Cyber Security
Application Security
TeamUpdraft Breach Lets Attackers Backdoor WordPress Sites
Attackers who breached TeamUpdraft used stolen UpdraftCentral keys to plant backdoor plugins on WordPress sites, Patchstack found; fixed releases are out.
Application Security
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
Siemens confirmed attackers exploited CVE-2026-110936 in Software Center, bundling a signed copy with malicious DLLs in the ROMULUS ClickFix campaign.
Application Security
Laravel TokenGuard Flaw Lets Attackers Log In as Any User
Laravel disclosed a critical TokenGuard authentication bypass rated CVSS 9.2 that affects MySQL and MariaDB apps, plus a moderate data-loss flaw; patches exist.
Application Security
Roundcube 1.6.20 and 1.7.5 Fix 20 Flaws, Including IMAP Injection
Roundcube released 1.6.20 and 1.7.5 to fix 20 flaws, including IMAP command injection, header injection, XSS, SSRF and CSRF; no exploitation is confirmed.
Cybersecurity
Citizen Lab Confirms Pegasus on Belgrade Rector’s Phone Before Vote
Citizen Lab confirmed NSO Group's Pegasus spyware on the phone of Belgrade university rector Vladan Djokic days before Serbia's October 25 elections.
Application Security
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and Cummins.
Cybersecurity
Parkview Health Disables Network After Suspicious Activity
Parkview Health took its network offline over suspicious activity, knocking out MyChart across Indiana and Ohio. The cause is not confirmed as a cyberattack.
Application Security
Plex2Shell Exploit Chain Hits Plex Servers a Day After PoC Release
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping a cryptominer and proxy tool.
Application Security
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is still pending.
Cybersecurity
OpenCode Console Breach May Have Exposed Saved AI Provider API Keys
An intruder reached a legacy OpenCode system, possibly exposing OpenAI, Anthropic and Google API keys saved by 1.4% of Console users; some report charges.
Cybersecurity
ConnectWise Cloud Backup Stays Offline After 173 Tenants Hit
ConnectWise Cloud Backup and two linked services stay offline as Huntress confirms attackers signed in to 173 Microsoft 365 tenants with a stolen app secret.
Cybersecurity
Unpatched Broadcom WPS Flaw Lets Nearby Attackers Root Routers
Researcher Quentin Kaiser disclosed an unpatched Broadcom WPS flaw with no CVE that gives nearby attackers root code execution on millions of routers.
Application Security
Drupal Patches Two Critical RCE Flaws, Warns Exploits Could Follow
Drupal patched critical RCE flaws CVE-2026-108097 in Field UI and CVE-2026-108099 in Entity List, warning exploits may be built within just hours or days.
Application Security
Trojanized Rank Math SEO PRO 3.0.123 Backdoors WordPress Sites
Attackers tampered with Rank Math SEO PRO 3.0.123 packages, tracked as CVE-2026-111862, planting backdoors and stealing credentials from WordPress sites.
Application Security
Apache Fixes 12 Kylin Flaws, Including Critical SQL Injection
Apache disclosed 12 Kylin flaws, led by critical SQL injection CVE-2026-64959, and separately fixed Airflow SSH and SFTP providers that skipped host-key checks.
CVE Vulnerability Alerts
CISA Flags dcm4chee Archive Flaws and Unpatched EseeCloud Cameras
CISA's October 15 advisories cover nine flaws: six in the dcm4chee medical image archive and three in EseeCloud IP cameras that have no vendor fix.
CVE Vulnerability Alerts
Infinity Core Research Publishes Exploits for Six Linux Kernel Flaws
Researcher Hyunwoo Kim released working exploits for six Linux kernel bugs called Infinity Core, five of which give local root or container escape.
Cybersecurity
California Student Records Exposed in ETS SFTP Breach
Attackers used a compromised credential to sit inside an ETS SFTP site for nearly five months, exposing records of California public school students statewide.
Cybersecurity
Frontier Pays $625,000 to Connecticut Over 2024 Data Breach
Frontier Communications settled with Connecticut's attorney general for $625,000 over a 2024 breach that exposed Social Security numbers of 58,841 residents.
Cybersecurity
Interpol Operation in 17 Countries Leads to 95 Arrests
An Interpol-coordinated operation across 17 countries in Latin America and Europe led to 95 arrests and 127 search warrants against online child abuse networks.
Application Security
TeamUpdraft Breach Lets Attackers Backdoor WordPress Sites
TOP CYBERSECURITY HEADLINES
Application Security
Roundcube 1.6.20 and 1.7.5 Fix 20 Flaws, Including IMAP Injection
Application Security
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
This Week’s Security Spotlight
Application Security
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
Application Security
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
CVE Vulnerability Alerts
AWS Patches Critical Amazon Neptune Flaw Rated CVSS 9.9
CVE Vulnerability Alerts
Cisco Secure Email Gateway Zero-Day CVE-2026-76519 Exploited
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Roundcube 1.6.20 and 1.7.5 Fix 20 Flaws, Including IMAP Injection
Roundcube released 1.6.20 and 1.7.5 to fix 20 flaws, including IMAP command injection, header injection, XSS, SSRF and CSRF; no exploitation is confirmed.
Citizen Lab Confirms Pegasus on Belgrade Rector’s Phone Before Vote
Citizen Lab confirmed NSO Group's Pegasus spyware on the phone of Belgrade university rector Vladan Djokic days before Serbia's October 25 elections.
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and Cummins.
Parkview Health Disables Network After Suspicious Activity
Parkview Health took its network offline over suspicious activity, knocking out MyChart across Indiana and Ohio. The cause is not confirmed as a cyberattack.
Plex2Shell Exploit Chain Hits Plex Servers a Day After PoC Release
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping a cryptominer and proxy tool.
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is still pending.
OpenCode Console Breach May Have Exposed Saved AI Provider API Keys
An intruder reached a legacy OpenCode system, possibly exposing OpenAI, Anthropic and Google API keys saved by 1.4% of Console users; some report charges.
ConnectWise Cloud Backup Stays Offline After 173 Tenants Hit
ConnectWise Cloud Backup and two linked services stay offline as Huntress confirms attackers signed in to 173 Microsoft 365 tenants with a stolen app secret.
Unpatched Broadcom WPS Flaw Lets Nearby Attackers Root Routers
Researcher Quentin Kaiser disclosed an unpatched Broadcom WPS flaw with no CVE that gives nearby attackers root code execution on millions of routers.
Drupal Patches Two Critical RCE Flaws, Warns Exploits Could Follow
Drupal patched critical RCE flaws CVE-2026-108097 in Field UI and CVE-2026-108099 in Entity List, warning exploits may be built within just hours or days.
Trojanized Rank Math SEO PRO 3.0.123 Backdoors WordPress Sites
Attackers tampered with Rank Math SEO PRO 3.0.123 packages, tracked as CVE-2026-111862, planting backdoors and stealing credentials from WordPress sites.
Apache Fixes 12 Kylin Flaws, Including Critical SQL Injection
Apache disclosed 12 Kylin flaws, led by critical SQL injection CVE-2026-64959, and separately fixed Airflow SSH and SFTP providers that skipped host-key checks.
CISA Flags dcm4chee Archive Flaws and Unpatched EseeCloud Cameras
CISA's October 15 advisories cover nine flaws: six in the dcm4chee medical image archive and three in EseeCloud IP cameras that have no vendor fix.
Infinity Core Research Publishes Exploits for Six Linux Kernel Flaws
Researcher Hyunwoo Kim released working exploits for six Linux kernel bugs called Infinity Core, five of which give local root or container escape.
California Student Records Exposed in ETS SFTP Breach
Attackers used a compromised credential to sit inside an ETS SFTP site for nearly five months, exposing records of California public school students statewide.
Frontier Pays $625,000 to Connecticut Over 2024 Data Breach
Frontier Communications settled with Connecticut's attorney general for $625,000 over a 2024 breach that exposed Social Security numbers of 58,841 residents.
Interpol Operation in 17 Countries Leads to 95 Arrests
An Interpol-coordinated operation across 17 countries in Latin America and Europe led to 95 arrests and 127 search warrants against online child abuse networks.
Rhysida Lists Anne Arundel County Data for Sale at 25 Bitcoin
Rhysida is offering 2.6TB of data it says came from Anne Arundel County, Maryland, for 25 BTC; the county confirms an August 28 attack on ...
China-Linked Armory Castle Exploited BeyondTrust Zero-Day
BeyondTrust patched CVE-2026-102764, a Remote Support zero-day that China-nexus group Armory Castle exploited since late August, per Mandiant and Google.
BAE Systems Cyberattack Halts US Federal Bankruptcy Notices
A cyberattack on contractor BAE Systems took the Bankruptcy Noticing Center offline, halting notices for all US federal bankruptcy courts. No restoration date.