The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP.
Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fad...
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws Details of two critical PHP vulnerabilities, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, leaked online ahead of coordinated disclosure, prompting the PHP project to urge all users to prepare for immediate patch...
A flaw in Signal’s calling library could let another participant keep hearing you after you hang up. Update your app to get the latest fixes.
Give your agents freedom to do useful work by locking them down
The private keys associated with eight certificates were compromised, and root programs and trust stores are blocking them.
The post Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys appeared first on SecurityWeek.
Proton now supports admin roles and SCIM for groups, enabling you to manage organizational access easily and more securely.
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the firewalls relying on cookie...
Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses 'absolutely substandard'
There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS).
Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the group’s tactics
The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems.
The post China Defends DeepSeek After US Ban of Its AI From Government Systems appeared first on SecurityWeek.
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.
PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out o...
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harness i...
Private keys associated with eight intermediate certificate authorities operated by Indian digital trust provider eMudhra have been compromised, potentially allowing attackers to forge trusted certificates and impersonate websites or services, according to Google and Mozilla....
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.
Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to...
Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches
The CA certificates in the ca-certificates package were updated.
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. [...]
Several security issues were fixed in .NET.