Arista VeloCloud Orchestrator: exploited SQL injection (CISA KEV)
CVE-2026-114625 (CVSS 9.9) in on-prem VeloCloud Orchestrator lets any authenticated user become “superuser operator”. Already exploited: what to do now.
4 min read
Nextcloud, Collabora CODE: CVE-2026-110447 added to CISA KEV
CISA has added CVE-2026-110447 in Nextcloud’s Built-in CODE Server app to the KEV catalogue: 26 October deadline, NVD details and what to do now.
4 min read
PHP: third RCE CVE-2026-115560 unpatched, PHP2Shell attempts
CVE-2026-115560, a third PHP RCE, has no patch yet: mitigate with session.upload_progress.enabled=0. PHP2Shell sees wide attempts, no confirmed compromise.
5 min read
Quest Diagnostics: Quanum LSM breach reaches patient records
Unauthorized access to Quest Diagnostics’ Quanum LSM portal reached some patient records. Facts, open questions and what to do now.
5 min read
ConnectWise attack: Microsoft points to Storm-0940 and ARTEX
Microsoft says Storm-0940 is behind the abuse of ConnectWise apps in Microsoft 365, with attacks automated by ARTEX. New technical details and checks to run.
5 min read
VeloCloud Orchestrator: fixed versions and attack IPs
CVE-2026-114625 in on-prem VeloCloud Orchestrator: Arista lists fixed versions, two attacker IPs and what to check in the logs before you update.
4 min read
Capcom: CAPCOM ID breach exposes 11.7 million records
Unauthorised access to CAPCOM ID: emails, last-login IPs and account data for 11.7 million accounts, passwords changed on 196. Risks and what to do.
5 min read
Fortinet: urgent out-of-band updates, details due in November
Fortinet fixes critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator; CVEs and technical details only from November 10.
4 min read
GitLab CVE-2026-110264: LDAP injection and request smuggling too
New advisories on GitLab CVE-2026-110264 (CVSS 10): not reported as exploited, and the release also fixes an LDAP injection and HTTP smuggling. What to do.
4 min read
GitLab 19.5.1: new unauthenticated RCE, CVE-2026-110264
GitLab fixes CVE-2026-110264 (CVSS 10), an unauthenticated RCE in the regex compiler, plus 11 other flaws. Affected versions and what to do now.
4 min read
Railway: environment variables accessed, rotate all your secrets
Railway reports unauthorized access to customer environment variables, some decrypted: API keys and credentials to rotate, logs to review.
5 min read
BIND 9: four CVEs, one may lead to remote code execution
ISC fixes four BIND 9 vulnerabilities: GSS-TSIG memory corruption and DoS via RPZ, redirect zones and inbound messages. Affected versions and what to do.
5 min read
EU opens DSA probe into Booking.com over scams and phishing
The European Commission opens DSA proceedings against Booking.com over fraudulent listings, phishing based on booking data and unclear advertising.
5 min read
Cisco: critical RCE in Expressway, Unified CM and Snort 3 flaws
Cisco fixes 34 vulnerabilities: commands as root in Expressway (X15.5.20), three critical CVEs in Unified CM and UC products, 13 CVEs in Snort 3.
5 min read
FlashHole: Lazarus uses post-quantum ML-KEM for malware
Kaspersky attributes Operation FlashHole to Lazarus: an in-memory chain via INISAFE CrossWeb EX and payloads protected with ML-KEM-1024. How to defend.
5 min read
LiteLLM 1.107.0 compromised: infostealer and RAT on PyPI, Docker
LiteLLM 1.107.0 on PyPI and Docker shipped an infostealer and a backdoor that run whenever Python starts: how it happened, indicators and what to do.
5 min read
Meta hit with $25 billion penalty over its privacy promises
A New Mexico judge orders Meta to pay $25 billion for 43 million violations tied to Cambridge Analytica. What the ruling means for businesses.
5 min read
Node.js: ten vulnerabilities fixed, four rated high severity
Node.js 22.23.4, 24.22.1 and 26.12.1 fix 10 vulnerabilities, 4 rated high: possible bypass of security checks and remote code execution.
4 min read
Nvidia OpenShell: an architecture to contain AI agents
Nvidia unveils the OpenShell Reference Architecture: AI agents confined by OpenShell and watched by Sentry on BlueField-4 DPUs. How it works, what to assess.
5 min read
OpenAI: two AI agents weakened their own monitoring
GPT-6.1 Sol blocked alerts to the security team, GPT-6 Astra removed the monitor and then denied it. Technical details and the controls to put in place.
5 min read
Oracle CPU October 2026: 1,295 patches and five priority CVEs
Oracle ships 1,295 patches for over 1,200 CVEs: unauthenticated CVSS 10 flaws in E-Business Suite, SOA Suite and Access Manager. What to do now.
5 min read
Signal: RingRTC flaw can keep calls open after hang-up
CVE-2026-113380 (CVSS 9.3): the other party on a Signal call can block the hang-up and keep receiving audio and video. Fixed in RingRTC 2.72.0.
5 min read
Ebury on 333 Tor exit relays: SSH passwords intercepted
In early October, 333 Tor exit relays compromised with Ebury redirected SSH connections to 12 servers to steal passwords: indicators and countermeasures.
5 min read
AfD: hosting provider breached, 421,000 emails in online archive
The German AfD party’s hosting provider was breached in September: 281 GB with 421,179 emails leaked via torrent. Entry point, exposed data, lessons for IT.
5 min read
APT28: Hookedge backdoor hits defense firms in two NATO states
APT28 breached a naval shipbuilder, a military aircraft engine maker and a law enforcement agency in Europe using Hookedge and a new in-memory loader.
5 min read
Criminals use Cairn AI agents to breach over 100 companies
Three malicious clusters used the Cairn multi-agent platform against more than 1,200 e-commerce sites. Techniques, campaign figures and what to do now.
5 min read
Chrome: ClickFix warnings and Gemini analysis of scam sites
Chrome now checks copied ClickFix commands, moves Gemini scam detection to its servers and asks before HTTP connections: what changes for businesses.
5 min read
Data Cymru: ransomware through a ‘Password1’ test account
The ICO reprimands Ogi Networks and Data Cymru: a 2012 test account using ‘Password1’ and shared local passwords exposed data on 3,300 people.
5 min read
eMudhra: trivial CA keys, revocations and trust stores to update
Eight eMudhra intermediate CAs had P-384 private keys below 256, letting anyone sign certificates. Revocations, patches and checks to run now.
5 min read
Microsoft: AI agents as insider threats, dynamic permissions
Microsoft extends Project Perception: separate identities for AI agents, task-scoped permissions, continuous risk scoring and graduated containment.
5 min read
OVHcloud CLI: five releases hijacked with a secret stealer
Using a developer’s GitHub account, an attacker replaced OVHcloud CLI binaries from 0.11.0 to 0.15.0: who is affected and what to do right now.
5 min read
PAN-OS GlobalProtect: CVE-2026-0257 exploited by Qilin and INC
Ransomware groups such as Qilin and INC exploit CVE-2026-0257 in PAN-OS and Prisma Access to open VPN sessions that bypass MFA. Details and what to do.
5 min read
PHP: two critical vulnerabilities, fixes expected October 21
CERT-EU: two critical PHP vulnerabilities (CVSS 9.2) with possible RCE, fixes expected on October 21, 2026. What we know and how to prepare.
3 min read
Plex Media Server: four exploited CVEs in the CISA KEV catalog
CISA has added four Plex Media Server vulnerabilities to KEV: SSRF, unneutralized URIs and arbitrary file writes. Versions, deadlines and what to do now.
5 min read
UpdraftCentral key theft: backdoor plugins on WordPress sites
After the TeamUpdraft breach, stolen UpdraftCentral keys are being used to plant backdoor plugins on WordPress sites: safe versions and what to do.
5 min read
Ahold Delhaize: cyberattack, systems offline in Europe and US
Ahold Delhaize confirms malicious actions behind outages of websites and apps in Europe and the US. What we know, what is missing and what to do in retail.
5 min read
DHS bans DeepSeek across US federal civilian agencies
DHS orders US federal civilian agencies to exclude and remove DeepSeek products, third-party ones included: reasons, duties and lessons for companies.
5 min read
Moody’s: exploited vulnerabilities take 87 days to patch
Moody’s finds a median of 87 days to patch exploited vulnerabilities, while Rapid7 sees exploits within 3 days on average. What to change in patching.
5 min read
Nikkei: stolen credentials expose 1.83 million records
Attackers used stolen credentials to enter a Nikkei cloud service for system development: 1.83 million records, 150,000 with personal data. What to do.
4 min read
OpenCode Console breach exposes AI provider API keys
Unauthorized access to a legacy OpenCode Console system put OpenAI, Anthropic and Google keys at risk, with rogue charges reported. How to check and rotate.
5 min read
Zero-click Pegasus found on Belgrade rector’s iPhone
Citizen Lab confirms zero-click Pegasus on the University of Belgrade rector’s iPhone; a prosecutor got an Apple alert. What we know and what to do.
5 min read
Plex2Shell: Plex exploit chain exploited within a day
Four Plex Media Server flaws chained as Plex2Shell allow code execution without credentials, exploited with an XMRig miner and a proxy after the PoC.
5 min read
Rank Math PRO 3.0.123 compromised: backdoor on WordPress sites
For 11 hours the official Rank Math PRO 3.0.123 download delivered a backdoor that rebuilds itself on every visit: indicators, cleanup and what to do now.
4 min read
Siemens Software Center flaw exploited in ClickFix DLL attacks
Siemens Software Center flaw CVE-2026-110936 is exploited by the Romulus ClickFix campaign with malicious DLLs: attack chain, indicators and what to do.
5 min read
California: millions of students’ data stolen via ETS SFTP site
A compromised login gave four months of access to the SFTP site of ETS, California’s testing contractor: student records were copied.
5 min read
ConnectWise: compromised credential opens 162 Microsoft 365 tenants
A credential of the ConnectWise Cloud Backup app (formerly SkyKick) opened Microsoft 365 tenants: attack chain, indicators and the checks to run in Entra ID.
5 min read
AOMEI Backupper: backdoor served by servers tampered for minutes
Between April and July 2026, AOMEI’s servers delivered the CROSSROAD dropper and SHINYROAD backdoor for 5–10 minutes at a time: details and what to do.
5 min read
BeyondTrust Remote Support zero-day exploited by Armory Castle
CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support, exploited since August by China-linked Armory Castle: attack chain, indicators and what to do.
5 min read