> TODAY'S SUMMARY (46 articles)
Today's cybersecurity landscape reveals significant threats across various sectors. Capcom confirmed a data breach exposing 11.7 million user accounts, emphasizing the risks associated with gaming platforms. In a concerning trend, an attacker compromised Microsoft 365 accounts at 79 organizations without needing passwords, utilizing replayed sign-in sessions and hidden inbox rules. Vulnerabilities in PHP continue to be exploited, with millions of attack attempts related to PHP2Shell and newly discovered RCE flaws prompting urgent patching. Additionally, Russian-linked hackers have launched destructive attacks in Ukraine, while compromised TLS certificates from eMudhra Limited highlight the ongoing risks in digital trust infrastructure. The rise of AI in cybersecurity is also notable, with AI tools being used both defensively and as vectors for new attacks.
|
// AI-powered summary generated at 12:01
Le 20 octobre 2026, PHP a publié une communication concernant deux vulnérabilités critiques. L'éditeur annonce la disponibilité des correctifs de sécurité pour le 21 octobre 2026 à 16h00 heure de Paris (14h00 UTC). Pour les versions de PHP 5.x, 6.x, 7.x, 8.0.x et 8.1.x , dont l'éditeur n'assure...
Meishi-KY (Meishi Daren Co., Ltd.) a annoncé que certains de ses systèmes d'information ont été victimes d'une cyberattaque. La société a immédiatement activé son mécanisme de réponse aux incidents de sécurité et fait appel à des experts externes pour l'enquête et la réparation. Selon l'évaluation p...
Robert Wayne Boling Jr. was the mastermind of an identity theft conspiracy that victimized thousands of military members and veterans. He faces up to 40 years in prison.
The post Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers appeared first on...
Massive clean-up job under way because this mess makes it possible to impersonate any website or service
The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern). The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. PHP is the programming language WordPress is bui...
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.
IQ.Lvbs implies that rival Comma.ai isn't playing fair
In a victory for data privacy, a federal court in New York definitively ruled that the Office of Personnel Management (OPM) violated the law when it disclosed millions of federal employee records to DOGE agents. In a summary judgment ruling issued on October 20, 2026, the court found that OPM violat...
Security researchers have found a critical flaw in the Linux kernel’s networking stack that can let attackers escape a KVM virtual machine and execute code on the host system. The weakness could also potentially let attackers compromise systems running other Linux-based virtua...
USN-8944-1 updated ca-certificates. This update provides the corresponding
changes for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS by removing the "emSign ECC Root CA - G3" and "Comodo AAA
Services root" CA certificates.
Original advisory details:
This update remove...
It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates. For the stable distribution (trixie), this problem has been fixed in
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. [...]
The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.
One of eMudhra's certificate authority private keys is the number 4.Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from
Chukwuemeka Victor Amachukwu hacked tax preparation businesses, filed false tax returns and enticed victims to send him money for investment schemes.
The post Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme appeared first on CyberScoop.
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. [...]
The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.
XZ Utils could be made to crash or run programs if it processed specially crafted compressed files under certain conditions.
Protocol Buffers could be made to crash if it received specially crafted input.
Wordfence Argus helped uncover CVE-2026-82814, a high-severity unauthenticated PHP object injection in Duplicator and Duplicator Pro. Update to version 5.0.0 or newer.
The post Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator appeared first on Wordfence.