> TODAY'S SUMMARY (1 articles)
Today’s cybersecurity news highlights critical vulnerabilities in PHP, known as PHP2Shell, which underscore issues in coordinated vulnerability disclosure. These vulnerabilities pose significant risks to enterprises relying on PHP for web applications, potentially exposing sensitive data and systems. Organizations are urged to assess their PHP implementations and apply necessary patches swiftly. Additionally, the ongoing trend of increasing sophistication in cyberattacks emphasizes the need for robust security measures and proactive incident response strategies. As attackers adapt, businesses must prioritize vulnerability management and employee training to mitigate risks effectively.
|
// AI-powered summary generated at 04:00
Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22.
The flaw lets anyone who can log in to the orchestrator, even with a read-only customer accoun...
The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.
Attackers are increasingly focusing on a limited range of critical vulnerabilities to run attacks with flaws packaged into exploits within as little as three days.
Rapid7’s latest Quarterly Threat Landscape report found the number of newly exploited vulnerabilities in Q3 of...
A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ’s calling library could allow a malicious caller to interfere with call terminat...
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates.
eMudhra said it will replace af...
The Earth is speeding up, the leap second is being abolished, oh, and there's critical vulnerabilities in PHP.
This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't ev...
One of the bill’s sponsors told CyberScoop it’s “incredibly expensive” for U.S. AI companies to stay ahead and distillation attacks incentivize stealing over innovation.
The post Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber a...
Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. For the stable distribution (trixie), these problems have been fixed in version 156.0.8078.47-1~deb13u1.
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...]
Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide.
The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42.
La Commission de protection des informations personnelles (PIPC) de Corée du Sud a appelé les responsables de traitement à prendre des mesures préventives suite à la découverte d'une vulnérabilité de sécurité critique dans le logiciel PHP.La vulnérabilité, nommée "PHP2Shell" et révélée le 21 octobre...
La présidente de la Commission Nationale de Protection des Données (CNPD) portugaise a participé à l'inauguration d'une exposition célébrant le 50ème anniversaire du Médiateur de la République.L'événement, qui s'est tenu le 15 octobre 2026 au Palais Vilalva, a marqué le lancement de l'exposition "Te...
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.
One of them, ZDI-CAN-33774, can be triggered before any network authentication. The...
L'autorité polonaise de protection des données (UODO) annonce la tenue d'une conférence en ligne sur l'articulation entre la liberté de la recherche scientifique et la protection des données personnelles.Cet événement, intitulé "Données de recherche, données personnelles. La liberté de la recherche...
L'Autorité polonaise de protection des données personnelles (UODO) a annoncé la poursuite de son initiative "L'UODO en tournée nationale" avec des visites prévues dans les voïvodies de Lublin et de Sainte-Croix.Cette campagne, lancée en septembre 2024, vise à sensibiliser les citoyens, les entrepris...
Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments.
The post The Current Landscape of OAuth Attacks appeared first on Unit 42.
L'Autorité de protection des données belge a classé sans suite une plainte relative à la gestion des témoins de connexion (cookies), les faits initiaux étant prescrits. Elle a néanmoins profité de cette décision pour rappeler les exigences de validité du consentement, notamment l'obligation d'offrir...
Users were misled about who could access their personal information on Facebook. Now Meta has been ordered to pay $25 billion.