Websites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue with the programming language was revealed, cybersecurity companies have said. Michael Safi speaks to global technology reporter Aisha Down Continue reading...
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 12:00 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
Continuous penetration testing is usually priced by subscription or credit model rather than per engagement. Cost depends on attack surface size, testing depth, and retest policy, not a simple asset count. Published price ranges vary widely across the market because providers define "scope" differently, so the pricing model is more useful to understand than any single published number. The post Continuous Penetration Testing Services: What’s Included and How Pricing Works appeared first on Synack .
Latest
Saturday, October 24
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating
Turns out that Node2Shell affects more than just Node! Python packages Brotli and brotlicffi are also affected by this vulnerability, but don't have a CVE yet..
Friday, October 23
PHP2Shell demands prompt patching and evidence that remediation worked. Mark Kuhr explains how exploitability validation and experts working with agentic AI help security teams understand exposure and act with confidence. The post PHP2Shell and the Case for Exploitability Validation appeared first on Synack .
[Open Source] 2XL Racing Legacy Server Emulation Project (FastAPI backend + libndkwrapper.so binary attached for analysis)
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an
[University Hospitals takes systems offline after detecting server breach - cleveland.com](https://www.cleveland.com/news/2026/10/university-hospitals-takes-digital-services-offline-after-finding-unusual-server-activity.html) Looks like another hospital from Ohio has been hit.
Three updates with practical consequences for security teams: 1. **VeloCloud needs urgent patching:** An actively exploited SQL injection flaw allows authenticated users to gain superuser privileges. Organizations running affected on-premises Orchestrator versions should prioritize updates and review privileged activity. 2. **LiteLLM requires more than a downgrade:** The compromised 1.107.0 release could steal credentials and load additional code. Check deployment history, rebuild affected environments and replace exposed secrets. Removing the package does not undo stolen credentials. 3. **PHP’s new warning has specific conditions:** The additional RCE path requires an unusual runtime change to session serialization with upload progress enabled. PHP recommends disabling session upload progress where applicable while awaiting a fix. The earlier PHP2Shell patches remain essential. Read the full breakdown on CyberRecaps.
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services
New technical findings make the PHP2Shell situation more serious than the original patch announcement alone suggested. Amazon Threat Intelligence identified attempted exploitation dating to October 17, four days before the vulnerabilities were publicly disclosed. **The vulnerabilities are:** CVE-2026-109618 and CVE-2026-109619 Both carry critical CVSS v4.0 scores of 9.2. Amazon observed additional attempts before the public release, followed by widespread exploitation attempts after the October 21 disclosure. Researchers have not established that every observed attempt successfully compromised a real-world server. Why onion-service administrators should care An onion service running vulnerable PHP may be exposed even when its real server IP address remains hidden. Tor protects the network path; it does not fix vulnerabilities in the application running behind it. Upgrade to patched PHP releases, including 8.2.35, 8.3.36, 8.4.27, or 8.5.12, as appropriate. Review server logs dating back to at least October 17. Web application firewalls may reduce exposure but do not replace patching. Update the existing PHP security advisory to mention confirmed exploitation attempts and the earlier October 17 activity.
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk.The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of
Recommandations à destination des acteurs du secteur de l’énergie et de l’eau - NSSI) has been receiving numerous reports concerning the targeting of the renewable energy production and water management sector in France by hacktivist groups and actors known to be linked to states
[github.com/backdoorskid/win-def-clickfix](http://github.com/backdoorskid/win-def-clickfix) win-def-clickfix is a run-1 detection replica for ClickFix / Win+R command lines, rebuilt by reverse-engineering Microsoft Defender's mpengine.dll. It runs a command line through the recovered normalizer/deobfuscator (FUN\_1800a2500) and matches it against the 807 VDM-extracted CMDHSTR\_EXT signatures, evaluated with their real condition: logic. It also ships the extracted BMClientV1 neural network — a stateful GRU — executed in pure numpy, alongside scanners for the engine's other recovered paths (AMSI, AMSI-UAC, RPF/JIT, WMI, script hosts, paste obfuscation).
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set
Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote
Thursday, October 22
Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve arbitrary code execution. Description PHP is a widely used open-source scripting language designed for web development and server-side applications. It powers millions of websites and web applications worldwide and can be deployed through a variety of server configurations, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. CVE-2026-109618 : A memory corruption vulnerability exists in the out-of-memory (OOM) handling mechanism of PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The vulnerability occurs when an OOM condition interrupts request processing while internal request data is only partially initialized; subsequent cleanup routines may access the invalid memory, potentially causing memory corruption and enabling arbitrary code execution. CVE-2026-109619 : A use-after-free vulnerability exists in the global state management of PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The vulnerability occurs when a worker retains a reference to request-owned state after its backing memory has been freed. A subsequent request handled by the same worker can access this stale state before normal request initialization resets it, potentially causing memory corruption and enabling arbitrary code execution. Impact Successful exploitation of these vulnerabilities allows an unauthenticated attacker to remotely execute arbitrary code via specially crafted HTTP requests, compromising the confidentiality,
Continuous penetration testing is usually priced by subscription or credit model rather than per engagement. Cost depends on attack surface size, testing depth, and retest policy, not a simple asset count. Published price ranges vary widely across the market because providers define "scope" differently, so the pricing model is more useful to understand than any single published number. The post Continuous Penetration Testing Services: What’s Included and How Pricing Works appeared first on Synack .
Packet Tracer pka/pkt reverse engineered to fully build, export, or decrypt without running Packet Tracer
[RESEARCH] SM-F956B (Z Fold 6) Bit-4: OEM-Unlock Flag Ignored by Bootloader + Bootchain Bug-Hunt & Temp-Root Status
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet. But those big headlines are only half the story. Stolen passwords, exposed
The current US administration is an obstacle, but public demand for protection will ultimately prevail Organisations around the world scrambled on Thursday to fix critical flaws in PHP, the software that powers much of the web. The vulnerabilities could allow attackers to take control of affected servers. Some websites were taken offline as a precaution while fixes were installed. The paradox is that while AI helped researchers uncover the flaw, it also threatens to accelerate the ability to exploit it. Amazon said that it had detected an attempt before the public disclosure of the PHP flaws. What the episode highlights is AI’s central role in security – and not always for the right reasons. OpenAI’s models have also been responsible for two alarming hacks this year – a security breach of an Australian health department website and a raid by a swarm of AI bots on Hugging Face, an AI services platform. Citing those incidents, the AI minister, Kanishka Narayan, warned that a similar cyber-attack on the UK is “likely, if not inevitable”.
Websites around the world have been taken offline as governments and businesses scramble to fix a flaw in the computer language PHP. There are fears that hackers could exploit the vulnerability to steal data, take control of web servers and disrupt services. Millions of attempts have already been made to attack websites since the issue with the programming language was revealed, cybersecurity companies have said. Michael Safi speaks to global technology reporter Aisha Down Continue reading...
An estimated 70% of websites use the open-source language. What is the identified vulnerability in it? Website owners faced millions of attempts to exploit a serious security vulnerability in their programming language, it has emerged, triggering a rush by governments and businesses to fix the problem. The newly discovered vulnerabilities in PHP, a programming language that underpins most websites, allows hackers to carry out cyber-attacks and steal data if not fixed. What were the vulnerabilities and why did they affect so many sites? Continue reading...
The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it? | Chris Stokel-Walker
I’ve been banging the drum about these vulnerabilities for years. It will take more than a handful of exhausted developers to keep us safe Parts of the internet are going dark. In the Netherlands, government websites, including its digital ID login service, have become unavailable. Finland has taken public services offline, and Wikimedia, the organisation behind Wikipedia, has switched off some of its systems too. This sounds like the results of a cyber-attack. In most instances, however, the people running the sites deliberately switched them off because the alternative – keeping them online – was too risky. The future is here, and suddenly much of our digital infrastructure is looking very fragile. Chris Stokel-Walker is the author of TikTok Boom: The Inside Story of the World’s Favourite App Continue reading...
Probably not the best week to be dropping research, i know alot of ya'll in the industry are working hard right now - stay safe out their! Tracking a new campaign by PHISHLETS 10k phaas kit dropped in August in the wild..
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet.
Wednesday, October 21
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild. Image: Shutterstock.com, Sashkin. The flaws at issue are present in PHP , the programming language that powers sites running on a large number of web publishing systems, including Drupal , Magento , Joomla and WordPress . Earlier today, PHP released an emergency security update to fix two critical bugs that can allow an attacker to execute code of their choosing on a vulnerable server. Reuters reports that government websites in Europe and elsewhere went offline today after the PHP vulnerabilities were disclosed. Cloudflare
Today we’re publishing patching-bugs and regression-hunt , two plugins that let engineers delegate patch development and regression checks to agents. Our patching-bugs plugin reproduces reported bugs, develops fixes, and tests them. The regression-hunt plugin checks whether any changes break previously working and supported behavior. Engineers can direct the work and review their results; maintainers can supply their own security assumptions and patching requirements, so the agents work within the project’s rules. We built patching-bugs and regression-hunt through Patch the Planet , our joint initiative with OpenAI, where we’ve co-authored hundreds of security patches for widely used open-source projects. Motivated by our major successes on projects like Scapy , our plugins draw on our analysis of merged patches and thousands of our engineers’ Codex sessions. The plugins provide maintainers with a structured workflow, evidence, independent checks, and best practices to improve their patching hygiene. In our preliminary evaluations, regression-hunt produces 25% fewer false-positive findings than a baseline Codex agent prompted to “review the PR for regressions.” Standardizing the patching process Our September post reported regressions introduced by some of our Patch the Planet patches. Since then, we’ve reviewed every patch that a Trail of
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
Hackers around the world are all-in on using agentic AI to wage attacks—and manipulating tools like Anthropic’s Claude to help them carry out their crimes.
Given the increasing reliance/uptake of AI models and this year's bonanza of PyPI supply chain attacks: thought it would be worthwhile looking at an attack that combines the two: Rank-One Model Editing (ROME) attacks + later some thoughts on detecting this particularly evasive supply chain attacks. ROME attacks: Supply chain attack is likely prerequisite to get malicious python to the model / GPU, though there's many avenues for that. Once a library is injected into PyTorch, it performs surgical weight rewrites (vs retraining) and changes specific outputs without a process being spawned, no new files and no network calls made. (Which obviously makes this rather difficult to catch with security tools living above the driver) Attack methodology originally published as a piece of research [Locating and Editing Factual Associations in GPT](http://arxiv.org/abs/2202.05262): Kevin Meng, David Bau, Alex Andonian and Yonatan Belinkov. There's a [deep dive blog](http://stealthium.io/blog/hands-off-detecting-model-weight-tampering) from cyber org Stealthium that covers both the attack & GPU-side detection via tracing CUDA kernels (eBPF) and hypothesises on further detection posssibilities. Welcome the communities thoughts? Reckon any of these model corruption attacks are in the wild and not yet been caught/seen? (((Also while the blog example is soviet propaganda, anybody aware of other nations that like both model development, influence campaigns and rewriting history? Just sayin...))) \+ shout out to the folks at Mithril Security for their PoisonGPT work a while back that explored this threat vector IRL with an upload to HF.
The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.
To escape the chaos of her Russian childhood, Lili Infante became an American law enforcement prodigy. She pioneered the DEA’s investigations of the dark web—never suspecting who she’d find hiding there.
More than four in 10 of the 1,884 people we surveyed didn’t tell their bank, the police, or the platform about a scam 42.7% of the 1,884 UK adults we surveyed who’d been targeted by a scam in the past 12 months didn’t tell their bank, the police, or the website or app where it […] The post Why people don’t report scams, and it’s not embarrassment appeared first on Heimdal Security Blog .
PHP2Shell - Critical vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619): detection, analysis, and remediation
Learn about the two critical vulnerabilities in PHP dubbed PHP2Shell.
Malicious releases of LiteLLM v1.107.0 were published to PyPI and container registries following multiple maintainer account compromises.
Tuesday, October 20
France had more Internet-exposed Danfoss refrigeration dashboards than the rest of the world combined before the supermarket attacks (weekly IPv4 scan data)
I work at IPinfo, which runs a weekly scan of the IPv4 Internet. Short version of what we found: * October 6–7 scan, five days before the attack: 2,528 addresses serving a Danfoss StoreView dashboard in 73 countries and territories. France had 1,331 (53%). * 85% of the French ones ran software with known flaws, including 527 end-of-life AK-SM 800 units. Only 195 had every fix. Elsewhere it was 84%, so France had more of them online, not worse patching. * 1,019 of the French addresses were already open on March 30. * October 14 scan: 316 still online in France (−76%, against a normal 3–7% weekly loss). Fully patched units dropped too (195 → 54), which points to disconnection rather than patching. Method: the newer UI is matched on page title, the older AK-SM 800 on its web server plus the Flash loader page, and firmware generation comes from the build date the dashboard exposes. Counts are addresses on the ports we scan, so they’re a floor. How the attackers got in is still unknown, and exposure isn’t proof of the entry point.
I continued researching sandbox bypasses discovered in Twig by project Glasswing. This time, I focused on CVE-2026-46633, which still had no public exploits. This writeup documents my development of payloads for the CVE-2026-46633 and the corresponding SSTImap modules.
Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the console API. This allows the attacker to maintain access and potentially escalate privileges within the Xerj ecosystem, even if the initial token is revoked. Description Xerj is an open-source search and indexing engine tailored specifically for AI agents utilizing the Elasticsearch API, allowing AI models to query a structured index. The vulnerability, CVE-2026-97406 , stems from a flaw in how session states are authenticated and handled within the Xerj system architecture. According to the documented security contract, the issuance of new API tokens must be strictly authorized by a passkey-backed session. However, the Xerj implementation converts both standard browser sessions and API bearer tokens into the same generic AuthSession object. The token creation handler then accepts this generalized principal without verifying whether the session was authenticated via a passkey. Because of this architectural oversight, an attacker who obtains or intercepts a valid Xerj API token can directly invoke the token creation endpoint, allowing them to create independent successor credentials with the same access levels of the original token. Furthermore, the Xerj platform lacks hierarchical revocation logic; consequently, revoking a compromised parent token has no effect on any descendant tokens spawned from it. Impact Exploiting this vulnerability allows an attacker to gain persistent, unauthorized access that completely bypasses multi-factor controls. T
Not a malware sample, but a full offensive toolkit recovered from an exposed open directory: a Java payload builder, serialized CommonsBeanutils2 gadgets, a shell stager, and the orchestration script that tied them together. Seven of the eight exploit directories were unmodified public PoCs. Hashes and the full toolkit breakdown are in the writeup. [https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell](https://hunt.io/blog/ukraine-state-data-exchange-graylog-log4shell)
Author here :) TLDR: on Oct 2, 333 exits (\~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.
On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised. These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic. Mozilla engineers responded immediately, blocking the affected certificates in Firefox using OneCRL , Mozilla’s centralized list of revoked certificates. OneCRL delivers this protection without requiring users to update or restart Firefox. By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations. Today, we are also releasing Firefox 158.0.1 for Desktop and Android, along with Firefox ESR 115.43.1 and Firefox ESR 153.5.1 . These releases will distribute this protection for a minority of users whose custom settings may have prevented them from receiving the OneCRL update. We are also updating the trusted certificate list in NSS ( NSS 3.131.1 ) to remove the root certificate that signed the affected intermediates. Firefox is already protected through OneCRL, but this additional update helps protect other applications that use Mozilla’s trust store or versions derived from it and do not receive OneCRL updates. Mozilla believes everyone has a fundamental right to security and privacy online. We remain c
Prompt injection, XSS and SIEM-exfil payloads living in reverse DNS, plus 28 fake Googlebots that passed FCrDNS
\- Google's own nameserver vouched for Russian IPs as Googlebot. \- One PTR addresses AI agents directly, and it passes forward confirmation. \- The exfil payload dodges filters for spaces, parentheses and quotes, and phones home to an IP written as one decimal number.
Apparent attempt to hack Rade Bajić’s iPhone comes amid efforts to undermine landmark criminal case A Serbian prosecutor who investigated the authorities’ allegedly illegal scheme to help the Trumps build a tower in Belgrade has been targeted with advanced spyware, expert analysis indicates. The finding suggests a disturbing new element in the authoritarian Serbian regime’s campaign to undermine what is believed to be the first criminal case related to global moneymaking drive of the US president’s family, which critics describe as a “pay to play” scheme trading the Trump administration’s favour for business opportunities. Continue reading...
Introducing pathrunner, a modular, cloud-native offensive security framework that automates the exploitation of AWS IAM privilege escalation paths.
Monday, October 19
A judge ordered Abdulrahman Alfozan to remain in custody, likening the Saudi government’s offer to secure the former OpenAI engineer’s release to a “blank check.”
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom. Hackers aligned with ShinyHunters have claimed credit for dozens of major data breaches since 2019, when the group was primarily operated by cybercriminals living in France. As those original members were arrested or jailed one by one, control over the ShinyHunters brand eventually passed to “ Rey ,” identified last year as a teenage hacker from Amman, Jordan. According to the FBI, ShinyHunters has extorted more than $70 million from victims so far this year. In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish the stolen files, which reportedly included medical and psychological records, Social Security numbers and home addresses, and information about each employee’s unit and specialization. The FBI jobs site hack has prompted the agency to move with uncommon speed to arrest, detain and question people who had any communications with Rey or other ShinyHunters suspects. Reuters reported on Oct
Presently sponsored by: After the Hugging Face incident, everyone asked the same thing. What did the agents actually do? Origin answers it: prompt to outcome. I have this sense that we've passed the point where "vibe coding" is a derogatory term. I have no empirical evidence for this; it's more a feeling that those weaponising the term have now accepted the inevitability and are just getting with the program. Or they've reskilled into other industries because, let's face it: you can't be a productive, competitive developer today without AI. I saw this comment from Linus Torvalds today which I thought really nailed it: ‼️ Linus Torvalds called rules against AI coding tools "UTTERLY STUPID" on the Linux kernel mailing list. He says people he respects and calls intelligent do not shy away from using new tools. https://t.co/HaQ8H4BrVc — International Cyber Digest (@IntCyberDigest) October 17, 2026 He's always had a way with words Anyway, here's what we're doing:
We tested Sonnet 5, Composer 2.5, and GPT 5.5 using set security rules to see whether using them produces measurably more secure code.
Sunday, October 18
The tech company says successful AI worms need more capability on less powerful devices, but current trends make that feasible by the end of the year Warnings about what artificial intelligence might do in the future – together with alarming reports of what it has gotten up to already – are being issued so quickly that even security experts have difficulty triaging what to worry about. Yet a report this week from Anthropic’s offensive research team grabbed attention by describing a new, practical threat, one devoid of human characteristics or apocalyptic musings. The red team, as such internal testers are called, said it created a malicious AI program that spread autonomously through internet-connected “smart” televisions and could do the same inside other ordinary devices. While machines running AI usually need a fair amount of computing power, the researchers said that their program split parts of itself among 15 televisions and was still able to function by using a bit of power from each. Continue reading...
Saturday, October 17
In the west the technology comes with at least some effort to provide security and a benign intent – not so from China There is much to fear from artificial intelligence developed in China and handed to businesses and governments in the west almost free of charge. Every month Chinese AI developers such as DeepSeek and Xiaomi dispatch the latest versions of their “open-weight” models that allow users to take the core software and use it without paying an expensive ongoing licence. Continue reading...
Researchers at Palo Alto Networks Unit 42 published an investigation into a sophisticated attack against a telecommunications provider. The original intrusion occurred in September 2024, but the newly published analysis documents previously unreported malware. Attackers initially exploited CVE-2024-47575 to compromise a FortiManager management appliance. They obtained configuration files and sensitive information associated with more than 500 FortiGate firewalls. The attackers subsequently deployed malware called PEERSTITCH. Its unusual feature is that it operates inside the memory of legitimate firewall processes rather than maintaining a conventional malware file on disk. The implant could manipulate VPN security checks while blending into normal network activity. The researchers did not establish that all 500 managed firewalls were compromised. This is an excellent example of why traditional antivirus scanning cannot detect every attack. Malware operating in memory may leave fewer conventional file-based indicators.
A formatter, minifier or deobfuscator can be made abused to change the entire logic. You can go try out all 186 techniques with this script: [https://divergence.trustsig.eu/](https://divergence.trustsig.eu/) Or try the Tetris-Snake demo here (Tetris runs normally, copy the *formatted* output from even just DevTools and it becomes Snake): [https://divergence-game.trustsig.eu/](https://divergence-game.trustsig.eu/) Blog/writeup post: [trustsig.eu/blog/javascript-divergence/](http://trustsig.eu/blog/javascript-divergence/)