Cyber Security
CVE Vulnerability Alerts
CISA Warns of Nine Kiloview E3 Encoder Flaws, Two at CVSS 9.9
CISA advisory ICSA-26-295-01 covers nine Kiloview E3 NDI encoder flaws, including two CVSS 9.9 command injections that give root; firmware V1.30 fixes them.
CVE Vulnerability Alerts
HPE Patches 72 Aruba AOS-8 and AOS-10 Flaws, Eight at CVSS 10.0
HPE advisory HPESBNW05162 fixes 72 vulnerabilities in Aruba AOS-8 and AOS-10 wireless products, including 34 critical flaws and eight rated CVSS 10.0.
Cybersecurity
Railway Says Intruder May Have Decrypted Customer Secrets
Railway detected anomalous activity on systems storing customer environment variables and urged all users to rotate secrets; crypto wallet thefts were reported.
Cybersecurity
INTERPOL Operation Serengeti III Nets 1,462 Arrests in Africa
INTERPOL's Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million across African countries.
Application Security
Node.js Security Releases Fix Brotli Out-of-Bounds Write Flaw
Node.js shipped fixes for 10 flaws, led by a Brotli decoder out-of-bounds write that could allow code execution; a public PoC hit RCE only on ...
Cybersecurity
Onamae Desktop Cloud Hacked; Malware on Up to 26,739 Servers
GMO Internet Group says an intruder planted malicious programs on up to 26,739 Onamae.com Desktop Cloud servers in Japan and has shut the service down.
Cybersecurity
Columbia, South Carolina Takes Systems Offline After Cyberattack
Columbia, South Carolina took city systems offline after suspicious activity; SLED leads the probe and the city has not said whether ransomware is involved.
CVE Vulnerability Alerts
FoxIO QPACK Flaws Crash HTTP/3 Servers via 4,000x Amplification
FoxIO found QPACK header decompression flaws in seven of ten HTTP/3 stacks; one unauthenticated connection can exhaust memory with up to 4,000x amplification.
AI Security
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
Attackers slipped a credential stealer and remote access trojan into LiteLLM 1.107.0, a package with 23 million weekly downloads, before PyPI quarantined it.
Cybersecurity
Microsoft Ties ConnectWise Backup Attack to China-Aligned Storm-0940
Microsoft ties the ConnectWise Cloud Backup compromise to Storm-0940, which used an AI pentest tool called ARTEX against more than 2,250 Microsoft 365 tenants.
Application Security
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
PHP released emergency fixes for two CVSS 9.2 flaws after details leaked early, and researchers saw exploitation attempts before and during the patch release.
Application Security
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
A CVSS 9.3 denial-of-service flaw in Signal's RingRTC library can leave a microphone and camera live after hangup. A fix shipped in version 2.72.0 in ...
AI Security
Exposed Servers Reveal INC and Gentlemen Ransomware AI Operations
SOCRadar found seven exposed servers tied to INC and The Gentlemen ransomware affiliates, holding AI chat logs, encryptor builds, credentials and 62 victims.
Cybersecurity
WhiteArmour Claims Breach of Disney Staff Directory
A hacker group called WhiteArmour says it holds Disney's internal staff directory and posted a sample of nearly 2,800 records. Disney has not commented.
Application Security
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
Google's Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is reported.
Application Security
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass exploitation soon.
Cybersecurity
DHS Orders Federal Civilian Agencies to Remove DeepSeek Products
A DHS order under the FASCSA directs US federal civilian agencies to remove DeepSeek products and bars new purchases, citing data access risks tied to ...
Cybersecurity
Feds Suspect Ransom Negotiator Helped Run ShinyHunters Leak Site
US investigators reportedly suspect executives at two ransomware negotiation firms had close ties to ShinyHunters, and one helped run its extortion site.
Cybersecurity
23andMe Successor Settles With California for $6M Over Breach
Chrome Holding Company, formerly 23andMe, will pay California $6 million over a 2023 breach that exposed data on nearly 7 million people, pending approval.
Cybersecurity
ICO Reprimands Welsh Bodies After ‘Password1’ Account Breach
The UK ICO reprimanded Data Cymru and Ogi Networks after a test account with the password Password1 let ransomware hit data on 3,300 people, mostly ...
CVE Vulnerability Alerts
PHP2Shell Attacks on Check Point Gateways Deploy TSGA, ESXi Wiper
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Citrix Patches 28 NetScaler Flaws and Critical Console Auth Bypass
This Week’s Security Spotlight
CVE Vulnerability Alerts
Barracuda Flaws CVE-2026-116606 and CVE-2026-111560 Exploited
CVE Vulnerability Alerts
Intel and AMD Patch Over 200 Vulnerabilities in November Updates
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
INTERPOL Operation Serengeti III Nets 1,462 Arrests in Africa
INTERPOL's Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million across African countries.
Node.js Security Releases Fix Brotli Out-of-Bounds Write Flaw
Node.js shipped fixes for 10 flaws, led by a Brotli decoder out-of-bounds write that could allow code execution; a public PoC hit RCE only on ...
Onamae Desktop Cloud Hacked; Malware on Up to 26,739 Servers
GMO Internet Group says an intruder planted malicious programs on up to 26,739 Onamae.com Desktop Cloud servers in Japan and has shut the service down.
Columbia, South Carolina Takes Systems Offline After Cyberattack
Columbia, South Carolina took city systems offline after suspicious activity; SLED leads the probe and the city has not said whether ransomware is involved.
FoxIO QPACK Flaws Crash HTTP/3 Servers via 4,000x Amplification
FoxIO found QPACK header decompression flaws in seven of ten HTTP/3 stacks; one unauthenticated connection can exhaust memory with up to 4,000x amplification.
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
Attackers slipped a credential stealer and remote access trojan into LiteLLM 1.107.0, a package with 23 million weekly downloads, before PyPI quarantined it.
Microsoft Ties ConnectWise Backup Attack to China-Aligned Storm-0940
Microsoft ties the ConnectWise Cloud Backup compromise to Storm-0940, which used an AI pentest tool called ARTEX against more than 2,250 Microsoft 365 tenants.
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
PHP released emergency fixes for two CVSS 9.2 flaws after details leaked early, and researchers saw exploitation attempts before and during the patch release.
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
A CVSS 9.3 denial-of-service flaw in Signal's RingRTC library can leave a microphone and camera live after hangup. A fix shipped in version 2.72.0 in ...
Exposed Servers Reveal INC and Gentlemen Ransomware AI Operations
SOCRadar found seven exposed servers tied to INC and The Gentlemen ransomware affiliates, holding AI chat logs, encryptor builds, credentials and 62 victims.
WhiteArmour Claims Breach of Disney Staff Directory
A hacker group called WhiteArmour says it holds Disney's internal staff directory and posted a sample of nearly 2,800 records. Disney has not commented.
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
Google's Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is reported.
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass exploitation soon.
DHS Orders Federal Civilian Agencies to Remove DeepSeek Products
A DHS order under the FASCSA directs US federal civilian agencies to remove DeepSeek products and bars new purchases, citing data access risks tied to ...
Feds Suspect Ransom Negotiator Helped Run ShinyHunters Leak Site
US investigators reportedly suspect executives at two ransomware negotiation firms had close ties to ShinyHunters, and one helped run its extortion site.
23andMe Successor Settles With California for $6M Over Breach
Chrome Holding Company, formerly 23andMe, will pay California $6 million over a 2023 breach that exposed data on nearly 7 million people, pending approval.
ICO Reprimands Welsh Bodies After ‘Password1’ Account Breach
The UK ICO reprimanded Data Cymru and Ogi Networks after a test account with the password Password1 let ransomware hit data on 3,300 people, mostly ...
Mozilla, Google, Apple Block Eight Weak eMudhra CA Keys
Eight eMudhra CA intermediate keys were so weak they could be computed, so Mozilla, Google, Apple and Go blocked them and eMudhra revoked the certificates.
Hacker Claims NBCUniversal Production and Tax-Credit Data Theft
An unverified claim on a hacker marketplace says NBCUniversal production plans, budgets and tax-credit applications were stolen; the company has not confirmed.
Hijacked Account Plants Stealer in Five OVHcloud CLI Releases
An attacker used a hijacked contributor GitHub account to swap secret-stealing builds into five OVHcloud CLI releases for about 94 minutes before detection.