Security

CISA confirms active exploitation of maximum-severity GitLab flaw

The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are actively exploiting a maximum-severity vulnerability in GitLab, tracked as CVE-2026-97229. The flaw, which was patched earlier this month, could allow unauthenticated remote attackers to run arbitrary code via a maliciously crafted regular expression in CI/CD configuration files. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to secure their servers by Sunday.

30 Oct·2 min

Trezor Warns of Reported Hardware Implant in CryptoBilis Safe 5

Trezor has warned customers who bought its hardware wallets from reseller CryptoBilis to move their funds as soon as possible, after a buyer in Indonesia reported a hardware implant in a Trezor Safe 5 device. The company said it had not yet examined the device but treated the report as credible based on a description and video interview.

30 Oct·2 min·2 sources

Critical PHP flaw puts 70% of websites at risk as agencies urge patches

A critical vulnerability in PHP, the programming language that underpins more than 70% of the world's websites, has triggered a global security response, with multiple European governments and the Port of Rotterdam taking websites offline and cyber agencies in Australia, the US, the UK, Europe and Japan urging developers to apply urgent patches.

30 Oct·3 min

Researchers find 'Embrace' flaws in five AI developer tools; OpenAI, Microsoft bugs unpatched

Researchers at security firm Forever Security have discovered vulnerabilities in five popular AI developer tools that could let attackers execute code on host machines, steal files, or spoof website addresses. The flaws, which affect Cursor, GitHub Copilot, Anthropic's Claude Desktop, Microsoft's VS Code and OpenAI's Codex, stem from a common class of weakness the company calls 'Embrace', over-empowered embedded browsers. While Cursor and GitHub Copilot have been patched, flaws in VS Code and Codex remain unpatched, according to the researchers.

30 Oct·3 min

Japan Airlines data breach exposes about 92,000 customers via Amadeus system

Japan Airlines has disclosed that a data breach at Amadeus's Passenger Service System exposed the personal information of about 92,000 customers, with the unauthorised access spanning more than three years.

Google Adopts DPoP to Bolster OAuth 2.0 Against Token Theft, but Only for Refresh Tokens

Google's OAuth platform has introduced support for Demonstrating Proof-of-Possession (DPoP), a cryptographic mechanism designed to mitigate the replay of stolen tokens by attackers, though the protection currently applies only to refresh tokens, not access tokens or web session cookies.

Florida Department of Education says data of up to 4.9 million was vulnerable in breach

Personal information, including Social Security numbers, of up to 4.9 million individuals was vulnerable during a data breach at the Florida Department of Education’s financial aid website, the agency announced Thursday.

Hackers exploit Cisco SD-WAN flaw to deploy 'KeyDrift' malware, researchers say

A hacking group was observed exploiting a patched Cisco vulnerability to deploy a custom malware framework called KeyDrift in attacks on space and satellite services, defense and aerospace technology, and policy research organizations, Cisco Talos researchers reported. The group, tracked as UAT-11473, appears to overlap with the Chinese state-sponsored Volt Typhoon's 'Silent Train' covert access network, though Talos made no definitive links.

319 Chrome extensions with 13.4 million installs caught hijacking searches

More than 300 Chrome extensions with a combined 13.4 million installations have been caught hijacking users' searches, redirecting them through tracking servers to generate advertising revenue from Bing and Yahoo, according to a report from Socket.

29 Oct·3 min

Moldovan president calls security meeting after cyberattack exposes data of about 750,000 Moldovans

Moldovan President Maia Sandu has called a meeting of the country's National Security Council after a large-scale cyberattack on government information systems resulted in the extraction of personal data belonging to roughly 750,000 Moldovans, in an attack most likely carried out with the help of artificial intelligence.

GCHQ cannot account for thousands of storage devices, watchdog finds

Britain's intelligence agency GCHQ cannot locate thousands of removable storage devices that may contain highly sensitive intercepted communications, according to a report from the Investigatory Powers Commissioner (IPCO) published Thursday. Brian Leveson, the Investigatory Powers Commissioner, said GCHQ "still cannot tell me what has happened to removable media that may hold sensitive data, years after I first raised it with them."

Belgium's tax agency confirms cyberattack, extends filing deadline

Belgium's finance and tax agency (FOD Financiën) has confirmed a cyberattack after which it took several digital services offline, including the main online tax portal MyMinfin, and said the deadline for certain tax filings will be extended to November 16.

Ransomware hits exposed Synology NAS, likely exploiting 18-month-old flaw

A Reddit user says files on their Synology DS918+ NAS were encrypted in a ransomware attack; analysis of logs and operating system files suggested the attack likely involved CVE-2024-10441, a remote code execution vulnerability revealed 18 months ago. The device had its web interface exposed to the internet and was roughly a year and a half out of date with security patches, according to a detailed write-up by user NakamuraHwang.

CISA warns of Fragnesia Linux flaw exploited alongside PHP2Shell vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug, tracked as CVE-2026-46300 and named Fragnesia. In a Monday report, Dream Security analysts said the vulnerabilities were used to breach more than two dozen servers, including three belonging to a U.S. government-affiliated organization.

29 Oct·2 min·2 sources

Cisco patches actively exploited zero-day allowing remote crash of VPN firewalls

Cisco has released security updates to patch a denial-of-service zero-day vulnerability, tracked as CVE-2026-76418, that attackers are actively exploiting to remotely crash vulnerable Adaptive Security Appliance (ASA) and Threat Defense (FTD) firewall devices.

Fake PS5 emulator repositories on GitHub spread password-stealing malware

Malicious repositories pretending to offer popular PS5 emulation tools have been found spreading malware reported to steal passwords, according to a report by NordVPN's Threat Intelligence research team. The malware's payload is believed to be an infostealer, a type of malware that can steal passwords and other sensitive data. The campaign targets users looking for AnyPS5 and Kyttyps5, two legitimate projects for running PlayStation 5 games on PC.

Attackers target 61 public GitHub repos in suspected supply-chain campaign

Threat hunters at Radware have uncovered a suspected coordinated supply chain campaign that targeted 61 public GitHub repositories, including popular open source projects like Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a campaign to execute commands in CI/CD environments and steal credentials and access tokens.

29 Oct·3 min

US and European Authorities Seize Virtualine, a Bulletproof Hosting Service for Cybercrime

US law enforcement, alongside agencies in the Netherlands, Germany, and the United Kingdom, has seized the primary domain and server infrastructure of Virtualine, a bulletproof hosting service authorities say has been at the centre of a broad range of cybercrime operations since at least 2022. The FBI seized the service's main domain, while Dutch police seized dozens of physical servers in Limburg. The service is accused of facilitating ransomware, infostealers, drug trafficking, and hosting a forum for child sexual abuse material.

28 Oct·3 min

Florida county won't probe mystery Flock cameras that vanished after takedown

A Florida county that found a dozen unpermitted Flock cameras during a countywide removal effort will not investigate who owned the cameras, which have since disappeared, leaving residents worried about where their data may have gone.

Oracle patches trailed by fresh exploits as PeopleSoft zero-day proves to be triple bug

Security researchers warn that a critical Oracle E-Business Suite vulnerability is already being probed in the wild despite a patch, while new analysis reveals that the PeopleSoft zero-day exploited by the ShinyHunters group is actually three distinct bugs that can be chained for remote code execution.

28 Oct·3 min

DHS takedown push fails to stop spread of leaked employee data

The Trump administration's efforts to contain a leak of records for more than 41,000 Department of Homeland Security employees and contractors struggled on Thursday as a searchable directory was taken down, but the information moved to a different domain and the Icelandic company hosting it refused a takedown request. Social media platform Bluesky also blocked links to DDoSecrets, marking them as malicious.

28 Oct·3 min·14 sources

Volt Typhoon uses 'Silent Train' relay framework with zero-day exploits, researchers say

Chinese state-sponsored hacking group Volt Typhoon has been using a framework dubbed Silent Train, which rotates chains of compromised devices to hide attacks that have exploited at least four zero-day vulnerabilities against high-value targets, according to researchers at Black Lotus Labs, the threat research division of communications company Lumen.

Sony ISP subsidiary data breach exposes 2.5 million customer records

Sony Network Communications, a Japanese subsidiary of Sony Group, has confirmed a data breach that exposed personal information held in approximately 2.5 million customer records. The company said an unauthorized party accessed its So-net member database on October 19, four days before the breach was detected and the affected servers were shut down.

Report warns of actively exploited vulnerabilities in critical network infrastructure

A report from Eclypsium's InfraTrust Pulse highlights 133 new security advisories across 18 vendors, with many vulnerabilities already under active exploitation. Among the most concerning are PHP2Shell flaws that allow unauthenticated remote code execution on network appliances such as firewalls, VPNs, and storage devices, whose embedded PHP cannot be patched by customers independently.

Fresh wave of cyberattacks hits South Korean financial firms

South Korean financial institutions have been hit this week by a fresh wave of cyberattacks, with brokerages and a crypto exchange reporting incidents and one firm disclosing that the personal information of 38,490 customers was exposed. The country's financial regulator has called for stronger security measures.

28 Oct·2 min·2 sources

Hotel booking scam hits Australians after RMS Cloud cyberattack

Australian travellers are being targeted in a sophisticated hotel booking scam after hackers accessed customer information held by accommodation software provider RMS Cloud. The company confirmed on Tuesday it was investigating phishing messages that use genuine reservation details to threaten cancellation unless payment is reconfirmed. The Australian Competition and Consumer Commission has received 62 reports in three days, with one victim losing more than $300.

28 Oct·3 min·2 sources

Attackers scan the internet for unpatched Oracle E-Business Suite systems

Attackers have begun scanning the internet for systems left unpatched against a recently disclosed critical Oracle E-Business Suite vulnerability that allows unauthenticated takeover, prompting the software maker to urge customers to apply its October security update without delay.

123 Reg says AI-driven cyberattack exposed customer data, China threat group suspected

UK domain registrar 123 Reg has disclosed that it suffered an AI-driven cyberattack in September that compromised customer data. The company said it notified affected customers this week after discovering that an attacker accessed personal and account information. Early indications from the company point to a Chinese state-sponsored group.

Microsoft October security update fixes 1,415 vulnerabilities, one exploited in the wild

Microsoft's October security update addresses 1,415 vulnerabilities across its software lineup, including one already exploited in the wild and 85 classified as critical. The unusually large patch set has drawn warnings from security experts about the strain on corporate IT departments.

Ukrainian ransomware affiliate sentenced to 70 months for attacks on hospitals and businesses

A Ukrainian national has been sentenced to 70 months in prison for his involvement in Nefilim and Hive ransomware attacks that targeted hospitals, government entities, and large corporations worldwide between 2018 and 2021, the US Justice Department announced.

CISA warns hackers are actively exploiting critical Brotli 'Node2Shell' flaw

The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed Tuesday that hackers are actively exploiting a critical vulnerability in Google's Brotli compression library, adding the flaw, tracked as CVE-2026-111497 and known as Node2Shell, to its Known Exploited Vulnerabilities (KEV) catalog and ordering federal agencies to patch within two weeks.

Black October's AI-discovered PHP bugs prove hard to exploit, but experts warn of coming 'vulnpocalypse'

The cybersecurity world braced for catastrophe after AI uncovered critical flaws in PHP, the language behind roughly 70% of websites, but the anticipated wave of automated attacks has surprisingly struggled to get off the ground. Security researchers say the vulnerabilities have proven unusually difficult to exploit, drawing comparisons to the Y2K phenomenon where warnings of armageddon helped rally companies to engineer a solution in time. However, experts caution this is a temporary reprieve, with one warning that 'we don't have to wait another two years before this happens (again), it could be three hours from now.'

28 Oct·3 min·7 sources

UNM Health ransomware attack disrupts patient care as new Byod gang claims responsibility

A cyberattack on the University of New Mexico Health Sciences Center disrupted patient care and academic activities this week, forcing the health system to divert ambulances, suspend outpatient surgeries and cancel classes before critical systems were restored, with a new ransomware group, Byod, claiming responsibility.

27 Oct·3 min

NIST publishes roadmap for transition to post-quantum cryptography

The US National Institute of Standards and Technology has released a high-level road map to help organizations move to post-quantum cryptography standards, setting out official timelines and priorities for a transition driven by the threat of future quantum computers.

Brazilian skimming gang compromises Convertr analytics script, steals payment card data

A credit card skimming group compromised a shared analytics script used by Brazilian e-commerce platform Convertr to steal shoppers’ payment data during checkout, according to e-commerce security firm Sansec. The campaign was identified on October 24 and has been attributed to a Brazilian gang active since at least July 2024.

Code-execution flaw in boot-time firmware threatens most servers worldwide

A critical vulnerability in the boot-time firmware used by most of the world's server vendors and data centers could let attackers execute malicious code before operating system defenses load. Tracked as CVE-2026-97631 and rated 9.5 out of 10 in severity, the flaw is a memory-corruption bug in TianoCore EDK II, the open source codebase behind most UEFI firmware.

Norway reports successful cyberattacks have tripled in six months, warns of AI threat

Norway's National Security Authority (NSM) said on Tuesday that the number of successful cyberattacks targeting Norwegian organisations has trebled in the last six months, warning that the rapid growth of artificial intelligence technology poses a serious risk to businesses and critical infrastructure.

Warp discloses breach exposing AI agent logs, user telemetry data

Warp, the developer tool that evolved from a terminal into an agentic development environment (ADE), has disclosed a security breach involving a third-party vendor that exposed agent decision logs and telemetry data. CEO Zach Lloyd estimates that roughly 1% of Warp’s users may have been impacted, and said the company detected the exploitation within hours and mitigated the incident.

Tailscale warns of serious SSH flaws that could allow root privilege escalation

Tailscale is working to patch nearly a dozen security vulnerabilities in its mesh VPN software, including critical flaws in its SSH server that could allow authorized attackers to gain root-level code execution, steal credentials, and crash servers.

GMO urges customers to shut down PCs after hackers publish stolen data

Japanese internet giant GMO Internet has told customers of its Onamae Desktop Cloud service to disconnect their computers, shut them down and unplug all cables, after a threat actor who breached the service published stolen company and customer data and threatened to trigger a ransomware attack. GMO confirmed the publication in a report on Tuesday and said it was verifying whether the leaked information was genuine.

27 Oct·3 min·3 sources

Hacker finds PS5 hypervisor bug with AI, awarded $50,000 bounty

A security researcher using an artificial intelligence language model discovered a hypervisor vulnerability in Sony's PlayStation 5 that allowed Linux to be loaded on the console. The researcher, who goes by Jordy on social media, reported the flaw to Sony and received a $50,000 bug bounty. The disclosure has drawn strong criticism from members of the jailbreaking community.

Attack on AfD email host exposes 345,000 accounts, party says AI used to analyse stolen data

A cyberattack on the email hosting provider of Germany's far-right Alternative for Germany (AfD) party exposed more than 345,000 unique email addresses and a large volume of confidential emails and attachments, Have I Been Pwned confirmed. The party disclosed the September attack on its own hosting provider, Alternita Dienstleistungs GmbH, last week and said it is 'deeply concerned', describing the incident as an illegal attack on democracy.

Microsoft removes seven certificates from Windows trust list in eMudhra response, plans Edge update

Microsoft has released an out-of-band Windows update that removes seven certificates from the Windows trust list, including six eMudhra G3 root certificates and an AAA Certificate Services cross-sign, as part of its response to the compromise of eMudhra intermediate certificate authority private keys. The company plans to remove the same certificates from the Microsoft Edge trust list on October 27.

27 Oct·2 min·3 sources

French energy giant ENGIE confirms customer data breach

French energy giant ENGIE has confirmed that attackers stole customer data after breaching a marketing platform used by its business partners, according to a company spokesperson. The breach is limited to customers in France and did not involve the company's internal systems, ENGIE said.

Apple Backports CoreGraphics Zero-Day Fix to Older iPhones and iPads

Apple has released security updates for older iPhones and iPads, backporting patches for a CoreGraphics zero-day vulnerability (CVE-2026-86950) that the company says was exploited in highly targeted attacks against specific individuals on versions of iOS before iOS 27.

npm worm that looked like a test secretly armed 42 GitHub repositories, researchers say

A self-replicating npm worm that initially appeared to be a harmless test had in fact compromised 42 GitHub repositories belonging to 11 owners, with accounts hijacked as early as July, according to security researchers at JFrog.

27 Oct·3 min

Keystone to destroy 18,835 wallets after hackers steal verification key in website breach

Keystone will destroy nearly 19,000 unsold hardware wallets and suspend shipments after attackers stole a factory-set key used to verify device authenticity, widening a breach first reported as a customer data leak.

27 Oct·2 min·3 sources