Cyber Security
Application Security
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
Attackers slipped a credential stealer and remote access trojan into LiteLLM 1.107.0, a package with 23 million weekly downloads, before PyPI quarantined it.
Cybersecurity
Microsoft Ties ConnectWise Backup Attack to China-Aligned Storm-0940
Microsoft ties the ConnectWise Cloud Backup compromise to Storm-0940, which used an AI pentest tool called ARTEX against more than 2,250 Microsoft 365 tenants.
Application Security
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
PHP released emergency fixes for two CVSS 9.2 flaws after details leaked early, and researchers saw exploitation attempts before and during the patch release.
Application Security
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
A CVSS 9.3 denial-of-service flaw in Signal's RingRTC library can leave a microphone and camera live after hangup. A fix shipped in version 2.72.0 in ...
Cybersecurity
Exposed Servers Reveal INC and Gentlemen Ransomware AI Operations
SOCRadar found seven exposed servers tied to INC and The Gentlemen ransomware affiliates, holding AI chat logs, encryptor builds, credentials and 62 victims.
Cybersecurity
WhiteArmour Claims Breach of Disney Staff Directory
A hacker group called WhiteArmour says it holds Disney's internal staff directory and posted a sample of nearly 2,800 records. Disney has not commented.
Application Security
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
Google's Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is reported.
Application Security
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass exploitation soon.
Cybersecurity
DHS Orders Federal Civilian Agencies to Remove DeepSeek Products
A DHS order under the FASCSA directs US federal civilian agencies to remove DeepSeek products and bars new purchases, citing data access risks tied to ...
Cybersecurity
Feds Suspect Ransom Negotiator Helped Run ShinyHunters Leak Site
US investigators reportedly suspect executives at two ransomware negotiation firms had close ties to ShinyHunters, and one helped run its extortion site.
Cybersecurity
23andMe Successor Settles With California for $6M Over Breach
Chrome Holding Company, formerly 23andMe, will pay California $6 million over a 2023 breach that exposed data on nearly 7 million people, pending approval.
Cybersecurity
ICO Reprimands Welsh Bodies After ‘Password1’ Account Breach
The UK ICO reprimanded Data Cymru and Ogi Networks after a test account with the password Password1 let ransomware hit data on 3,300 people, mostly ...
Cybersecurity
Mozilla, Google, Apple Block Eight Weak eMudhra CA Keys
Eight eMudhra CA intermediate keys were so weak they could be computed, so Mozilla, Google, Apple and Go blocked them and eMudhra revoked the certificates.
Cybersecurity
Hacker Claims NBCUniversal Production and Tax-Credit Data Theft
An unverified claim on a hacker marketplace says NBCUniversal production plans, budgets and tax-credit applications were stolen; the company has not confirmed.
Application Security
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94 minutes before detection.
Cybersecurity
CISA, FBI Say SafePay Ransomware Has Hit 600+ Organizations
A joint advisory from CISA, FBI and partners says SafePay ransomware has breached at least 600 organizations since August 2024, many in critical infrastructure.
Application Security
Public Exploit Released for Critical FortiSIEM Flaw CVE-2026-106173
Horizon3.ai published a proof-of-concept for CVE-2026-106173, a CVSS 9.4 unauthenticated path traversal flaw in Fortinet FortiSIEM that leads to code execution.
Cybersecurity
State Bank of India Confirms Data Leak of 3,897 Customer Records
State Bank of India told stock exchanges it lost certain data after 3,897 customer records appeared on the dark web in a set of about ...
Cybersecurity
Conduent Agrees to $80M Settlement Over Breach of 62M People
Conduent will pay $80 million to settle a class action over a 2024 cyber incident that exposed personal and health data of about 62 million ...
Cybersecurity
Public Exploit Chains 37-Year-Old BSD Bug for OpenBSD Root
Calif published a working OpenBSD 7.9 root exploit chaining a 37-year-old integer overflow with a kernel flaw; syspatch errata 018 and 026 fix both bugs.
Application Security
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
Cybersecurity
WhiteArmour Claims Breach of Disney Staff Directory
TOP CYBERSECURITY HEADLINES
Application Security
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
Cybersecurity
WhiteArmour Claims Breach of Disney Staff Directory
Application Security
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
This Week’s Security Spotlight
Application Security
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
Application Security
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
A CVSS 9.3 denial-of-service flaw in Signal's RingRTC library can leave a microphone and camera live after hangup. A fix shipped in version 2.72.0 in ...
Exposed Servers Reveal INC and Gentlemen Ransomware AI Operations
SOCRadar found seven exposed servers tied to INC and The Gentlemen ransomware affiliates, holding AI chat logs, encryptor builds, credentials and 62 victims.
WhiteArmour Claims Breach of Disney Staff Directory
A hacker group called WhiteArmour says it holds Disney's internal staff directory and posted a sample of nearly 2,800 records. Disney has not commented.
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
Google's Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is reported.
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass exploitation soon.
DHS Orders Federal Civilian Agencies to Remove DeepSeek Products
A DHS order under the FASCSA directs US federal civilian agencies to remove DeepSeek products and bars new purchases, citing data access risks tied to ...
Feds Suspect Ransom Negotiator Helped Run ShinyHunters Leak Site
US investigators reportedly suspect executives at two ransomware negotiation firms had close ties to ShinyHunters, and one helped run its extortion site.
23andMe Successor Settles With California for $6M Over Breach
Chrome Holding Company, formerly 23andMe, will pay California $6 million over a 2023 breach that exposed data on nearly 7 million people, pending approval.
ICO Reprimands Welsh Bodies After ‘Password1’ Account Breach
The UK ICO reprimanded Data Cymru and Ogi Networks after a test account with the password Password1 let ransomware hit data on 3,300 people, mostly ...
Mozilla, Google, Apple Block Eight Weak eMudhra CA Keys
Eight eMudhra CA intermediate keys were so weak they could be computed, so Mozilla, Google, Apple and Go blocked them and eMudhra revoked the certificates.
Hacker Claims NBCUniversal Production and Tax-Credit Data Theft
An unverified claim on a hacker marketplace says NBCUniversal production plans, budgets and tax-credit applications were stolen; the company has not confirmed.
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94 minutes before detection.
CISA, FBI Say SafePay Ransomware Has Hit 600+ Organizations
A joint advisory from CISA, FBI and partners says SafePay ransomware has breached at least 600 organizations since August 2024, many in critical infrastructure.
Public Exploit Released for Critical FortiSIEM Flaw CVE-2026-106173
Horizon3.ai published a proof-of-concept for CVE-2026-106173, a CVSS 9.4 unauthenticated path traversal flaw in Fortinet FortiSIEM that leads to code execution.
State Bank of India Confirms Data Leak of 3,897 Customer Records
State Bank of India told stock exchanges it lost certain data after 3,897 customer records appeared on the dark web in a set of about ...
Conduent Agrees to $80M Settlement Over Breach of 62M People
Conduent will pay $80 million to settle a class action over a 2024 cyber incident that exposed personal and health data of about 62 million ...
Public Exploit Chains 37-Year-Old BSD Bug for OpenBSD Root
Calif published a working OpenBSD 7.9 root exploit chaining a 37-year-old integer overflow with a kernel flaw; syspatch errata 018 and 026 fix both bugs.
OpenCode Silently Patched Critical RCE Flaw With No CVE
Pillar Security says OpenCode fixed a critical MCP OAuth remote code execution flaw in version 1.18.33 without a CVE or advisory, hiding it from scanners.
Qilin, INC Ransomware Exploit PAN-OS Flaw, Then Pivot to VMware
Unit 42 says Qilin and INC ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA, then pivot from VPN gateways to VMware vCenter and ESXi ...
TeamUpdraft Breach Lets Attackers Backdoor WordPress Sites
Attackers who breached TeamUpdraft used stolen UpdraftCentral keys to plant backdoor plugins on WordPress sites, Patchstack found; fixed releases are out.