Cyber Security
Application Security
Nextcloud Collabora Flaw CVE-2026-110447 Exploited for Webshells
SecurityOnline reports attackers are exploiting CVE-2026-110447, a CVSS 9.2 command injection in Nextcloud's Collabora CODE app, to plant PHP webshells.
Cybersecurity
ShinyHunters Claims H&M Database Breach; Retailer Sees No Compromise
ShinyHunters claims it accessed H&M internal databases covering inventory and logistics; H&M says it is investigating and sees no sign of compromise yet.
Cybersecurity
FTC Sues Sextortion Help Operator Dmitry Belkin Over $60M Fraud
The FTC sued Dmitry Belkin and Digital Forensics Corporation, alleging a fake sextortion help scheme took in at least $60 million from blackmail victims.
Cybersecurity
Joint Disruption Week Nets 28 Arrests in West African Scam Crackdown
A week-long operation hosted by the UK NCA led to 28 arrests in Ghana and Nigeria, identified 117 trafficking victims and removed 3.7 million scam ...
Cybersecurity
UK Housing Ombudsman Probes Third-Party Incident, Pauses Complaints
The UK Housing Ombudsman Service is investigating a third-party security incident at its case management system and has blocked new online complaints.
CVE Vulnerability Alerts
Vghost Linux Kernel Flaw CVE-2026-74580 Gets Public Exploit
A public exploit for Vghost, Linux kernel flaw CVE-2026-74580 in the vhost subsystem, gives local root and a VM escape path across nine years of ...
Application Security
SlugFest Flaw Left 1,500+ npm Packages Open to Hijacking
Bloom Security's SlugFest finding showed npm trusted publishing could let attackers hijack 1,500+ packages after repo renames; GitHub now tightens its rules.
CVE Vulnerability Alerts
Fortinet, Citrix, Ivanti Patch 29 Flaws, Including Critical FortiSIEM
Fortinet, Citrix and Ivanti released patches for 29 vulnerabilities, including critical bugs in FortiSIEM, FortiSandbox and Ivanti Neurons Patch for Intune.
Cybersecurity
Hackers Hijack Danfoss Fridge Controllers at French Supermarkets
Attackers took over Danfoss refrigeration controllers overnight, forcing fridges to heat up and spoiling stock at hundreds of French supermarkets nationwide.
Cybersecurity
Ahold Delhaize Pulls Systems Offline After Security Incident
Ahold Delhaize took systems offline after a network security issue disrupted Albert Heijn online services and staff tools at Stop & Shop and Food Lion.
Application Security
SAP Patch Day Fixes 20 Flaws, Including CVSS 10.0 Cloud SDK Bug
SAP's October patch day fixes 20 vulnerabilities, four critical, led by a CVSS 10.0 SSRF flaw in SAP Cloud SDK for Python that exposes OAuth2 ...
Application Security
IBM Patches Three Critical Flaws in IBM i, Db2 Mirror and Maximo
IBM issued three critical bulletins rated CVSS 9.8 to 9.9 for IBM i, Db2 Mirror for i and Maximo AI Service, with no workarounds and ...
Application Security
Progress Fixes 31 MarkLogic Server Flaws, Three Rated CVSS 9.9
Progress Software's October bulletin fixes 31 MarkLogic Server flaws, including three rated CVSS 9.9 that allow code execution and hidden admin accounts.
Application Security
CERT/CC Warns of 11 Unpatched Thelia E-Commerce Vulnerabilities
CERT/CC says 11 unpatched Thelia flaws, seven enabling remote code execution by back-office users, remain open because the vendor could not be reached.
Cybersecurity
Norway Fines Microsoft’s Xandr $9.6M Over Grindr Data Sharing
Norway's data protection authority fined Microsoft-owned Xandr NOK 92 million, its largest ever, over ad auctions that exposed Grindr users' sensitive data.
Cybersecurity
YMCO Leader Oleg Korniev Pleads Guilty to Running Mule Network
Oleg Korniev pleaded guilty in the US to running Your Mule Cashout, which recruited over 15,000 unwitting money mules to launder stolen funds for hackers.
Cybersecurity
Gentlemen Ransomware Gang Claims MoneyGram Breach, Unconfirmed
The Gentlemen ransomware gang listed MoneyGram on its leak site and set a deadline of a little over a week. MoneyGram has not confirmed any ...
Cybersecurity
Dutch Police and Shadowserver Dismantle 178,000-Device Proxy Network
Dutch police, prosecutors and the Shadowserver Foundation took down servers behind a proxy service of 178,000 infected devices; more takedowns are planned.
Cybersecurity
CyberXero Broker Used Claude Code Agents to Steal Ukrainian Data
A Russian-speaking initial access broker, CyberXero, ran 51 Claude Code agents to compromise WordPress sites and steal over 628,000 Ukrainian records.
Cybersecurity
Nippon Columbia Malware Incident Exposes 8.6M Karaoke Customers
Nippon Columbia disclosed malware on an employee computer that may have exposed records of about 8.7 million karaoke customers and employees across Japan.
Application Security
LiteLLM 1.107.0 Backdoored in PyPI Supply Chain Attack
Cybersecurity
WhiteArmour Claims Breach of Disney Staff Directory
TOP CYBERSECURITY HEADLINES
Application Security
Signal RingRTC Flaw CVE-2026-113380 Can Keep Mic and Camera On
Cybersecurity
WhiteArmour Claims Breach of Disney Staff Directory
Application Security
Chrome 156 Patches 353 Security Flaws, Six Rated Critical
This Week’s Security Spotlight
Application Security
PHP Ships Emergency Patches for PHP2Shell as Exploitation Begins
Application Security
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Joint Disruption Week Nets 28 Arrests in West African Scam Crackdown
A week-long operation hosted by the UK NCA led to 28 arrests in Ghana and Nigeria, identified 117 trafficking victims and removed 3.7 million scam ...
UK Housing Ombudsman Probes Third-Party Incident, Pauses Complaints
The UK Housing Ombudsman Service is investigating a third-party security incident at its case management system and has blocked new online complaints.
Vghost Linux Kernel Flaw CVE-2026-74580 Gets Public Exploit
A public exploit for Vghost, Linux kernel flaw CVE-2026-74580 in the vhost subsystem, gives local root and a VM escape path across nine years of ...
SlugFest Flaw Left 1,500+ npm Packages Open to Hijacking
Bloom Security's SlugFest finding showed npm trusted publishing could let attackers hijack 1,500+ packages after repo renames; GitHub now tightens its rules.
Fortinet, Citrix, Ivanti Patch 29 Flaws, Including Critical FortiSIEM
Fortinet, Citrix and Ivanti released patches for 29 vulnerabilities, including critical bugs in FortiSIEM, FortiSandbox and Ivanti Neurons Patch for Intune.
Hackers Hijack Danfoss Fridge Controllers at French Supermarkets
Attackers took over Danfoss refrigeration controllers overnight, forcing fridges to heat up and spoiling stock at hundreds of French supermarkets nationwide.
Ahold Delhaize Pulls Systems Offline After Security Incident
Ahold Delhaize took systems offline after a network security issue disrupted Albert Heijn online services and staff tools at Stop & Shop and Food Lion.
SAP Patch Day Fixes 20 Flaws, Including CVSS 10.0 Cloud SDK Bug
SAP's October patch day fixes 20 vulnerabilities, four critical, led by a CVSS 10.0 SSRF flaw in SAP Cloud SDK for Python that exposes OAuth2 ...
IBM Patches Three Critical Flaws in IBM i, Db2 Mirror and Maximo
IBM issued three critical bulletins rated CVSS 9.8 to 9.9 for IBM i, Db2 Mirror for i and Maximo AI Service, with no workarounds and ...
Progress Fixes 31 MarkLogic Server Flaws, Three Rated CVSS 9.9
Progress Software's October bulletin fixes 31 MarkLogic Server flaws, including three rated CVSS 9.9 that allow code execution and hidden admin accounts.
CERT/CC Warns of 11 Unpatched Thelia E-Commerce Vulnerabilities
CERT/CC says 11 unpatched Thelia flaws, seven enabling remote code execution by back-office users, remain open because the vendor could not be reached.
Norway Fines Microsoft’s Xandr $9.6M Over Grindr Data Sharing
Norway's data protection authority fined Microsoft-owned Xandr NOK 92 million, its largest ever, over ad auctions that exposed Grindr users' sensitive data.
YMCO Leader Oleg Korniev Pleads Guilty to Running Mule Network
Oleg Korniev pleaded guilty in the US to running Your Mule Cashout, which recruited over 15,000 unwitting money mules to launder stolen funds for hackers.
Gentlemen Ransomware Gang Claims MoneyGram Breach, Unconfirmed
The Gentlemen ransomware gang listed MoneyGram on its leak site and set a deadline of a little over a week. MoneyGram has not confirmed any ...
Dutch Police and Shadowserver Dismantle 178,000-Device Proxy Network
Dutch police, prosecutors and the Shadowserver Foundation took down servers behind a proxy service of 178,000 infected devices; more takedowns are planned.
CyberXero Broker Used Claude Code Agents to Steal Ukrainian Data
A Russian-speaking initial access broker, CyberXero, ran 51 Claude Code agents to compromise WordPress sites and steal over 628,000 Ukrainian records.
Nippon Columbia Malware Incident Exposes 8.6M Karaoke Customers
Nippon Columbia disclosed malware on an employee computer that may have exposed records of about 8.7 million karaoke customers and employees across Japan.
P7 DarkSword iOS Exploit Kit Variant Adds Crypto-Wallet Theft
Researchers disclosed P7, a DarkSword iOS exploit kit variant that steals data from 25+ crypto-wallet apps and adds remote command execution to iPhones.
Trojanized Terraform Provider Hides FLATROOF and ROOFDECK Backdoors
Zscaler and SentinelLabs say a fake AWS Terraform provider delivers FLATROOF and ROOFDECK backdoors, with low-confidence links to TraderTraitor.
AnyPwn Heap Overflow in AnyDesk for Linux Gives Root RCE, PoC Public
A public proof of concept for AnyPwn, a heap overflow in AnyDesk for Linux 8.0.2, gives remote root code execution before the user approves a ...