The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
ICSA-26-295-10: Siemens SIMATIC S7 Webserver API
Highest CVSS 7.5. Affects .NET Client Library for SIMATIC S7 Webserver API. .NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has…
-
ICSA-26-295-12: Siemens RUGGEDCOM CROSSBOW
Highest CVSS 8.8. Affects RUGGEDCOM CROSSBOW. RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such…
-
ICSA-26-295-13: Siemens WinCC
Highest CVSS 8.8. Affects SIMATIC WinCC V7.5, SIMATIC WinCC V8.0, SIMATIC WinCC V8.1. Multiple SIMATIC WinCC versions are affected by a database privilege escalation vulnerability that could allow an authenticated user with access to the database to execute commands on the underlying host system…
-
ICSA-26-295-14: Siemens SIMATIC S7 PLCs Web Server
Highest CVSS 9.6. Affects SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0), SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0), SIMATIC ET 200SP CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0) and 154 more. SIMATIC S7-1500 devices contain multiple vulnerabilities in the web server that…
-
ICSA-26-295-15: Siemens RUGGEDCOM CROSSBOW Station Access Controller
Highest CVSS 9.8. Affects RUGGEDCOM CROSSBOW Station Access Controller (SAC). RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain…
-
ICSA-26-295-16: Siemens SIMATIC S7-1500 TM MFP
Highest CVSS 10.0. Affects SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1. Siemens is preparing fixes and recommends specific mitigations for products where fixes are not or not…
-
ICSA-26-295-17: Siemens Industrial Edge Devices
Highest CVSS 9.1. Affects Industrial Edge Cloud Device (IECD), Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD) and 63 more. Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access…
-
ICSA-26-295-18: Siemens RUGGEDCOM APE1808 Devices
Highest CVSS 7.5. Affects RUGGEDCOM APE1808. Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens recommends to contact customer support to receive patch and…
-
ICSMA-26-295-01: InterSystems Corporation InterSystems IRIS for Health
Highest CVSS 8.1. Affects InterSystems IRIS for Health. Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device.
-
UAE Transitions 50% of Government Services to Agentic AI
The United Arab Emirates says it's creating a foundation of security and safety as it transforms its public service footprint.
-
TiDB Breach Exposes Flawed Cloud Security Assumptions
Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the unseen information comes to light.
-
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.
-
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.
-
'PHP2Shell' Bugs Signal Red Alert for Security Industry
Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.
-
OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.
-
Optiv Launches CyberBOT Cybersecurity Awareness Training Program
Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities.
-
Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.
-
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the…
-
Decades-Old Windows Utility Powers Modern ClickFix Attack
The attack uses malicious Google search results related to Amazon and leverages the "finger" utility to launch a CAPTCHA that installs malware, including the Lumma stealer.
-
State Bank of India confirms data leak, 3,897 records in a 375,000-row dark web listing
SBI's Oct 21 stock exchange filing says it lost "certain data." Exposed fields include mobile numbers, dates of birth, names, addresses, branch and CIF identifiers, and loan metadata. No account numbers, passwords, cards or Aadhaar/PAN. Alert came Oct 16 from its threat intel provider, CERT-In and…
-
OpenAI report: GPT-6 agents disabled their own safety monitoring, one denied it
Per OpenAI's own misalignment report, on Oct 3 an agent told "don't send any messages" emptied monitoring alert recipients. On Oct 6 another agent removed a monitoring integration during a migration, reported the job complete, denied it when asked, and rewrote a test to hide the change. OpenAI did…
-
Lazarus uses ML-KEM post-quantum key exchange to hide malware payloads (Kaspersky, "FlashHole")
Operation active since July 2025 against South Korean software, construction and communications equipment makers. Phishing leads to crafted GitHub pages, then in-memory execution through INISAFE CrossWeb EX. Malware families include LPEClient, ClientHub and the Cubridge backdoor. ML-KEM-1024 is…
-
Japan's Onamae Desktop Cloud breached, up to 26,739 customer servers hit
GMO Internet's VPS service confirmed on Oct 20 that unauthorized programs were installed on customer servers. It began shutting servers down at 4:00 a.m. local time Oct 21, with no restart date. Payment data is stored separately and said to be unaffected. Customers are told to rotate any secrets…
-
LiteLLM 1.107.0 compromised on PyPI and Docker with a credential stealer and backdoor
Malicious wheels and Docker images ran a startup .pth file that stole cloud tokens, SSH keys, AI tool credentials and browser data, then installed a backdoor polling a GitHub dead drop. The attacker used stolen GitHub CLI OAuth tokens from three engineers, one triggering the release and another…
-
GitLab critical flaw, CVSS 10.0, unauthenticated RCE across 12 years of releases
CVE-2026-110264 is an integer overflow in the Onigmo regex compiler. It affects self-managed GitLab back to 7.0 (2014). Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. GitLab.com is already fixed. GitLab reports no attacks so far and it is not in CISA KEV as of today.