Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3580 articles
The roundup covers reported PHP2Shell exploitation, scanning for a patched Oracle flaw, ransomware prosecutions, data breaches, camera compromises, a payment-card skimmer and an information stealer targeting AI and developer credentials.
Cofense reports that an unidentified actor's fake Anthropic early-access emails are reaching major email security tools and targeting Google and Microsoft credentials, using shortened links and CAPTCHAs; AI involvement remains unconfirmed.
Socket reported 319 Chrome extensions with 13.4 million combined reported installs that routed searches through operator-controlled proxies for referral revenue. Researchers warn the destinations could change to phishing sites or malicious downloads.
A fake Padre Terminal iOS app has been linked by investigator Iris to about $23,000 stolen from 27 Solana wallets. Iris confirmed one victim was compromised through the app; the app was removed, but other thefts’ access paths are unknown.
Researchers report renewed Hugging Face models deploying cryptominers and backdoors, plus a fake Solana starter kit that tricks AI coding agents into installing NetSupport Manager for attacker access.
CrowdStrike expanded its prompt-injection taxonomy to 222 techniques, adding methods that manipulate agent planning and session state. The article explains how attackers could steer an agent toward actions such as sending local configuration files to an outside server.
The FCC voted to stop recognizing device-testing labs in China and other countries that do not accept U.S. lab results, giving manufacturers two years to move testing. Chair Brendan Carr cited risks to sensitive product information and communications infrastructure.
Anthropic says an unreleased Claude model built five chained exploits across Chrome, Safari, Android, Windows and Linux; vendors have patched the flaws. Experts note the claims of autonomous discovery lack success-rate and effort data.
Microsoft says updates released October 28, 2026, including preview update KB5127936, fix Remote Desktop failures affecting some non-admin users on Windows 11 24H2 and later when Administrator protection is enabled.
Symantec found an unauthorized AI relay on systems at about a dozen organizations that redirects Codex and Claude Code traffic, disables safeguards, and replaces credentials. Researchers observed no malicious activity, but say the setup creates serious risk.
Elastic made audit-log delivery generally available for Elastic Cloud Serverless, with centralized project activity logs, seven dashboards, and eight alerting rules for credential attacks and unusual sign-in patterns.
Aikido reviews PHP2Shell’s disclosure and patch timeline, reporting widespread exploitation attempts and uneven patching. Censys counted 32.5 million affected PHP services and 11.2 million fixed as of Oct. 27 among services reporting versions.
The roundup covers Palo Alto’s confirmed PHP2Shell exploitation of exposed PAN-OS interfaces, CVE-2026-111497 joining KEV, AI-agent security findings and incident reports, Upwind’s $400M Series C, and the author’s AI audit-trail book launch.
OFAC sanctioned 10 individuals and one entity over DPRK IT-worker schemes that place operatives in businesses and route earnings through cryptocurrency. Chainalysis describes Russian intermediaries and AI-enabled hiring deception.
Starting December 1, approved third-party Android stores can offer one-tap installs and background updates on supported Android 17 QPR2+ devices outside the U.S. Stores must submit their catalogs and updates for Google's ongoing malware scanning.
Artem Stryzhak was sentenced to 70 months in US prison after pleading guilty to conspiracy to commit computer fraud. Court documents describe his work as an affiliate for Nefilim and Hive; the State Department is offering rewards for information on group leaders.
Upwind Security announced a $400 million Series C at a $3.8 billion valuation. The company says its runtime-native cloud security platform helps teams identify exposures, remediate risks and detect attacks.
Google patched 52 security flaws in Chrome 156, while Mozilla patched 167 in Firefox 159. Neither company reported in-the-wild exploitation; users are advised to update.
Rapid7 says InsightGovCloud supports BOD 22-01 compliance with asset discovery, CISA KEV prioritization, remediation tracking, and CyberScope XML reporting.
Google and Mozilla released Chrome and Firefox updates on October 27, addressing 52 security issues in Chrome and 167 vulnerabilities in Firefox. The fixes include use-after-free flaws; both updates are rolling out gradually.
Infisical raised $40 million at a $600 million valuation. Its Agent Vault lets AI agents access sensitive systems using placeholders while secrets are injected at a proxy; requests pass through Infisical and are logged.
Anthropic says an unreleased model found flaws across major platforms and built lab-only proof-of-concept chains; vendors patched the reported flaws. Claims about the model's autonomy and links between some chains and public CVE records remain unverified.
The DOJ announced the seizure of Virtualine’s domain, alleging the bulletproof host supported criminal services and laundered customer payments. The operator disputes knowingly hosting illegal material and says customer data is safe.
GMO is offering up to $1 million for tips leading to an arrest or international wanted notice after confirming unauthorized access to its Desktop Cloud service and customer-information exfiltration. The entry method and full impact remain unclear.
