Cyber Security
Application Security
GitLab Patches CVSS 10.0 Unauthenticated RCE Flaw CVE-2026-110264
GitLab fixed CVE-2026-110264, a CVSS 10.0 regex flaw in Onigmo that can let unauthenticated users run code on self-managed servers back to version 7.0.
CVE Vulnerability Alerts
Arista Patches Exploited VeloCloud Orchestrator Zero-Day
Arista fixed CVE-2026-114625, a CVSS 9.9 SQL injection in VeloCloud Orchestrator that it says is exploited, letting low-privilege users gain operator access.
Cybersecurity
eMudhra Exits TLS Business as Chrome and Oracle Distrust Its Keys
eMudhra will leave the global TLS certificate business, Chrome will distrust its ECC G3 root on October 27, and Oracle issued a Java alert for ...
CVE Vulnerability Alerts
Okta Patches Four Access Gateway Flaws Including CVSS 9.1 Bug
Okta fixed four Access Gateway vulnerabilities in three advisories, including CVE-2026-115547, a CVSS 9.1 command execution flaw in the Admin Console.
CVE Vulnerability Alerts
ZDI Posts Unpatched Linux KSMBD RCE Flaws to Public Mailing Lists
Trend Micro's ZDI posted two unpatched CVSS 9.0 Linux KSMBD flaws to public kernel mailing lists, with no mainline fix available and no CVE IDs ...
CVE Vulnerability Alerts
CISA Warns of Nine Kiloview E3 Encoder Flaws, Two at CVSS 9.9
CISA advisory ICSA-26-295-01 covers nine Kiloview E3 NDI encoder flaws, including two CVSS 9.9 command injections that give root; firmware V1.30 fixes them.
CVE Vulnerability Alerts
HPE Patches 72 Aruba AOS-8 and AOS-10 Flaws, Eight at CVSS 10.0
HPE advisory HPESBNW05162 fixes 72 vulnerabilities in Aruba AOS-8 and AOS-10 wireless products, including 34 critical flaws and eight rated CVSS 10.0.
Cybersecurity
Railway Says Intruder May Have Decrypted Customer Secrets
Railway detected anomalous activity on systems storing customer environment variables and urged all users to rotate secrets; crypto wallet thefts were reported.
Cybersecurity
INTERPOL Operation Serengeti III Nets 1,462 Arrests in Africa
INTERPOL's Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million across African countries.
Application Security
Node.js Security Releases Fix Brotli Out-of-Bounds Write Flaw
Node.js shipped fixes for 10 flaws, led by a Brotli decoder out-of-bounds write that could allow code execution; a public PoC hit RCE only on ...
Cybersecurity
Onamae Desktop Cloud Hacked; Malware on Up to 26,739 Servers
GMO Internet Group says an intruder planted malicious programs on up to 26,739 Onamae.com Desktop Cloud servers in Japan and has shut the service down.
Cybersecurity
Columbia, South Carolina Takes Systems Offline After Cyberattack
Columbia, South Carolina took city systems offline after suspicious activity; SLED leads the probe and the city has not said whether ransomware is involved.
CVE Vulnerability Alerts
FoxIO QPACK Flaws Crash HTTP/3 Servers via 4,000x Amplification
FoxIO found QPACK header decompression flaws in seven of ten HTTP/3 stacks; one unauthenticated connection can exhaust memory with up to 4,000x amplification.
AI Security
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
Attackers slipped a credential stealer and remote access trojan into LiteLLM 1.107.0, a package with 23 million weekly downloads, before PyPI quarantined it.
Cybersecurity
Microsoft Ties ConnectWise Backup Attack to China-Aligned Storm-0940
Microsoft ties the ConnectWise Cloud Backup compromise to Storm-0940, which used an AI pentest tool called ARTEX against more than 2,250 Microsoft 365 tenants.
Application Security
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
PHP released emergency fixes for two CVSS 9.2 flaws after details leaked early, and researchers saw exploitation attempts before and during the patch release.
Application Security
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
A CVSS 9.3 denial-of-service flaw in Signal's RingRTC library can leave a microphone and camera live after hangup. A fix shipped in version 2.72.0 in ...
AI Security
Exposed Servers Reveal INC and Gentlemen Ransomware AI Operations
SOCRadar found seven exposed servers tied to INC and The Gentlemen ransomware affiliates, holding AI chat logs, encryptor builds, credentials and 62 victims.
Cybersecurity
WhiteArmour Claims Breach of Disney Staff Directory
A hacker group called WhiteArmour says it holds Disney's internal staff directory and posted a sample of nearly 2,800 records. Disney has not commented.
Application Security
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
Google's Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is reported.
Cybersecurity
Binance Loses About $6.3 Billion in Record Crypto Heist
TOP CYBERSECURITY HEADLINES
CVE Vulnerability Alerts
Cisco Patches Exploited ASA/FTD VPN Zero-Day CVE-2026-76418
Application Security
Polymarket Halts Trading After Hacked DebugBear Script Drains Wallets
Cybersecurity
Cyberattack Knocks Belgium’s MyMinfin Tax Portal Offline
Application Security
TeamViewer Flaw CVE-2026-111585 Lets Hosts Hijack Technicians
This Week’s Security Spotlight
Cybersecurity
Binance Loses About $6.3 Billion in Record Crypto Heist
Application Security
NVIDIA Patches CVSS 10.0 Authentication Flaw in NeMo Toolkit
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Okta Patches Four Access Gateway Flaws Including CVSS 9.1 Bug
Okta fixed four Access Gateway vulnerabilities in three advisories, including CVE-2026-115547, a CVSS 9.1 command execution flaw in the Admin Console.
ZDI Posts Unpatched Linux KSMBD RCE Flaws to Public Mailing Lists
Trend Micro's ZDI posted two unpatched CVSS 9.0 Linux KSMBD flaws to public kernel mailing lists, with no mainline fix available and no CVE IDs ...
CISA Warns of Nine Kiloview E3 Encoder Flaws, Two at CVSS 9.9
CISA advisory ICSA-26-295-01 covers nine Kiloview E3 NDI encoder flaws, including two CVSS 9.9 command injections that give root; firmware V1.30 fixes them.
HPE Patches 72 Aruba AOS-8 and AOS-10 Flaws, Eight at CVSS 10.0
HPE advisory HPESBNW05162 fixes 72 vulnerabilities in Aruba AOS-8 and AOS-10 wireless products, including 34 critical flaws and eight rated CVSS 10.0.
Railway Says Intruder May Have Decrypted Customer Secrets
Railway detected anomalous activity on systems storing customer environment variables and urged all users to rotate secrets; crypto wallet thefts were reported.
INTERPOL Operation Serengeti III Nets 1,462 Arrests in Africa
INTERPOL's Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million across African countries.
Node.js Security Releases Fix Brotli Out-of-Bounds Write Flaw
Node.js shipped fixes for 10 flaws, led by a Brotli decoder out-of-bounds write that could allow code execution; a public PoC hit RCE only on ...
Onamae Desktop Cloud Hacked; Malware on Up to 26,739 Servers
GMO Internet Group says an intruder planted malicious programs on up to 26,739 Onamae.com Desktop Cloud servers in Japan and has shut the service down.
Columbia, South Carolina Takes Systems Offline After Cyberattack
Columbia, South Carolina took city systems offline after suspicious activity; SLED leads the probe and the city has not said whether ransomware is involved.
FoxIO QPACK Flaws Crash HTTP/3 Servers via 4,000x Amplification
FoxIO found QPACK header decompression flaws in seven of ten HTTP/3 stacks; one unauthenticated connection can exhaust memory with up to 4,000x amplification.
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
Attackers slipped a credential stealer and remote access trojan into LiteLLM 1.107.0, a package with 23 million weekly downloads, before PyPI quarantined it.
Microsoft Ties ConnectWise Backup Attack to China-Aligned Storm-0940
Microsoft ties the ConnectWise Cloud Backup compromise to Storm-0940, which used an AI pentest tool called ARTEX against more than 2,250 Microsoft 365 tenants.
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
PHP released emergency fixes for two CVSS 9.2 flaws after details leaked early, and researchers saw exploitation attempts before and during the patch release.
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
A CVSS 9.3 denial-of-service flaw in Signal's RingRTC library can leave a microphone and camera live after hangup. A fix shipped in version 2.72.0 in ...
Exposed Servers Reveal INC and Gentlemen Ransomware AI Operations
SOCRadar found seven exposed servers tied to INC and The Gentlemen ransomware affiliates, holding AI chat logs, encryptor builds, credentials and 62 victims.
WhiteArmour Claims Breach of Disney Staff Directory
A hacker group called WhiteArmour says it holds Disney's internal staff directory and posted a sample of nearly 2,800 records. Disney has not commented.
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
Google's Chrome 156 fixes 353 vulnerabilities, including six critical and 61 high-severity flaws, mostly memory safety bugs. No exploitation is reported.
PHP Warns of Two Critical RCE Flaws as Embargoed Details Leak
PHP pre-announced emergency patches for two CVSS 9.2 remote code execution flaws after embargoed details leaked, raising fears of mass exploitation soon.
DHS Orders Federal Civilian Agencies to Remove DeepSeek Products
A DHS order under the FASCSA directs US federal civilian agencies to remove DeepSeek products and bars new purchases, citing data access risks tied to ...
Feds Suspect Ransom Negotiator Helped Run ShinyHunters Leak Site
US investigators reportedly suspect executives at two ransomware negotiation firms had close ties to ShinyHunters, and one helped run its extortion site.