List cybersec
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean..
8:10 pm, October 14, 2026 Cybersecurity
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
11:10 pm, October 14, 2026 Cybersecurity
ISC Stormcast For Thursday, October 15th, 2026 https://isc.sans.edu/podcastdetail/10138, (Thu, Oct 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
2:10 am, October 15, 2026 Cybersecurity
Panchan's Mining Island [Guest Diary], (Wed, Oct 14th)
[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program]
2:10 am, October 15, 2026 Cybersecurity
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8..
7:10 am, October 15, 2026 Cybersecurity
UK Legal Aid Agency: Hackers stole records dating back to 1978
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole recor..
8:10 am, October 15, 2026 Cybersecurity
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on Oc..
9:10 am, October 15, 2026 Cybersecurity
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (A..
9:10 am, October 15, 2026 Cybersecurity
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vul..
9:10 am, October 15, 2026 Cybersecurity
Microsoft fixes bug causing Windows black screens, Explorer crashes
Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. [...]
10:10 am, October 15, 2026 Cybersecurity
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1
The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 202..
11:10 am, October 15, 2026 Cybersecurity
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attac..
12:10 pm, October 15, 2026 Cybersecurity
Police arrests 95 suspects in international CSAM crackdown action
Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM..
12:10 pm, October 15, 2026 Cybersecurity
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns betwe..
12:10 pm, October 15, 2026 Cybersecurity
Why AI Confidence Is Not Validation
AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster ..
12:10 pm, October 15, 2026 Cybersecurity
Is AI pentesting as good as a human pentester?
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and ..
2:10 pm, October 15, 2026 Cybersecurity
Microsoft: Windows Server 2022 reached end of mainstream support
Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. [...]
2:10 pm, October 15, 2026 Cybersecurity
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI7..
3:10 pm, October 15, 2026 Cybersecurity
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGI..
3:10 pm, October 15, 2026 Cybersecurity
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One co..
3:10 pm, October 15, 2026 Cybersecurity
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attac..
3:10 pm, October 15, 2026 Cybersecurity
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, re..
5:10 pm, October 15, 2026 Cybersecurity
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from..
5:10 pm, October 15, 2026 Cybersecurity
Fake Arch Linux packages push malware with root privileges
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
6:10 pm, October 15, 2026 Cybersecurity
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets in..
7:10 pm, October 15, 2026 Cybersecurity
Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. [...]
7:10 pm, October 15, 2026 Cybersecurity
Android gets AI defenses against messaging scams, fake calls
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
8:10 pm, October 15, 2026 Cybersecurity
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
9:10 pm, October 15, 2026 Cybersecurity
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud ..
9:10 pm, October 15, 2026 Cybersecurity
Small Agents, Smaller Blast Radius: Controlling What AI Can Do, (Fri, Oct 16th)
I believe the cybersecurity industry may be approaching AI security the wrong way.
1:10 am, October 16, 2026 Cybersecurity
ISC Stormcast For Friday, October 16th, 2026 https://isc.sans.edu/podcastdetail/10140, (Fri, Oct 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
2:10 am, October 16, 2026 Cybersecurity
BeyondTrust patches zero-day exploited in attacks since August
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. [...]
7:10 am, October 16, 2026 Cybersecurity
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack inv..
7:10 am, October 16, 2026 Cybersecurity
BAE Systems cyberattack disrupts US federal court operations
The Administrative Office of the US Courts says a cyberattack on government contractor BAE Systems has taken down the notice system used by federal bankruptcy courts. [...]
8:10 am, October 16, 2026 Cybersecurity
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-da..
8:10 am, October 16, 2026 Cybersecurity
CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15..
8:10 am, October 16, 2026 Cybersecurity
Microsoft: October Windows update may break Smart App Control
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]
9:10 am, October 16, 2026 Cybersecurity
Burger King Japan data breach exposes 11 million customer records
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]
12:10 pm, October 16, 2026 Cybersecurity
AI Decision Models and Their Impact on AI SOC Platforms
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive ..
12:10 pm, October 16, 2026 Cybersecurity
Employees using personal ChatGPT at work? Here's what IT admins need to do
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investi..
2:10 pm, October 16, 2026 Cybersecurity
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ether..
4:10 pm, October 16, 2026 Cybersecurity
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct vi..
5:10 pm, October 16, 2026 Cybersecurity
Zero-click attacks used targeted ads to deliver Candiru spyware
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...
6:10 pm, October 16, 2026 Cybersecurity
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the..
6:10 pm, October 16, 2026 Cybersecurity
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address r..
7:10 pm, October 16, 2026 Cybersecurity
Targeted ads installed Candiru spyware in zero-click attacks
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. [...
7:10 pm, October 16, 2026 Cybersecurity
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on sto..
8:10 pm, October 16, 2026 Cybersecurity
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud B..
7:10 am, October 17, 2026 Cybersecurity
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded..
12:10 pm, October 17, 2026 Cybersecurity
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...]
3:10 pm, October 17, 2026 Cybersecurity
AI Testing
