the foodservice, retail, and industrial sectors, including export markets

• Ransomware.live·32m agoRansomwareAdvisory

  🏴‍☠️ Fulcrumsec has just published a new victim : EMARKETER

  [AI generated] EMARKETER is a market research and business intelligence company based in the United States, specializing in digital marketing, media, and commerce data. It provides forecasts, analysis, reports, and trends on topics like advertising, e-comme...

• Infosecurity Magazine·42m agoBreach

  Attacks on Tech Firms Behind Most Third-Party Data Breach Victims

  Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause

• SecurityWeek·43m agoZero-dayVulnerability

  Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months

  The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWeek .

• The Hacker News·1h agoVulnerability

  Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

  Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passin...

• The Register·1h agoUKNation-state

  UK threatens subsea cable saboteurs with 14 years behind bars

  Whitehall wants tougher penalties and new powers over telecoms operators as Russian activity raises alarm

• Ransomware.live·1h agoRansomware

  🏴‍☠️ N0n has just published a new victim : Horn of Africa Regional Environment Centre and Network

  Environmental NGO · Ethiopia | The complete SAP Business One production database of the organization: 15,275 journal transactions with 89,929 journal lines, 1,007 business partner records of regional partner organizations with contacts, 333 general ledger a...

• Assured·1h agoUK

  Weekly Cyber Update: 23 October 2026

  Some P2PShell incident response best practices; three new supply chain incidents; and the European Commission investigates Booking.com for fraud. The Cyber Threat Intelligence Briefing is a weekly round-up of the latest cybersecurity news, trends and indica...

• Help Net Security·2h agoBreach

  Capcom data breach exposes 11.7 million account records

  Players who signed up for Capcom's online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the account p...

• The Hacker News·2h ago

  Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

  Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, ...

• The Hacker News·2h agoVulnerability

  Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

  AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit unt...

• SecurityWeek·2h agoBreach

  11 Million Impacted by Capcom Data Breach

  The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts. The post 11 Million Impacted by Capcom Data Breach appeared first on SecurityWeek .

• SecurityWeek·2h agoBreachAdvisory

  Quest Diagnostics Reports Cyber Breach Affecting 'Certain Patient Records'

  In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders. The post Quest Diagnostics Reports Cyber Breach Affecting 'Certain Patient Records' appeared f...

• Help Net Security·2h agoNation-state

  Hackers hijack exposed AI models to launch cyberattacks at victims’ expense

  An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model's owner pays for the computing power. Symantec captured the agent's instruction set this summer through a honey...

• SecurityWeek·3h ago

  LiteLLM Compromised in Fresh Supply Chain Attack

  Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek .

• Ransomware.live·3h agoRansomware

  🏴‍☠️ Wallstreet has just published a new victim : Prism Medical Products

  Prism Medical Products is a U.S. home medical supplies provider specializing in wound care, along with ostomy, urological, compression, and other prescribed supplies. It works with clinicians and insurers to coordinate coverage and deliver supplies directly...

• Ransomware.live·3h agoRansomware

  🏴‍☠️ N0n has just published a new victim : PROTEX Confection

  textile manufacturing · Tunisia | Client master records of the group's accounting and commercial dossiers: 84 records with client names, addresses, Tunisian tax registration numbers, phones and emails; Supplier master records: 32 records with the same ...

• SecurityWeek·3h agoVulnerability

  Atlassian Patches 75 Flaws in Data Center and Server Products

  Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components. The post Atlassian Patches 75 Flaws in Data Center and Server Products appeared first on SecurityWeek .

• Ransomware.live·3h agoRansomwareAdvisory

  🏴‍☠️ N0n has just published a new victim : SunTechnics Fabrisolar AG

  solar energy company · Switzerland | Financial and bank records of a Swiss solar energy company, including annual accounts and audit files; Payroll and staff data with employee names and social insurance records; Customer and project files for solar install...

• Ransomware.live·3h agoRansomware

  🏴‍☠️ Emperador has just published a new victim : B2Chat

  B2Chat is a multimillion dollar business communication platform based in Spain that provides tools for customer support, sales, and engagement. It allows businesses to interact with customers through various channels, such as live chat, chatbots, and messag...

• The Hacker News·3h agoVulnerabilityMalware

  PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

  Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously...

• Ransomware.live·3h agoRansomware

  🏴‍☠️ Qilin has just published a new victim : Coop Italia

  N/A

• ITPro·4h ago

  Progress WhatsUp Gold 2026 review

  A good value network monitoring choice with a wealth of features, a highly informative web console, and the smart WhatsUp Gold 360 service

• SecurityWeek·4h agoNation-state

  Iran's Prince of Persia APT Hosts C&C in US for First Time Since 2016

  After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. The post Iran's Prince of Persia APT Hosts C&C in US for First Time Since 2016 appeared first on SecurityWeek .

• Security Affairs·5h ago

  INTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime Crackdown

  INTERPOL's Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 ar...

• Help Net Security·5h ago

  Google opens its cloud to rival OpenAI, promises business data won’t train models

  Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna. Google positions them as options for demanding work, lower-cost professio...

• Help Net Security·5h ago

  Drone program compliance: What a CTO says most agencies get wrong

  In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short. He covers chain of custody for flight log...

• Help Net Security·6h ago

  AI is taking cybersecurity jobs at junior and experienced levels alike

  Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda’s Cybersecurity Skills Gap Report. 56% have experienced professional workforce reductions linked...

• Help Net Security·7h agoVulnerability

  New infosec products of the week: October 23, 2026

  Here’s a look at the most interesting products from the past week, featuring releases from AppGate, IDENTOS, Sweet Security, and ThreatModeler. Sweet Security adds one-click protection for vulnerable cloud workloads Sweet Security has announced the release ...

• Dark Reading·7h agoBreach

  State Bank of India Suffers a Customer PII Data Leak

  Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII.

• Ransomware.live·11h agoRansomware

  🏴‍☠️ Qilin has just published a new victim : SEPIVER

  N/A

• Ransomware.live·13h agoRansomware

  🏴‍☠️ Lockbit5 has just published a new victim : istanbultrading.com

  Istanbul Foodstuff Trading Co LLC is a company that operates in the Computer Equipment & Peripherals...

• The Record·14h agoBreachNation-state

  Toronto crime tips org freezes operations after details of data breach come to light

  Late Wednesday night the Toronto chapter of Crime Stoppers broke ranks with the national association, revealing a timeline showing what it knew and when along with an announcement that it will pause operations.

• Security Affairs·14h agoBreachNation-state

  Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX

  China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind...

• Dark Reading·14h agoNation-state

  Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack

  The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.

• The Register·14h ago

  PHP2Shell exploit bypasses protections designed to stop remote code execution

  “Adversaries are clearly spending time (and tokens) on this bug,” researcher says.

• Dark Reading·14h agoNation-state

  What We Missed: Feds Lasso Texas Laptop Farms

  In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in "Operation Lonestar Justice" to Staples' gift card bonanza.

• Ransomware.live·15h agoRansomware

  🏴‍☠️ Silentransomgroup has just published a new victim : M... C...

  Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

• Dark Reading·15h ago

  Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour

  Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.

• The Hacker News·16h agoNation-state

  The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat

  Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns it. If an employe...

• The Hacker News·16h agoZero-dayVulnerabilityAdvisory

  Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

  Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw lets anyone who can log in to the orchestra...

• The Record·16h ago

  Indian tech company eMudhra announces withdrawal from certificate business after security incident

  The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.

• Ransomware.live·16h agoRansomware

  🏴‍☠️ Qilin has just published a new victim : United Restaurant Supply

  N/A

• Security Affairs·16h agoVulnerability

  Signal Vulnerability Could Keep Calls Alive After Users Hang Up

  A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ’s calling library could allow a malic...

• The Hacker News·16h ago

  eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

  eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA cer...

• HackRead·17h ago

  Paying in ADA: Cardano’s vision for the future of payroll

  Cardano payroll could support ADA salaries and automated payments, but employers must address price volatility, tax obligations, wallet security and compliance.

• The Hacker News·17h agoBreachVulnerability

  ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

  This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal wit...

• The Register·17h ago

  Max-severity GitLab bug allows remote code execution over 12 years of releases

  Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'

• Unit 42·17h ago

  EMudhra Intermediate CA Certificates Compromised

  Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42 .

• Ransomware.live·18h agoRansomware

  🏴‍☠️ Bravox has just published a new victim : AMSAM

  Social, Healthcare and Home Care Services.

• Ransomware.live·18h agoRansomware

  🏴‍☠️ Bravox has just published a new victim : Barrow & Grimm

  Legal Services, Business Litigation and Corporate Law.

• The Hacker News·18h agoVulnerability

  Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

  Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be trigge...

• Unit 42·18h ago

  The Current Landscape of OAuth Attacks

  Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42 .

• Ransomware.live·18h agoRansomware

  🏴‍☠️ Silentransomgroup has just published a new victim : M...r

  Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

• The Register·18h ago

  Disgraced Indian cert issuer leaves the cert issuing business

  We didn't want to issue SSL/TLS certs anyway, Indian firm suggests after one private key turns out to be the number 4

• Ransomware.live·18h agoRansomware

  🏴‍☠️ Silentransomgroup has just published a new victim : Kirkland & Ellis LLP

  [AI generated] Kirkland & Ellis LLP is a global law firm headquartered in Chicago, Illinois, United States. It operates in the legal services industry, providing counsel in private equity, mergers and acquisitions, restructuring, litigation, intellectua...

• The Record·18h ago

  Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents

  A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around the globe, Microsoft said.

• Computer Weekly·18h agoVulnerability

  Botched PHP2Shell disclosure revealed as panic continues

  As security teams worldwide grapple with the deep impact of the PHP2Shell flaws, the PHP Foundation reveals how a carefully planned vulnerability disclosure process went horribly wrong

• The Hacker News·18h ago

  Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations

  Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data scandal, which came to light in 2018. According to multiple repor...

• The Register·19h agoUK

  PHP2Shell puts dozens of UK government services out of service

  Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise

• Ransomware.live·19h agoRansomware

  🏴‍☠️ Akira has just published a new victim : Bethany Press International

  Bethany Press partners with authors, ministries, and publishers to create, produce, and distrib ute millions of life-changing Christian books each year. They offer industry-leading publishing services for both short-run and long-run printing and distributio...

• Ransomware.live·19h agoRansomware

  🏴‍☠️ Akira has just published a new victim : Medienwerkstatt

  Medienwerkstatt stands for digital and printed communication of the highest quality and disting uishes itself through an exceptional customer service. With more than 50 passionate talents for various offline and online disciplines, medienwerkstatt ag is one...

• Ransomware.live·19h agoRansomware

  🏴‍☠️ Akira has just published a new victim : Annapath

  Annapath, Inc. is a privately owned surgical and cytopathology laboratory that primarily focuse s on dermatopathology, serving clients in Maryland, Delaware, Pennsylvania, Washington D.C., Vi rginia, and West Virginia. The company offers a full range of ana...

• HackRead·19h ago

  Operation Serengeti III Nets 1,462 Arrests and $105M in Cybercrime Crackdown

  INTERPOL’s Operation Serengeti III targeted cybercrime in 21 African countries, recovering over $105 million and identifying 65,929 victims…

• Ransomware.live·19h agoRansomware

  🏴‍☠️ Rhysida has just published a new victim : DR.SCHNELL GmbH & Co. KGaA

  DR.SCHNELL GmbH & Co. KGaA DR.SCHNELL GmbH & Co. KGaA � full network dump. 175,151 files / 2.52 TB.1.2+ TB of Navision/Business Central ERP backups - full commercial history (clients, pricing, procurement).Complete HR & payroll for Germany, Swit...

• Ransomware.live·19h agoRansomware

  🏴‍☠️ Qilin has just published a new victim : Airtificial

  N/A

• The Register·20h agoPhishing

  When the attacker becomes the user: Rethinking account takeover

  SPONSORED FEATURE: AI makes phishing easier than ever

• Security Affairs·20h agoVulnerability

  PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports

  AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public...

• ITPro·20h agoVulnerability

  PHP vulnerabilities spark global scramble as websites taken down

  The impact of critical PHP vulnerabilities has been felt worldwide

• Ransomware.live·20h agoRansomware

  🏴‍☠️ Qilin has just published a new victim : Bathurst RSL

  N/A

• Ransomware.live·20h agoRansomware

  🏴‍☠️ Qilin has just published a new victim : Creative Universe

  N/A

• SecurityWeek·20h ago

  Hacker Conversations: Corey Thuen and the Evil Bit

  Corey Thuen hires hackers for what he calls ‘the evil bit’ — an adversarial streak he believes is either there or it isn’t. The post Hacker Conversations: Corey Thuen and the Evil Bit appeared first on SecurityWeek .

• HackRead·21h ago

  Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year

  Contern, Luxembourg, 22nd October 2026, CyberNewswire

• Infosecurity Magazine·21h agoPhishing

  EU Regulators to Investigate Booking.com Over Scam Risks

  The EU Commission will assess whether Booking.com has adequately protected customers from phishing attacks

• The Hacker News·21h ago

  INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown

  INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspect...

• The Record·21h agoRansomware

  Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized

  More than 1,400 suspected cybercriminals were arrested across Africa this summer as part of a crackdown on the gangs perpetrating online fraud, ransomware and business email compromise attacks, Interpol said.

• Help Net Security·22h agoMalware

  LiteLLM hit by second supply chain attack this year, users urged to rotate credentials

  A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. “LiteLLM got compromised… again,” security researche...

• Ransomware.live·22h agoUKRansomwareAdvisory

  🏴‍☠️ Everest has just published a new victim : PWC

  [AI generated] PwC (PricewaterhouseCoopers) is a multinational professional services network headquartered in London, United Kingdom. It is one of the "Big Four" accounting firms, offering audit and assurance, tax, consulting, and advisory services to busin...

• Infosecurity Magazine·22h agoMalwareNation-state

  Iranian Hacking Group Found Hosting C2 Infrastructure in the US

  Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil

• SecurityWeek·22h agoUK

  Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform

  The Amsterdam-based company plans to use the funding for research and development and commercial expansion in Europe and the Middle East. The post Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform appeared first on SecurityWeek .

• Help Net Security·22h ago

  OpenAI’s coding agents talked themselves out of being monitored

  Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it had done no such thing. OpenAI disclosed both episodes in a misalignment report released earlier this wee...

• SecurityWeek·22h agoVulnerability

  Signal Vulnerability Lets Malicious Callers Block Hang-Ups

  Affecting the open source calling library RingRTC, the bug prevented calls from ending properly. The post Signal Vulnerability Lets Malicious Callers Block Hang-Ups appeared first on SecurityWeek .

• The Register·22h agoVulnerability

  Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

  Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed

• The Record·22h ago

  South Carolina officials offer assistance after state capital hit with cyberattack

  The systems impacted by the attack include the MyColaSC platform that citizens use to pay utility bills, report non-emergency issues and access other city services.

• Help Net Security·23h agoVulnerability

  New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619

  Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21. PHP2Shell lets an attacker reach pre-auth RCE ag...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens SIMATIC S7 Webserver API

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-10.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>.NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that cou...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens APOGEE, TALON and Desigo PXC/PXM Products

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-08.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The products listed below contain multiple vulnerabilities that could allow an attacker to ...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens RUGGEDCOM CROSSBOW

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-12.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execut...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens RUGGEDCOM APE1808 Devices

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-18.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This a...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens Industrial Edge App Publisher

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The Industrial Edge App Publisher contains a vulnerability chain involving improper certifi...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-11_test.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens WinCC

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-13.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerabili...

• CISA Advisories·23h agoAdvisory

  Siemens Industrial Edge Device Kit

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-09.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Users of Industrial Edge Devices are advised to consult the respective Security Advisories ...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens Capital Embedded AR Classic

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The products listed below contain an out-of-bounds read vulnerability that could allow an a...

• CISA Advisories·23h agoVulnerabilityAdvisory

  InterSystems Corporation InterSystems IRIS for Health

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to view transmitted ...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens PSS(R)SINCAL

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-06.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>PSS(R)SINCAL uses WibuKey third-party product that contains an out-of-bounds write vulnerab...

• CISA Advisories·23h agoAdvisory

  Siemens Software Center

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search pa...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens RUGGEDCOM CROSSBOW Station Access Controller

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-15.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens SIMATIC IPCs

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-07.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The products listed below contain a vulnerability that could allow an attacker to boot an o...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens Industrial Edge Devices

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-17.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could ...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens SIMATIC S7 PLCs Web Server

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-14.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that could allow...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens SENTRON 3NA COM Fuse

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a net...

• CISA Advisories·23h agoAdvisory

  Managing AI Token Consumption for Operational Resilience

  <p>CISA, the Canadian Centre for Cyber Security (Cyber Centre), and partners are releasing joint guidance, <a href="https://www.cyber.gc.ca/en/guidance/managing-ai-token-consumption-operational-resilience-itsm00125" target="_blank"><em>Managing AI Token Con...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Siemens SIMATIC S7-1500 TM MFP

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-16.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the ...

• CISA Advisories·23h agoVulnerabilityAdvisory

  Kiloview E3 NDI Encoder

  <p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-295-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this these vulnerabilities could allow an attacker to fully comp...

• Help Net Security·23h ago

  Fingerprint uses AI coding tools to automate fraud detection setup

  Fingerprint has announced Agentic Installation, the AI-powered onboarding path for companies to deploy device intelligence to their websites or apps in minutes to detect and stop fraud. By running a single prompt in an AI coding tool, such as Claude Code, C...

• The Register·23h agoBreach

  Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

  AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours

• The Hacker News·23h ago

  Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation

  Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access to ...

• Infosecurity Magazine·24h ago

  Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants

  Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform

• The Hacker News·24h agoVulnerability

  OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL

  A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code...