News

What the cybersecurity press and forums are saying · updated
From the press
SecurityWeek ·

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. The post Iran’s Prince of Persia APT Hosts C&C in US for First Time…
Help Net Security ·

Google opens its cloud to rival OpenAI, promises business data won’t train models

Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna. Google…
The Register - Security ·

Windows said modem worked fine. That unmistakable scorched electronics smell suggested otherwise

Catching lightning in a tech support bottle
Dark Reading ·

State Bank of India Suffers a Customer PII Data Leak

Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII.
The Hacker News ·

The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat

Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching.…
The Record from Recorded Future News ·

Toronto crime tips org freezes operations after details of data breach come to light

Late Wednesday night the Toronto chapter of Crime Stoppers broke ranks with the national association, revealing a timeline showing what it knew and when along with an announcement that it will pause…
CyberScoop ·

Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber

One of the bill’s sponsors told CyberScoop it’s “incredibly expensive” for U.S. AI companies to stay ahead and distillation attacks incentivize stealing over innovation. The post Exclusive:…
BleepingComputer, Security ·

Railway warns devs to rotate secrets after potential breach

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...]
HIPAA Journal, Healthcare Data Breach ·

Ridgeway Pharmacy Data Breach Affects 259,000 Individuals

A data breach at Ridgeway Pharmacy in Montana has affected almost 259,000 individuals. Data breaches have also been announced by […] The post Ridgeway Pharmacy Data Breach Affects 259,000 Individuals…
SecurityWeek ·

Hacker Conversations: Corey Thuen and the Evil Bit

Corey Thuen hires hackers for what he calls ‘the evil bit’ — an adversarial streak he believes is either there or it isn’t. The post Hacker Conversations: Corey Thuen and the Evil Bit appeared first…
Help Net Security ·

Drone program compliance: What a CTO says most agencies get wrong

In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most…
The Register - Security ·

PHP2Shell exploit bypasses protections designed to stop remote code execution

“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.
Dark Reading ·

Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack

The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.
The Hacker News ·

Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on…
The Record from Recorded Future News ·

Indian tech company eMudhra announces withdrawal from certificate business after security incident

The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.
CyberScoop ·

eMudhra kills its certificate business after researchers cracked its private keys in under a second

The private keys were so weak they could be guessed in under a second — and one of them was just the number 4. The post eMudhra kills its certificate business after researchers cracked its private…
BleepingComputer, Security ·

Capcom confirms data breach affecting 11.7 million accounts

Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. [...]
HIPAA Journal, Healthcare Data Breach ·

Innovative Renal Care Pays $900,000 to Settle Data Breach Litigation

American Renal Management LLC, doing business as Innovative Renal Care, a kidney care specialist with more than 200 locations in […] The post Innovative Renal Care Pays $900,000 to Settle Data Breach…
SecurityWeek ·

Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform

The Amsterdam-based company plans to use the funding for research and development and commercial expansion in Europe and the Middle East. The post Indurex Raises $8 Million to Expand Industrial…
Help Net Security ·

AI is taking cybersecurity jobs at junior and experienced levels alike

Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda’s Cybersecurity Skills Gap Report. 56%…
The Register - Security ·

Human receives AI-designed virus for the first time

Not to kill the human, of course – to kill the antibiotic-resistant bacteria causing their infection
Dark Reading ·

What We Missed: Feds Lasso Texas Laptop Farms

In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in "Operation Lonestar Justice" to Staples' gift…
The Hacker News ·

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported…
The Record from Recorded Future News ·

Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents

A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to…
BleepingComputer, Security ·

LiteLLM release pipeline hacked to distribute info-stealer malware

Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...]
HIPAA Journal, Healthcare Data Breach ·

HHS Confirms HIPAA Penalties Will Not Be Adjusted for Inflation This Year

This week, the Department of Health and Human Services (HHS) has confirmed via the Federal Register that it will not […] The post HHS Confirms HIPAA Penalties Will Not Be Adjusted for Inflation This…
SecurityWeek ·

Signal Vulnerability Lets Malicious Callers Block Hang-Ups

Affecting the open source calling library RingRTC, the bug prevented calls from ending properly. The post Signal Vulnerability Lets Malicious Callers Block Hang-Ups appeared first on SecurityWeek .
Help Net Security ·

New infosec products of the week: October 23, 2026

Here’s a look at the most interesting products from the past week, featuring releases from AppGate, IDENTOS, Sweet Security, and ThreatModeler. Sweet Security adds one-click protection for vulnerable…
The Register - Security ·

Backdoored robot tries its hand at finger chopping and cat cooking

No actual digits or cats were harmed beyond the number crunching that went into this LLM poisoning experiment
Dark Reading ·

Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour

Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de…
The Hacker News ·

ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and…
The Record from Recorded Future News ·

Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized

More than 1,400 suspected cybercriminals were arrested across Africa this summer as part of a crackdown on the gangs perpetrating online fraud, ransomware and business email compromise attacks,…
BleepingComputer, Security ·

Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
HIPAA Journal, Healthcare Data Breach ·

Massachusetts AG Settles HIPAA & MassHealth Fraud Allegations with Transformative Healthcare

The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and […] The post Massachusetts AG Settles HIPAA &…
SecurityWeek ·

Tech and Security Companies Respond to PHP2Shell Vulnerabilities

Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching. The post Tech and Security Companies Respond to PHP2Shell…
Help Net Security ·

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials

A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who…
The Register - Security ·

Max-severity GitLab bug allows remote code execution over 12 years of releases

Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'
The Hacker News ·

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the…
The Record from Recorded Future News ·

South Carolina officials offer assistance after state capital hit with cyberattack

The systems impacted by the attack include the MyColaSC platform that citizens use to pay utility bills, report non-emergency issues and access other city services.
BleepingComputer, Security ·

Microsoft shares how to fix broken Exchange Online EWS apps

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...]
Help Net Security ·

OpenAI’s coding agents talked themselves out of being monitored

Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it had done no such thing. OpenAI disclosed both…
The Register - Security ·

Disgraced Indian cert issuer leaves the cert issuing business

We didn't want to issue SSL/TLS certs anyway, Indian firm suggests after one private key turns out to be the number 4
The Hacker News ·

Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge Analytica data…
Help Net Security ·

New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619

Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on…
The Register - Security ·

PHP2Shell puts dozens of UK government services out of service

Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise
The Hacker News ·

INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown

INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law…
Help Net Security ·

Fingerprint uses AI coding tools to automate fraud detection setup

Fingerprint has announced Agentic Installation, the AI-powered onboarding path for companies to deploy device intelligence to their websites or apps in minutes to detect and stop fraud. By running a…
The Register - Security ·

Apple App Store review process hits a traffic jam

Apple log jam? Apple fast lane pie-lup? We're here all week, on stage... sweeping it
The Hacker News ·

Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation

Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found…
On the forums
Disgraced eMudhra drops out of TLS business after using cert private key of 4
r/cybersecurity · 312 · 44 News - General
Do all MSPs micromanage like this?
r/sysadmin · 105 · 134
The Art of the Deal: Jared Kushner’s Hacked Phone Revealed His Secret…
r/hacking · 1168 · 29 News
Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web
r/netsec · 241 · 34
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
r/cybersecurity · 491 · 72 New Vulnerability Disclosure
eMudhra to Exit global SSL/TLS Certificate Business
r/sysadmin · 782 · 190 General Discussion
Are these all hacks or are they exploiting vulnerabilities? Can anyone explain the impact of what is happening?
r/hacking · 202 · 32
Someone Knew About PHP's Critical Flaws Four Days Before the Public Did and Amazon Can't Explain How
r/cybersecurity · 897 · 95 News - Breaches & Ransoms
Adding fuel to this weeks fire, several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List
r/sysadmin · 589 · 92 Linux
Re: No, there is an easy way to exploit this vulnerability
r/hacking · 259 · 25 AI
Support to all those university sysadmins renewing eMudhra certs this weekend
r/sysadmin · 241 · 59
Headlines and pictures belong to their publishers and link to them.