Siemens confirmed attackers exploited CVE-2026-110936 in Software Center, bundling a signed copy with malicious DLLs in the ROMULUS ClickFix campaign.
Laravel disclosed a critical TokenGuard authentication bypass rated CVSS 9.2 that affects MySQL and MariaDB apps, plus a moderate data-loss
Roundcube released 1.6.20 and 1.7.5 to fix 20 flaws, including IMAP command injection, header injection, XSS, SSRF and CSRF; no
Citizen Lab confirmed NSO Group’s Pegasus spyware on the phone of Belgrade university rector Vladan Djokic days before Serbia’s October
NorForge says a Chinese-speaking operator used autonomous AI agents to compromise more than 100 e-commerce sites, including Deere, SharkNinja and
Parkview Health took its network offline over suspicious activity, knocking out MyChart across Indiana and Ohio. The cause is not
Attackers began exploiting the Plex2Shell chain of four CVEs in Plex Media Server a day after a public proof-of-concept, dropping
Microsoft confirmed October Windows Server updates cause OWA sign-in failures and stuck mail on on-premises Exchange servers; a fix is
An intruder reached a legacy OpenCode system, possibly exposing OpenAI, Anthropic and Google API keys saved by 1.4% of Console
ConnectWise Cloud Backup and two linked services stay offline as Huntress confirms attackers signed in to 173 Microsoft 365 tenants
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.