Today ·
Security and privacy news from international and Chinese sources, refreshed every day.
Threat intel
Cisco Talos researchers say a highly sophisticated APT tracked as UAT-11473 exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances, to gain unauthorized access and deploy the KeyDrift malware.
AI-written summary Source: Cisco Talos Blog · Fetched
Read the story
Threat intel
The China-nexus cyber espionage group Volt Typhoon has been attributed to a now-disrupted covert access network called Silent Train that was used for zero-day exploitation and strategic access, according to a Lumen Technologies Black Lotus Labs report shared with The Hacker News.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background.
Summary from source Source: The Hacker News · Fetched
Threat intel
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown.
Summary from source Source: The Hacker News · Fetched
Threat intel
Dark Reading reports on a wide-scale, ongoing social engineering campaign that pairs email bombing with external Microsoft Teams chats to deliver malware in as little as 15 minutes, with possible ties to the Black Basta ransomware gang.
AI-written summary Source: Dark Reading · Fetched
Threat intel
A recent Shai-Hulud supply chain attack shows that software bills of materials on their own are not enough, and defenders need real-time visibility into production code and affected services to respond effectively, Dark Reading reports.
AI-written summary Source: Dark Reading · Fetched
Threat intel
An unknown threat actor has infected 953 online stores, most of them running Magento, in a campaign active since July 2025, according to Dutch e-commerce security firm Sansec. The attackers inject code that serves malicious JavaScript through Magento CMS blocks and is designed to evade security scanners.
AI-written summary Source: The Hacker News · Fetched
Threat intel
An ongoing supply chain campaign dubbed "Gheist" is abusing stolen GitHub tokens to steal cloud secrets, according to Dark Reading. The operation is harvesting credentials and other sensitive data from thousands of developer repositories.
AI-written summary Source: Dark Reading · Fetched
Threat intel
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.
Summary from source Source: The Hacker News · Fetched
Threat intel
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware.
Summary from source Source: The Hacker News · Fetched
Threat intel
A security researcher has disclosed unpatched flaws in Tailscale SSH that could let a single compromised device on a Tailscale network be used to gain root access on other reachable servers, The Hacker News reported. The attack requires Tailscale SSH port forwarding to be enabled and the network's access rules to allow the compromised device to connect to the target.
AI-written summary Source: The Hacker News · Fetched
Threat intel
A memory-corruption flaw in Google's Brotli decoder, tracked as CVE-2026-111497, affects a range of software that unpacks Brotli-compressed data, including Bun, Python's Brotli and brotlicffi packages, and Envoy proxies, The Hacker News reports. Specially crafted compressed data can overwrite past a buffer's end and corrupt memory, and the flaw was previously linked to remote code execution in Node.js.
AI-written summary Source: The Hacker News · Fetched
Threat intel
LiteLLM disclosed that a master key accidentally committed to a public GitHub repository in late May 2026 let a threat actor steal GitHub tokens, hijack its release pipeline and push a malicious version of the popular Python package, according to The Hacker News.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine.
Summary from source Source: The Hacker News · Fetched
Threat intel
CISA has added two critical vulnerabilities affecting Collabora Online's Built-in CODE Server and Arista VeloCloud Orchestrator to its Known Exploited Vulnerabilities catalog, citing reports of active exploitation. One of the flaws, CVE-2026-110447, carries a CVSS score of 9.2.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.
Summary from source Source: SANS Internet Storm Center · Fetched
Threat intel
Fixing the critical PHP vulnerabilities known as PHP2Shell is more complicated than applying a simple update, Dark Reading reports. Security experts have shared advice on how organizations can assess their exposure and protect themselves.
AI-written summary Source: Dark Reading · Fetched
Threat intel
A new UEFI bootkit called BlackX targeted diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026, in a campaign Kaspersky suspects was orchestrated by the China-linked group APT41. The bootkit can bypass Secure Boot on fully patched Windows systems that are missing revocations.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.
Summary from source Source: The Hacker News · Fetched
Threat intel
Dark Reading examines how cyber threats in the Caribbean can ripple outward into global cyber-risk, arguing that the region illustrates what happens when exploitation accelerates but security assurance fails to keep pace.
AI-written summary Source: Dark Reading · Fetched
Threat intel
Researchers have disclosed a large-scale campaign targeting exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, that has exposed more than 70,000 credentials, according to The Hacker News.
AI-written summary Source: The Hacker News · Fetched
Threat intel
This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to "business as usual".
Summary from source Source: SANS Internet Storm Center · Fetched
Threat intel
Arista has warned that attackers are actively exploiting a critical zero-day SQL injection flaw in VeloCloud Orchestrator, the central management system for its SD-WAN product. According to The Hacker News, even a read-only account can be abused to gain top-level operator privileges.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Two remote code execution flaws in the Linux kernel's KSMBD SMB server, each rated CVSS 9.0 by Trend Micro's Zero Day Initiative, have been disclosed on public mailing lists before fixes landed in the mainline kernel. One flaw can be triggered before any network authentication.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Palo Alto Networks' Unit 42 threat intelligence team has published an analysis of the current OAuth attack landscape, exploring modern threats and outlining actionable steps organizations can take to protect their environments, according to the team's blog post.
AI-written summary Source: Unit 42 · Fetched
Threat intel
PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits before the patch became available.
Summary from source Source: SANS Internet Storm Center · Fetched
Threat intel
Marvell, Microsoft and Oracle are collaborating to standardize an integrated hardware security module built to NIST FIPS 140-3 Level 3 for cloud and hyperscale data centers, according to Dark Reading.
AI-written summary Source: Dark Reading · Fetched
Threat intel
A Cloud Security Alliance survey found that among respondents who experienced data loss, only 16 percent said their DLP tools blocked the most significant incident before data left the organization, Dark Reading reported. The findings suggest DLP more often works as a detection mechanism than a preventive control.
AI-written summary Source: Dark Reading · Fetched
Threat intel
Security teams are scrambling to remediate two critical PHP vulnerabilities dubbed 'PHP2Shell' after technical details leaked and exploitation attempts were reported, according to Dark Reading.
AI-written summary Source: Dark Reading · Fetched
Threat intel
GitLab released fixes on October 21 for a maximum-severity flaw (CVSS 10.0) that allows unauthenticated remote code execution on self-managed servers and affects every release since version 7.0 in 2014, The Hacker News reports. Administrators who applied the October 12 patch may still need to update again.
AI-written summary Source: The Hacker News · Fetched
Threat intel
The popular LiteLLM Python package was compromised in a software supply chain attack that delivered a credential stealer and a backdoor through version 1.107.0, distributed via PyPI wheels and Docker images, The Hacker News reported, citing SafeDep, Socket, StepSecurity, and Upwind. The package has since been quarantined on PyPI.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Cloud provider OVHcloud's GitHub environment was compromised in an incident tied to the GlassWorm threat actors, Dark Reading reports. A developer's GitHub account, compromised months earlier, was used to push malicious code to unsuspecting users.
AI-written summary Source: Dark Reading · Fetched
Threat intel
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 appeared first on Unit 42 .
Summary from source Source: Unit 42 · Fetched
Threat intel
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42 .
Summary from source Source: Unit 42 · Fetched
Threat intel
Researchers have released a proof-of-concept exploit for CVE-2026-106173, a critical path traversal vulnerability in Fortinet FortiSIEM with a CVSS score of 9.4 that could allow unauthenticated remote code execution, according to The Hacker News. The flaw has been patched.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Palo Alto Networks says ransomware actors, including the Qilin and INC groups, continue to exploit a now-patched authentication bypass flaw (CVE-2026-0257) in PAN-OS and Prisma Access to establish unauthorized VPN connections and bypass MFA. The vulnerability was fixed in May 2026, according to The Hacker News.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Cisco Talos highlights a dramatic jump in monthly vulnerability disclosures, noting that Microsoft's latest Patch Tuesday release included 1,415 vulnerabilities compared with a pre-June average of around 100 per month. The blog post examines where the surge is coming from and what it means for the future.
AI-written summary Source: Cisco Talos Blog · Fetched
Threat intel
Researchers have infiltrated a large-scale tech support scam operation that impersonates Microsoft, according to Dark Reading. The operation relies on a malicious traffic distribution system run by a Russian organization and abuses thousands of Cloudflare links.
AI-written summary Source: Dark Reading · Fetched
Threat intel
Spyware vendors are abusing the targeted ad bidding process in the digital advertising ecosystem to identify and track specific individuals and organizations, turning ordinary ad impressions into a zero-click spyware delivery channel, Dark Reading reports.
AI-written summary Source: Dark Reading · Fetched
Threat intel
ConnectWise has disabled its cloud backups amid concerns for downstream managed service providers, after researchers said attackers authenticated into Microsoft 365 tenants using ConnectWise credentials, according to Dark Reading. ConnectWise says customer impact remains unconfirmed.
AI-written summary Source: Dark Reading · Fetched
Threat intel
Threat actors are actively exploiting a chain of four vulnerabilities in Plex Media Server, collectively dubbed Plex2Shell, to install cryptocurrency miners and reverse proxy software, according to The Hacker News. The attacks reportedly began just one day after a proof-of-concept exploit was made public.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16.
Summary from source Source: The Hacker News · Fetched
Threat intel
Copyright takedown requests linked to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results, Dark Reading reports. UpGuard's Greg Pollock weighs in on what affected institutions and security teams should consider next.
AI-written summary Source: Dark Reading · Fetched
Threat intel
ConnectWise said it has disabled seven of its application identities and suspended its Cloud Backup service after unknown threat actors gained unauthorized access to the identities and compromised Microsoft 365 tenants, according to The Hacker News.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX.
Summary from source Source: The Hacker News · Fetched
Threat intel
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to customers' M365 environments.
Summary from source Source: The Hacker News · Fetched
Threat intel
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Summary from source Source: Dark Reading · Fetched
Threat intel
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections.Security firm Calif, which found and…
Summary from source Source: The Hacker News · Fetched
Threat intel
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42 .
Summary from source Source: Unit 42 · Fetched
Threat intel
Attackers repeatedly swapped files on AOMEI Backupper's own update servers in five-to-ten-minute windows between May and July 2026, so any copy of the Windows backup program that checked for updates during those windows would download and run a backdoor, The Hacker News reported. The activity was documented by Google Threat Intelligence Group, Mandiant, and ManageEngine researchers.
AI-written summary Source: The Hacker News · Fetched
Threat intel
An APT group tracked as UAT-11985 is using fake event invitations in a spear-phishing campaign against people affiliated with Taiwanese research organizations, luring them to an adversary-in-the-middle phishing framework that steals Google account credentials and MFA codes, The Hacker News reported.
AI-written summary Source: The Hacker News · Fetched
Threat intel
Dark Reading reports the arrest of a well-known ransomware negotiator alleged to have been working on behalf of attackers, a case the outlet says exposes the need for tighter oversight of incident response vendors.
AI-written summary Source: Dark Reading · Fetched
Threat intel
The United Kingdom has imposed economic sanctions on Cryptomus, a cryptocurrency platform accused of serving as a major conduit for payments tied to ransomware, narcotics, darknet markets, fraud, and cybercrime services that help Russia bypass financial restrictions.
AI-written summary Source: Krebs on Security · Fetched
Threat intel
Microsoft has shipped updates fixing more than 1,400 security vulnerabilities across Windows and its other software, Krebs on Security reports. The batch surpasses September's record of nearly 1,000 fixes, which was already about ten times the company's normal monthly patch load.
AI-written summary Source: Krebs on Security · Fetched
Sources we could not reach today: 绿盟科技博客 (failed); BleepingComputer (blocked by the site); Schneier on Security (blocked by the site); The Record (expected-blocked); FreeBuf (not a feed)
Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.