The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and…
-
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at…
-
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25…
-
Insurance industry fears potential impacts from PHP2Shell
A systemic cyber event could lead to billions of dollars in claims that exceed current risk models.
-
AI Takes Root in Hospital Corridors, Raises Security Stakes
Artificial intelligence is everywhere in healthcare, from doctors' intake forms to cancer screenings. But in some cases, life-and-death uses are outpacing cybersecurity.
-
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.
-
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application…
-
123 Reg discloses suspected AI-enabled attack on customer data, China-nexus suspected (backfill, 2026-10-28)
Per the briefing, the UK domain registrar disclosed a suspected AI-enabled attack on customer data and links it to a China-nexus actor. Details not verified.
-
ShinyHunters' Oracle PeopleSoft zero-day was three chained flaws (CVE-2026-35273, CVSS 9.8); WAF path blocking was bypassed
An SSRF in the Integration Gateway reaches the Environment Management Hub, which trusts localhost by default, leading to RCE. ShinyHunters (UNC6240) exploited it from May 27 to June 9, mainly against universities, with a later wave across tech, healthcare, transport and government. Oracle patched…
-
China-linked actors chain PHP2Shell with the Fragnesia exploit to root firewalls at a US government-affiliated organization
Per the teaser, attackers combined PHP2Shell with Fragnesia and compromised two servers belonging to a US government-affiliated organization. Details on which firewall products are involved were not retrievable.
-
CISA ICS advisories ICSA-26-300-01 and -02: EPICS Base (CVSS 9.8) and Mitsubishi Electric/ICONICS SCADA suite (CVSS 9.1)
Facts per the aggregator: EPICS Base 7.0.10 and earlier has four unauthenticated integer overflow flaws (fixed in 7.0.11). Mitsubishi Electric and ICONICS products (GENESIS64, MC Works64, Hyper Historian, MobileHMI) have authentication bypass and arbitrary operation flaws plus a legacy libwebp…
-
HHS rule: Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity
This final rule focuses on deregulatory actions identified in HHS regulations regarding health information technology standards, implementation specifications, and certification criteria and regarding certification programs for health information technology. This final rule reduces burden, offers…
-
CISA adds CVE-2026-41709 to KEV: Broadcom VMWare ESX Insufficient Logging Vulnerability
Federal patch deadline 2026-11-11. Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Also covered by The Hacker News
-
Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first…
-
Wazuh and AI for Enhanced SOC Workflows
Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making…
-
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score…
-
American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind…
-
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any real attack, and…
-
FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering
The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The move was in response to the service being used to commit and facilitate prolific criminal activity, including "the advertisement of sexually…
-
Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature
Interpol's annual Operation Serengeti, now in its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds.
-
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
-
External Teams Chats Anchor 15-Minute Malware Delivery
Mail bombing is getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.
-
SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.
-
Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills
Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.
-
'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants
The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.