The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
PHP2Shell plus Fragnesia chain used to root Palo Alto firewall management servers (edge of window)
Attackers chained PHP2Shell (CVE-2026-109618, CVE-2026-109619, CVSS 4.0 9.2) with the Linux kernel flaw Fragnesia (CVE-2026-46300) to get root on PAN-OS management servers. Reported: 24 internet-facing firewalls plus one internal management server compromised, a persistent reverse SSH tunnel into…
-
Hackers scanning for patched Oracle E-Business Suite RCE (CVE-2026-101767) (backfill, week of 2026-10-30)
Critical unauthenticated SQL injection leading to RCE, patched Oct 20, 2026. Attackers are now scanning for unpatched systems. I could not open the article, so details come from the briefing summary.
-
Tailscale "Tailworm" report: 11 findings, SSH root escalation, patches pending (backfill, 2026-10-25 to 10-27)
Researcher Erica Windisch published 11 findings. With one compromised device and SSH port forwarding on, an attacker can reach root on permitted servers. A race condition could capture an enrollment key, letting a rogue machine join where Tailnet Lock is off. Tested on Tailscale 1.104.2 and…
-
Russian-aligned actors exploit old WinRAR flaw inside MDaemon mail server, no user click needed
MDaemon bundles an outdated ClamAV unrar library (libclamunrar.dll) affected by CVE-2025-8088, a WinRAR path traversal flaw. An attacker emails a crafted RAR to any address on the server. When MDaemon's antivirus scan opens the attachment, a malicious DLL is written to the server. ESET could not…
-
Wireshark 5.0.0rc1 Release, (Sat, Oct 31st)
Wireshark Release Candidate 5.0.0 was published : soon we can expect a new major version of Wireshark.
-
YARA-X 1.22.1 Release, (Sat, Oct 31st)
YARA-X&#;x26;#;39;s 1.22.1 is a bugfix version, it brings 2 bugfixes.
-
YARA-X 1.22.0 Release, (Sun, Oct 25th)
YARA-X&#39&#x3b;s 1.22.0 release brings 11 improvements and 9 bugfixes.
-
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18…
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in…
-
Investors Dish on New Startups & What They'd Back Next
The cybersecurity market is difficult to predict, but a glimpse into the annual DataTribe Challenge shows what's trending and what's not.
-
Devs Hit by Trojanized Claude Code Extension for Cursor
Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).
-
Behind the Scenes of How Operation Blackout Went Down
A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.
-
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion…
-
L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara
I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.
-
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can…
-
Palo Alto Networks firewalls compromised in chained attacks using PHP2Shell
The AI-enabled campaign hit two dozen targets, including sites linked to the U.S. government.
-
Top cybersecurity conferences to attend in 2027
AI, global conflict and supply chain security are likely to be top of mind at many of the year’s big events.
-
North Korea-linked group steals $6.3B from Binance in largest-ever cryptocurrency hack
Blockchain analysis firms say they have worked with Binance to freeze roughly half of the stolen money, and the exchange said it would cover all losses.
-
Undead Software Projects Continue to Raise Security Risks
A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.
-
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It…
-
Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to…
-
Synology NAS hit by C3RB3R / LOCK3D ransomware (edge of window, 2026-10-30)
Cerber-family variant appends .L0CK3D and drops read-me3.txt. 360 says it has seen victim reports since early October and that samples used DSM flaws CVE-2026-13639 and CVE-2026-13684 (fixed in Synology SA-26:13, Sept 18). Synology's own warning points to an older flaw patched in Dec 2024…
-
Binance theft update: $6.3 billion, attributed to North Korea, DevOps laptop (update to unverified 10-31 item 2)
Per Security Affairs, Binance ties a $6.3 billion theft to a compromised DevOps laptop, and blockchain analysts blame North Korean actors. The attribution comes from analysts, not an official statement I could confirm. I could not open the primary BBC or Binance statement.
-
Malicious "Claude Code" extension on Cursor's marketplace tries to plant an SSH backdoor (edge of window)
Trojanized versions 2.1.312 and 2.1.313 of the "anthropic.claude-code" extension were live on Cursor's marketplace for about 11 hours on Oct 29 (roughly 2:27 AM to 1:35 PM PDT). On load it reported host details, added an SSH key to authorizedkeys and opened a reverse tunnel. Persistence lives…
-
Help desk impersonation on Microsoft Teams leads to domain admin through AD CS abuse (edge of window)
Attackers messaged staff on Teams posing as IT support, got them to start Quick Assist, then abused Active Directory Certificate Services. One intrusion used a weak certificate template (ESC1) to impersonate privileged accounts and run DCSync, then moved data out with Rclone over SFTP. A second…