A remotely exploitable out-of-bounds write flaw in Google's widely used Brotli compression library, publicly disclosed by Node.js on October 21, 2026, affects software well beyond the Node.js ecosystem, Help Net Security reported. Attackers who can get an application to decompress crafted Brotli data via node:zlib can corrupt process memory, potentially causing crashes or memory disclosure.
Tailscale is rushing to prepare patches for vulnerabilities in its Tailscale SSH feature, dubbed 'Tailworm,' after details of the flaws were published over the weekend before any fixes were available, SecurityWeek reports.
Attackers are flooding employees' inboxes with spam and then contacting them on Microsoft Teams posing as IT help desk staff, offering to fix the very problem they created. Arctic Wolf documented more than 400 incidents involving abuse of the Teams external chat feature, Help Net Security reports.
Siemens, Schneider Electric, ABB and other industrial vendors have confirmed that some of their products are affected by the PHP2Shell vulnerabilities, SecurityWeek reported. The companies are reviewing their product portfolios to determine their exposure.
Genesys has been hit by a hack that exposed customer data held in internal systems, SecurityWeek reported. The company's Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected.
PHP's security team has scheduled an urgent security release for 21 October 2026 to patch two vulnerabilities each rated 9.2 (Critical) under CVSS v4.0, according to Help Net Security. The outlet's weekly roundup also highlights an exploited Palo Alto Networks GlobalProtect VPN flaw, though the supplied excerpt contains no technical details on that issue.
Researchers have tied recent PHP2Shell attack attempts to a Mirai botnet and documented ASLR bypass exploits, SecurityWeek reports, though no successful compromise has been confirmed so far.
The British government has published plans that would impose prison sentences of up to 14 years for damaging undersea cables off the UK coast, according to Help Net Security. The proposals, set out in a government White Paper, would modernize laws protecting subsea cables and pipelines, some of which date back 140 years.
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress.
Corey Thuen hires hackers for what he calls ‘the evil bit’ — an adversarial streak he believes is either there or it isn’t. The post Hacker Conversations: Corey Thuen and the Evil Bit appeared first on SecurityWeek .
· 1 min read
Summary from source Source: SecurityWeek · Fetched
Google has added new protections to Chrome aimed at scams and social engineering, including defenses against ClickFix-style attacks and insecure HTTP connections, according to SecurityWeek. The measures reportedly include new site warnings and server-side analysis powered by Gemini.
PHP has released patches for two vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), after several cybersecurity firms detected exploitation attempts before the fixes shipped, SecurityWeek reports.
Google is updating Chrome's Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command, according to Help Net Security.
Security researchers discovered a stealthy supply chain attack in which AOMEI Backupper's servers were repeatedly tampered with for five to ten minutes at a time to infect users with a backdoor, Help Net Security reports.
Attackers are exploiting a vulnerability in Siemens Software Center by pairing a genuine, signed copy of the application with malicious DLL files to infect Windows PCs, according to SecurityWeek. The attacks rely on ClickFix social-engineering lures to draw in victims.
Drupal has warned that a critical remote code execution vulnerability in its core could be exploited quickly, according to SecurityWeek. The flaws affect the Entity List and Field UI modules, and exploit paths also exist through contributed modules.
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16. The post Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek .
· 1 min read
Summary from source Source: SecurityWeek · Fetched
Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets. The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek .
· 1 min read
Summary from source Source: SecurityWeek · Fetched
Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow flaw under attack.
· 1 min read
Summary from source Source: SecurityWeek · Fetched
Sources we could not reach today: 绿盟科技博客 (failed); BleepingComputer (blocked by the site); Schneier on Security (blocked by the site); The Record (expected-blocked); FreeBuf (not a feed)
How to read this
Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.
