The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Cyber insurance softens on price but tightens on AI exposure
Marsh reports global cyber rates fell 4% in Q3 2026, the 13th straight quarterly decline, and US rates were flat. Some insurers are tightening underwriting on AI risk, and one in five insurance respondents in a Gallagher survey saw an AI-related loss or claim in the past year. AI endorsements are…
-
Covenant Health (Maine) settles 2025 breach class action for $2 million
Attackers accessed Covenant Health's network in May 2025, found in July 2025. More than 500,000 patients affected, at least 284,000 in Maine. Data included SSNs, treatment details and insurance information. Class members can claim up to $5,000 for documented losses or about $75 cash, plus two…
-
Cybersecurity incident forces a major New Mexico hospital to divert patients and close clinics (UNM Hospital)
UNM Hospital diverted ambulances and closed clinics after an incident. TechNadu reports ransomware groups have claimed breaches at universities in Mexico and New Mexico. Cause and scope are unconfirmed. Publication dates were not available, so window fit is unconfirmed.
-
Webinar: How to Build AI Threat Readiness Into Your Security Operations
Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate exploit code, and move through weaknesses faster than traditional security…
-
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of…
-
The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers
AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tasks that AI systems can perform on their own. As these capabilities…
-
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories…
-
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS…
Also covered by CISA KEV, Cybersecurity News
-
GitHub Launches npm Firewall to Block Malicious Packages Before Installation
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate,"…
-
Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes
The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale — but with key security features turned off.
-
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular…
Also covered by CISA KEV, Xalgorix weekly AppSec digest
-
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt traffic between sites and store them for later use, Cisco…
-
Cyber Vulnerabilities Besiege Italy, Absent Clear Cause
Researchers can't quite explain why cyber threats look so different in Italy compared with everywhere else.
-
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you reached a critical step. But, if you need to…
-
ICSA-25-275-02: Hitachi Energy MSM Product (Update A)
Highest CVSS 7.5. Affects MSM. Hitachi Energy is aware of open-source software vulnerabilities that affect MSM product versions listed in this document below. If exploited these vulnerabilities could result in XSS and DoS attacks potentially causing confidentiality, integrity and availability…
-
ICSA-26-125-01: Hitachi Energy PCM600 (Update A)
Highest CVSS 4.4. Affects PCM600 Legacy, PCM600. Hitachi Energy is aware of a vulnerability that affects the Hitachi Energy PCM600 product versions listed in this document. An attacker successfully exploiting this vulnerability can impact integrity of the product. Please refer to the Recommended…
-
ICSA-26-258-06: Siemens Mendix SAML
Highest CVSS 8.7. Affects Mendix SAML (Mendix 10 compatible), Mendix SAML (Mendix 11 compatible), Mendix SAML (Mendix 9.24 compatible). Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has…
-
ICSA-26-302-01: Siemens Mendix SAML Module
Highest CVSS 6.8. Affects Mendix SAML (Mendix 10 compatible), Mendix SAML (Mendix 11 compatible), Mendix SAML (Mendix 9 compatible). Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a…
-
ICSA-26-302-02: Hitachi Energy TRO600 series products
Highest CVSS 7.5. Affects TRO600. Hitachi Energy is aware of multiple vulnerabilities that affect the TRO600 series product versions listed in this document. These vulnerabilities can be exploited for remote code execution (RCE) to carry out further attacks and disclosure of sensitive information…
-
ICSA-26-302-03: Hitachi Energy CoreTec Product
Highest CVSS 8.8. Affects CoreTec5, CoreTec4. Hitachi Energy is aware of OS command injection and Dirty Frag vulnerabilities that affect CoreTec product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and…
-
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the…
-
ISC Stormcast For Thursday, October 29th, 2026 https://isc.sans.edu/podcastdetail/10156, (Thu, Oct 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
Yet Another ClickFix Campaign, (Wed, Oct 28th)
Introduction
-
GhostAction Hacking Wave Fizzles, but Attackers Lurk on in GitHub
The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.
-
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train uses rotating chains of compromised…