> TODAY'S SUMMARY (16 articles)
Today's cybersecurity news highlights several significant threats and trends. Researchers have demonstrated a remote code execution (RCE) exploit in Node.js, termed "Node2Shell," that leverages malicious Brotli data to run attacker-supplied code. Additionally, attackers are attempting to exploit newly disclosed PHP2Shell vulnerabilities to incorporate systems into a Mirai botnet variant, with attempts noted just days prior to patch releases. Iran's "Prince of Persia" APT has reestablished a command and control server in the U.S. after several years. Meanwhile, INTERPOL's Operation Serengeti III has resulted in over 1,400 arrests and the recovery of $105 million, showcasing ongoing global efforts to combat cybercrime. Lastly, a serious breach at Capcom has exposed 11.7 million accounts, underscoring the persistent risks of data leaks.
|
// AI-powered summary generated at 08:01
USN-8890-1 fixed vulnerabilities in libsoup. This update provides the
corresponding updates for libsoup3 on Ubuntu 26.10.
Original advisory details:
It was discovered that libsoup incorrectly handled certain HTTP/2
requests.
A remote attacker could possibly use this issue to cause a denial of...
A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countri...
Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code e...
Several vulnerabilities were discovered in BIND, a DNS server implementation, which could result in denial of service or remote code execution. For the stable distribution (trixie), these problems have been fixed in version 1:9.20.30-1~deb13u1.
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated attackers to execute code on affected web servers. Both carry a CVSS v4.0 score of 9.2, and exploitation attempts are already being observed in the wild.
PHP has released the following fixed versions:
PH...
Several security issues were fixed in c-ares.
EVP of Microsoft Security Hayete Gallot writes in a blog post that AI agents operating independently within companies could be a serious security threat. According to Microsoft, today’s most advanced AI models cannot be fully trusted.
Not because they are malicious, but bec...
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]
The Cambridge Analytica data privacy scandal from a decade ago is still weighing on Meta's finances.
The CA certificates in the nss package were updated.
Up to 500 under-resourced utilities will receive support in order to bolster their cybersecurity through a private sector initiative launched this week.
OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misa...
From AI-discovered PHP vulnerabilities to flaws in Node.js and popular AI tool LiteLLM, cybersecurity teams have plenty to worry about this week.
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.
The fix matters even for administrators who patched nine days earlier: the October 12 update c...
Several security issues were fixed in Ghostscript.
Hidden instructions told WhatsApp’s chatbot not to suggest privacy regulators to users struggling to delete their accounts.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...]
The pair stressed the latest update showed no country is pursuing the technically challenging effort to interfere with or hack into the country’s election infrastructure or tamper directly with votes.
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.
The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog.