> TODAY'S SUMMARY (16 articles)
Today's cybersecurity news highlights several significant threats and trends. Researchers have demonstrated a remote code execution (RCE) exploit in Node.js, termed "Node2Shell," that leverages malicious Brotli data to run attacker-supplied code. Additionally, attackers are attempting to exploit newly disclosed PHP2Shell vulnerabilities to incorporate systems into a Mirai botnet variant, with attempts noted just days prior to patch releases. Iran's "Prince of Persia" APT has reestablished a command and control server in the U.S. after several years. Meanwhile, INTERPOL's Operation Serengeti III has resulted in over 1,400 arrests and the recovery of $105 million, showcasing ongoing global efforts to combat cybercrime. Lastly, a serious breach at Capcom has exposed 11.7 million accounts, underscoring the persistent risks of data leaks.
|
// AI-powered summary generated at 08:01
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables.
Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in s...
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. The service scans codebases for vulnerabilities and suggests patches for review. It is powered by the company’s full family of models, inclu...
Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform
A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC checks, uses Dell’s real template, and confirms a $736.09 purchase of Microsoft Project Standard 2024 that you never made. Under “Ship To,” where an address should b...
Fortinet a publié le 22 octobre des correctifs urgents pour FortiOS, FortiManager et FortiAnalyzer, contre des failles critiques détectées grâce à l'IA.
Le post FortiGate, FortiManager : Fortinet vous demande de patcher tout de suite, mais sans dire ce qu’il corrige a été publié sur IT-Connect.
Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.
The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek.
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access....
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fixed PAN-OS releases yet. Fortinet and Cisco published their own adviso...
Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.
The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek.
Join Detego Global in SĂŁo Paulo on 26 November 2026 for an exclusive event showcasing cutting-edge digital forensics, AI-powered evidence analysis, and investigation management solutions designed to help investigators uncover critical evidence faster.
Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers.
The post Encryption isn’t enough to protect data wherever it goes appeared first on CyberScoop.
Misaligned incentives led to an intractable argument
A New Mexico judge ordered Meta to pay $25 billion for misleading Facebook users about their data. What the Cambridge Analytica ruling means.
Initial attempts were observed on October 17, and mass activity began shortly after patches were released.
The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek.
Two lawsuits allege delivery robots scanned customers’ faces without consent, linked scans to names and addresses, and used them to train AI.
Software can expose complex functionality to unauthenticated users even when that functionality is disabled or unnecessary. Anthropic’s Frontier Red Team used Claude to examine 25 open-source projects and reported 493 issues involving unnecessary exposure, conflicting settings, and code running befo...
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up. Tracked as CVE-2026-113380, the vulnerability affects RingRTC versions before 2.72.0. RingRTC is the open source library that powers voice and video ca...
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor.
On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub...