[{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Primary npm/PyPI supply-chain research; the origin of the Shai-Hulud package-version figures this project already cites. Fills the Supply Chain category, which had keyword rules but no dedicated feed. filter_uncategorized drops product/marketing posts.","created_at":"2026-10-28T09:25:16.676207+00:00","id":42968,"published_date":"2026-10-28T10:00:00+00:00","severity":"medium","source_name":"Aikido Security","summary":"Aikido launches external network pentesting: AI agents attack your internet-facing systems from the outside and report only findings they actually exploit. Category: Company Updates","title":"Aikido launches external network pentesting","url":"https://www.aikido.dev/blog/aikido-launches-external-network-pentesting"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-28T09:25:09.532872+00:00","id":42966,"published_date":"2026-10-28T09:14:23+00:00","severity":"high","source_name":"SecurityWeek","summary":"CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution. The post Hackers Start Probing Fresh Oracle EBS Vulnerability appeared first on SecurityWeek.","title":"Hackers Start Probing Fresh Oracle EBS Vulnerability","url":"https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-28T09:25:09.534329+00:00","id":42967,"published_date":"2026-10-28T08:37:24+00:00","severity":"critical","source_name":"SecurityWeek","summary":"CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit. The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.","title":"CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts","url":"https://www.securityweek.com/cisa-warns-of-node2shell-exploitation-as-honeypots-log-attack-attempts"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-28T09:25:18.878751+00:00","id":42969,"published_date":"2026-10-28T08:34:17+00:00","severity":"medium","source_name":"Security Affairs","summary":"Three Japan-focused cyberattacks show how AI helps hackers scale operations, while exploiting old systems and weak security remains key. In autumn 2026, Japanese companies and other organizations reported a series of data leaks involving their web systems. On October 9, Japan\u2019s National Cybersecurity Office issued a warning to businesses, while the head of the ruling [\u2026]","title":"Three Japan-Focused Cyberattacks Show How Hackers Use AI","url":"https://securityaffairs.com/201913/ai/three-japan-focused-cyberattacks-show-how-hackers-use-ai.html"},{"category":"Cloud Security","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-28T07:25:07.875561+00:00","id":42927,"published_date":"2026-10-28T07:13:21+00:00","severity":"medium","source_name":"The Hacker News","summary":"Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice. The service hosts Windows desktops used for FX trading,","title":"Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach","url":"https://thehackernews.com/2026/10/japans-gmo-offers-1-million-bounty-to.html"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-28T07:25:34.385141+00:00","id":42931,"published_date":"2026-10-28T06:30:35+00:00","severity":"medium","source_name":"Help Net Security","summary":"In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He argues that \u201cpatch faster\u201d is not enough and that teams need to cut exposure while remediation is pending. Blakley describes a shared metric for CIOs and CISOs, how his team tests for silent model updates, who owns the damage when an AI agent makes a mistake, and why blocking \u2026 More \u2192 The post Bellini Capital CISO on AI security governance and the limits of patching faster appeared first on Help Net Security.","title":"Bellini Capital CISO on AI security governance and the limits of patching faster","url":"https://www.helpnetsecurity.com/2026/10/28/brian-blakley-bellini-capital-ai-security-governance"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-28T07:25:08.507940+00:00","id":42928,"published_date":"2026-10-28T06:20:37+00:00","severity":"high","source_name":"The Hacker News","summary":"Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how Tailscale SSH forwards network connections, a job the Tailscale background process carries out with root privileges. To use them, an attacker must","title":"Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers","url":"https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-28T07:25:08.508570+00:00","id":42929,"published_date":"2026-10-28T06:04:58+00:00","severity":"high","source_name":"The Hacker News","summary":"The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address","title":"ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws","url":"https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-28T09:25:09.408169+00:00","id":42965,"published_date":"2026-10-28T06:00:00+00:00","severity":"medium","source_name":"Dark Reading","summary":"Interpol's annual Operation Serengeti, now on its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds.","title":"Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature","url":"https://www.darkreading.com/cybersecurity-operations/third-serengeti-sweep-1400-arrests-investigations-mature"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-28T07:25:08.510106+00:00","id":42930,"published_date":"2026-10-28T05:42:26+00:00","severity":"critical","source_name":"The Hacker News","summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in","title":"Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges","url":"https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-28T07:25:34.402433+00:00","id":42932,"published_date":"2026-10-28T05:30:29+00:00","severity":"medium","source_name":"Help Net Security","summary":"The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive federal systems. The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), explains which cryptographic methods need to be replaced, what organizations should consider and how the transition will unfold. It builds on the post-quantum cryptography standards NIST released in August 2024. Those standards provide new ways to protect information against \u2026 More \u2192 The post NIST starts the countdown to retire quantum-vulnerable encryption appeared first on Help Net Security.","title":"NIST starts the countdown to retire quantum-vulnerable encryption","url":"https://www.helpnetsecurity.com/2026/10/28/nist-post-quantum-cryptography-migration-roadmap"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-28T05:25:37.265318+00:00","id":42908,"published_date":"2026-10-28T05:00:19+00:00","severity":"medium","source_name":"Help Net Security","summary":"Nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier, according to its Data Breach Outlook 2026. Businesses rely on outside providers to store information, process transactions and operate software. A breach at one of those providers can expose customer records across multiple organizations, including people who have never heard of the company holding their data. Percentage of individuals impacted due to a third party, by industry \u2026 More \u2192 The post Breach victims discover their data was held by companies they\u2019ve never heard of appeared first on Help Net Security.","title":"Breach victims discover their data was held by companies they\u2019ve never heard of","url":"https://www.helpnetsecurity.com/2026/10/28/kroll-third-party-data-breaches-insurance-claims-report"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-28T01:25:21.296472+00:00","id":42640,"published_date":"2026-10-28T00:47:17+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"October 27, 2026 \u2013 Gatineau, Quebec Privacy Commissioner of Canada Philippe Dufresne has opened an investigation related to a cybersecurity incident involving tips shared with Crime Stoppers programs across Canada. The Commissioner initiated the investigation into Navigate360, the commercial organization that provides and manages the tip management platform used by Canadian Crime Stoppers\u2019 chapters. The...","title":"Privacy Commissioner of Canada to investigate data breach involving Crime Stoppers","url":"https://databreaches.net/2026/10/27/privacy-commissioner-of-canada-to-investigate-data-breach-involving-crime-stoppers"},{"category":"Malware/Infostealer","confidence":"MEDIUM","confidence_reason":"Threat-intelligence firm with strong primary supply-chain and AI-attack research (LiteLLM supply-chain compromise, npm typosquatting crossing WSL into Windows). Adds non-US-centric coverage. Commercial context, hence Tier 2.","created_at":"2026-10-28T07:25:45.086959+00:00","id":42933,"published_date":"2026-10-28T00:00:00+00:00","severity":"medium","source_name":"CloudSEK","summary":"A new Android malware operation called MR ROBOT is turning banking fraud into a subscription business. CloudSEK\u2019s investigation reveals how cybercriminals rent customised banking trojans to steal OTPs, card details, UPI PINs and credentials while secretly forwarding calls to bypass security checks. One tracked affiliate intercepted 5,407 SMS messages across 153 infected devices, exposing the scale of this Malware-as-a-Service operation targeting Indian bank customers. Authors : Bhavik Malhotra","title":"Inside \"MR ROBOT\" - Anatomy of a Malware-as-a-Service Operation Targeting Indian Bank Customers","url":"https://www.cloudsek.com/blog/inside-mr-robot-malware-as-a-service-targeting-indian-bank-customers"},{"category":"Ransomware","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-28T01:25:13.752191+00:00","id":42553,"published_date":"2026-10-27T23:35:51+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today. [...]","title":"Japan's GMO urges customers to shut down PCs amid ransomware threat","url":"https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Firmware/hardware supply-chain security, second source for the below-the-OS gap alongside Binarly (BMC vulnerabilities, network-device CVE analysis). Weakest of this batch on inspection \u2014 roughly a third of the feed is a recurring 'BTS #NN' podcast plus conference and compliance marketing, so the podcast series is dropped via exclusions.yml.","created_at":"2026-10-27T23:26:01.384302+00:00","id":42452,"published_date":"2026-10-27T23:17:12+00:00","severity":"medium","source_name":"Eclypsium","summary":"Critical flaw in EDK2 allows attackers to execute code early in the boot process. The post Ars Technica: Code-execution flaw in UEFI firmware affects most servers on planet Earth appeared first on Eclypsium.","title":"Ars Technica: Code-execution flaw in UEFI firmware affects most servers on planet Earth","url":"https://eclypsium.com/news/ars-technica-code-execution-flaw-in-uefi-firmware-affects-most-servers-on-planet-earth"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T23:25:20.623716+00:00","id":42382,"published_date":"2026-10-27T22:43:27+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems. [...]","title":"OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests","url":"https://www.bleepingcomputer.com/news/artificial-intelligence/openais-gpt-61-terra-is-safer-overall-but-shows-more-destructive-action-flags-in-tests"},{"category":"Ransomware","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T22:23:11.055142+00:00","id":42364,"published_date":"2026-10-27T22:07:34+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]","title":"UNM Health ransomware attack disrupts patient care, surgeries","url":"https://www.bleepingcomputer.com/news/security/unm-health-ransomware-attack-disrupts-patient-care-surgeries"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party Cisco PSIRT advisories (IOS/ASA/FTD/NX-OS). Authoritative earliest source for a heavily-exploited enterprise network product line. Pure advisory feed \u2014 no filter_uncategorized, an uncategorized Cisco advisory is still signal.","created_at":"2026-10-27T22:23:18.434544+00:00","id":42369,"published_date":"2026-10-27T21:30:00+00:00","severity":"critical","source_name":"Cisco PSIRT","summary":"On October 21, 2026, Node.js announced the availability of fixes for multiple vulnerabilities across the following supported release lines: 22.x, 24.x, and 26.x. These vulnerabilities impact critical operations such as the Brotli decoder, DNS resolution, and TLS certificate validation. The vulnerabilities pose risks for remote code execution and traffic interception. For more information, see Node.js Security Release. The following vulnerabilities have a Security Impact Rating (SIR) of High and are addressed in this advisory: CVE-2026-111497 - Brotli decoder out-of-bounds write; potential remote code execution CVE-2026-105482 - DNS resolution truncation involving embedded NUL characters CVE-2026-105483 - TLS hostname validation bypass using fullwidth IP digits CVE-2026-106069 - TLS hostname validation bypass with noncanonical IP addresses Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u Security Impact Rating: High","title":"Vulnerabilities in node.js Affecting Cisco Products: October 2026","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-oct2026-node-js-Jj3SQ19u?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DVulnerabilities+in+node.js+Affecting+Cisco+Products%3A+October+2026%26vs_k%3D1"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-27T22:23:19.338348+00:00","id":42370,"published_date":"2026-10-27T21:21:27+00:00","severity":"medium","source_name":"CyberScoop","summary":"Open-source maintainers are so overwhelmed by AI-generated security reports that some have stopped accepting them. OpenAI\u2019s Daybreak lead says the fix is higher-quality findings and far more coordination. The post Before you file that AI bug report, OpenAI has some advice appeared first on CyberScoop.","title":"Before you file that AI bug report, OpenAI has some advice","url":"https://cyberscoop.com/openai-ai-generated-bug-reports"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T22:23:11.057286+00:00","id":42365,"published_date":"2026-10-27T20:57:25+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]","title":"Hackers hijack Convertr analytics script to steal payment card data","url":"https://www.bleepingcomputer.com/news/security/hackers-hijack-convertr-analytics-script-to-steal-payment-card-data"},{"category":"Ransomware","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-27T22:23:11.725538+00:00","id":42366,"published_date":"2026-10-27T20:42:40+00:00","severity":"medium","source_name":"Dark Reading","summary":"Main bombing sis getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.","title":"External Teams Chats Anchor 15-Minute Malware Delivery","url":"https://www.darkreading.com/cloud-security/email-bombing-external-teams-chats-repeatable-access-path"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-27T22:23:19.342368+00:00","id":42371,"published_date":"2026-10-27T20:41:16+00:00","severity":"medium","source_name":"CyberScoop","summary":"Anthropic has said out-of-control AI poses a threat to the world, but perhaps unsurprisingly suggests that profit will shape those decisions, too. The post All the security risks Anthropic is worried about before its IPO appeared first on CyberScoop.","title":"All the security risks Anthropic is worried about before its IPO","url":"https://cyberscoop.com/anthropic-ipo-filing-cybersecurity-risks"},{"category":"Ransomware","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-27T22:23:11.996328+00:00","id":42368,"published_date":"2026-10-27T20:40:00+00:00","severity":"medium","source_name":"The Record","summary":"Ukrainian national Artem Stryzhak, 36, had pleaded guilty last year to charges related to participating in at least two well-known ransomware groups.","title":"Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea","url":"https://therecord.media/nefilim-hive-ransomware-operator-70-months-prison"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T22:23:19.535040+00:00","id":42372,"published_date":"2026-10-27T20:36:24+00:00","severity":"critical","source_name":"DataBreaches.net","summary":"Multiple Ontario Crime Stoppers organizations have suspended use due to Navigate360\u2019s data breach and unacceptable incident response; U.S. state education departments are collaborating to seek more answers from Navigate360; an update from DataBreaches.net. Toronto Crime Stoppers didn\u2019t take long to respond after Val\u00e9rie Ouellet and Michelle Allan dove into the Crime Stoppers data in the...","title":"Navigate360\u2019s lack of transparency is catching up with them; More organizations tell people NOT to use their tiplines.","url":"https://databreaches.net/2026/10/27/navigate360s-lack-of-transparency-is-catching-up-with-them-more-organizations-tell-people-not-to-use-their-tiplines"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Mainstream technical journalism with unusually rigorous security reporting (Dan Goodin). Fills the general-audience gap between trade press and vendor research. filter_uncategorized drops non-security items.","created_at":"2026-10-27T22:23:22.998315+00:00","id":42373,"published_date":"2026-10-27T20:25:55+00:00","severity":"medium","source_name":"Ars Technica (Security)","summary":"Critical flaw in EDK2 allows attackers to execute code early in the boot process.","title":"Code-execution flaw in UEFI firmware affects most servers on planet Earth","url":"https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.212328+00:00","id":42323,"published_date":"2026-10-27T20:10:30+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"Bill Toulas reports: The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. The educational organization detected the breach last Tuesday and disclosed it on Friday. In an update yesterday, the university added another 20,000 staff and students whose PIN codes were exposed....","title":"University of Copenhagen data breach exposes data of 525,000 people","url":"https://databreaches.net/2026/10/27/university-of-copenhagen-data-breach-exposes-data-of-525000-people"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-27T22:23:11.726625+00:00","id":42367,"published_date":"2026-10-27T19:58:06+00:00","severity":"medium","source_name":"Dark Reading","summary":"A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.","title":"SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack","url":"https://www.darkreading.com/cyber-risk/sboms-alone-scope-supply-chain-attack"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.214540+00:00","id":42324,"published_date":"2026-10-27T19:49:30+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"Dawn Kopecki reports: The US Federal Election Commission\u2019s website has been targeted by a hacker or hackers, disrupting the agency\u2019s electronic filings system a week before the November 3 elections, according to an email seen by Reuters. In a statement, the FEC said that, \u201cat this time, the FEC\u2019s electronic filing system is currently offline...","title":"Hacking attempts against US Federal Election Commission system triggered outage, email shows","url":"https://databreaches.net/2026/10/27/hacking-attempts-against-us-federal-election-commission-system-triggered-outage-email-shows"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-27T20:23:25.725723+00:00","id":42321,"published_date":"2026-10-27T19:30:00+00:00","severity":"medium","source_name":"The Record","summary":"DOJ action against five foreign nationals \u2014 plus a sting in Madagascar \u2014 highlight the expanding global reach of the scam center industry.","title":"US indicts Malaysian national after Madagascar scam operation uncovered","url":"https://therecord.media/malaysian-national-indicted-after-scam-centers-raid-madagascar"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-27T20:23:38.511400+00:00","id":42334,"published_date":"2026-10-27T19:12:30+00:00","severity":"medium","source_name":"Security Affairs","summary":"Italy \u2019s Parliament cyberattack highlights hybrid warfare risks and the need for transparency, stronger defenses and accountability. The cyberattack targeting email accounts at Italy\u2019s Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, raises questions that go well beyond the security of individual inboxes. At a time when European institutions face [\u2026]","title":"Italy \u2019s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters","url":"https://securityaffairs.com/201867/hacking/italys-parliament-under-cyber-pressure-why-the-attack-on-the-chamber-matters.html"},{"category":"OT/ICS","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-27T20:23:35.165160+00:00","id":42333,"published_date":"2026-10-27T19:11:02+00:00","severity":"medium","source_name":"The Register (Security)","summary":"One critical, three high-severity EPICS bugs could disrupt research experiments","title":"AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours","url":"https://www.theregister.com/security/2026/10/27/ai-hacker-finds-4-severe-bugs-in-popular-industrial-control-software-in-under-4-hours/5305811"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.215418+00:00","id":42325,"published_date":"2026-10-27T19:01:39+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"UA News reports: In Moldova, the personal data of approximately 750,000 people may have been stolen following a cyberattack on government digital services. Prime Minister Vasile Tofan stated that such attacks may become increasingly frequent, so the country needs to strengthen its cybersecurity and invest more in the security of government systems. Some online services...","title":"Moldova Issues Warning About New Cyberattacks Following a Data Breach","url":"https://databreaches.net/2026/10/27/moldova-issues-warning-about-new-cyberattacks-following-a-data-breach"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.218476+00:00","id":42326,"published_date":"2026-10-27T18:59:41+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"Avery Kreemer reports: Ohio Auditor Keith Faber announced that his office\u2019s web server was attacked by \u201coverseas cybercriminals and potentially foreign state actors,\u201d prompting the state to temporarily take down the server. Faber said there\u2019s no reason to believe Ohioans\u2019 personal financial information is at risk as a result of the attack, which came on...","title":"Ohio auditor: Cyber attack on state server carried out by possible \u2018foreign state actors\u2019","url":"https://databreaches.net/2026/10/27/ohio-auditor-cyber-attack-on-state-server-carried-out-by-possible-foreign-state-actors"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.220572+00:00","id":42327,"published_date":"2026-10-27T18:53:14+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"The Lokmat Times Desk reports: A cyber attack on the digital systems of Kamalnayan Bajaj Hospital has sent shockwaves through the city. Around midnight, hackers broke into all nine of the hospital\u2019s servers and encrypted its entire data in what appears to be a digital heist aimed at extorting money. The attack has put patient...","title":"IN: 9 servers of Bajaj Hospital hacked in cyberattack at 3 am, sensitive data stolen; systems encrypted","url":"https://databreaches.net/2026/10/27/in-9-servers-of-bajaj-hospital-hacked-in-cyberattack-at-3-am-sensitive-data-stolen-systems-encrypted"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.222656+00:00","id":42328,"published_date":"2026-10-27T18:49:27+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"DysruptionHub reports: A cyberattack forced the University of New Mexico Health System to divert ambulances and cancel clinic appointments Monday, interrupting care at the state\u2019s only Level I trauma center. The Albuquerque-based academic health system canceled appointments at more than 30 clinics across New Mexico. Patients were told not to come to its facilities for...","title":"Cyberattack forces University of New Mexico Health to divert ambulances, cancel appointments","url":"https://databreaches.net/2026/10/27/cyberattack-forces-university-of-new-mexico-health-to-divert-ambulances-cancel-appointments"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-27T20:23:38.513167+00:00","id":42335,"published_date":"2026-10-27T18:41:51+00:00","severity":"medium","source_name":"Security Affairs","summary":"Australia\u2019s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale. Australia\u2019s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is [\u2026]","title":"Australia\u2019s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking","url":"https://securityaffairs.com/201859/ai/australias-cyber-spy-chief-expect-more-disruption-as-ai-accelerates-hacking.html"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.223582+00:00","id":42329,"published_date":"2026-10-27T18:41:50+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"John & Rusty Report: An attacker used a \u201cphishing\u201d strategy to get unauthorized access to Covered California agent information spreadsheets May 13, according to a sample breach notice letter posted on the California attorney general\u2019s website Oct. 16. \u201cAs a result of this incident, your information, along with information relating to other agents, was disclosed,\u201d...","title":"Covered California Agent Data Exposed In Phishing Attack","url":"https://databreaches.net/2026/10/27/covered-california-agent-data-exposed-in-phishing-attack"},{"category":"Ransomware","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-27T20:23:33.932983+00:00","id":42322,"published_date":"2026-10-27T18:33:41+00:00","severity":"medium","source_name":"CyberScoop","summary":"Artem Stryzhak participated in a series of ransomware attacks on hospitals, government entities and law firms from the middle of 2018 to late 2021. The post Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison appeared first on CyberScoop.","title":"Prolific Hive and Nefilim ransomware affiliate sentenced to 70 months in prison","url":"https://cyberscoop.com/nefilim-hive-ransomware-affiliate-artem-stryzhak-sentenced"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T20:23:09.633075+00:00","id":42316,"published_date":"2026-10-27T18:26:46+00:00","severity":"medium","source_name":"The Hacker News","summary":"Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published","title":"CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets","url":"https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.224280+00:00","id":42330,"published_date":"2026-10-27T18:21:15+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"Bruce Giles reports: Business services provider Conduent has agreed to pay $80 million to settle class action litigation over the third-largest healthcare data breach on record, which exposed data on about 62.2 million people. Conduent signed the settlement Oct. 16 with plaintiffs in the U.S. District Court for the District of New Jersey, according to...","title":"Conduent to pay $80M to settle 3rd-largest healthcare data breach","url":"https://databreaches.net/2026/10/27/conduent-to-pay-80m-to-settle-3rd-largest-healthcare-data-breach"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.225847+00:00","id":42331,"published_date":"2026-10-27T18:21:10+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"Thomas Brewster reports: Crypto thieves are targeting iPhone users at scale with a sneaky kind of cyberattack that only requires victims to view an ad or visit an infected webpage, researchers tell Forbes. Hundreds of websites have been compromised as part of the hack, they say and, in one case, a malware ad was served...","title":"Hackers Are Serving Malware To iPhones Via Hundreds Of Infected Websites","url":"https://databreaches.net/2026/10/27/hackers-are-serving-malware-to-iphones-via-hundreds-of-infected-websites"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Independent breach-focused journalism (Dissent Doe). Covers incidents mainstream outlets skip. Promoted 3 -> 2 on 2026-08-29: the prior entry set Tier 3 explicitly 'until track record is established in our pipeline', and it now is \u2014 sustained accurate breach reporting at ~3/day, including carrying the McKesson disclosure while Bleeping Computer was dark. Single-author with no masthead peer review, which is why it stops at Tier 2 rather than Tier 1.","created_at":"2026-10-27T20:23:34.226713+00:00","id":42332,"published_date":"2026-10-27T18:20:59+00:00","severity":"medium","source_name":"DataBreaches.net","summary":"The following is a machine translation of an article that originally appeared in Russian. Boris Piletskiy writes: On October 22, Capcom acknowledged a massive user data breach. A hacker managed to breach Capcom ID and access data for 11.7 million accounts: We recently discovered that a third party gained unauthorized access to our systems, resulting...","title":"Hacker breached Capcom ID \u2013 obtained data from 11 million accounts and started changing passwords","url":"https://databreaches.net/2026/10/27/hacker-breached-capcom-id-obtained-data-from-11-million-accounts-and-started-changing-passwords"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T18:23:11.917185+00:00","id":42282,"published_date":"2026-10-27T18:20:28+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]","title":"Microsoft releases Windows OOB updates to distrust eMudhra certificates","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-oob-updates-to-distrust-emudhra-certificates"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-27T18:23:28.199692+00:00","id":42295,"published_date":"2026-10-27T18:14:19+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Bulletin ID: 2026-152-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/27/2026 11:00 AM PDT Description: The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It can be configured to serve the streamable-http transport with OAuth authentication, validating a bearer token against an identity provider nominated by the operator. We identified CVE-2026-115413 in versions >=1.3.0 and <1.6.0, the server validates a token's signature, issuer and expiry, but not the claim identifying the application the token was issued for. Impacted versions: >=1.3.0 AND <1.6.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article","title":"CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-152-aws"},{"category":"Supply Chain","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-27T20:23:25.581643+00:00","id":42320,"published_date":"2026-10-27T18:12:53+00:00","severity":"medium","source_name":"Reddit r/netsec","summary":"submitted by /u/mabote [link] [comments]","title":"GhostAction Crosses Paths With PolinRider","url":"https://www.reddit.com/r/netsec/comments/1xh04rd/ghostaction_crosses_paths_with_polinrider"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T18:23:28.526838+00:00","id":42296,"published_date":"2026-10-27T17:38:51+00:00","severity":"critical","source_name":"Help Net Security","summary":"A vulnerability in Brotli, Google\u2019s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as \u201cNode2Shell\u201d, \u201cBroccoli2Shell\u201d and \u201cBrotli2Shell\u201d, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node.js publicly disclosed it on October 21, 2026. \u201cAn attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process \u2026 More \u2192 The post Brotli bug reaches far beyond Node.js (CVE-2026-111497) appeared first on Help Net Security.","title":"Brotli bug reaches far beyond Node.js (CVE-2026-111497)","url":"https://www.helpnetsecurity.com/2026/10/27/node2shell-broccoli2shell-vulnerability-cve-2026-111497"},{"category":"Malware/Infostealer","confidence":"HIGH","confidence_reason":"University of Toronto \u2014 gold-standard surveillance/spyware research. NSO Group, Predator, Pegasus. filter_uncategorized drops political commentary, keeps classified threat research.","created_at":"2026-10-27T17:23:15.417125+00:00","id":42270,"published_date":"2026-10-27T16:49:55+00:00","severity":"medium","source_name":"The Citizen Lab","summary":"New findings by the Citizen Lab and SHARE Foundation show that a prominent supporter of Serbia's student movement was targeted with spyware. The post Serbian Prosecutor Who Investigated Belgrade Trump Tower Project \u2018Targeted with Spyware\u2019 appeared first on The Citizen Lab.","title":"Serbian Prosecutor Who Investigated Belgrade Trump Tower Project \u2018Targeted with Spyware\u2019","url":"https://citizenlab.ca/serbian-prosecutor-who-investigated-belgrade-trump-tower-project-targeted-with-spyware"},{"category":"Malware/Infostealer","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-27T18:23:12.367828+00:00","id":42283,"published_date":"2026-10-27T16:47:20+00:00","severity":"medium","source_name":"Dark Reading","summary":"The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.","title":"'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants","url":"https://www.darkreading.com/endpoint-security/aokigahara-stealer-developer-keyrings-ai-assistants"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Cloud security posture and vulnerability research. Vendor context; filter_uncategorized drops product marketing.","created_at":"2026-10-27T18:23:30.090933+00:00","id":42297,"published_date":"2026-10-27T16:46:00+00:00","severity":"medium","source_name":"Orca Security","summary":"On Thursday, a customer marketing manager vibe codes a community portal where customers can sign in, post questions, and search past answers. By Friday it\u2019s live on Vercel, with a custom domain, an OPENAI_API_KEY for the AI search saved as a plain config variable, and a database full of customer names, emails, and support threads. [\u2026]","title":"Securing Vercel at Scale: From One Team to Every Team","url":"https://orca.security/resources/blog/securing-vercel-at-scale-from-one-team-to-every-team"},{"category":"Ransomware","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-27T18:23:31.405095+00:00","id":42298,"published_date":"2026-10-27T16:45:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"The University of New Mexico is working to restore systems following the incident, which has been claimed by the BYOD ransomware group","title":"Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances","url":"https://www.infosecurity-magazine.com/news/cyber-unmhealth-surgeries"},{"category":"SaaS Breach","confidence":"HIGH","confidence_reason":"Authoritative vulnerability disclosure program, coordinates with vendors.","created_at":"2026-10-27T17:23:17.875193+00:00","id":42271,"published_date":"2026-10-27T16:39:07+00:00","severity":"critical","source_name":"Zero Day Initiative","summary":"On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI\u2019s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an investigation I conducted with Minh Giang and Lucas Miller of TrendAI Research. Although Oracle issued a patch under a single CVE, we reported three distinct vulnerabilities across multiple PeopleSoft components. We are coordinating with Oracle to assign separate CVEs for each issue. In this blog post, we will walk through each of these vulnerabilities, starting with a Server-Side Request Forgery (SSRF) vulnerability. We will also review the validateClient method that Oracle introduced to allow PeopleSoft system administrators to restrict access to certain functionality. Spoiler alert: the SSRF allows attackers to make requests that satisfy this validation and access endpoints vulnerable to remote code execution (RCE). Overview There are two main components involved here, both served as individual Oracle WebLogic applications. The first, the PeopleSoft Environment Management Hub (PSEMHUB), is part of Oracle\u2019s Environment Management Framework. This component implements the validateClient method, ensuring only trusted clients can reach PSEMHUB functionality. Because this is an internal management interface, it makes sense that Oracle would restrict access to its web endpoints. However, this also means it\u2019s a prime target for attackers looking to pivot from their existing, low-privileged access. The second, the PeopleSoft Integration Gateway (PSIGW), contains functionality for exchanging messages between the PeopleSoft server and remote systems. This is accomplished using a set of Listening and Target Connectors. One such connector is the HttpListeningConnector, which translates data from inbound HTTP requests into the format supported by the specified Target Connector before routing the request to the desired URL. In this chain, attackers specify the HttpTargetConnector. The diagram below shows how an attacker like ShinyHunters can combine these vulnerabilities to compromise PeopleSoft systems. Notice that the attacker cannot simply hit the PSEMHUB functionality directly: Bug 1: PSIGW Server-Side Request Forgery (ZDI-CAN-31816) Now let\u2019s take a look at how the PSIGW SSRF provides attackers with a foothold in the PeopleSoft application. An example malicious request to PSIGW shows just how powerful this is for an attacker. We control the URL to hit AND the full payload to send! At [1], the attacker sends a POST request to /PSIGW/HttpListeningConnector At [2], the HttpTargetConnector handler class is specified At [3], the target is PeopleSoft on the loopback interface at http://127.0.0.1:8000, satisfying the validateClient logic At [4], the full POST request payload is specified in the Data field, to be forwarded to the target URL at [3] The HttpTargetConnector handler appears below. Note there is no validation to ensure this traffic is legitimate and bound for a valid target. I've done my best to pull out the important parts of this 800+-line function. If you want a fun side quest, go decompile this for yourself and check it out. I hope you like spaghetti! At [1], retrieve the target URL from the attacker's request At [2], create an httpObj using the URL from [1] At [3], retrieve the HTTP method (POST) and apply it to the httpObj from [2] At [4], send the content data seen in the Data tag of the network request. This content is sent as-is using the HTTP parameters configured in the httpObj To fully understand why this SSRF is valuable, here is the validateClient method I mentioned earlier: At [1] and [2], the validateClient method pulls the hostname and IP of the requesting client At [3], a file path is built to the /envmetadata/config/allowedhosts.properties file, which contains the list of hosts allowed to access functionality protected by validateClient At [4], the server checks if the allowedList set contains any entries. The first time this path is hit, the set is empty, so execution continues into the client list refresh block At [5], that allowedhosts.properties file is read and iterated over At [6] and [7], each allowed host is added to the allowedList set, including the default localhost entry alongside the server's resolved hostname and IP address At [8] and [9], if the requesting host is found in the allowedList set, validateClient returns true We can see the localhost entry in the default allowedhosts.properties that ships with PeopleSoft: While this solution does restrict access, an attacker on any trusted host can still reach PSEMHUB. Because Oracle allows localhost by default, the PSIGW SSRF provides exactly that access. Bug 2: PSEMHUB External Control of File Path (ZDI-CAN-31818) Now that the attacker can make requests to the PSEMHUB endpoints using the PSIGW SSRF, let's see how they can turn that into RCE. The first path to code execution uses an External Control of File Path vulnerability in the ExecuteProcessActivityCommand handler, which is designed to allow remote clients to write log entries to the PeopleSoft server\u2019s filesystem. However, callers of the command control both the file contents AND the absolute file path on disk to which that content is written. Here\u2019s an example of the request made to PSEMHUB. Note that, in practice, each parameter value is a form-encoded serialized Java object. For clarity, I\u2019ve decoded and formatted it here: At [1], we see the request is being made to PSEMHUB\u2019s central routing hub At [2], note that the request is made to the loopback address 127.0.0.1. Since this request originates from localhost, the validateClient check is satisfied At [3], the web shell contents are specified in the m_line parameter At [4], the absolute path where the contents will be written is specified in the m_targetFile parameter Looking at the handler for this request, we can see that no validation is performed to ensure that\u2026","title":"CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft","url":"https://www.thezdi.com/blog/2026/10/20/cve-2026-35273-ssrf-to-rce-in-oracle-peoplesoft"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-27T20:23:25.525158+00:00","id":42319,"published_date":"2026-10-27T16:33:17+00:00","severity":"medium","source_name":"Reddit r/netsec","summary":"Our Threat Research Unit published a breakdown of \u201cThe Gentlemen\u201d - a Russian-speaking ransomware-as-a-service group that emerged in mid-2025, reportedly after affiliates split off from established groups like LockBit and Qilin. A few things that stood out from the research: They\u2019re offering affiliates up to 90% of ransom revenue - aggressive even by RaaS standards Claimed 800+ victims across the US and Europe, making them one of the top RaaS groups this year Cross-platform ransomware variants targeting Windows, Linux, NAS, and BSD Active use of EDR-killing tooling - one recent incident involved a custom dropper abusing vulnerable Safetica ProcessMonitor and Lenovo BootRepair.sys drivers (BYOVD) A breach of the group\u2019s own infrastructure gave researchers rare visibility into their affiliate network, tooling, and ties to the broader ransomware ecosystem Full technical writeup linked below for anyone who wants to dig into the IOCs and affiliate details. https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/ submitted by /u/acronis [link] [comments]","title":"The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation","url":"https://www.reddit.com/r/netsec/comments/1xgxdk8/the_gentlemen_a_closer_look_at_a_notsogentle"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T16:23:11.735141+00:00","id":42247,"published_date":"2026-10-27T16:15:39+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure. [...]","title":"Warp discloses breach exposing AI agent logs, user telemetry data","url":"https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-27T16:23:22.988165+00:00","id":42254,"published_date":"2026-10-27T16:15:00+00:00","severity":"medium","source_name":"The Register (Security)","summary":"University hospitals once again accepting patients after initial ambulance diversion, but recovery to continue in phases","title":"Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack","url":"https://www.theregister.com/cyber-crime/2026/10/27/day-2-of-canceled-classes-at-university-of-new-mexico-after-health-sciences-center-cyberattack/5305690"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Malware analysis and software supply-chain research (Shai-Hulud worm tracking, malware-as-a-service trends). Reinforces the Supply Chain category, which had no dedicated source before this audit. filter_uncategorized drops partner/product posts.","created_at":"2026-10-27T18:23:32.591893+00:00","id":42311,"published_date":"2026-10-27T16:00:00+00:00","severity":"medium","source_name":"ReversingLabs","summary":"AI-powered security researchers gained access to sensitive Anthropic business systems through third-party applications, highlighting a growing enterprise security blind spot.","title":"Researchers Break Into Anthropic\u2019s Systems in Just 12 Hours\u2014Through Third-Party Software","url":"https://www.reversinglabs.com/blog/anthropic-third-party-software-breach"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-27T16:23:25.236781+00:00","id":42266,"published_date":"2026-10-27T16:00:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Researchers uncovered an OpenAI API flaw that exposed hidden AI reasoning traces, prompting a fix and a $6000 bug bounty reward","title":"OpenAI Compaction Flaw Exposed AI Reasoning to Researchers","url":"https://www.infosecurity-magazine.com/news/openai-compaction-flaw-ai"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-27T16:23:25.236056+00:00","id":42265,"published_date":"2026-10-27T16:00:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Attackers have infected 953 online stores with a scanner-evading JavaScript loader since July 2025","title":"Hackers Infect 953 Online Stores With Scanner-Evading Code","url":"https://www.infosecurity-magazine.com/news/hackers-infect-953-online-stores"},{"category":"Cloud Security","confidence":"MEDIUM","confidence_reason":"Cloud security posture and vulnerability research. Vendor context; filter_uncategorized drops product marketing.","created_at":"2026-10-27T16:23:24.002435+00:00","id":42263,"published_date":"2026-10-27T15:59:22+00:00","severity":"medium","source_name":"Orca Security","summary":"Software isn\u2019t just built by developers anymore. Business teams, citizen developers, and AI agents are all shipping apps now, on top of more code, more models, and more cloud than ever. AWS re:Invent is where the people doing that building get together, and we can\u2019t think of a better place to be. We\u2019re heading to [\u2026]","title":"Calling All Builders: Meet Orca Security at AWS re:Invent 2026","url":"https://orca.security/resources/blog/calling-all-builders-meet-orca-security-at-aws-reinvent-2026"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research, consumer-threat focused.","created_at":"2026-10-27T16:23:18.083319+00:00","id":42251,"published_date":"2026-10-27T15:36:09+00:00","severity":"medium","source_name":"Malwarebytes Labs","summary":"Election messages can ask you to register, donate, take a survey, or buy merchandise. Here\u2019s how to check before you click or pay.","title":"Five election scams to watch out for","url":"https://www.malwarebytes.com/blog/scams/2026/10/five-election-scams-to-watch-out-for"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T16:23:12.197982+00:00","id":42248,"published_date":"2026-10-27T15:26:12+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released. The post Tailscale Rushes Patches After Uncoordinated Disclosure of \u2018Tailworm\u2019 Flaws appeared first on SecurityWeek.","title":"Tailscale Rushes Patches After Uncoordinated Disclosure of \u2018Tailworm\u2019 Flaws","url":"https://www.securityweek.com/tailscale-rushes-patches-after-uncoordinated-disclosure-of-tailworm-flaws"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-27T16:23:21.863047+00:00","id":42253,"published_date":"2026-10-27T15:13:48+00:00","severity":"medium","source_name":"CyberScoop","summary":"Like the water sector initiative, the six-month pilot program will connect rural hospitals with industry for free services. The post National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals appeared first on CyberScoop.","title":"National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals","url":"https://cyberscoop.com/oncd-rural-hospital-cybersecurity-pilot-project-lifeline-250"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-27T16:23:12.512610+00:00","id":42249,"published_date":"2026-10-27T15:07:00+00:00","severity":"medium","source_name":"The Record","summary":"His Majesty\u2019s Inspectorate of Constabulary and Fire & Rescue Services says British police data has been breach several times this decade through third-party IT suppliers.","title":"Hackers repeatedly breached suppliers holding UK police data, watchdog finds","url":"https://therecord.media/uk-police-data-breached-from-suppliers-watchdog-report"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.774130+00:00","id":42235,"published_date":"2026-10-27T15:06:27+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Wagyu.xyz is a cross-chain swap platform that allows users to exchange cryptocurrencies for native Monero (XMR) without requiring identity verification (KYC) . It routes orders through Hyperliquid's order book for execution . We hold 38,628 orders and 10,139 IPs from wagyu.xyz: wallets, sessions, fingerprints, countries, $907M XMR-heavy volume. Our demand is only $5,000,000... hehe Samples can be found below. Since you do not have any emails for us to contact, surely you will contact us yourselves. Contact Us: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : wagyu.xyz","url":"https://www.ransomware.live/id/d2FneXUueHl6QFdoaXRlYXJtb3I"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-27T16:23:25.238482+00:00","id":42267,"published_date":"2026-10-27T15:00:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"ISC2\u2019s new Cyber-AI Workforce Coalition serves as a \u201cvendor-neutral convener\u201d to map the future of AI security careers, ISC2 CEO Scott Beale told Infosecurity","title":"ISC2 Launches Cyber-AI Workforce Coalition to Address the Future of AI Security Jobs","url":"https://www.infosecurity-magazine.com/news/isc2-launches-cyberai-workforce"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-27T16:23:12.513913+00:00","id":42250,"published_date":"2026-10-27T14:57:00+00:00","severity":"medium","source_name":"The Record","summary":"For about two hours on Monday, the organization diverted ambulances to health systems in Albuquerque and Santa Fe. They were forced to suspend outpatient surgeries and appointments for the remainder of the day.","title":"University of New Mexico hospital diverts ambulances after cyberattack","url":"https://therecord.media/university-of-new-mexico-hospital-diverts-cyber-incident"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Cloud security posture and vulnerability research. Vendor context; filter_uncategorized drops product marketing.","created_at":"2026-10-27T16:23:24.004514+00:00","id":42264,"published_date":"2026-10-27T14:54:29+00:00","severity":"critical","source_name":"Orca Security","summary":"Executive Summary: A high-severity vulnerability (CVE-2026-111497) was disclosed affecting Node.js across all supported release lines (22.x, 24.x, 26.x), allowing attackers to achieve remote code execution via malformed Brotli-compressed data processed by node:zlib or fetch(). Due to the potential for crashes, memory disclosure, and code execution in cloud workloads, immediate patching is required. About CVE-2026-111497 The [\u2026]","title":"Node.js Brotli Decoder Out-of-Bounds Write Threatens Remote Code Execution Across All Supported Versions","url":"https://orca.security/resources/research/cve-2026-111497-nodejs-brotli-rce"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-27T16:23:22.989039+00:00","id":42255,"published_date":"2026-10-27T14:45:00+00:00","severity":"critical","source_name":"The Register (Security)","summary":"Both critical PHP flaws land on the agency\u2019s exploited list as infosec pros confirm hackers are getting working shells","title":"CISA confirms PHP2Shell under attack as researchers clock successful exploits","url":"https://www.theregister.com/cyber-crime/2026/10/27/cisa-confirms-php2shell-under-attack-as-researchers-clock-successful-exploits/5305681"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Primary web application security research from the makers of Burp Suite. Niche-authoritative. No filter_uncategorized \u2014 100% security content.","created_at":"2026-10-27T16:23:20.682048+00:00","id":42252,"published_date":"2026-10-27T14:29:26+00:00","severity":"medium","source_name":"PortSwigger Research","summary":"I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.","title":"Scalable Vector Grief","url":"https://portswigger.net/research/scalable-vector-grief"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T14:23:22.335207+00:00","id":41946,"published_date":"2026-10-27T14:16:43+00:00","severity":"medium","source_name":"Help Net Security","summary":"Threat actors are flooding employees\u2019 inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents in which the external chat feature in Teams was abused. In many of these cases, the fake help desk message arrived minutes after the victim\u2019s inbox had been filled with hundreds of newsletter and subscription confirmations. \u201cMicrosoft Teams \u2026 More \u2192 The post Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support appeared first on Help Net Security.","title":"Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support","url":"https://www.helpnetsecurity.com/2026/10/27/microsoft-teams-social-engineering-fake-it-help-desk"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.775261+00:00","id":42236,"published_date":"2026-10-27T14:11:50+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Oil and Gas","title":"\ud83c\udff4\u200d\u2620\ufe0f Direwolf has just published a new victim : GRUPO PETROIL","url":"https://www.ransomware.live/id/R1JVUE8gUEVUUk9JTEBkaXJld29sZg"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T14:23:10.779864+00:00","id":41839,"published_date":"2026-10-27T14:09:46+00:00","severity":"high","source_name":"Bleeping Computer","summary":"The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]","title":"Tailscale warns of SSH flaws allowing root privilege escalation","url":"https://www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T14:23:10.834503+00:00","id":41840,"published_date":"2026-10-27T14:01:11+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks. [...]","title":"The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest","url":"https://www.bleepingcomputer.com/news/security/the-huntress-tragic-quadrant-ranking-threats-hitting-businesses-hardest"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T20:23:09.816614+00:00","id":42317,"published_date":"2026-10-27T13:59:48+00:00","severity":"medium","source_name":"The Hacker News","summary":"The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked","title":"GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption","url":"https://thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T20:23:09.819256+00:00","id":42318,"published_date":"2026-10-27T13:59:09+00:00","severity":"critical","source_name":"The Hacker News","summary":"Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file. Patches for the flaw were released last month by Apple in","title":"Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads","url":"https://thehackernews.com/2026/10/apple-backports-fix-for-exploited.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.776003+00:00","id":42237,"published_date":"2026-10-27T13:52:40+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Hospitals and Health Care Stolen data: 1 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : RCOA- Regent Christian Online Academy","url":"https://www.ransomware.live/id/UkNPQS0gUmVnZW50IENocmlzdGlhbiBPbmxpbmUgQWNhZGVteUBCb29iYSBQcm9qZWN0"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.776599+00:00","id":42238,"published_date":"2026-10-27T13:52:20+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Hospitals and Health Care Stolen data: 10 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : Kerckstede vzw","url":"https://www.ransomware.live/id/S2VyY2tzdGVkZSB2endAQm9vYmEgUHJvamVjdA"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.777191+00:00","id":42239,"published_date":"2026-10-27T13:51:59+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Medical Practices Stolen data: 100 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : BASS Medical Group","url":"https://www.ransomware.live/id/QkFTUyBNZWRpY2FsIEdyb3VwQEJvb2JhIFByb2plY3Q"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.778889+00:00","id":42240,"published_date":"2026-10-27T13:51:38+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Museums, Historical Sites, and Zoos Stolen data: 115 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : Hudson River Museum","url":"https://www.ransomware.live/id/SHVkc29uIFJpdmVyIE11c2V1bUBCb29iYSBQcm9qZWN0"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.779870+00:00","id":42241,"published_date":"2026-10-27T13:51:17+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Medical Practices Stolen data: 121 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : Horizon Eye Specialists & LASIK Center","url":"https://www.ransomware.live/id/SG9yaXpvbiBFeWUgU3BlY2lhbGlzdHMgJiBMQVNJSyBDZW50ZXJAQm9vYmEgUHJvamVjdA"},{"category":"Malware/Infostealer","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-27T14:23:12.345411+00:00","id":41845,"published_date":"2026-10-27T13:36:00+00:00","severity":"medium","source_name":"The Record","summary":"Cybercriminals are stuffing infostealer malware into bogus apps aimed at tracking gas prices, police activity, drone strikes and other information of concern to average Russians, researchers said.","title":"Malicious apps prey on Russians\u2019 anxiety about fuel prices, drone strikes","url":"https://therecord.media/malicious-apps-russian-anxiety-gas-prices-drone-strikes"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T14:23:12.254197+00:00","id":41843,"published_date":"2026-10-27T13:30:28+00:00","severity":"medium","source_name":"SecurityWeek","summary":"A leaked SquareML access key could have been used to access a database containing personal and health information. The post Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk appeared first on SecurityWeek.","title":"Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk","url":"https://www.securityweek.com/vendor-key-leak-puts-data-of-238000-denver-health-plan-members-at-risk"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T14:23:22.340507+00:00","id":41947,"published_date":"2026-10-27T13:28:31+00:00","severity":"medium","source_name":"Help Net Security","summary":"Socure has launched Agent Intelligence, a suite that detects AI agents, scores whether they should be trusted, and ties each agent to the verified person or business that authorized it. Agent Intelligence includes three layers in one platform designed to go beyond simple Know Your Agent (KYA) solutions: Agent Detection, generally available today inside Socure\u2019s existing Digital Intelligence offering, Agent TrustScore, open for beta customers now, and Agent Credential, reaching general availability in Q1 2027. \u2026 More \u2192 The post Socure links AI agents to verified people and businesses appeared first on Help Net Security.","title":"Socure links AI agents to verified people and businesses","url":"https://www.helpnetsecurity.com/2026/10/27/socure-agent-intelligence"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Primary cloud-security research (cross-tenant isolation, container escape, cloud IAM). Vendor context; filter_uncategorized drops heavy product marketing. Long archive but only 64 entries inside the 90-day guard (~0.8/day).","created_at":"2026-10-27T14:23:22.975724+00:00","id":41997,"published_date":"2026-10-27T13:21:45+00:00","severity":"critical","source_name":"Wiz","summary":"Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.","title":"PHP2Shell: Exploitation Attempts and Remediation Trends","url":"https://www.wiz.io/blog/php2shell-exploitation-so-far"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-27T14:23:12.577248+00:00","id":41846,"published_date":"2026-10-27T13:20:00+00:00","severity":"medium","source_name":"The Record","summary":"The restrictions will be in place from October 27 to 29, coinciding with the Gas Exporting Countries Forum summit and the Russia-Africa summit, Russia's Ministry of Digital Development said Monday.","title":"Moscow faces internet disruptions as foreign leaders gather for summits","url":"https://therecord.media/moscow-faces-internet-disruptions-as-foreign-leaders-gather"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-27T14:23:12.578235+00:00","id":41847,"published_date":"2026-10-27T13:16:00+00:00","severity":"medium","source_name":"The Record","summary":"CISA added the widely publicized PHP vulnerabilities to the KEV, but didn't specify what kind of exploitation it was observing.","title":"CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch","url":"https://therecord.media/php-vulnerabilities-cisa-kev"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T14:23:12.255232+00:00","id":41844,"published_date":"2026-10-27T13:13:58+00:00","severity":"high","source_name":"SecurityWeek","summary":"Eight max-severity security defects could lead to remote code execution and authentication bypass. The post HPE Patches Dozens of Critical Flaws in Networking Products appeared first on SecurityWeek.","title":"HPE Patches Dozens of Critical Flaws in Networking Products","url":"https://www.securityweek.com/hpe-patches-dozens-of-critical-flaws-in-networking-products"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-27T14:23:12.581085+00:00","id":41848,"published_date":"2026-10-27T13:13:00+00:00","severity":"medium","source_name":"The Record","summary":"More than half of the individual warnings from the Australian Signals Directorate (ASD) drew on previously secret material that had been cleared for disclosure, underscoring the growing role of intelligence sharing to prevent attacks.","title":"Australia\u2019s spies are sharing intelligence with hacking targets \u2014 and want them to share back","url":"https://therecord.media/australia-spies-share-intel-and-want-victims-to-share-back"},{"category":"OT/ICS","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T14:23:22.341089+00:00","id":41948,"published_date":"2026-10-27T13:11:59+00:00","severity":"medium","source_name":"Help Net Security","summary":"Sekoia has introduced Sekoia Self-Hosted, a deployment model that brings the Sekoia SOC platform into the customer\u2019s own infrastructure. Designed for large organizations, including government agencies, defense organizations, critical infrastructure operators and highly regulated enterprises, Sekoia Self-Hosted enables security teams to run modern, intelligence-driven security operations within their chosen environment. The deployment model is designed for organizations whose sovereignty, connectivity or data-control requirements make standard public-cloud deployment unsuitable. It gives customers control over where security \u2026 More \u2192 The post Sekoia introduces self-hosted deployment for organizations with strict data controls appeared first on Help Net Security.","title":"Sekoia introduces self-hosted deployment for organizations with strict data controls","url":"https://www.helpnetsecurity.com/2026/10/27/sekoia-self-hosted"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research. Good primary work but commercial context.","created_at":"2026-10-27T14:23:13.272373+00:00","id":41855,"published_date":"2026-10-27T13:03:27+00:00","severity":"critical","source_name":"Check Point Research","summary":"Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. The attackers use fake GitHub projects that pretend to be AI desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude [\u2026] The post Tricks from the Past deployed via signed ChatGPT and Claude binaries appeared first on Check Point Research.","title":"Tricks from the Past deployed via signed ChatGPT and Claude binaries","url":"https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T14:23:22.346428+00:00","id":41949,"published_date":"2026-10-27T13:00:49+00:00","severity":"medium","source_name":"Help Net Security","summary":"DNSFilter has launched LUMINATE by DNSFilter, a security platform that allows organizations to deliver five security solutions from one agent, one console and one policy. Shadow AI is now one of the fastest-growing risks in business. Employees are adopting AI tools and agents faster than security teams can approve them, often without any visibility from existing security technology. Nearly a third of employees using generative AI at work are doing so without their employer\u2019s permission, \u2026 More \u2192 The post DNSFilter LUMINATE unifies DNS security, AI controls and remote work protection appeared first on Help Net Security.","title":"DNSFilter LUMINATE unifies DNS security, AI controls and remote work protection","url":"https://www.helpnetsecurity.com/2026/10/27/dnsfilter-luminate"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established offensive security research firm. Pentest tooling, vulnerability research, red team techniques.","created_at":"2026-10-28T01:25:18.504448+00:00","id":42605,"published_date":"2026-10-27T13:00:00+00:00","severity":"critical","source_name":"Bishop Fox","summary":"On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities that can allow unauthenticated remote code execution. Both are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Every PHP install serving web requests is in scope,","title":"Responder Guidance for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)","url":"https://bishopfox.com/blog/responder-guidance-for-php2shell"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"First-party analysis of record-scale DDoS campaigns and internet-wide attack trends, plus post-incident write-ups. Mixed with heavy product launch content; filter_uncategorized is essential.","created_at":"2026-10-27T14:23:25.481381+00:00","id":42208,"published_date":"2026-10-27T13:00:00+00:00","severity":"medium","source_name":"Cloudflare","summary":"We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer.","title":"Introducing the Cloudflare PHP Capture the Flag challenge","url":"https://blog.cloudflare.com/php-ctf"},{"category":"OT/ICS","confidence":"MEDIUM","confidence_reason":"Vulnerability-management research with fast Patch Tuesday and KEV-adjacent analysis. Vendor context; filter_uncategorized drops product marketing.","created_at":"2026-10-27T14:23:23.679273+00:00","id":42046,"published_date":"2026-10-27T13:00:00+00:00","severity":"medium","source_name":"Tenable","summary":"AI is widening the attack surface of the critical infrastructure facilities and services that state, local, and education (SLED) organizations run. In the final post of our Cybersecurity Awareness Month series, we explain how a whole-of-state security approach can help SLED agencies protect their critical infrastructure. Key takeaways Because cyber attackers prey on under-resourced targets, they often go after SLED organizations, especially those that operate critical infrastructure, including water systems, hospitals, mass transit, emergency services, and schools. In the latest research from the National Association of State Chief Information Officers (NASCIO), nearly 90% of state CIOs rated cyberattacks on critical systems as a high concern. AI expands the attack surface in two fundamental ways: SLED agencies and employees adopt AI tools and AI-built apps faster than security teams can authorize and inventory them, while attackers use AI automation to find weak points faster. A whole-of-state cybersecurity approach treats state agencies, counties, cities, school districts, and utilities as one defensive perimeter, with shared visibility, shared services, and clear governance. Cyber attackers often look for the weakest link that can offer them an entry point into larger targets. If they can\u2019t crack a state agency\u2019s hardened systems, they\u2019ll try to breach it in a roundabout way by first breaking into a small town\u2019s water utility, a rural school district, or a county dispatch center, and then attempt to move laterally toward the bigger target. When one of those weak links fails, the consequences can reach well beyond the breached agency: halted 911 dispatches, disrupted water service, exposed resident data, and more. AI is further complicating the picture. State, local, and education (SLED) organizations are adopting AI quickly to improve efficiency, employees are building applications with it informally, and adversaries are using it to speed up reconnaissance. Each of those developments is making it harder for security teams to protect SLED agencies. In this fourth and final blog in our Cybersecurity Awareness Month series, we focus on what that expanding AI attack surface means for state, local, and education cybersecurity leaders responsible for critical infrastructure, and how whole-of-state cybersecurity can help them stay ahead. Why SLED critical infrastructure is a prime target SLED organizations operate critical infrastructure, such as water treatment plants, transportation systems, public hospitals, schools, and emergency communications, across many of the 16 critical infrastructure sectors categorized by the Cybersecurity and Infrastructure Security Agency (CISA). State technology leaders are concerned about protecting these critical infrastructure facilities and services from cyber attacks, as \u201cThe Expanding Cyber Perimeter\u201d report, published in September by the National Association of State Chief Information Officers (NASCIO) and General Dynamics Information Technology (GDIT), found. Here are five key findings from the report, which drew on the 2026 NASCIO State CIO Survey, the 2026 NASCIO-Deloitte Cybersecurity Study, and interviews with state CISOs: Nearly 90% of state CIOs rate cyber attacks on critical systems as a high concern. The rest rate them as moderate. State CIOs report low confidence in local governments\u2019 cyber practices. The report\u2019s authors also say it\u2019s unclear how states should help local governments and independent local government entities, like special districts. Water and wastewater plants, dams, hospitals, and transportation services face the greatest cyber risk. Many systems run on aging or proprietary operational technology (OT) with no upgrade path, and broad remote access increases their cyber risk. Small communities and special districts often have limited cyber staff, aging equipment, and complex OT with few controls. With hundreds of such entities in a single state, attackers have plenty of entry points to try. Responsibility is also murky. According to the NASCIO-GDIT report, it\u2019s often unclear which agency is responsible for responding to an attack on critical infrastructure, especially where legal authority, governance, or partnerships aren\u2019t in place. Cyber risk extends beyond technical and geographical boundaries. When an attacker breaches systems of a county water utility or a school district, the incident can have widespread consequences. State and local officials and their CIOs and CISOs should stop treating these incidents as one city\u2019s or one county\u2019s problem. Robert Beach, then CTO of the City of Cocoa, Florida, and a member of the Multi-State Information Sharing and Analysis Center (MS-ISAC) executive committee, told StateScoop last year that an attack on critical infrastructure \u201cis an attack on the nation.\u201d Insiders add another layer of risk. Another MS-ISAC report, \u201cStrengthening Critical Infrastructure: SLTT Progress & Priorities,\u201d published in August 2025, flagged excessive access to system controls as a vulnerability. The report recommended agencies review who can reach their networks and disable credentials promptly when employees leave. The 2026 NASCIO-Deloitte study underscores the risk, noting that attackers exploit compromised credentials and former employee accounts, so regular access reviews and prompt offboarding remain essential. Recent cyber attacks against water systems have made the threat very real. On July 30, the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA) warned that water and wastewater sector utilities in at least seven states had reported cyber attacks, leading in some cases to degraded water operations. That same day, the CISA said it had observed \u201ca significant increase in cyber threat actors targeting programmable logic controllers\u201d in the water and wastewater sector. \u201cThreat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected\u2026","title":"Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era","url":"https://www.tenable.com/blog/whole-of-state-security-sled-critical-infrastructure"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.780552+00:00","id":42242,"published_date":"2026-10-27T12:51:50+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Medical Practices Stolen data: 22GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : Aesthetic Specialty Centre","url":"https://www.ransomware.live/id/QWVzdGhldGljIFNwZWNpYWx0eSBDZW50cmVAQm9vYmEgUHJvamVjdA"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.781134+00:00","id":42243,"published_date":"2026-10-27T12:51:29+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Government Administration Stolen data: 151 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : City of Big Spring","url":"https://www.ransomware.live/id/Q2l0eSBvZiBCaWcgU3ByaW5nQEJvb2JhIFByb2plY3Q"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.781809+00:00","id":42244,"published_date":"2026-10-27T12:51:09+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Hospitals and Health Care Stolen data: 67 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : KING FAMILY MEDICAL","url":"https://www.ransomware.live/id/S0lORyBGQU1JTFkgTUVESUNBTEBCb29iYSBQcm9qZWN0"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T14:23:22.352339+00:00","id":41950,"published_date":"2026-10-27T12:51:04+00:00","severity":"medium","source_name":"Help Net Security","summary":"FireMon has announced FireMon Agentic AI, changing how enterprises investigate network access, make policy decisions, and prepare security changes. Built into FireMon\u2019s network security management solutions, the new agentic AI capabilities makes agents first-class citizens alongside practitioners, putting them to work on complex, multi-step tasks using the policy data, context, and tools practitioners already trust. Customers can use FireMon\u2019s supplied agents, create their own, or connect external agentic workflows through the FireMon MCP Server. Network \u2026 More \u2192 The post FireMon Agentic AI helps teams investigate access and prepare policy changes appeared first on Help Net Security.","title":"FireMon Agentic AI helps teams investigate access and prepare policy changes","url":"https://www.helpnetsecurity.com/2026/10/27/firemon-agentic-ai"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.782666+00:00","id":42245,"published_date":"2026-10-27T12:50:48+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Government Administration Stolen data: 155 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : Charter Township of Commerce","url":"https://www.ransomware.live/id/Q2hhcnRlciBUb3duc2hpcCBvZiBDb21tZXJjZUBCb29iYSBQcm9qZWN0"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T16:23:10.783409+00:00","id":42246,"published_date":"2026-10-27T12:50:26+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Hospitals and Health Care Stolen data: 26 GB.","title":"\ud83c\udff4\u200d\u2620\ufe0f Booba project has just published a new victim : Regent Christian Online Academy","url":"https://www.ransomware.live/id/UmVnZW50IENocmlzdGlhbiBPbmxpbmUgQWNhZGVteUBCb29iYSBQcm9qZWN0"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research, consumer-threat focused.","created_at":"2026-10-27T14:23:14.195339+00:00","id":41885,"published_date":"2026-10-27T12:40:00+00:00","severity":"medium","source_name":"Malwarebytes Labs","summary":"Our latest report reveals how AI is reshaping our relationships, blurring what feels authentic, and creating new ways for intimacy to be exploited.","title":"Artificial Intimacy: Love and lies in the age of AI","url":"https://www.malwarebytes.com/blog/ai/2026/10/artificial-intimacy-love-and-lies-in-the-age-of-ai"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T14:23:22.363352+00:00","id":41951,"published_date":"2026-10-27T12:36:08+00:00","severity":"medium","source_name":"Help Net Security","summary":"Exeon Analytics has introduced Exeon.AgentGuard, a new AI security solution designed to give organizations visibility into approved and shadow AI use, autonomous agent activity and the data flows created through connected tools and external services. Building on its expertise in AI-driven behavioral analytics and threat detection, Exeon expands its cybersecurity capabilities to address emerging risks associated with the rapid adoption of agentic AI. Bringing visibility, addressing data leakage and rogue AI agent behavior As enterprises \u2026 More \u2192 The post Exeon expands threat detection to shadow AI and autonomous agents appeared first on Help Net Security.","title":"Exeon expands threat detection to shadow AI and autonomous agents","url":"https://www.helpnetsecurity.com/2026/10/27/exeon-expands-threat-detection-to-shadow-ai-and-autonomous-agents"},{"category":"Ransomware","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-27T14:23:24.789396+00:00","id":42047,"published_date":"2026-10-27T12:30:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware","title":"Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes","url":"https://www.infosecurity-magazine.com/news/exploit-teams-chat-breach"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-27T14:23:22.228505+00:00","id":41945,"published_date":"2026-10-27T12:30:00+00:00","severity":"medium","source_name":"The Register (Security)","summary":"Did you hear the one about eMudhra and the power of 4? Time to get connected to certificate trust list updates","title":"Microsoft releases out-of-band Windows fixes with certificate updates","url":"https://www.theregister.com/security/2026/10/27/microsoft-releases-out-of-band-windows-fixes-with-certificate-updates/5305637"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T14:23:22.366859+00:00","id":41952,"published_date":"2026-10-27T12:24:14+00:00","severity":"medium","source_name":"Help Net Security","summary":"University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a substantial data breach. Hospitals diverted ambulances and canceled appointments The University of New Mexico, located in Albuquerque, New Mexico, is a public research university. Its Health Sciences Center encompasses its clinical, research and education initiatives. The clinical \u2026 More \u2192 The post Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack appeared first on Help Net Security.","title":"Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack","url":"https://www.helpnetsecurity.com/2026/10/27/university-of-new-mexico-hospitals-cyberattack"},{"category":"SaaS Breach","confidence":"HIGH","confidence_reason":"Emergent threat response team. Primary exploit analysis on actively exploited vulns, peer-quality with ZDI.","created_at":"2026-10-27T13:23:12.308240+00:00","id":41737,"published_date":"2026-10-27T12:24:04+00:00","severity":"medium","source_name":"Rapid7","summary":"Managing access to security tools shouldn't require another manual process. As organizations grow, keeping user accounts and permissions up to date becomes increasingly complex. Employees join, change roles, and leave, creating a constant need to update access across applications. When these processes rely on manual administration, delays and oversights can introduce unnecessary work and security risk. Rapid7 Command Platform now supports System for Cross-domain Identity Management (SCIM), enabling customers to automate user provisioning and deprovisioning through their existing identity provider (IdP). This helps organizations reduce administrative overhead, maintain more consistent access controls, and manage identity at scale. Automate user access throughout the employee lifecycle SCIM is an open standard that enables identity providers, such as Okta, to automatically manage user accounts in connected applications. With SCIM enabled, Rapid7 Command Platform customers can: Automate provisioning: Create accounts when employees join or need access. Keep user information current: Synchronize supported user attributes as information changes. Simplify offboarding: Automatically deactivate accounts when users no longer require access. Manage groups at scale: Synchronize group membership to help streamline access administration. Rather than manually updating accounts in Command Platform, administrators can manage supported identity lifecycle changes through their existing IdP. Less administration, more consistent access control Consider a common scenario: An employee leaves the organization. Without automated provisioning, an administrator must remember to deactivate that employee's access across their applications. If an account is missed, it could remain active longer than intended. With SCIM, changes made in the organization's identity provider can automatically trigger corresponding account updates in Command Platform. By introducing SCIM at the platform level, Rapid7 helps organizations: Reduce operational overhead by eliminating repetitive account-management tasks. Strengthen access governance by reducing stale accounts and keeping user information aligned with identity provider policies. Scale more efficiently by centralizing identity lifecycle management for supported Command Platform applications. For organizations with security and compliance requirements, these capabilities also help support consistent onboarding and offboarding processes. Get started with SCIM SCIM support is now available to Rapid7 Command Platform customers. Platform administrators can configure SCIM through Command Platform's SSO settings using their existing identity provider. SCIM is disabled by default and requires configuration before automated provisioning begins. For prerequisites and setup instructions, visit the Command Platform SCIM integration documentation.","title":"Simplify User Access Management with SCIM on Rapid7 Command Platform","url":"https://www.rapid7.com/blog/post/pt-scim-simplifies-user-access-management-uam-command-platform"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research, consumer-threat focused.","created_at":"2026-10-27T14:23:14.196290+00:00","id":41886,"published_date":"2026-10-27T12:22:37+00:00","severity":"medium","source_name":"Malwarebytes Labs","summary":"PHP and Node.js flaws, hacked sites, fake updates, and rogue certificates can put you at risk even on trusted websites. Here\u2019s how to stay safe.","title":"The web\u2019s having a rough week. Here\u2019s how to browse safely","url":"https://www.malwarebytes.com/blog/news/2026/10/the-webs-having-a-rough-week-heres-how-to-browse-safely"},{"category":"OT/ICS","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T12:23:38.987578+00:00","id":41685,"published_date":"2026-10-27T12:14:03+00:00","severity":"medium","source_name":"Help Net Security","summary":"The Cybersecurity and Infrastructure Security Agency (CISA) has released CISA 2030: Defend, Harden, Prevail, a strategy to strengthen national security and the resilience of critical infrastructure. It addresses intersecting cyber, physical, and geopolitical threats that can disrupt essential services. Working with public- and private-sector partners, the agency will strengthen operational technology security, advance software security, support the secure adoption of new technologies, and improve the continuity of National Security and Emergency Preparedness communications. The strategy \u2026 More \u2192 The post CISA lays out plan to push cyber adversaries out of US critical infrastructure appeared first on Help Net Security.","title":"CISA lays out plan to push cyber adversaries out of US critical infrastructure","url":"https://www.helpnetsecurity.com/2026/10/27/cisa-2030-cyber-resilience-strategy"},{"category":"Identity & Access","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T12:23:38.989575+00:00","id":41686,"published_date":"2026-10-27T12:13:25+00:00","severity":"medium","source_name":"Help Net Security","summary":"ThreatAware has announced the launch of Dimension, its governed workspace that provides organisations with a foundation for building, running and managing their own customised security applications. Dimension gives security teams the flexibility to develop applications tailored to their needs, while providing organisations with greater oversight of how those applications access data and interact with live systems. A shadow AI detector, an MFA dashboard, a compliance tracker, or whatever the organisation needs. If a team can \u2026 More \u2192 The post ThreatAware brings governance to AI-built security applications appeared first on Help Net Security.","title":"ThreatAware brings governance to AI-built security applications","url":"https://www.helpnetsecurity.com/2026/10/27/threataware-dimension-governed-workspace"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T12:23:37.762186+00:00","id":41682,"published_date":"2026-10-27T12:11:30+00:00","severity":"medium","source_name":"Ransomware.live","summary":"[architecture] GreenbergFarrow \u2014 a respected ESOP-owned architecture firm headquartered in Atlanta, Georgia with offices in Charlotte, Dallas, Los Angeles, New York, Myrtle Beach, and international operations in Mexico, Colombia, India, and Canada. The dataset spans three major divisions: Client Libraries (152 client folders, A\u2013F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW. Corporate Library: The entire institutional memory \u2014 24 years of accounting (invoicing, cleared checks, budgets from 2002\u20132026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards. Discipline Libraries (283 GB): Complete architecture reference library. The exposed material includes: 300\u2013650+ individuals' personal data \u2014 SSNs from three years of payroll tax returns, 57+ W-9 forms, employee censuses with DOBs/salaries/home addresses, and an employee's complete termination package including Medicare enrollment and voicemail recording. 7,450+ cleared check images with routing numbers, account numbers, payee details, and authorised signatures spanning 2014\u20132023. Complete active litigation file for GF v. Storm/RFW (1:25-cv-03532) \u2014 complaint, amended complaint, answers to interrogatories, discovery requests and responses, settlement negotiations, D&O insurer correspondence, and engagement letters. The entire attorney-client privilege chain. FBI facility clearance documents \u2014 SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects. Complete acquisition records for 7 deals (5 completed + 2 in progress) including purchase prices, due diligence materials, certified financial statements, and wire instructions.","title":"\ud83c\udff4\u200d\u2620\ufe0f Aurora has just published a new victim : GreenbergFarrow","url":"https://www.ransomware.live/id/R3JlZW5iZXJnRmFycm93QGF1cm9yYQ"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T12:23:19.902079+00:00","id":41594,"published_date":"2026-10-27T12:09:50+00:00","severity":"medium","source_name":"The Hacker News","summary":"Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,","title":"Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens","url":"https://thehackernews.com/2026/10/microsoft-authenticator-flaw-let.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T12:23:37.763838+00:00","id":41683,"published_date":"2026-10-27T12:08:39+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Bristol City Council is the local authority for Bristol, England. It provides public services for residents, businesses, and visitors, including council tax and benefits, housing, schools, social care, waste and recycling, transport, planning, parks, and libraries","title":"\ud83c\udff4\u200d\u2620\ufe0f Wallstreet has just published a new victim : Bristol City Council","url":"https://www.ransomware.live/id/QnJpc3RvbCBDaXR5IENvdW5jaWxAV2FsbHN0cmVldA"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T12:23:21.742489+00:00","id":41598,"published_date":"2026-10-27T12:02:06+00:00","severity":"medium","source_name":"SecurityWeek","summary":"The company says it reacted to an issue affecting some of its systems, including DreamHost webmail. The post Unexplained DreamHost Incident Prompts Email, FTP Password Resets appeared first on SecurityWeek.","title":"Unexplained DreamHost Incident Prompts Email, FTP Password Resets","url":"https://www.securityweek.com/unexplained-dreamhost-incident-prompts-email-ftp-password-resets"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"Best-in-class APT campaign tracking and malware reverse engineering. Industry-leading primary research.","created_at":"2026-10-27T12:21:47.901266+00:00","id":41593,"published_date":"2026-10-27T12:00:19+00:00","severity":"high","source_name":"Kaspersky Securelist","summary":"A Kaspersky expert presents a cloud isolation bypass case honored at Russian Pentest Award 2026. Learn how vulnerabilities in Kubernetes, Konnectivity, and the overlay network lead to RCE and compromise of other tenants' services.","title":"An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure","url":"https://securelist.com/cloud-infrastructure-isolation-bypass/121609"},{"category":"Industry/Policy","confidence":"HIGH","confidence_reason":"UK government CERT, authoritative advisories for UK & allied operators.","created_at":"2026-10-27T10:21:45.044309+00:00","id":41538,"published_date":"2026-10-27T12:00:00+00:00","severity":"medium","source_name":"NCSC UK","summary":"How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity","title":"From industry concern to practical action: the value of working with regulators","url":"https://www.ncsc.gov.uk/blogs/industry-concern-practical-action-value-working-regulators"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T12:23:21.743760+00:00","id":41599,"published_date":"2026-10-27T11:49:57+00:00","severity":"critical","source_name":"SecurityWeek","summary":"Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones. The post iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 appeared first on SecurityWeek.","title":"iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18","url":"https://www.securityweek.com/ios-macos-27-2-patch-286-bugs-fix-for-exploited-flaw-backported-to-ios-18"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T12:23:19.905001+00:00","id":41595,"published_date":"2026-10-27T11:46:00+00:00","severity":"medium","source_name":"The Hacker News","summary":"An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve","title":"Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key","url":"https://thehackernews.com/2026/10/keystone-to-destroy-18835-hardware.html"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T12:23:38.991183+00:00","id":41687,"published_date":"2026-10-27T11:39:22+00:00","severity":"medium","source_name":"Help Net Security","summary":"The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal data belonging to some 525,000 people. On Monday, the university took Workzone, Nimbus and other administrative systems offline in what it called \u201ca preventive and controlled shutdown of the administrative systems in question,\u201d warning that users might have \u2026 More \u2192 The post Cyberattack on University of Copenhagen exposes data of 525,000 people appeared first on Help Net Security.","title":"Cyberattack on University of Copenhagen exposes data of 525,000 people","url":"https://www.helpnetsecurity.com/2026/10/27/university-of-copenhagen-cyberattack-data-breach"},{"category":"Identity & Access","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T12:23:19.906280+00:00","id":41596,"published_date":"2026-10-27T11:32:46+00:00","severity":"medium","source_name":"The Hacker News","summary":"Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain","title":"AI-Generated Fake Login Pages Are Making Account Takeovers Easier","url":"https://thehackernews.com/2026/10/ai-generated-fake-login-pages-are.html"},{"category":"Nation State/APT","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T12:23:19.908165+00:00","id":41597,"published_date":"2026-10-27T11:32:31+00:00","severity":"medium","source_name":"The Hacker News","summary":"The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up","title":"Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption","url":"https://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.html"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-27T12:23:38.468665+00:00","id":41684,"published_date":"2026-10-27T11:28:12+00:00","severity":"high","source_name":"Reddit r/netsec","summary":"submitted by /u/Gallus [link] [comments]","title":"From Arbitrary File Read to Shell: Yet Another RCE in Telerik","url":"https://www.reddit.com/r/netsec/comments/1xgpz1q/from_arbitrary_file_read_to_shell_yet_another_rce"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-27T11:22:01.019019+00:00","id":41571,"published_date":"2026-10-27T11:00:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Hackers have stolen personal information on over 520,000 people from the University of Copenhagen","title":"Copenhagen University Breach Compromises Data on Half a Million People","url":"https://www.infosecurity-magazine.com/news/copenhagen-university-data-breach"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"Top-tier security research firm. Formal verification, crypto, smart contract, and systems security. Primary research. No filter_uncategorized \u2014 100% security content.","created_at":"2026-10-27T11:21:56.268933+00:00","id":41554,"published_date":"2026-10-27T11:00:00+00:00","severity":"medium","source_name":"Trail of Bits","summary":"The software you are running is almost certainly riddled with known, unfixed security bugs. These bugs can be trivially and quickly exploited by modern AI agents. This is not merely theoretical; I saw this during my sandbox escape research, and an old vulnerability in stable software was used as a part of the recently disclosed OpenAI hack: From the official hack description To say it simply: whatever you are running is almost certainly easily hackable by advanced AI. Luckily, there is a fix, and we (not just at Trail of Bits, but in the security industry more broadly) are working on it. But first, how did we get here? Stability versus security Software has bugs, and some are relevant to security. We try to fix them when we can, and the first place the fix happens is in the latest version of the software. Unfortunately, that\u2019s often the only place where the fix happens. The process of getting a fix from the latest source code to older versions is called \u201cbackporting.\u201d Fixes for big-name, critical bugs are indeed often backported quickly. But for many other bugs, the backporting process never happens. It is easy to understand why: software packaging is often done by volunteers who are already overworked, and backporting is frustrating, thankless work that gets little credit or publicity. For open source projects staffed by teams of volunteers, backports are (understandably) a low priority. The lack of backports is a problem because almost no one runs the latest and greatest version of software that\u2019s been freshly built with today\u2019s code changes. People overwhelmingly prefer slightly older, more tested software packaged in \u201clong term stable\u201d releases. For example, about 95% of Ubuntu Linux installations are of the Long Term Support (LTS) variety. When looking at installed Linux kernel packages from Debian\u2019s popcon, the overwhelming majority are based on older stable trees: This is a Codex-generated graph of recently installed kernel packages from Debian\u2019s popcon. The overwhelming majority (about 96%) are older, stable releases, and not the latest kernel series. This puts users in a bind: They can either stick with a stable, familiar version of software that has security flaws, or upgrade to a newer version that fixes those flaws but introduces other changes and new features they may not want. We should not have to make this choice. Seeing no evil Even three years ago, we could stick our heads in the sand and pretend the problem didn\u2019t exist: backporting all fixes was a genuinely difficult, time-consuming job and any attacks were extraordinarily unlikely. Now, both of those assumptions are false. A swarm of cyber-capable AI agents can cut through a network of stable, known-vulnerable software like a hot knife through butter. On the positive side, AI has significantly lessened the burden for identifying and backporting security-relevant bugs. Of course, we should assume all software has bugs (because it does), and use the lessons we learned in our computer security classes: mandatory access controls, code integrity checks, sandboxing, and privilege separation. This works. Mobile platforms are much safer because they enforce these standards. But desktop and server platforms don\u2019t mandate this behavior, and few voluntarily enable protections. And yes, everyone should update to the latest software. But many people purposely do not update to releases. I think that this normal end-user behavior is entirely justified. Just recently, I updated my Mac to macOS 27 and couldn\u2019t use a printer that had worked flawlessly for years (until Codex wrote a new, compatible printer driver, on the first try). Regardless, it\u2019s good practice to assume that something may have bugs and that they should be contained; leaving known, easily fixed bugs is negligent. So, let\u2019s backport all the fixes! Accounting for security liabilities Let\u2019s quantify the scale of the problem. To make counting simple, we can limit ourselves to known bugs (with assigned CVEs) that are patched in the latest release but missing from stable packages. For this example, we\u2019ll look at the Linux kernel, Ubuntu 26.04 LTS and Debian 13 Stable. I\u2019m not singling out those projects\u2014they are all run very well! I\u2019m using them because they have documentation and accounting for unfixed CVEs. Other projects lack this transparency. The first step towards a solution is knowing that there is a problem. Let\u2019s look at the number of outstanding CVEs in the Linux Kernel, by stable branch. The table below shows CVEs per supported stable branch that do not have a fix in that branch, but do have it in a newer branch. (Hence, older branches by definition have more unfixed CVEs.) The source is the kernel CVE team\u2019s vulns.git as of September 18, 2026. This is not an exact bug count, as it both over- and under-counts due to several technicalities. It is also not a measure of exploitability. Rather, it\u2019s a measuring stick showing that a substantial amount of known CVEs have not been fixed in stable kernel branches: Branch Unfixed CVEs % CVEs with an NVD Score High or Critical Severity 5.10.y 2,006 55.8% 213 (19.0%) 5.15.y 1,889 51.5% 195 (20.0%) 6.1.y 1,329 43.9% 99 (17.0%) 6.6.y 1,012 35.6% 65 (18.1%) 6.12.y 686 22.3% 21 (13.7%) 6.18.y 337 15.1% 3 (5.9%) The package landscape is not any better. These are non-kernel CVEs reported as open or affected in Debian 13 and Ubuntu 26.04 (raw data via their respective bulk CVE data feeds, compiled by Codex). These are distro-metadata findings, not individually source-confirmed vulnerabilities. Again, this is not meant to be an exact bug count, but more of a measuring stick indicating how many unfixed vulnerabilities remain in stable software packages: Distribution Source Packages with Unfixed CVEs Unique CVEs High or Critical Severity Debian 13 1,128 4,562 1,822 (39.9%) Ubuntu 26.04 1,028 770 335 (43.5%) Fixing the bugs We realized this was an issue and have been fixing it proactively. First, we started with the equivalent of\u2026","title":"Backporting security fixes to stable releases","url":"https://blog.trailofbits.com/2026/10/27/backporting-security-fixes-to-stable-releases"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T11:21:58.096253+00:00","id":41566,"published_date":"2026-10-27T10:58:07+00:00","severity":"medium","source_name":"Help Net Security","summary":"Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token, finds every repository that token can open, and plants a workflow in each one. The workflow prints the repository\u2019s secrets into a log, and the attacker downloads it. The exposure is in private repositories. A \u2026 More \u2192 The post Private repos still leak secrets to Gheist, a stolen GitHub token campaign appeared first on Help Net Security.","title":"Private repos still leak secrets to Gheist, a stolen GitHub token campaign","url":"https://www.helpnetsecurity.com/2026/10/27/gheist-github-token-abuse"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T11:21:46.926654+00:00","id":41545,"published_date":"2026-10-27T10:44:20+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Anthropic presents its own initial public offering as a step toward mitigating the risks it believes AI poses. The post Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI appeared first on SecurityWeek.","title":"Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI","url":"https://www.securityweek.com/risks-spelled-out-for-anthropic-investors-include-possible-harms-from-runaway-ai"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-27T11:22:00.862712+00:00","id":41568,"published_date":"2026-10-27T10:39:41+00:00","severity":"critical","source_name":"Security Affairs","summary":"U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2). The flaws [\u2026]","title":"U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/201840/security/u-s-cisa-adds-php-flaws-php2shell-to-its-known-exploited-vulnerabilities-catalog.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T11:21:46.822946+00:00","id":41543,"published_date":"2026-10-27T10:38:24+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : NuVista Federal Credit Union","url":"https://www.ransomware.live/id/TnVWaXN0YSBGZWRlcmFsIENyZWRpdCBVbmlvbkBxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T11:21:46.823525+00:00","id":41544,"published_date":"2026-10-27T10:37:43+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Hawaii Law Enforcement Fedral Credit Union","url":"https://www.ransomware.live/id/SGF3YWlpIExhdyBFbmZvcmNlbWVudCBGZWRyYWwgQ3JlZGl0IFVuaW9uQHFpbGlu"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T11:21:46.121501+00:00","id":41539,"published_date":"2026-10-27T10:36:12+00:00","severity":"critical","source_name":"Bleeping Computer","summary":"Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in \"extremely sophisticated\" targeted attacks on iOS devices. [...]","title":"Apple backports CoreGraphics zero-day patches to older iPhones","url":"https://www.bleepingcomputer.com/news/apple/apple-backports-coregraphics-zero-day-patches-to-older-iphones"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-27T11:22:01.023864+00:00","id":41572,"published_date":"2026-10-27T10:30:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"ISC2 is seeking 3000 volunteers to enrol to a pilot exam phase for its upcoming AI security certification","title":"First ISC2 AI Security Certification Expected for Early 2027","url":"https://www.infosecurity-magazine.com/news/first-isc2-ai-security"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T11:21:58.634455+00:00","id":41567,"published_date":"2026-10-27T10:19:08+00:00","severity":"medium","source_name":"Help Net Security","summary":"DreamHost has brought its File Manager back online after an incident that disrupted several of its services, though some of its customers still can\u2019t get into their email or FTP accounts until someone sets a new password for them. DreamHost is a web hosting provider whose services include shared, VPS, dedicated and WordPress hosting, along with domain registration, email hosting, and cloud computing and storage. In its latest update, posted on October 26, the hosting \u2026 More \u2192 The post DreamHost incident triggers password resets, locks customers out of email and FTP accounts appeared first on Help Net Security.","title":"DreamHost incident triggers password resets, locks customers out of email and FTP accounts","url":"https://www.helpnetsecurity.com/2026/10/27/dreamhost-incident-email-ftp-password-resets"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T11:21:47.031728+00:00","id":41546,"published_date":"2026-10-27T10:02:24+00:00","severity":"critical","source_name":"SecurityWeek","summary":"Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon. The post This is Fine: What NetScaler Zero-Days Tell Us About the New Normal appeared first on SecurityWeek.","title":"This is Fine: What NetScaler Zero-Days Tell Us About the New Normal","url":"https://www.securityweek.com/this-is-fine-what-netscaler-zero-days-tell-us-about-the-new-normal"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"Top-tier threat intelligence research with strong malware analysis track record.","created_at":"2026-10-27T12:21:45.649779+00:00","id":41592,"published_date":"2026-10-27T10:00:21+00:00","severity":"medium","source_name":"Cisco Talos","summary":"What does it mean to be \"blue collar\" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.","title":"From federal SOCs to Talos: Ryan Fetterman on practical security research","url":"https://blog.talosintelligence.com/from-federal-socs-to-talos-ryan-fetterman-on-practical-security-research"},{"category":"OT/ICS","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-27T11:21:57.188076+00:00","id":41564,"published_date":"2026-10-27T10:00:00+00:00","severity":"medium","source_name":"CyberScoop","summary":"A China-linked ransomware crew disabled the security tools at a critical infrastructure operator before it launched the encryptor. Most security budgets never priced that in. The post What happens when security tools go dark before the ransomware appeared first on CyberScoop.","title":"What happens when security tools go dark before the ransomware","url":"https://cyberscoop.com/warlock-ransomware-storm-2603-sharepoint-attacks-op-ed"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-27T11:22:00.864724+00:00","id":41569,"published_date":"2026-10-27T09:56:54+00:00","severity":"medium","source_name":"Security Affairs","summary":"Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings. Ukraine\u2019s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The [\u2026]","title":"Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP","url":"https://securityaffairs.com/201827/hacking/attackers-take-control-of-dahua-cameras-and-video-recorders-via-easy4ip.html"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T11:21:47.035085+00:00","id":41547,"published_date":"2026-10-27T09:44:50+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek.","title":"Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover","url":"https://www.securityweek.com/dead-popcorn-time-updater-put-millions-of-computers-at-risk-of-takeover"},{"category":"Uncategorized","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T11:21:45.078856+00:00","id":41541,"published_date":"2026-10-27T09:33:06+00:00","severity":"medium","source_name":"The Hacker News","summary":"A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. \"The next steps that we took were to disconnect that Amadey controller from all those","title":"Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers","url":"https://thehackernews.com/2026/10/australia-gets-into-amadey-malware.html"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T11:21:46.123051+00:00","id":41540,"published_date":"2026-10-27T09:25:50+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]","title":"Energy giant ENGIE discloses data breach affecting customers","url":"https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-27T11:22:00.868499+00:00","id":41570,"published_date":"2026-10-27T09:07:11+00:00","severity":"medium","source_name":"Security Affairs","summary":"Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems. A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task. \u201cAsked to write a defensive detection rule, Qwen3.8-Flash-Next [\u2026]","title":"Cohere Finds Qwen AI Model Contacting a Server in China","url":"https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html"},{"category":"AI Security","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T11:21:46.211746+00:00","id":41542,"published_date":"2026-10-27T08:22:43+00:00","severity":"medium","source_name":"The Hacker News","summary":"OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past","title":"OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections","url":"https://thehackernews.com/2026/10/openai-compaction-flaw-let-researchers.html"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-27T09:21:46.012529+00:00","id":41537,"published_date":"2026-10-27T08:20:54+00:00","severity":"critical","source_name":"Bleeping Computer","summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]","title":"CISA confirms PHP2Shell vulnerabilities now exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T07:21:46.473147+00:00","id":41517,"published_date":"2026-10-27T07:14:27+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products. The post Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems appeared first on SecurityWeek.","title":"Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems","url":"https://www.securityweek.com/maritime-coalition-launches-free-vulnerability-database-for-ship-and-port-systems"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Troy Hunt's curated breach disclosure feed. Low volume (~2-4/month), high trust, universally cited. Each entry names the breached org, account count, and exposed data types.","created_at":"2026-10-27T11:21:57.453438+00:00","id":41565,"published_date":"2026-10-27T07:01:06+00:00","severity":"medium","source_name":"Have I Been Pwned","summary":"In September 2026, the German political party Alternative f\u00fcr Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files. An analysis of the incident reported that the breach was detected as early as 9 September, with a subsequent intrusion occurring five days later. In its public statement, AfD attributed the breach to an attack on a hosting provider, identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH.","title":"AfD - 345,439 breached accounts","url":"https://haveibeenpwned.com/Breach/AfD"},{"category":"Uncategorized","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T07:21:45.232199+00:00","id":41509,"published_date":"2026-10-27T06:34:47+00:00","severity":"medium","source_name":"The Hacker News","summary":"The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. \"Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded,\" the State Special Communications Service of Ukraine (SSSCIP)","title":"Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses","url":"https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T07:21:52.790221+00:00","id":41518,"published_date":"2026-10-27T06:30:01+00:00","severity":"medium","source_name":"Help Net Security","summary":"In this interview with Help Net Security, Jonathan Care, Lead Analyst and Practice Lead AI at KuppingerCole Analysts, compares AI security startups to the early fraud market he helped define at Gartner. He explains which categories will survive as products and which will become features inside bigger platforms. Care talks about Q3 funding going to fewer, larger rounds, Israel\u2019s share of cyber venture investment, and the five controls an organization needs before an agent touches \u2026 More \u2192 The post Several AI security market categories are headed for bigger platforms appeared first on Help Net Security.","title":"Several AI security market categories are headed for bigger platforms","url":"https://www.helpnetsecurity.com/2026/10/27/jonathan-care-kuppingercole-analysts-ai-security-market"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T07:21:46.308631+00:00","id":41511,"published_date":"2026-10-27T06:24:08+00:00","severity":"medium","source_name":"Ransomware.live","summary":"retail and facility services \u00b7 United Arab Emirates | [PENDING EXPOSURE: \u00b7 The complete payroll ledger, employee records and identity document archive of a UAE services group are held.]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Company #111","url":"https://www.ransomware.live/id/Q29tcGFueSAjMTExQE4wbg"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T07:21:52.792601+00:00","id":41519,"published_date":"2026-10-27T06:14:22+00:00","severity":"medium","source_name":"Help Net Security","summary":"If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn\u2019t need permissions, and you didn\u2019t need to tap anything. Here\u2019s what happened Authenticator does more than show six-digit codes. On Android it also acts as a \u201cbroker.\u201d When Teams, Outlook or another Microsoft app needs to sign you in, it asks Authenticator, and Authenticator \u2026 More \u2192 The post Microsoft Authenticator vulnerability let rogue Android apps steal work account access appeared first on Help Net Security.","title":"Microsoft Authenticator vulnerability let rogue Android apps steal work account access","url":"https://www.helpnetsecurity.com/2026/10/27/microsoft-authenticator-vulnerability-patchedcve-2026-80097"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T07:21:52.796812+00:00","id":41520,"published_date":"2026-10-27T06:00:26+00:00","severity":"medium","source_name":"Help Net Security","summary":"Madhu Shashanka, Chief Scientist at Concentric AI, explains why securing LLM tools and agents depends more on your data than on the model. Controls on model behavior, such as guardrails and injection detection, lower the rate of bad outcomes but never reach zero. Controls on what goes in are different, because you own the documents, systems, and credentials an agent can reach. He covers prompt injection, data leakage through connectors, overprivileged agents, and shadow AI. \u2026 More \u2192 The post LLM agent security needs more than guardrails appeared first on Help Net Security.","title":"LLM agent security needs more than guardrails","url":"https://www.helpnetsecurity.com/2026/10/27/llm-agent-security-video"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T07:21:52.808778+00:00","id":41521,"published_date":"2026-10-27T05:30:33+00:00","severity":"medium","source_name":"Help Net Security","summary":"Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7\u2019s Q3 2026 Quarterly Threat Landscape Report. The company reported an average of three days between public disclosure and exploitation of high-severity vulnerabilities, with 71% of tracked exploitation occurring within the first week. Cumulative exploitation rate (Source: Rapid7) Exploitation puts pressure on fixed patching schedules Researchers tracked 43 newly exploited high- and critical-severity vulnerabilities during the quarter. Organizations \u2026 More \u2192 The post 71% of vulnerability exploitation starts within a week of disclosure appeared first on Help Net Security.","title":"71% of vulnerability exploitation starts within a week of disclosure","url":"https://www.helpnetsecurity.com/2026/10/27/rapid7-vulnerability-exploitation-trends-q3-2026-report"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T05:21:54.322640+00:00","id":41507,"published_date":"2026-10-27T05:00:31+00:00","severity":"medium","source_name":"Help Net Security","summary":"Cybersecurity Expert / Penetration Tester Barrion | Sweden | On-site \u2013 View job details As a Cybersecurity Expert / Penetration Tester, you will test web applications and APIs for authentication, authorisation, and business logic vulnerabilities. You\u2019ll identify complex attack paths and validate findings.You\u2019ll evaluate AI-driven security testing, investigate false positives and missed vulnerabilities, and develop scenarios that improve automated discovery. Cloud Network Solution Architect TAL | Australia | On-site \u2013 View job details As a \u2026 More \u2192 The post Cybersecurity jobs available right now: October 27, 2026 appeared first on Help Net Security.","title":"Cybersecurity jobs available right now: October 27, 2026","url":"https://www.helpnetsecurity.com/2026/10/27/cybersecurity-jobs-available-right-now-october-27-2026"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-27T07:21:45.563490+00:00","id":41510,"published_date":"2026-10-27T04:37:59+00:00","severity":"critical","source_name":"The Hacker News","summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory","title":"CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution","url":"https://thehackernews.com/2026/10/cisa-confirms-active-exploitation-of.html"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-27T05:21:54.328629+00:00","id":41508,"published_date":"2026-10-27T04:33:34+00:00","severity":"medium","source_name":"Help Net Security","summary":"OpenAI released GPT-6.1 Terra, a model that operates desktop software, to all Plus, Pro, Enterprise, and Edu users in ChatGPT Work and Codex, and to developers through its API as gpt-6.1-terra. API prices are 50 percent below those of GPT-5.6 Terra and GPT-6.1 Sol: $1 per million input tokens, $0.05 per million cached input tokens, and $5 per million output tokens. Tokens are the chunks of text a model reads and writes. OpenAI says Terra \u2026 More \u2192 The post GPT-6.1 Terra meets OpenAI\u2019s Critical cyber threshold, and it\u2019s cheaper than GPT-5.6 Terra appeared first on Help Net Security.","title":"GPT-6.1 Terra meets OpenAI\u2019s Critical cyber threshold, and it\u2019s cheaper than GPT-5.6 Terra","url":"https://www.helpnetsecurity.com/2026/10/27/gpt-6-1-terra-released"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T07:21:46.311261+00:00","id":41512,"published_date":"2026-10-27T04:31:41+00:00","severity":"medium","source_name":"Ransomware.live","summary":"[AI generated] Natuzzi S.p.A. is an Italian manufacturer and distributor of furniture, specializing in leather and fabric upholstered sofas, chairs, and home furnishings. Founded in 1959 and headquartered in Santeramo in Colle, Italy, the company operates in the home furniture and interior design industry. Natuzzi designs, produces, and markets its products globally, selling through its own branded stores and third-party retailers across multiple countries.","title":"\ud83c\udff4\u200d\u2620\ufe0f Everest has just published a new victim : Natuzzi","url":"https://www.ransomware.live/id/TmF0dXp6aUBldmVyZXN0"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T07:21:46.313159+00:00","id":41513,"published_date":"2026-10-27T04:30:31+00:00","severity":"medium","source_name":"Ransomware.live","summary":"[AI generated] MediSolution was a Canadian software company based in Montreal, Quebec, specializing in enterprise resource planning and management software solutions for the public sector, including healthcare, local government, and education institutions. It provided financial management, human resources, and payroll software systems. The company operated in the enterprise software and information technology industry before being acquired and integrated into Harris Computer Systems.","title":"\ud83c\udff4\u200d\u2620\ufe0f Everest has just published a new victim : MediSolution","url":"https://www.ransomware.live/id/TWVkaVNvbHV0aW9uQGV2ZXJlc3Q"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T07:21:46.315550+00:00","id":41514,"published_date":"2026-10-27T04:11:37+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Antah Healthcare Group (AHCG) is one of Malaysia's leading integrated healthcare distribution and commercial partners, specializing in the nationwide marketing, sales, clinical regulatory support, and supply chain logistics of pharmaceuticals, medical equipment, and consumable products to hospitals and clinics.We successfully infiltrated AHCG's network and exfiltrated over 500 GB of highly sensitive data, including human resources and employee records, customer transaction histories, confidential commercial contracts, clinical and regulatory documentation, logistics tracking information, and financial statements.","title":"\ud83c\udff4\u200d\u2620\ufe0f Crypto24 has just published a new victim : Antah HealthCare Group","url":"https://www.ransomware.live/id/QW50YWggSGVhbHRoQ2FyZSBHcm91cEBjcnlwdG8yNA"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T07:21:46.316459+00:00","id":41515,"published_date":"2026-10-27T04:11:17+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Once the timer reaches zero, all exfiltrated data will be published in full.","title":"\ud83c\udff4\u200d\u2620\ufe0f Crypto24 has just published a new victim : DATEM, Inc.","url":"https://www.ransomware.live/id/REFURU0sIEluYy5AY3J5cHRvMjQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T07:21:46.316854+00:00","id":41516,"published_date":"2026-10-27T04:05:36+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Verification for Gamblinglore.com","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : gamblinglore","url":"https://www.ransomware.live/id/Z2FtYmxpbmdsb3JlQFdoaXRlYXJtb3I"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T03:21:52.695460+00:00","id":41496,"published_date":"2026-10-27T03:07:40+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Verification for Gamblinglore.com","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : Verification","url":"https://www.ransomware.live/id/VmVyaWZpY2F0aW9uQFdoaXRlYXJtb3I"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-27T03:21:53.159517+00:00","id":41500,"published_date":"2026-10-27T01:30:00+00:00","severity":"medium","source_name":"SecurityWeek","summary":"The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque and canceled appointments at more than 30 clinics. The post Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics appeared first on SecurityWeek.","title":"Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics","url":"https://www.securityweek.com/cybersecurity-issue-forces-a-major-new-mexico-hospital-to-divert-patients-and-close-clinics"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Vulnerability-management research with fast Patch Tuesday and KEV-adjacent analysis. Vendor context; filter_uncategorized drops product marketing.","created_at":"2026-10-27T03:22:01.651607+00:00","id":41501,"published_date":"2026-10-27T01:19:40+00:00","severity":"critical","source_name":"Tenable","summary":"Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows. Key Takeaways CVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Google's Brotli decoder library that Google, the CVE Numbering Authority (CNA), scored 9.2 under CVSSv4.0. Any application that decompresses attacker-controlled data with a vulnerable Brotli decoder is potentially at risk, including Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse. Patches are available for Google Brotli and the major runtimes, though some projects had not shipped a fixed release as of October 26, and applications that bundle their own copy of Brotli each need their own fix. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding Brotli2Shell, a vulnerability in Google's Brotli C decoder library, which Node.js, .NET and other software embed. FAQ What is Brotli2Shell? Brotli2Shell is one of several names for CVE-2026-111497, a memory corruption flaw in Google's open-source Brotli compression library. Some researchers call it Node2Shell, after Node.js, which disclosed the flaw in its October 21 security advisory. Others use HTTP2Shell, since the same bug reaches HTTP software outside Node.js. It has circulated as Broccoli2Shell as well. We use Brotli2Shell because the bug sits in the Brotli decoder itself, not in any one downstream product. What is the vulnerability associated with Brotli2Shell? CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli C decoder library. CVEDescriptionCVSSv4.0CVE-2026-111497Google Brotli decoder out-of-bounds write vulnerability9.2 An attacker can trigger the flaw by getting an application to decompress crafted Brotli data. Two common paths are a compressed HTTP response sent to a client that decompresses it automatically, and a compressed request body sent to a server that decompresses incoming content. The impact ranges from a process crash to potential remote code execution, and the bug can also leak process memory. Note on severity scoring: Google, as the CNA, scored the flaw 9.2 (CVSSv4.0) with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Microsoft rates it 8.1 (CVSSv3.1) for .NET. When was CVE-2026-111497 first disclosed? Google committed the upstream fix to the Brotli source repository on February 27. Node.js publicly disclosed the vulnerability on October 21 in its security advisory, the same day Google released fixed Brotli versions. Envoy Proxy and Istio had already shipped fixed releases earlier in October without naming the flaw. NVD published the CVE record on October 22. Brotli 1.2.1 and brotlicffi 1.2.1.0 both reached the Python Package Index (PyPI) on October 22. On October 25, Microsoft released .NET security updates. What software is affected by CVE-2026-111497? The risk applies wherever an application decompresses Brotli data an attacker can control, whether that data arrives over HTTP in either direction or inside a file. ProjectAffected versionsFixed versionsGoogle Brotli1.0.3 to 1.0.9, 1.1.0, 1.2.01.0.10, 1.1.1, 1.2.1Node.js< 22.23.4, < 24.22.1, < 26.12.122.23.4, 24.22.1, 26.12.1Bun>= 1.0.21, < 1.4.41.4.4Envoy Proxy<= 1.36.11, <= 1.37.7, <= 1.38.5, <= 1.39.21.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0Istio< 1.29.9, < 1.30.6, < 1.31.21.29.9, 1.30.6, 1.31.2Microsoft .NET 8< 8.0.338.0.33Microsoft .NET 9< 9.0.229.0.22Microsoft .NET 10< 10.0.1410.0.14Microsoft .NET 11< Release Candidate 3Release Candidate 3Python Brotli1.0.3 to 1.2.01.2.1Python brotlicffi1.0.3 to 1.2.0.x1.2.1.0PHP for WindowsWindows builds that bundle Brotli 1.0.3 to 1.2.08.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 Node.js release lines that have reached end of support, including 20, 23 and 25, do not receive a fixed release. Akamai said its telemetry \"shows that 61% of networks are running affected Node.js versions.\" JFrog Security Research showed that the flaw also reaches FFmpeg through the libjxl library, by way of Brotli-compressed metadata in JPEG XL files. JFrog obtained instruction-pointer control in FFmpeg with a crafted JPEG XL file but did not demonstrate code execution. The same research produced an infinite-loop denial of service in Apache Arrow, which uses Brotli for compressed Parquet data, with a crafted 534-byte input, and crashed a tested ClickHouse server with a single malformed Brotli-compressed HTTP request. Python HTTP clients such as urllib3, requests, httpx and aiohttp are also in scope when the Brotli or brotlicffi package is installed. Does updating the system Brotli library fix the issue? It depends on where the software gets its decoder. Programs that load the operating system's copy of Brotli pick up the fix once they restart. Node.js, Bun and other applications that ship with a built-in copy keep the flawed decoder until a fixed release of that application is installed. Is every .NET, Envoy Proxy or Istio installation exposed? No. These platforms are exposed only when Brotli decompression is in use. .NET: Microsoft says an application \"is not exposed merely because an affected .NET package is installed,\" and ASP.NET Core request decompression and HttpClient automatic response decompression are off by default. Applications are in scope when they use ASP.NET Core request decompression, HttpClient response decompression, or the Brotli APIs in System.IO.Compression such as BrotliStream and BrotliDecoder. NativeAOT and self-contained applications pick up the fix only when they are rebuilt and redeployed. Microsoft says .NET Framework is not affected. Envoy Proxy and Istio: Envoy Proxy is exposed only when its Brotli decompressor is configured, and Istio users\u2026","title":"Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)","url":"https://www.tenable.com/blog/brotli2shell-frequently-asked-questions-for-google-brotli-decoder-cve-2026-111497"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T03:21:52.695928+00:00","id":41497,"published_date":"2026-10-27T01:08:42+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Country: c | Status: Sale","title":"\ud83c\udff4\u200d\u2620\ufe0f Ulose has just published a new victim : zzq-test","url":"https://www.ransomware.live/id/enpxLXRlc3RAVUxvc2U"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T03:21:52.696774+00:00","id":41498,"published_date":"2026-10-27T01:08:22+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Country: zz | Status: Public","title":"\ud83c\udff4\u200d\u2620\ufe0f Ulose has just published a new victim : probe-011637cabbf94076-","url":"https://www.ransomware.live/id/cHJvYmUtMDExNjM3Y2FiYmY5NDA3Ni1AVUxvc2U"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-27T01:21:54.727577+00:00","id":41217,"published_date":"2026-10-27T01:06:22+00:00","severity":"medium","source_name":"The Register (Security)","summary":"CEO admits service used for foreign exchange trading had holes company was slow to fix","title":"Japanese virtual desktop cloud hacked so hard it asks to be banned","url":"https://www.theregister.com/security/2026/10/27/japanese-virtual-desktop-cloud-hacked-so-hard-it-asks-to-be-banned/5305610"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-27T01:21:46.793814+00:00","id":41127,"published_date":"2026-10-27T00:26:50+00:00","severity":"medium","source_name":"Dark Reading","summary":"Measuring AI model security gets complex fast \u2014 a growing patchwork of benchmarks targets different variables in the equation, but none replace testing against your own code and workflows.","title":"So Many AI Security Benchmarks, But None Tell the Whole Story","url":"https://www.darkreading.com/cybersecurity-analytics/benchmarking-security-of-ai-models-poses-challenges"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-27T01:21:53.641045+00:00","id":41199,"published_date":"2026-10-27T00:22:54+00:00","severity":"critical","source_name":"CyberScoop","summary":"The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn\u2019t been observed in the wild. The post Experts temper emergency-level alarms over critical Brotli defect appeared first on CyberScoop.","title":"Experts temper emergency-level alarms over critical Brotli defect","url":"https://cyberscoop.com/brotli-critical-vulnerability-decompression-library-node2shell-broccoli2shell"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-27T03:21:52.699132+00:00","id":41499,"published_date":"2026-10-27T00:14:02+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Provider and developer of smart logistics solutions and autonomous driving systems intended to serve the vehicle industry. The company develops intelligent vehicle software and hardware system for the commercial vehicle industry, committing to making transportation and logistics more intelligent and safer.","title":"\ud83c\udff4\u200d\u2620\ufe0f Dragonforce has just published a new victim : Zhito Technology","url":"https://www.ransomware.live/id/WmhpdG8gVGVjaG5vbG9neUBkcmFnb25mb3JjZQ"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Container/Kubernetes runtime-security research and cryptomining campaign analysis. NOTE: removed 2026-07-11 as a 404 on a guessed URL; this path was re-verified live 2026-08-29 (HTTP 200, 100 entries) and works.","created_at":"2026-10-27T14:23:23.391527+00:00","id":42027,"published_date":"2026-10-27T00:00:00+00:00","severity":"medium","source_name":"Sysdig","summary":"","title":"Three layers of open source defense for AI coding agents: OpenShell, Prempti, and Falco","url":"https://webflow.sysdig.com/blog/three-layers-of-open-source-defense-for-ai-coding-agents-openshell-prempti-and-falco"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Container/Kubernetes runtime-security research and cryptomining campaign analysis. NOTE: removed 2026-07-11 as a 404 on a guessed URL; this path was re-verified live 2026-08-29 (HTTP 200, 100 entries) and works.","created_at":"2026-10-27T14:23:23.388352+00:00","id":42026,"published_date":"2026-10-27T00:00:00+00:00","severity":"medium","source_name":"Sysdig","summary":"","title":"Mythos access is expanding: what this means for vulnerability management","url":"https://webflow.sysdig.com/blog/mythos-access-is-expanding-what-this-means-for-vulnerability-management"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T23:22:13.276203+00:00","id":41005,"published_date":"2026-10-26T23:07:56+00:00","severity":"medium","source_name":"Ransomware.live","summary":"[AI generated] Morrison Cohen LLP is a United States law firm headquartered in New York City. It provides legal services across practice areas including corporate law, litigation, bankruptcy and restructuring, real estate, intellectual property, and white-collar defense. The firm serves corporate clients, financial institutions, and individuals. It operates within the legal services industry, primarily serving businesses in the New York metropolitan area and nationally.","title":"\ud83c\udff4\u200d\u2620\ufe0f Silentransomgroup has just published a new victim : Morrison Cohen","url":"https://www.ransomware.live/id/TW9ycmlzb24gQ29oZW5AU2lsZW50UmFuc29tR3JvdXA"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"CERT/CC vulnerability coordination center. Authoritative vuln notes, partially replaces dead CISA feeds.","created_at":"2026-10-26T23:21:57.834621+00:00","id":40953,"published_date":"2026-10-26T22:45:54+00:00","severity":"medium","source_name":"CERT Vulnerability Notes","summary":"Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-level signer share to recover the higher-level share it was derived from. Description Fireblocks is a digital-asset custody and wallet platform that secures the private keys behind cryptocurrency wallets for institutions and exchanges, using multi-party computation (MPC) so that no single machine ever holds a complete key. Fireblocks\u2019 key security pipeline contains two layers: MPC, which splits a single key into shares, and hardened derivation, which mathematically isolates each share from its key hierarchy. Normally, the derivation delta between parent and child keys is formed by hashing the private parent key, a derivation index, and associated metadata. CVE-2026-90975 A fail-open vulnerability was identified within the BIP32 hardened derivation implementation which fails to reject operations where no parent secret is present. If a parent key is missing, the implementation substitutes the secret parent contribution with a null buffer. Because the buffer becomes a known constant, 0, the delta becomes computable, violating ancestor isolation. Impact An attacker who compromises a single MPC party's descendant signer share, and who knows the associated chain code, can compute the public derivation delta and subtract it to recover that party's ancestor share, repeating the operation up the hierarchy to obtain that party's root share. The isolation between derivation levels is reduced to a publicly computable scalar, so a single leaf-level share compromise extends to that party's shares across the entire key hierarchy managed by the MPC cluster. The primary MPC secret-sharing layer still prevents reconstruction of a full private key from a single compromised party's shares, so this flaw does not by itself yield a spendable key. Its significance is the elimination of a defense-in-depth layer: hardened derivation no longer provides post-compromise ancestor isolation, threshold-security assumptions degrade as compromise propagates across derivation levels over time, and the downgrade occurs silently with no error or log signal. In BIP32 deployments where the chain code is treated as public, the precondition of knowing the chain code is trivially met. Solution At the time of writing, Fireblocks could not be reached to coordinate this vulnerability, and no vendor fix is available. Integrators can, however, reduce exposure with the following mitigations. Treat the chain code as secret. The attack is only available to a party that knows the chain code, because the derivation delta is computed as HMAC-SHA512(chaincode, ...). Chain codes should not be distributed in watch-only extended public keys or otherwise exposed to untrusted parties. Where a deployment can keep the chain code confidential, the delta is no longer publicly computable and ancestor-share recovery is not possible. This is the most effective mitigation available without a code change. Do not rely on hardened derivation for isolation between signer shares. Audit derivation paths for hardened segments and treat the compromise of any single share as potentially exposing that party's other shares across the derivation hierarchy. A complete fix requires a change in the library. Acknowledgements Thanks to hodlturk for reporting this vulnerability. This document was written using AI assisted tools by Alexander Curtis and Alex Lewis.","title":"VU#701544: mpc-lib Hardened Derivation Fails to Protect Ancestor Isolation","url":"https://kb.cert.org/vuls/id/701544"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T22:29:29.213973+00:00","id":40933,"published_date":"2026-10-26T22:20:36+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]","title":"University of Copenhagen data breach exposes data of 525,000 people","url":"https://www.bleepingcomputer.com/news/security/university-of-copenhagen-data-breach-exposes-data-of-525-000-people"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Primary npm/PyPI supply-chain research; the origin of the Shai-Hulud package-version figures this project already cites. Fills the Supply Chain category, which had keyword rules but no dedicated feed. filter_uncategorized drops product/marketing posts.","created_at":"2026-10-26T23:22:16.797016+00:00","id":41008,"published_date":"2026-10-26T22:15:00+00:00","severity":"critical","source_name":"Aikido Security","summary":"Patch PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with free Aikido Images for PHP 5.5 to 8.5. Stay on your current version with backported fixes. Category: Product Updates","title":"How to patch PHP2Shell with free Aikido Images","url":"https://www.aikido.dev/blog/how-to-patch-php2shell-with-free-aikido-images"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"First-party analysis of record-scale DDoS campaigns and internet-wide attack trends, plus post-incident write-ups. Mixed with heavy product launch content; filter_uncategorized is essential.","created_at":"2026-10-26T22:29:40.941709+00:00","id":40939,"published_date":"2026-10-26T22:01:23+00:00","severity":"medium","source_name":"Cloudflare","summary":"A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.","title":"Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang","url":"https://blog.cloudflare.com/kv-cache-exposure-remediation"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T23:22:13.278768+00:00","id":41006,"published_date":"2026-10-26T21:52:29+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Alain Afflelou is a leading European franchisor of optical and hearing aid products, founded in France in 1972. The company operates a robust network of over 1,500 stores across 20 countries, driven by aggressive marketing innovations like its famous \"Tchin-Tchin\" multi-pair offer. Key Figures \u2022 Network Revenue: \u20ac1.13 billion (TTC) for the fiscal year ending July 2025 \u2022 Corporate Revenue: \u20ac447.3 million (excl. taxes), generated from corporate stores and franchise fees. \u2022 Core Segments: Eyewear and audioprosthetics. [Sector: Retail]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : Afflelou","url":"https://www.ransomware.live/id/QWZmbGVsb3VAZW1wZXJhZG9y"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T22:29:29.217079+00:00","id":40934,"published_date":"2026-10-26T21:08:28+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. [...]","title":"Former pentester used ARTEX AI to steal 8.2 million data records","url":"https://www.bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-26T22:29:29.830008+00:00","id":40937,"published_date":"2026-10-26T21:03:00+00:00","severity":"medium","source_name":"The Record","summary":"In an unusual move, the suit \u2014 brought under the state\u2019s deceptive trade practices laws \u2014 seeks to hold founder and CEO Sam Altman personally liable for the alleged deception.","title":"Texas sues OpenAI for deceiving consumers about safety, seeks sweeping reforms and fines","url":"https://therecord.media/texas-sues-openai-deceiving-customers"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-26T22:29:29.543958+00:00","id":40936,"published_date":"2026-10-26T20:59:26+00:00","severity":"medium","source_name":"Dark Reading","summary":"A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.","title":"In-the-Wild Attack Abuses AI Agents' Trust in Markdown","url":"https://www.darkreading.com/application-security/in-the-wild-attack-ai-agents-trust-markdown"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T23:22:13.280122+00:00","id":41007,"published_date":"2026-10-26T20:52:51+00:00","severity":"medium","source_name":"Ransomware.live","summary":"36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.","title":"\ud83c\udff4\u200d\u2620\ufe0f Byod has just published a new victim : University of New Mexico","url":"https://www.ransomware.live/id/VW5pdmVyc2l0eSBvZiBOZXcgTWV4aWNvQEJZT0Q"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T22:29:29.218764+00:00","id":40935,"published_date":"2026-10-26T20:46:49+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models. [...]","title":"OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing","url":"https://www.bleepingcomputer.com/news/artificial-intelligence/openai-launches-gpt-61-terra-with-3x-faster-ai-agents-50-percent-lower-pricing"},{"category":"Supply Chain","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-26T22:29:37.744337+00:00","id":40938,"published_date":"2026-10-26T20:30:53+00:00","severity":"medium","source_name":"The Register (Security)","summary":"A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'","title":"LiteLLM supply chain attack started with an exposed master key","url":"https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T20:29:25.066088+00:00","id":40908,"published_date":"2026-10-26T20:27:18+00:00","severity":"medium","source_name":"Ransomware.live","summary":"MISC Group Incorporated in 1968, MISC Group is a world leading provider of international energy-related maritime solutions and services.29,841 files , 28.4 GBComplete command workstations: Master, Chief Officer and Bridge user folders - 16,918 files / 15.5 GB, including PST mail archives;Crew personal data (PDPA breach): IMO FAL Form 5 crew lists for ~30 seafarers with passport numbers (Malaysia/Philippines/Indonesia/India), Seafarer Employment Agreements with DOB, home addresses and salaries, a full scan of the 4th Officer's PRC passport;Every ship's password: ECDIS, CCTV, AIS, fire & gas alarm panels, door access codes, the Ship Security Plan (ISPS) password, NS5/Dualog mail accounts, domain admin credentials, OCIMF/SIRE web account;Internal investigations: complaint against the Chief Engineer (on-board assault/harassment, 25.08.2026), FR-HR25 investigative report;Incidents: vessel listing during (de-)ballasting - twice, one incident not reported to the flag state; a series of near-misses (VDR sensor failure, radar misuse during collision avoidance);Compliance gap: ~20 internal ISM non-conformities (rusted cargo pipelines, HV gloves expired since 2021) vs 'clean' statutory ABS audits of 17.10.2025; Japan PSC deficiency (Himeji, 09.12.2025) + Statements of Fact from 4 officers;Drydock & charter documentation: repair specs (SQLite MSL), ExxonMobil/APLNG delivery & redelivery certificates, CTMS custody-transfer data, full e-docs and ship plans More","title":"\ud83c\udff4\u200d\u2620\ufe0f Rhysida has just published a new victim : MISC Group","url":"https://www.ransomware.live/id/TUlTQyBHcm91cEByaHlzaWRh"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T20:29:24.531693+00:00","id":40912,"published_date":"2026-10-26T20:20:56+00:00","severity":"medium","source_name":"SecurityWeek","summary":"A string of hacking incidents by rogue AI agents also has raised fears the technology will slip free of human control to carry out harmful, life-threatening tasks. The post Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI appeared first on SecurityWeek.","title":"Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI","url":"https://www.securityweek.com/anthropic-files-for-potentially-the-biggest-ipo-ever-as-ceo-warns-of-risk-to-humanity-from-ai"},{"category":"Cloud Security","confidence":"MEDIUM","confidence_reason":"Vulnerability-management research with fast Patch Tuesday and KEV-adjacent analysis. Vendor context; filter_uncategorized drops product marketing.","created_at":"2026-10-26T23:22:19.279911+00:00","id":41009,"published_date":"2026-10-26T19:48:07+00:00","severity":"critical","source_name":"Tenable","summary":"Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) faster. Key takeaways The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) put security teams in a race against attackers. PHP runs on more than 70% of websites, so organizations need to quickly find where they\u2019re affected and update PHP to fixed versions. Tenable helps you find PHP2Shell across your attack surface. Tenable One Attack Surface Management discovers externally facing PHP assets. Tenable One Vulnerability Management and Tenable Security Center provide detections, including local checks for Linux distribution packages. Tenable One Web App Scanning assesses web applications, and Tenable One Cloud Exposure covers cloud workloads. Tenable accelerates remediation. Tenable Patch Management matches exposures to the right patches, launches patch workflows, and validates fixes with post-scan checks. Tenable One with Tenable Hexa AI lets you find vulnerable assets, create exposure initiatives, and generate remediation tickets with simple prompts. Respond faster with Tenable solutions The recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have put security teams in a race against attackers to remediate or mitigate exposure before their systems are targeted. PHP runs on more than 70% of websites, and many of those sites run unsupported, legacy branches that no longer receive upstream support. Organizations need to quickly find where they\u2019re affected and update PHP to fixed versions. To help cybersecurity teams accelerate emergency response, this blog outlines tips for using the Tenable solutions to identify vulnerable versions of PHP, prioritize remediation decisions, and implement patches as quickly as possible. External Attack Surface Management Tenable One Attack Surface Management (ASM) helps you discover externally facing assets running PHP. ASM continuously scans public data sources, such as DNS records, IP addresses, Autonomous System Numbers (ASN), WHOIS registrations, and neighboring IP ranges, to discover forgotten, rogue, or shadow IT assets that might be vulnerable to PHP2Shell. This is one of the first steps to take. It shows your digital footprint from the attacker\u2019s perspective and identifies potential entry points into your organization. Important ASM tips include: Use ASM to find additional top-level domains related to your organization. Suggested Domains helps you identify additional domains you may own based on ASN, brand, domain name, IP range, subdomain, or nameserver. You can also adjust the suggestion rules to prioritize domain names based on the likelihood of ownership. Search the inventory for PHP deployments. Create a query in ASM to identify PHP as a programming language filter. This gives you a quick starting point to assess locations, asset details, and software versions for further analysis. Continuously monitor for changes in your attack surface. Use Subscriptions in ASM to receive event-driven notifications and understand important changes in your attack surface that may create new exposure. Choose from hundreds of pre-built event categories or create a customized subscription. Two subscriptions apply to PHP: PHP in applications and PHP end-of-life installs. Explore the solution walk-through to learn more about Tenable One Attack Surface Management. How to Identify and Tag PHP Assets in Tenable One Attack Surface Management. This demo shows how to get a view of the external attack surface and identify where php2shell creates exposure. In Explore > Asset Inventory, review the inventory of assets facing the outside world. To add another inventory source, click '+' and choose an option from the drop-down menu, such as 'Add Hostnames or Domains.' In the pop-up menu, enter a new hostname, for example 'tenable.com.' To narrow the results to assets running PHP, use the query bar to set 'Programming Language' equal to 'PHP.' The results show 265 assets with PHP listed as their Programming Language. Create a 'PHP2Shell' tag and apply it to the selected assets so they can be grouped and prioritized. The Tags column then displays the 'PHP2Shell' tag. Subscriptions can be used to view and assess PHP. Subscriptions provide a growing list of events, including predefined lists and categories. Search for 'PHP' and add the 'PHP - v1' subscription. After subscribing, create an alert for the subscription. The subscription is set to 'Programming Language' contains php, so it filters assets and sends an alert when a new asset meeting this criteria is identified. Vulnerability Management Tenable One Vulnerability Management and Tenable Security Center both help you find PHP2Shell vulnerabilities with detections for PHP, including local checks for PHP packages from Linux distributions. Tenable will release additional detections as vendors publish fixes in their security advisories. Both solutions help you create out-of-band, tactical scans based on your preferred scan policy. Additional tips include: Update plugin feeds before running a scan. Tenable One Vulnerability Management automatically manages and updates plugin feeds through cloud synchronization by default. In offline or air-gapped environments, Tenable Security Center may require manual plugin feed updates. Use thorough testing to discover more vulnerabilities. Enabling thorough testing and paranoia mode in your scan policy conducts deeper assessments of your attack surface using multiple methods to discover risk. This is very important when you need to scan software across all system drives or investigate deep component-level software vulnerabilities where default settings may result in false negatives. Assign tags to indicate exposure. Use dynamic tagging to identify PHP2Shell on existing and newly discovered assets. Actively manage open remediations. Use Exposure Response in Tenable One\u2026","title":"Discover and remediate PHP2Shell exposure with Tenable","url":"https://www.tenable.com/blog/discover-and-remediate-php2shell-exposure-with-tenable"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T20:29:24.067704+00:00","id":40902,"published_date":"2026-10-26T19:26:20+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...]","title":"DreamHost forces password resets in ongoing \"incident\"","url":"https://www.bleepingcomputer.com/news/security/dreamhost-forces-email-ftp-sftp-password-resets-in-ongoing-incident"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"CERT/CC vulnerability coordination center. Authoritative vuln notes, partially replaces dead CISA feeds.","created_at":"2026-10-26T19:29:23.187454+00:00","id":40897,"published_date":"2026-10-26T19:07:02+00:00","severity":"high","source_name":"CERT Vulnerability Notes","summary":"Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable (TCP) SOME/IP endpoint grows its receive buffer to an attacker-declared message size before validating that the declared bytes have actually been received, allowing a remote, unauthenticated peer to exhaust host memory and deny service. The issue was reported publicly as COVESA/vsomeip issue #1009 and fixed in release 3.7.4 (2026-07-06). Description CVE-2026-91141 vsomeip is a middleware implementation of the Scalable service-Oriented MiddlewarE over IP (SOME/IP) protocol, widely used for service-oriented communication between electronic control units (ECUs) in automotive and other embedded environments. A SOME/IP message begins with a 16-byte header that includes a 32-bit length field declaring the size of the message that follows. A vulnerability was discovered in the handling of this length field on reliable (TCP) endpoints. When a message arrives, vsomeip grows its receive buffer to the size declared in the length field in order to read the incoming message, before confirming that those bytes have actually been received. In the default configuration, no size limit is applied to reliable endpoints, so a peer can declare a message size of up to roughly 4 GB and cause the receiver to allocate that memory. Because a freshly accepted connection reaches this path on its first message, no valid service, credentials, or SOME/IP authentication are required to trigger the allocation. The client endpoint contains the same behavior, where a malicious or compromised server can attack a connecting client. Deployments that explicitly configure a reliable message-size limit are not affected. This issue is publicly known. It was reported as COVESA/vsomeip issue #1009 (opened 2026-02-26) and fixed in release 3.7.4 (released 2026-07-06). Impact A remote, unauthenticated peer can force the host to allocate an attacker-chosen amount of memory, up to approximately 4 GB per connection, by sending a single short message on a normal TCP connection to any reachable reliable SOME/IP endpoint in the default configuration. On a memory-constrained node this can terminate the service outright: a service limited to 1.5 GB was OOM-killed by a single 16-byte message claiming a 3 GB payload. On a memory-rich host, the allocation for a single connection is released when the connection closes, so sustained memory exhaustion and denial of service follow from holding or repeating connections, each forcing its own allocation. Solution Upgrade to vsomeip 3.7.4 or later. This issue is fixed in release 3.7.4 (released 2026-07-06). The fix replaces the unlimited compile-time default (MESSAGE_SIZE_UNLIMITED) with a bounded DEFAULT_MAX_MESSAGE_SIZE of 10 MiB, so reliable endpoints reject an oversized declared length before growing the receive buffer even when no limit is explicitly configured. The release also adds a regression test for an oversized length field. The issue and fix are tracked publicly in COVESA/vsomeip issue #1009. Deployments that cannot upgrade immediately should apply the following mitigations. Deployments can explicitly set max-payload-size-reliable (or the equivalent per-service reliable message-size limit) to a value appropriate for the service. Endpoints with such a limit configured reject oversized declared lengths and are not affected by this issue. This is the most effective mitigation available without upgrading. Because the vulnerability is reachable by any host that can open a TCP connection to a reliable SOME/IP endpoint, exposure should be minimized through network segmentation. Reliable endpoints should be confined to trusted, isolated in-vehicle or lab networks, and firewall or access-control rules should limit connectivity to known, authorized peers. SOME/IP endpoints should never be exposed to untrusted or external networks. Operators should monitor for anomalous memory growth on services offering reliable endpoints and for unexpected or repeated inbound TCP connections to SOME/IP ports, which may indicate attempts to exploit this vulnerability. Acknowledgements Thank you to the Jaafer Rahmani for reporting this vulnerability. This document was written by Alexander Curtis.","title":"VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling","url":"https://kb.cert.org/vuls/id/128947"},{"category":"OT/ICS","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T20:29:25.066749+00:00","id":40909,"published_date":"2026-10-26T18:57:11+00:00","severity":"medium","source_name":"Ransomware.live","summary":"smart grid engineering firm \u00b7 Spain | Live electrical telemetry sampled from the plant control network, with voltage, current and energy readings recorded on 23 October 2026; Complete inventory of 49 network devices including substation switches, remote terminal units, power meters and server management controllers, with locations and firmware details; Full maps of the internal control network segments and message broker metrics that carry the plant data | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Ingelectus Innovative Electrical Solutions S.L.","url":"https://www.ransomware.live/id/SW5nZWxlY3R1cyBJbm5vdmF0aXZlIEVsZWN0cmljYWwgU29sdXRpb25zIFMuTC5ATjBu"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party Palo Alto Networks PSIRT advisories (PAN-OS / GlobalProtect). Earliest authoritative source for a frequently-exploited edge-device product line.","created_at":"2026-10-26T20:29:32.923767+00:00","id":40913,"published_date":"2026-10-26T18:45:00+00:00","severity":"critical","source_name":"Palo Alto PSIRT","summary":"","title":"CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)","url":"https://security.paloaltonetworks.com/CVE-2026-111497"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T20:29:23.213434+00:00","id":40903,"published_date":"2026-10-26T18:12:22+00:00","severity":"critical","source_name":"The Hacker News","summary":"An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. \"When you","title":"Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento","url":"https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-26T18:29:35.372595+00:00","id":40892,"published_date":"2026-10-26T18:05:35+00:00","severity":"medium","source_name":"CyberScoop","summary":"Section 702 of the Foreign Intelligence Surveillance Act has lapsed, but another decision on its future nears, and the classified opinion could be decisive. The post Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion appeared first on CyberScoop.","title":"Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion","url":"https://cyberscoop.com/wyden-schiff-fisa-section-702-declassification"},{"category":"Supply Chain","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-26T18:29:26.345091+00:00","id":40880,"published_date":"2026-10-26T18:01:40+00:00","severity":"medium","source_name":"Dark Reading","summary":"An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.","title":"'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets","url":"https://www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T20:29:25.069929+00:00","id":40910,"published_date":"2026-10-26T18:00:10+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million. We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion. The way in was something internal, a machine account that was already sitting in their admin side (Metawin). Issued years back, nobody ever rotated it. Never meant to leave the building. It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores. About your provably fair: what it promised and what it delivered were never the same thing. We demand $15,000,000 in BTC. Emails with instructions will be sent to you directly. To verify, a sample can be found below.","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : Gamdom","url":"https://www.ransomware.live/id/R2FtZG9tQFdoaXRlYXJtb3I"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T20:29:24.146894+00:00","id":40904,"published_date":"2026-10-26T17:45:57+00:00","severity":"critical","source_name":"The Hacker News","summary":"PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but","title":"PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw","url":"https://thehackernews.com/2026/10/php-issues-second-windows-security.html"},{"category":"Consumer Awareness","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-26T18:29:35.378369+00:00","id":40893,"published_date":"2026-10-26T17:33:19+00:00","severity":"medium","source_name":"CyberScoop","summary":"Zheng Zhao and his co-conspirators allegedly deceived 174 U.S. residents into sending funds to a globally coordinated fake investment operation with ties to Cambodia. The post Authorities extradite Chinese national for alleged $37M investment scam appeared first on CyberScoop.","title":"Authorities extradite Chinese national for alleged $37M investment scam","url":"https://cyberscoop.com/chinese-national-extradited-investment-scam"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"Emergent threat response team. Primary exploit analysis on actively exploited vulns, peer-quality with ZDI.","created_at":"2026-10-26T18:29:30.423203+00:00","id":40884,"published_date":"2026-10-26T17:32:46+00:00","severity":"critical","source_name":"Rapid7","summary":"Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE Numbering Authority (CNA), gives it a critical CVSSv4 score of 9.2. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory. According to Node.js, this corruption can lead to a process crash, disclosure of sensitive process memory, or remote code execution. Exposure therefore depends on whether an application passes attacker-controlled compressed data to the affected decoder. As of October 26, 2026, Rapid7 is not aware of exploitation in the wild, and CVE-2026-111497 is not listed in CISA's Known Exploited Vulnerabilities catalog. However, given the vulnerability's potential to disclose memory or enable remote code execution (RCE), Rapid7 recommends that organizations prioritize remediation. Technical overview CVE-2026-111497 is classified as an out-of-bounds write (CWE-787) and an unchecked return value (CWE-252). Per the vendor advisory, the decoder handled an invalid Brotli block switch as a temporary need for more input instead of a permanent format error. The streaming decoder then continued appending input bytes to an eight-byte internal buffer, allowing malformed input to write beyond the buffer and corrupt process memory. The vulnerability originates in Google Brotli, which the affected Node.js release lines bundle as a dependency. The CVE record identifies affected upstream Brotli ranges on all platforms as versions 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. The Node.js Project remediated its bundled decoder in the fixed Node.js releases listed below. Because CVE-2026-111497 affects the upstream Google Brotli decoder, its reach is not limited to Node.js. Vendor and project advisories have also identified affected implementations in Bun, Python's Brotli and brotlicffi packages, .NET, Envoy and Istio, brotli4j, and operating-system packages. Affected versions, default exposure, and remediation vary by product; the presence of an affected decoder does not by itself establish exposure unless an application processes attacker-controlled Brotli data. Organizations should consult the relevant downstream vendor or distribution advisories to identify affected versions, assess exposure, and determine appropriate remediation. Mitigation guidance Vendor-supplied security updates are available to remediate CVE-2026-111497. Organizations running an affected Node.js release should upgrade on an urgent basis, outside of normal patch cycles: Node.js 22.x releases before 22.23.4 are affected; upgrade to 22.23.4 or later. Node.js 24.x releases before 24.22.1 are affected; upgrade to 24.22.1 or later. Node.js 26.x releases before 26.12.1 are affected; upgrade to 26.12.1 or later. The vendor states that end-of-life Node.js release lines should also be treated as affected when a security release occurs. Organizations using an end-of-life release should migrate to a supported, fixed release line. Node.js has not published a vendor-supported workaround; if an immediate upgrade is not possible, Rapid7 recommends restricting or disabling application paths that decompress untrusted Brotli data as a temporary exposure-reduction measure. For the latest mitigation guidance, please refer to the Node.js security advisory. Rapid7 customers Exposure Command, Vulnerability Management, and Nexpose Exposure Command, Vulnerability Management, and Nexpose customers can assess exposure to CVE-2026-111497 with an authenticated Linux and macOS vulnerability check expected to be available in the October 26 content release. Windows-based vulnerability check is in progress and an update will be provided soon. Please refer to this blog for the latest information. Updates October 26, 2026: Initial publication.","title":"CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder","url":"https://www.rapid7.com/blog/post/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-26T18:29:27.232519+00:00","id":40881,"published_date":"2026-10-26T17:30:00+00:00","severity":"medium","source_name":"The Record","summary":"Serbian strongman leader Aleksandar Vu\u010di\u0107 on Sunday admitted defeat in his race for prime minister, a loss that follows a series of incidents of digital repression that galvanized the opposition.","title":"Serbian autocrat loses election following widespread reports of digital repression","url":"https://therecord.media/serbia-election-spyware-vucic"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Cloud security posture and vulnerability research. Vendor context; filter_uncategorized drops product marketing.","created_at":"2026-10-26T18:29:37.889242+00:00","id":40894,"published_date":"2026-10-26T17:21:56+00:00","severity":"critical","source_name":"Orca Security","summary":"Executive Summary: What are CVE-2026-109618 and CVE-2026-109619? Why PHP vulnerabilities put most of the web at risk When you open a web page, something has to build that page before it reaches you. For roughly seven out of ten websites, the software doing that job is PHP. It sits on the web server, assembles the [\u2026]","title":"PHP2Shell: From the attacker\u2019s perspective","url":"https://orca.security/resources/blog/php2shell-from-the-attackers-perspective"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T20:29:25.071803+00:00","id":40911,"published_date":"2026-10-26T16:54:28+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Plaintiff litigation law firm - Our 214 GB extraction includes executed agreements, final settlement participation agreements, court-signed stipulations regarding net worth, privileged internal memos, detailed litigation strategies, rough trial transcripts, comprehensive staff FAQs and much more.","title":"\ud83c\udff4\u200d\u2620\ufe0f Falcon has just published a new victim : Beasley Allen Law Firm","url":"https://www.ransomware.live/id/QmVhc2xleSBBbGxlbiBMYXcgRmlybUBGYWxjb24"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-26T17:29:33.753161+00:00","id":40879,"published_date":"2026-10-26T16:50:46+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Bulletin ID: 2026-151-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/26/2026 09:30 AM PDT Description: The AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module provides experimental constructs that manage Amazon Redshift users, tables and privileges. We identified CVE-2026-115418, an issue where crafted user names, comments or passwords set in these constructs could change the SQL that runs with Amazon Redshift superuser privileges at deployment, including granting access to all cluster users. Exploiting the issue requires the ability to influence the CDK application's construct property values. Impacted versions: <2.274.0-alpha.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article","title":"CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-151-aws"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-26T18:29:27.235007+00:00","id":40882,"published_date":"2026-10-26T16:40:00+00:00","severity":"medium","source_name":"The Record","summary":"Ukrainian Defense Minister Yevhen Khmara said Saturday that Starlink and Starshield connectivity had been restored.","title":"Ukraine disputes Musk's claims of Starlink misuse as military connectivity restored","url":"https://therecord.media/ukraine-disputes-musk-claims-of-starlink-misuse"},{"category":"Consumer Awareness","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-26T18:29:27.238062+00:00","id":40883,"published_date":"2026-10-26T16:37:00+00:00","severity":"medium","source_name":"The Record","summary":"44-year-old Zheng Zhao was allegedly a key money-launderer working with a group of scammers who called U.S.-based victims and urged them to invest in fictitious businesses.","title":"Dutch police extradite Chinese national accused of laundering Cambodian investment scam funds","url":"https://therecord.media/dutch-police-extradite-chinese-national-money-laundering-scams"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T16:29:24.231687+00:00","id":40787,"published_date":"2026-10-26T16:27:57+00:00","severity":"critical","source_name":"Bleeping Computer","summary":"A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]","title":"Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches","url":"https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research. Good primary work but commercial context.","created_at":"2026-10-26T16:29:26.020585+00:00","id":40803,"published_date":"2026-10-26T16:12:38+00:00","severity":"critical","source_name":"Check Point Research","summary":"For the latest discoveries in cyber research for the week of 26th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malware on customer servers. More than 26,000 servers were potentially affected. The provider [\u2026] The post 26th October \u2013 Threat Intelligence Report appeared first on Check Point Research.","title":"26th October \u2013 Threat Intelligence Report","url":"https://research.checkpoint.com/2026/26th-october-threat-intelligence-report"},{"category":"OT/ICS","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-26T16:29:40.249048+00:00","id":40858,"published_date":"2026-10-26T16:00:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"CISA\u2019s new strategy, CISA 2030, will focus on rapid detection and response and resiliency of critical services ahead of \u201cpassive defense\u201d","title":"CISA 2030 Sets Out \u2018Aggressive, Anticipatory\u2019 Cyber Defense Strategy for Critical Infrastructure","url":"https://www.infosecurity-magazine.com/news/cisa-aggressive-strategy-critical"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T20:29:24.148830+00:00","id":40905,"published_date":"2026-10-26T15:52:40+00:00","severity":"medium","source_name":"The Hacker News","summary":"Cybersecurity researchers are calling attention to what they say is a \"recurring social engineering pattern\" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. \"A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT","title":"Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware","url":"https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-26T16:29:32.718035+00:00","id":40855,"published_date":"2026-10-26T15:47:05+00:00","severity":"medium","source_name":"The Register (Security)","summary":"Claude maker reveals financials and warns investors its AI models could blackmail humans, resist shutdown, or go rogue","title":"Trumpets blare and skies part as AI hypefest culminates in Anthropic IPO filing","url":"https://www.theregister.com/ai-and-ml/2026/10/26/trumpets-blare-and-skies-part-as-ai-hypefest-culminates-in-anthropic-ipo-filing/5305456"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T16:29:24.234148+00:00","id":40788,"published_date":"2026-10-26T15:38:24+00:00","severity":"critical","source_name":"Bleeping Computer","summary":"Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]","title":"Microsoft releases emergency .NET patches for critical Brotli flaw","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-emergency-net-patches-for-critical-brotli-flaw"},{"category":"Mobile Security","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-26T16:29:40.111107+00:00","id":40857,"published_date":"2026-10-26T15:06:26+00:00","severity":"medium","source_name":"Security Affairs","summary":"Dutch police arrest two men over AI-voiced bank fraud that allegedly used a fake app to steal card data from 170 victims, causing \u20ac380,000 in losses. Rotterdam police have arrested two men over a new type of bank fraud that used AI-generated phone calls, a fake banking app, and NFC technology to steal bank card [\u2026]","title":"AI-Generated Fake Bank Calls and NFC App Enabled \u20ac380,000 Fraud, Dutch Police Say","url":"https://securityaffairs.com/201786/cyber-crime/ai-generated-fake-bank-calls-and-nfc-app-enabled-e380000-fraud-dutch-police-say.html"},{"category":"OT/ICS","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T16:29:25.226057+00:00","id":40799,"published_date":"2026-10-26T14:52:14+00:00","severity":"critical","source_name":"SecurityWeek","summary":"Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities. The post Industrial Vendors Check Products for PHP2Shell Vulnerabilities appeared first on SecurityWeek.","title":"Industrial Vendors Check Products for PHP2Shell Vulnerabilities","url":"https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T16:29:25.227195+00:00","id":40800,"published_date":"2026-10-26T14:40:48+00:00","severity":"medium","source_name":"SecurityWeek","summary":"The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected. The post Genesys Hack Exposes Customer Data From Internal Systems appeared first on SecurityWeek.","title":"Genesys Hack Exposes Customer Data From Internal Systems","url":"https://www.securityweek.com/genesys-hack-exposes-customer-data-from-internal-systems"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T16:29:25.230210+00:00","id":40801,"published_date":"2026-10-26T14:30:09+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Xint says a flaw in OpenAI\u2019s compaction process let researchers move reasoning traces between models, potentially making it cheaper to distill a rival AI. The post Stolen AI Reasoning Could Help China Build Cheaper Rivals appeared first on SecurityWeek.","title":"Stolen AI Reasoning Could Help China Build Cheaper Rivals","url":"https://www.securityweek.com/stolen-ai-reasoning-could-help-china-build-cheaper-rivals"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-26T14:29:25.295093+00:00","id":40432,"published_date":"2026-10-26T14:21:00+00:00","severity":"medium","source_name":"The Record","summary":"CERT-UA says it has identified cases in which hackers compromised Dahua internet-connected cameras and video recorders, changed their settings and created unauthorized user accounts.","title":"Ukraine warns hackers are exploiting Chinese-made Dahua surveillance cameras","url":"https://therecord.media/ukraine-cert-ua-warning-chinese-dahua-cameras-hacked"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T16:29:23.227791+00:00","id":40789,"published_date":"2026-10-26T14:06:13+00:00","severity":"high","source_name":"The Hacker News","summary":"This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security teams have more urgent patches than they can keep up with. And that's not even the full story. A leaked key led to a software supply-chain","title":"\u26a1 Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More","url":"https://thehackernews.com/2026/10/weekly-recap-this2shell-that2shell.html"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T14:29:24.482508+00:00","id":40427,"published_date":"2026-10-26T14:00:10+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"A new NIST, CISA, and NSA guide treats runaway agents as incidents to be rehearsed. The hard part of the response is answering whose authority the agent used, and that answer has to exist before the incident does. [...]","title":"When an AI Agent Is the Incident, the Identity Record Is the Evidence","url":"https://www.bleepingcomputer.com/news/security/when-an-ai-agent-is-the-incident-the-identity-record-is-the-evidence"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-26T14:29:42.423722+00:00","id":40590,"published_date":"2026-10-26T14:00:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Six Linux flaws were made public, including one with a working root exploit and no merged fix","title":"Linux Flaws Exposed Before Fixes as Root Exploit Goes Public","url":"https://www.infosecurity-magazine.com/news/linux-flaws-exposed-before-fixes"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-26T14:29:24.711301+00:00","id":40429,"published_date":"2026-10-26T14:00:00+00:00","severity":"medium","source_name":"Dark Reading","summary":"This Cybersecurity Awareness Month's theme, \"Securing the Next 250,\" asks us to look beyond vulnerabilities and consider what will make our digital systems resilient for generations.","title":"10 Software Security Practices Built for the Next 250 Years","url":"https://www.darkreading.com/cyberattacks-data-breaches/10-software-security-practices-built-250-years"},{"category":"Consumer Awareness","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T14:29:24.488421+00:00","id":40428,"published_date":"2026-10-26T13:56:44+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"A Chinese national was arraigned in California after being extradited from the Netherlands for his alleged involvement in a cryptocurrency investment scam that stole nearly $37 million from 174 victims in the United States. [...]","title":"Chinese man extradited for role in $36 million cryptocurrency scam","url":"https://www.bleepingcomputer.com/news/security/chinese-man-extradited-for-role-in-36-million-cryptocurrency-scam"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-26T14:29:38.176157+00:00","id":40497,"published_date":"2026-10-26T13:31:38+00:00","severity":"medium","source_name":"CyberScoop","summary":"It includes a review of whether its existing capabilities will meet its three pillars: \u201cdefend, harden, prevail.\u201d The post CISA publishes strategy with eye on the next four years appeared first on CyberScoop.","title":"CISA publishes strategy with eye on the next four years","url":"https://cyberscoop.com/cisa-2030-cybersecurity-strategy"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T14:29:25.177036+00:00","id":40430,"published_date":"2026-10-26T13:30:10+00:00","severity":"critical","source_name":"SecurityWeek","summary":"Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24. The post PHP2Shell Exploitation Moves From Probes to Working Shells appeared first on SecurityWeek.","title":"PHP2Shell Exploitation Moves From Probes to Working Shells","url":"https://www.securityweek.com/php2shell-exploitation-moves-from-probes-to-working-shells"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research, consistent technical malware reports. filter_uncategorized drops consumer lifestyle and parenting content.","created_at":"2026-10-27T11:21:47.959532+00:00","id":41548,"published_date":"2026-10-26T13:25:00+00:00","severity":"critical","source_name":"ESET WeLiveSecurity","summary":"Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe \u2013 all in a little more than two minutes","title":"PHP2Shell: What to know about two critical PHP flaws","url":"https://www.welivesecurity.com/en/videos/php2shell-what-know-two-critical-php-flaws"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Primary cloud-security research (cross-tenant isolation, container escape, cloud IAM). Vendor context; filter_uncategorized drops heavy product marketing. Long archive but only 64 entries inside the 90-day guard (~0.8/day).","created_at":"2026-10-26T14:29:39.628439+00:00","id":40556,"published_date":"2026-10-26T13:24:12+00:00","severity":"medium","source_name":"Wiz","summary":"GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.","title":"The Pwn Request Reckoning: What Still Works Against GitHub Actions","url":"https://www.wiz.io/blog/github-actions-security-pwn-request-reckoning"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T14:29:39.141433+00:00","id":40513,"published_date":"2026-10-26T13:16:01+00:00","severity":"medium","source_name":"Help Net Security","summary":"Employees pasting company data into AI tools worry security teams more than AI-powered attacks do. Most-concerning risks of AI agents (Source: O\u2019Reilly) AI-generated phishing, the attack they run into most often, made the list of top concerns for only a quarter of the 209 security professionals O\u2019Reilly surveyed in September. Mike Loukides, VP of content strategy at O\u2019Reilly Media, believes the fear of AI wiping out humanity distracts from harm happening today. \u201cWe don\u2019t need \u2026 More \u2192 The post Security pros reckon the biggest AI risk comes with an employee badge appeared first on Help Net Security.","title":"Security pros reckon the biggest AI risk comes with an employee badge","url":"https://www.helpnetsecurity.com/2026/10/26/ai-tools-security-worry-survey"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T16:29:24.905332+00:00","id":40791,"published_date":"2026-10-26T13:13:30+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : RaceTrakka","url":"https://www.ransomware.live/id/UmFjZVRyYWtrYUBxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T16:29:24.905908+00:00","id":40792,"published_date":"2026-10-26T13:12:22+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Smith Feddeler & Smith","url":"https://www.ransomware.live/id/U21pdGggRmVkZGVsZXIgJiBTbWl0aEBxaWxpbg"},{"category":"Malware/Infostealer","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T14:29:25.179938+00:00","id":40431,"published_date":"2026-10-26T12:46:44+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection. The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek.","title":"953 Online Stores Infected in Long-Lasting Malware Campaign","url":"https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-26T14:29:42.424709+00:00","id":40591,"published_date":"2026-10-26T12:45:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Microsoft\u2019s updates address two newly disclosed vulnerabilities in the .NET developer platform, as well as flaws not fully addressed in an earlier release","title":"Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw","url":"https://www.infosecurity-magazine.com/news/microsoft-patch-update-net-flaw"},{"category":"AI Security","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-26T16:29:25.392663+00:00","id":40802,"published_date":"2026-10-26T12:44:15+00:00","severity":"medium","source_name":"Reddit r/netsec","summary":"submitted by /u/tedivm [link] [comments]","title":"The AI RCEssion: Why AI-driven security is calling in decades of software tech debt","url":"https://www.reddit.com/r/netsec/comments/1xfvrxl/the_ai_rcession_why_aidriven_security_is_calling"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.562408+00:00","id":40283,"published_date":"2026-10-26T12:29:19+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Lucky Union Foods","url":"https://www.ransomware.live/id/THVja3kgVW5pb24gRm9vZHNAcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.562832+00:00","id":40284,"published_date":"2026-10-26T12:28:35+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Michelle Accesorios","url":"https://www.ransomware.live/id/TWljaGVsbGUgQWNjZXNvcmlvc0BxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.563196+00:00","id":40285,"published_date":"2026-10-26T12:27:53+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Warrnambool Bus Lines","url":"https://www.ransomware.live/id/V2Fycm5hbWJvb2wgQnVzIExpbmVzQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.563543+00:00","id":40286,"published_date":"2026-10-26T12:27:10+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Fairfield City Council","url":"https://www.ransomware.live/id/RmFpcmZpZWxkIENpdHkgQ291bmNpbEBxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.563846+00:00","id":40287,"published_date":"2026-10-26T12:26:29+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Ndi Engineering","url":"https://www.ransomware.live/id/TmRpIEVuZ2luZWVyaW5nQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.564275+00:00","id":40288,"published_date":"2026-10-26T12:25:43+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Southern Specialty & Supply","url":"https://www.ransomware.live/id/U291dGhlcm4gU3BlY2lhbHR5ICYgU3VwcGx5QHFpbGlu"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.566308+00:00","id":40289,"published_date":"2026-10-26T12:20:30+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR, Arcserve image backup, and white-label reseller options), emphasizing zero ingress/egress fees, UK-based engineer support, and SME/education/charity customers, with roughly a dozen to a few dozen employees and estimated revenue in the low millions of dollars\u2014making it a regional niche backup provider rather than a global cloud giant.","title":"\ud83c\udff4\u200d\u2620\ufe0f Auditteam has just published a new victim : Safe Data Storage","url":"https://www.ransomware.live/id/U2FmZSBEYXRhIFN0b3JhZ2VAQXVkaXRUZWFt"},{"category":"Malware/Infostealer","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-26T14:29:42.142535+00:00","id":40589,"published_date":"2026-10-26T12:11:38+00:00","severity":"medium","source_name":"Security Affairs","summary":"uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof [\u2026]","title":"Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram","url":"https://securityaffairs.com/201764/malware/researchers-uncover-rentable-android-spyware-ucreater-targeting-wechat-and-telegram.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.566753+00:00","id":40290,"published_date":"2026-10-26T12:03:57+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Delta Electric Power Association","url":"https://www.ransomware.live/id/RGVsdGEgRWxlY3RyaWMgUG93ZXIgQXNzb2NpYXRpb25AcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.567097+00:00","id":40291,"published_date":"2026-10-26T12:03:03+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Bangor Wholesale Laminates","url":"https://www.ransomware.live/id/QmFuZ29yIFdob2xlc2FsZSBMYW1pbmF0ZXNAcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.568209+00:00","id":40292,"published_date":"2026-10-26T12:02:01+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : TeleTronic","url":"https://www.ransomware.live/id/VGVsZVRyb25pY0BxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.568566+00:00","id":40293,"published_date":"2026-10-26T12:01:07+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : FIRMENGRUPPE APPL Holding GmbH","url":"https://www.ransomware.live/id/RklSTUVOR1JVUFBFIEFQUEwgSG9sZGluZyBHbWJIQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.568859+00:00","id":40294,"published_date":"2026-10-26T12:00:15+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Premier Medical Group","url":"https://www.ransomware.live/id/UHJlbWllciBNZWRpY2FsIEdyb3VwQHFpbGlu"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-26T12:29:34.834735+00:00","id":40213,"published_date":"2026-10-26T12:00:00+00:00","severity":"medium","source_name":"The Record","summary":"LiteLLM, an open-source tool widely used by artificial intelligence developers, said a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands of users last week.","title":"Popular AI tool LiteLLM says unrevoked key allowed hackers to target users","url":"https://therecord.media/litellm-hackers-ai-malware"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.569172+00:00","id":40295,"published_date":"2026-10-26T11:59:07+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Zachary Confections","url":"https://www.ransomware.live/id/WmFjaGFyeSBDb25mZWN0aW9uc0BxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.569456+00:00","id":40296,"published_date":"2026-10-26T11:58:15+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : THOMAS JORDAN, P.A","url":"https://www.ransomware.live/id/VEhPTUFTIEpPUkRBTiwgUC5BQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.569715+00:00","id":40297,"published_date":"2026-10-26T11:57:22+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Five Star Sheets","url":"https://www.ransomware.live/id/Rml2ZSBTdGFyIFNoZWV0c0BxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.570052+00:00","id":40298,"published_date":"2026-10-26T11:55:59+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Power Funding","url":"https://www.ransomware.live/id/UG93ZXIgRnVuZGluZ0BxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.570387+00:00","id":40299,"published_date":"2026-10-26T11:54:33+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Hochschule Worms","url":"https://www.ransomware.live/id/SG9jaHNjaHVsZSBXb3Jtc0BxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.570836+00:00","id":40300,"published_date":"2026-10-26T11:53:05+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Mountain Rheumatology","url":"https://www.ransomware.live/id/TW91bnRhaW4gUmhldW1hdG9sb2d5QHFpbGlu"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T16:29:24.261065+00:00","id":40790,"published_date":"2026-10-26T11:52:41+00:00","severity":"medium","source_name":"The Hacker News","summary":"Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmtime build to compile a module they control, and one of the flaws affects only ARM64 systems. Fixed versions were released on","title":"Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes","url":"https://thehackernews.com/2026/10/two-critical-wasmtime-flaws-could-let.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.571294+00:00","id":40301,"published_date":"2026-10-26T11:51:36+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Taubensee Steel & Wire","url":"https://www.ransomware.live/id/VGF1YmVuc2VlIFN0ZWVsICYgV2lyZUBxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.571844+00:00","id":40302,"published_date":"2026-10-26T11:50:06+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Natural Energy Laboratory of Hawaii Authority","url":"https://www.ransomware.live/id/TmF0dXJhbCBFbmVyZ3kgTGFib3JhdG9yeSBvZiBIYXdhaWkgQXV0aG9yaXR5QHFpbGlu"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T12:29:34.748728+00:00","id":40212,"published_date":"2026-10-26T11:47:52+00:00","severity":"medium","source_name":"SecurityWeek","summary":"The individuals called victims and persuaded them to install an app and scan their credit cards to loot their bank accounts. The post Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts appeared first on SecurityWeek.","title":"Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts","url":"https://www.securityweek.com/dutch-police-arrest-two-over-nfc-relay-attacks-that-drained-400000"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.572522+00:00","id":40303,"published_date":"2026-10-26T11:36:12+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Burnaby Schools - School District 41","url":"https://www.ransomware.live/id/QnVybmFieSBTY2hvb2xzIC0gU2Nob29sIERpc3RyaWN0IDQxQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.572896+00:00","id":40304,"published_date":"2026-10-26T11:35:08+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Miller Stratvert","url":"https://www.ransomware.live/id/TWlsbGVyIFN0cmF0dmVydEBxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.573191+00:00","id":40305,"published_date":"2026-10-26T11:33:31+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Seufert Construction","url":"https://www.ransomware.live/id/U2V1ZmVydCBDb25zdHJ1Y3Rpb25AcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.573547+00:00","id":40306,"published_date":"2026-10-26T11:32:37+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Nissho Electric Manufacturing Co., Ltd","url":"https://www.ransomware.live/id/Tmlzc2hvIEVsZWN0cmljIE1hbnVmYWN0dXJpbmcgQ28uLCBMdGRAcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T12:29:49.573885+00:00","id":40307,"published_date":"2026-10-26T11:31:22+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : BCSA GEAR","url":"https://www.ransomware.live/id/QkNTQSBHRUFSQHFpbGlu"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T12:29:51.203957+00:00","id":40308,"published_date":"2026-10-26T11:26:40+00:00","severity":"medium","source_name":"Help Net Security","summary":"A file that a website saves to the Downloads folder without approval can trick AI coding agents into installing a malicious npm package or handing over the user\u2019s login token when they\u2019re opened in that folder, Forever Security has found. The file is called AGENTS.md, a plain text document developers place in a project folder with instructions for coding agents, the AI tools that write and run code on their own. One turned up on \u2026 More \u2192 The post AI coding agents fall for malicious instructions planted in the Downloads folder appeared first on Help Net Security.","title":"AI coding agents fall for malicious instructions planted in the Downloads folder","url":"https://www.helpnetsecurity.com/2026/10/26/ai-coding-agents-malware-openai-codex"},{"category":"Uncategorized","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T12:29:33.327786+00:00","id":40211,"published_date":"2026-10-26T11:23:56+00:00","severity":"medium","source_name":"The Hacker News","summary":"Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated view. SOC teams often first see the shape of an intrusion","title":"Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses","url":"https://thehackernews.com/2026/10/between-alerts-what-attackers-do-in.html"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T11:27:49.902816+00:00","id":40144,"published_date":"2026-10-26T11:22:52+00:00","severity":"critical","source_name":"Help Net Security","summary":"Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet\u2019s Chief Information Security Officer Carl Windsor explained in the advance announcement. But attackers also have access to AI tools, he warned, and can use them to find vulnerabilities and build \u2026 More \u2192 The post Fortinet patches critical FortiOS flaws found with AI help appeared first on Help Net Security.","title":"Fortinet patches critical FortiOS flaws found with AI help","url":"https://www.helpnetsecurity.com/2026/10/26/fortinet-patches-critical-fortios-flaws-found-with-ai-help"},{"category":"OT/ICS","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-26T11:27:49.840305+00:00","id":40143,"published_date":"2026-10-26T11:00:00+00:00","severity":"medium","source_name":"The Register (Security)","summary":"Whitehall wants agents guarding critical infrastructure as part of a wider \u00a3600M spending spree","title":"Britain bets big on AI to defend against the threats AI is helping create","url":"https://www.theregister.com/security/2026/10/26/britain-bets-big-on-ai-to-defend-against-the-threats-ai-is-helping-create/5305319"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T11:27:39.301948+00:00","id":40108,"published_date":"2026-10-26T10:47:51+00:00","severity":"medium","source_name":"Ransomware.live","summary":"A Portuguese manufacturing company that produces equipment for offices, schools, and presentations. Its product line includes whiteboards, corkboards, flip charts, information displays, glass board...","title":"\ud83c\udff4\u200d\u2620\ufe0f Majinahanashi has just published a new victim : Bi-silque","url":"https://www.ransomware.live/id/Qmktc2lscXVlQE1hamluYWhhbmFzaGk"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T11:27:49.907875+00:00","id":40145,"published_date":"2026-10-26T10:41:47+00:00","severity":"medium","source_name":"Help Net Security","summary":"Anthropic has outlined the security and privacy protections behind Claude Duet, its proactive AI agent that can monitor connected accounts and complete tasks while users are away. The safeguards include approval requirements, checks for sensitive information and infrastructure that keeps credentials outside the model\u2019s reach. Duet works through a cloud-based computer and browser to prepare briefings, draft messages and handle business tasks. The standalone app is available through a research preview waitlist for Pro and \u2026 More \u2192 The post Anthropic details what stops Claude Duet from going rogue appeared first on Help Net Security.","title":"Anthropic details what stops Claude Duet from going rogue","url":"https://www.helpnetsecurity.com/2026/10/26/anthropic-claude-duet-security-safeguards"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T11:27:38.339555+00:00","id":40103,"published_date":"2026-10-26T10:26:52+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"Kali Linux has released version 2026.3, its third release this year, featuring six new hacking tools, desktop environment improvements, refreshed build scripts, and more. [...]","title":"Kali Linux 2026.3 released with 6 new tools, desktop updates","url":"https://www.bleepingcomputer.com/news/linux/kali-linux-20263-released-with-6-new-tools-desktop-updates"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T11:27:38.795538+00:00","id":40112,"published_date":"2026-10-26T10:21:57+00:00","severity":"critical","source_name":"SecurityWeek","summary":"An out-of-bounds write in Google\u2019s Brotli decoder affects Node.js, .NET, PowerShell, and Python packages, and can lead to code execution. The post Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages appeared first on SecurityWeek.","title":"Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages","url":"https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T11:27:39.303683+00:00","id":40109,"published_date":"2026-10-26T10:21:11+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Transport company from Ecuador engaged in road freight transport. Including the transportation of heavy and bulk cargo, cars, animals and cargo in tanks. Year Founded: 2020 There are many customer documents and employee data. Financial documents, accounting and banking data. [Sector: Transportation]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : TRANSPORTES JIMENEZ and REYES JIM REY S.A.","url":"https://www.ransomware.live/id/VFJBTlNQT1JURVMgSklNRU5FWiBhbmQgUkVZRVMgSklNIFJFWSBTLkEuQGVtcGVyYWRvcg"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-26T11:27:52.689020+00:00","id":40188,"published_date":"2026-10-26T10:15:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Blue Initiative launches a new vulnerability database for IT and OT CVEs relevant to the maritime industry","title":"Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database","url":"https://www.infosecurity-magazine.com/news/blue-initiative-maritime"},{"category":"AI Security","confidence":"HIGH","confidence_reason":"Best-in-class APT campaign tracking and malware reverse engineering. Industry-leading primary research.","created_at":"2026-10-26T10:27:40.616436+00:00","id":40102,"published_date":"2026-10-26T10:00:18+00:00","severity":"medium","source_name":"Kaspersky Securelist","summary":"We look at best practices for deploying AI tools securely in corporate environments, with Kaspersky Security Center and Kaspersky Endpoint Security as examples. We also cover ways that EDR and TIP can detect AI agents.","title":"Deploying AI agents securely: how Kaspersky products mitigate AI threats","url":"https://securelist.com/tr/how-to-secure-ai-agents/121444"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-26T11:27:52.538904+00:00","id":40187,"published_date":"2026-10-26T09:58:31+00:00","severity":"critical","source_name":"Security Affairs","summary":"Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale. The flaws affect all PHP versions that handle web requests. The vulnerable code dates [\u2026]","title":"PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts","url":"https://securityaffairs.com/201748/hacking/php2shell-suspected-north-korean-campaign-targets-216-vulnerable-php-hosts.html"},{"category":"Identity & Access","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T11:27:38.064597+00:00","id":40104,"published_date":"2026-10-26T09:54:02+00:00","severity":"medium","source_name":"The Hacker News","summary":"A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers' own container app. The kit's Telegram part matches Baohuo, a backdoor that Doctor","title":"uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts","url":"https://thehackernews.com/2026/10/ucreator-android-spyware-can-steal.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T11:27:39.304438+00:00","id":40110,"published_date":"2026-10-26T09:22:04+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Status: leaked | Data size: 3.07 GB | Files: 2 files | Deadline: 2026-10-26T00:00:00Z","title":"\ud83c\udff4\u200d\u2620\ufe0f Doommageddon has just published a new victim : Referans Lab Ref-Lab","url":"https://www.ransomware.live/id/UmVmZXJhbnMgTGFiIFJlZi1MYWJARG9vbW1hZ2VkZG9u"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-26T09:27:39.050197+00:00","id":40092,"published_date":"2026-10-26T09:19:57+00:00","severity":"critical","source_name":"Bleeping Computer","summary":"Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...]","title":"PHP2Shell security flaws now sucessfully exploited in the wild","url":"https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-26T09:27:47.981720+00:00","id":40101,"published_date":"2026-10-26T09:15:00+00:00","severity":"high","source_name":"Infosecurity Magazine","summary":"PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected","title":"PHP Publishes Mitigation Advice for New RCE Flaw","url":"https://www.infosecurity-magazine.com/news/php-publishes-mitigation-advice"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-26T09:27:39.726312+00:00","id":40093,"published_date":"2026-10-26T09:10:03+00:00","severity":"medium","source_name":"SecurityWeek","summary":"The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub. The post Mythos 5 Ignored Real-World Harm in July Attack appeared first on SecurityWeek.","title":"Mythos 5 Ignored Real-World Harm in July Attack","url":"https://www.securityweek.com/mythos-5-ignored-real-world-harm-in-july-attack"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T11:27:38.695339+00:00","id":40105,"published_date":"2026-10-26T08:35:51+00:00","severity":"medium","source_name":"The Hacker News","summary":"Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successful Microsoft 365 sign-in events across","title":"Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations","url":"https://thehackernews.com/2026/10/microsoft-365-token-replay-attacks.html"},{"category":"OT/ICS","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T11:27:39.305260+00:00","id":40111,"published_date":"2026-10-26T08:34:49+00:00","severity":"medium","source_name":"Ransomware.live","summary":"[manufacturer] Ernesto Malvestiti S.p.A. \u2014 a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM. The exposed material spans the company's entire operations: PAGHENET payroll database (1.1 GB SQL Server backup \u00d77 copies) \u2014 every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB \u00d75). GDPR Article 9 special-category data \u2014 medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce. 50+ plaintext OEM portal credentials stored in a single file called accesso web.txt \u2014 BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more. SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export. ADP payroll SFTP credentials stored in WinSCP.ini \u2014 the channel used to transmit employee salary data to the external payroll processor. 614 MB of financial/controlling data \u2014 consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships. 1.5 GB of engineering IP \u2014 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts. 160+ client/supplier contracts with pricing, commercial terms, and executed NDAs. 560+ job candidate CVs with full names, addresses, phone numbers, and career histories.","title":"\ud83c\udff4\u200d\u2620\ufe0f Aurora has just published a new victim : Ernesto Malvestiti S.p.A.","url":"https://www.ransomware.live/id/RXJuZXN0byBNYWx2ZXN0aXRpIFMucC5BLkBhdXJvcmE"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-26T09:27:47.754966+00:00","id":40100,"published_date":"2026-10-26T08:05:12+00:00","severity":"medium","source_name":"Security Affairs","summary":"Anthropic says Claude Mythos 5 targeted real developers with fake identities to push malicious code during a security test. A cybersecurity test is supposed to measure what an AI model can do within an agreed boundary. In one UK AI Security Institute evaluation, Claude Mythos 5 crossed that boundary, targeted a real GitHub project and [\u2026]","title":"Anthropic reveals how Claude Mythos 5 crossed security testing boundaries","url":"https://securityaffairs.com/201729/ai/anthropic-reveals-how-claude-mythos-5-crossed-security-testing-boundaries.html"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-26T16:29:36.258803+00:00","id":40856,"published_date":"2026-10-26T08:00:00+00:00","severity":"critical","source_name":"The Register (Security)","summary":"PARTNER CONTENT: Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium","title":"PHP2Shell: No login, no app code, no warning. What next?","url":"https://www.theregister.com/security/2026/10/26/partner-content-no-login-no-app-code-no-warning-what-next/5305336"},{"category":"Cloud Security","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T11:27:38.697198+00:00","id":40106,"published_date":"2026-10-26T07:49:46+00:00","severity":"medium","source_name":"The Hacker News","summary":"An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses","title":"Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs","url":"https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html"},{"category":"Supply Chain","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T07:27:51.929066+00:00","id":40074,"published_date":"2026-10-26T07:00:45+00:00","severity":"medium","source_name":"Help Net Security","summary":"Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it. A compiled binary doesn\u2019t say which machine built it or what code went in. Witness lets a team check which command produced the file, which materials went \u2026 More \u2192 The post Witness: Open-source framework for verifying how your software was built appeared first on Help Net Security.","title":"Witness: Open-source framework for verifying how your software was built","url":"https://www.helpnetsecurity.com/2026/10/26/witness-open-source-software-supply-chain-tool"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party Fortinet PSIRT / FortiGuard IR advisories. Authoritative source for heavily-exploited FortiOS/FortiGate CVEs. Replaces the deprecated feeds.fortinet.com threat-research path (silent, 0 articles/30d).","created_at":"2026-10-26T17:29:26.035403+00:00","id":40876,"published_date":"2026-10-26T07:00:00+00:00","severity":"critical","source_name":"Fortinet FortiGuard PSIRT","summary":"CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106071 - (low)This vulnerability affects Node.js 26.x.CVE-2026-106073 - (low)This vulnerability affects Node.js 26.x, 24.x, and 22.x. Revised on 2026-10-26 00:00:00","title":"Multiple Node.js CVEs","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-187"},{"category":"OT/ICS","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T07:27:40.690024+00:00","id":40067,"published_date":"2026-10-26T06:59:51+00:00","severity":"medium","source_name":"Ransomware.live","summary":"In 2004, Tlingit & Haida Regional Electric Authority was re-organized to an electric cooperative which is now known as Inside Passage Electric Cooperative, Inc. IPEC is a non-profit, independent electric utility owned by the members we serve. Electric cooperatives are democratically governed businesses, ensuring they are closely regulated by their consumers. Members of electric cooperatives express higher than average levels of customer satisfaction since they put customers first because the consumers are the owners. In addition, co-ops are locally owned and operated which makes IPEC more responsive to our members since they are the owners and we are accountable to them. IPEC is governed by a board of directors elected from the membership, which sets policies and procedures that are implemented by the cooperatives\u2019 professional staff. Our Board is committed to providing quality, dependable and affordable electric service to our members since they live in the communities they represent. IPEC currently serves Hoonah (463 services), Kake (321 services), Chilkat Valley (231 services), Angoon (227 services) and Klukwan (61 services) for a total of 1,303 customers.","title":"\ud83c\udff4\u200d\u2620\ufe0f Dragonforce has just published a new victim : Inside Passage Electric Cooperative, Inc","url":"https://www.ransomware.live/id/SW5zaWRlIFBhc3NhZ2UgRWxlY3RyaWMgQ29vcGVyYXRpdmUsIEluY0BkcmFnb25mb3JjZQ"},{"category":"AI Security","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-26T11:27:38.701038+00:00","id":40107,"published_date":"2026-10-26T06:03:48+00:00","severity":"medium","source_name":"The Hacker News","summary":"A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder. The file","title":"Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware","url":"https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T07:27:51.946513+00:00","id":40075,"published_date":"2026-10-26T06:00:12+00:00","severity":"medium","source_name":"Help Net Security","summary":"An AI SOC that starts with somebody else\u2019s alert is already too late. Stellar Cyber collects and normalizes telemetry, detects suspicious activity, correlates evidence, builds cases, investigates incidents, triages findings, and drives response from the same security architecture. That gives people and AI access to the evidence behind the alert \u2013 not just the alert itself. Full-cycle security operations means the data, detections, context, investigation, decisions, and response remain connected as an incident moves through \u2026 More \u2192 The post Product showcase: Stellar Cyber\u2019s ISOC platform provides full-cycle architecture appeared first on Help Net Security.","title":"Product showcase: Stellar Cyber\u2019s ISOC platform provides full-cycle architecture","url":"https://www.helpnetsecurity.com/2026/10/26/product-showcase-stellar-cyber-isoc-platform"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T07:27:51.952922+00:00","id":40076,"published_date":"2026-10-26T05:30:27+00:00","severity":"medium","source_name":"Help Net Security","summary":"AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security\u2019s 2026 Autonomous Agents Threat Report. About 76% of enabled agents examined had not run in 60 days, leaving access available through inactive software. Agents by exposure family (Source: Arrakis Security) The analysis covered thousands of agents in customer production environments over a 12-week period. These programs can read and write data, call tools and start workflows, giving \u2026 More \u2192 The post Forgotten AI agents may still access sensitive company data appeared first on Help Net Security.","title":"Forgotten AI agents may still access sensitive company data","url":"https://www.helpnetsecurity.com/2026/10/26/arrakis-dormant-ai-agent-risks-report"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T05:27:49.241752+00:00","id":40045,"published_date":"2026-10-26T05:00:59+00:00","severity":"medium","source_name":"Help Net Security","summary":"Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion\u2019s Fraud in the Age of Continuous Trust report. Eighty-one percent of suspected digital fraud in its network during the first half of 2026 occurred during account logins and financial transactions, highlighting risks that persist throughout a customer relationship. Verifying someone\u2019s identity does not establish whether every subsequent interaction can be trusted. Scammers can manipulate legitimate customers into \u2026 More \u2192 The post Synthetic identities leave US lenders with $2.4 billion in fraud exposure appeared first on Help Net Security.","title":"Synthetic identities leave US lenders with $2.4 billion in fraud exposure","url":"https://www.helpnetsecurity.com/2026/10/26/transunion-synthetic-identity-fraud-risks-report"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T07:27:40.691655+00:00","id":40068,"published_date":"2026-10-26T04:56:48+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Mah Sing Group is a leading Malaysian property developer specializing in affordable residential and commercial properties, with additional businesses in healthcare and plastics manufacturing.","title":"\ud83c\udff4\u200d\u2620\ufe0f Scarlettgroup has just published a new victim : mahsing.com.my","url":"https://www.ransomware.live/id/bWFoc2luZy5jb20ubXlAU2NhcmxldHRncm91cA"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-26T05:27:49.255537+00:00","id":40046,"published_date":"2026-10-26T04:25:59+00:00","severity":"medium","source_name":"Help Net Security","summary":"Google has open-sourced the Elephant-Goldfish Model plugin, an internal tool that makes an AI coding agent write and defend a design document before it touches any code. The plugin hands that document to fresh AI sessions that have never seen the design conversation and tells them to find what is wrong with it. The EGM plugin in a nutshell (Source: Google) \u201cAI-powered velocity is transformative; however, it has silently introduced a potential reliability crisis by \u2026 More \u2192 The post Google open-sources the Elephant-Goldfish Model plugin its engineers use to catch AI coding mistakes appeared first on Help Net Security.","title":"Google open-sources the Elephant-Goldfish Model plugin its engineers use to catch AI coding mistakes","url":"https://www.helpnetsecurity.com/2026/10/26/google-elephant-goldfish-model-plugin"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T03:27:40.650285+00:00","id":40033,"published_date":"2026-10-26T02:57:17+00:00","severity":"medium","source_name":"Ransomware.live","summary":"LoveSac (LOVE) is a premium furniture retailer operating more than 250 showrooms across the United States, generating approximately $700 million in annual revenue. We have obtained a database containing 1,113,285 order records spanning nearly seven years of transactions, from December 2019 through October 2026, with a combined recorded transaction value exceeding $1.62 billion. Each record contains detailed customer and transaction information, including full customer names, complete billing and shipping addresses, telephone numbers, order numbers, order dates, order statuses, and order grand totals. Our demand: $500,000 in BTC or XMR To verify, samples can be found below.","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : LoveSac","url":"https://www.ransomware.live/id/TG92ZVNhY0BXaGl0ZWFybW9y"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T03:27:40.655313+00:00","id":40034,"published_date":"2026-10-26T00:24:26+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Gl\u00fcckauf-Vermessung GmbH (glueckauf-vermessung.de) is a German engineering and technical company based in Sondershausen, operating as part of the ERCOSPLAN Group and specializing in surveying and mine surveying (Bergbau-Markscheiderei). Its core business activities include geodetic support for the mining industry, geological exploration, and work related to salt and mineral deposits. The company provides services for surface and underground measurements, deformation monitoring, and the preparation of technical documentation for industrial projects.","title":"\ud83c\udff4\u200d\u2620\ufe0f Payload has just published a new victim : Gl\u00fcckauf-Vermessung GmbH","url":"https://www.ransomware.live/id/R2zDvGNrYXVmLVZlcm1lc3N1bmcgR21iSEBwYXlsb2Fk"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T03:27:40.657436+00:00","id":40035,"published_date":"2026-10-26T00:23:12+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Miletic GmbH is a German specialized contractor headquartered in Bad Sch\u00f6nborn that has been operating in the construction sector since 1989. The company's core business focuses on construction and repair work for ecologically sensitive industrial facilities, including gas stations, tank farms, and operations governed by German water protection laws (WHG Class LAU facilities). Its service portfolio includes joint sealing and remediation, the application of chemical-resistant protective coatings, concrete construction, and related earthworks.","title":"\ud83c\udff4\u200d\u2620\ufe0f Payload has just published a new victim : Miletic GmbH","url":"https://www.ransomware.live/id/TWlsZXRpYyBHbWJIQHBheWxvYWQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T03:27:40.659102+00:00","id":40036,"published_date":"2026-10-26T00:21:58+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Edelstahl-Mechanik GmbH is a German manufacturing company based in G\u00f6ppingen. The company specializes in laser metal processing, including 2D and 3D laser cutting and welding, as well as structural sheet metal fabrication. Its products and services are applied in industries such as mechanical engineering, the automotive sector, construction, medical technology, and the food industry.","title":"\ud83c\udff4\u200d\u2620\ufe0f Payload has just published a new victim : Edelstahl-Mechanik GmbH","url":"https://www.ransomware.live/id/RWRlbHN0YWhsLU1lY2hhbmlrIEdtYkhAcGF5bG9hZA"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-26T03:27:40.660170+00:00","id":40037,"published_date":"2026-10-26T00:00:24+00:00","severity":"medium","source_name":"Ransomware.live","summary":"You are so stupid JB Hunt. Instead of getting in contact with us & starting the negotiation process, not only did you not announce the breach, you silently email customers demanding them to update their passwords.. Fuck you... ;/","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : J.B Hunt","url":"https://www.ransomware.live/id/Si5CIEh1bnRAV2hpdGVhcm1vcg"},{"category":"OT/ICS","confidence":"HIGH","confidence_reason":"First-party OT/ICS vendor CERT. Authoritative advisories for Siemens industrial products. Fills OT/ICS category depth.","created_at":"2026-10-26T16:29:30.612666+00:00","id":40815,"published_date":"2026-10-26T00:00:00+00:00","severity":"critical","source_name":"Siemens ProductCERT","summary":"On October 21, 2026, the PHP project and security researchers disclosed two critical, unauthenticated remote code execution vulnerabilities in the core PHP language runtime known as \u201cphp2shell\u201d (tracked as CVE-2026-109618 and CVE-2026-109619). This advisory covers the status of impact of various Siemens software products. Siemens is actively monitoring the situation and assessing the implications of these vulnerabilities on our portfolio. Because this evaluation is ongoing, our findings are subject to change as new technical details and vendor updates emerge. We will publish updated findings, guidance, and remediation recommendations as soon as they become available.","title":"SSA-166980 V1.0: PHP2Shell Vulnerabilities in Siemens Products","url":"https://cert-portal.siemens.com/productcert/html/ssa-166980.html"},{"category":"OT/ICS","confidence":"HIGH","confidence_reason":"First-party OT/ICS vendor CERT. Authoritative advisories for Siemens industrial products. Fills OT/ICS category depth.","created_at":"2026-10-26T11:27:44.028692+00:00","id":40114,"published_date":"2026-10-26T00:00:00+00:00","severity":"high","source_name":"Siemens ProductCERT","summary":"Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions.","title":"SSA-137528 V1.0: Authentication Bypass Vulnerability in Mendix SAML module","url":"https://cert-portal.siemens.com/productcert/html/ssa-137528.html"},{"category":"Identity & Access","confidence":"HIGH","confidence_reason":"First-party OT/ICS vendor CERT. Authoritative advisories for Siemens industrial products. Fills OT/ICS category depth.","created_at":"2026-10-26T11:27:43.899263+00:00","id":40113,"published_date":"2026-10-26T00:00:00+00:00","severity":"high","source_name":"Siemens ProductCERT","summary":"Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.","title":"SSA-887643 V1.1 (Last Update: 2026-10-26): Account Hijacking Vulnerability in Mendix SAML module","url":"https://cert-portal.siemens.com/productcert/html/ssa-887643.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T20:40:05.382914+00:00","id":39435,"published_date":"2026-10-25T17:55:57+00:00","severity":"medium","source_name":"Ransomware.live","summary":"YOD Engineering is an engineering company computer science, member of the NED&CO Group , a pan-African player committed to transformation digital, information systems governance and innovation by intelligence artificial.","title":"\ud83c\udff4\u200d\u2620\ufe0f Panzer has just published a new victim : Yodingenierie","url":"https://www.ransomware.live/id/WW9kaW5nZW5pZXJpZUBQYW56ZXI"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Primary cloud-security research (cross-tenant isolation, container escape, cloud IAM). Vendor context; filter_uncategorized drops heavy product marketing. Long archive but only 64 entries inside the 90-day guard (~0.8/day).","created_at":"2026-10-25T20:40:17.370952+00:00","id":39439,"published_date":"2026-10-25T17:55:33+00:00","severity":"medium","source_name":"Wiz","summary":"An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.","title":"Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles","url":"https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-25T18:40:17.154165+00:00","id":39432,"published_date":"2026-10-25T17:49:25+00:00","severity":"medium","source_name":"Security Affairs","summary":"Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At [\u2026]","title":"SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 5","url":"https://securityaffairs.com/201718/ai/security-affairs-ai-cybersecurity-newsletter-round-5.html"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-25T20:40:03.703103+00:00","id":39433,"published_date":"2026-10-25T17:44:09+00:00","severity":"high","source_name":"The Hacker News","summary":"A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target. The findings were","title":"Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers","url":"https://thehackernews.com/2026/10/unpatched-tailscale-ssh-flaws-could-let.html"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-25T20:40:04.736053+00:00","id":39434,"published_date":"2026-10-25T17:19:46+00:00","severity":"critical","source_name":"The Hacker News","summary":"Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. \"In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed password hashes and multi-factor","title":"PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking","url":"https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T20:40:05.383462+00:00","id":39436,"published_date":"2026-10-25T17:18:17+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : White & Case","url":"https://www.ransomware.live/id/V2hpdGUgJiBDYXNlQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T20:40:05.383796+00:00","id":39437,"published_date":"2026-10-25T17:17:40+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Hossner-Textil GmbH","url":"https://www.ransomware.live/id/SG9zc25lci1UZXh0aWwgR21iSEBxaWxpbg"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T20:40:05.385489+00:00","id":39438,"published_date":"2026-10-25T16:56:33+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Brazil's Liberal Party (PL) is the political party of the Bolsonaro family. Although named \"Liberal,\" it is currently characterized by conservatism and right-wing populism. Jair Bolsonaro joined the party in 2021, and his son Fl\u00e1vio Bolsonaro is now the party's presidential candidate, advocating reduced government intervention and tough security policies. We hold the complete Partido Liberal (PL, Brazil) dump: 79K member records with CPF/voter ID/RG photos, 374 live cleartext e-T\u00edtulo credentials, 475 operator accounts with shared password, 2.7M audit events, party dossiers (artist payments, deepfakes, ghost donations), vendor PII, and 340K+ member images. If you don't want this getting out, we suggest you contact us & pay the ransom amount of $5,000,000 in BTC :) Contact: Email: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : Partido Liberal","url":"https://www.ransomware.live/id/UGFydGlkbyBMaWJlcmFsQFdoaXRlYXJtb3I"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T16:40:04.211834+00:00","id":39385,"published_date":"2026-10-25T16:20:30+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Ooredoo Myanmar","url":"https://www.ransomware.live/id/T29yZWRvbyBNeWFubWFyQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T16:40:04.215553+00:00","id":39386,"published_date":"2026-10-25T15:52:01+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Mass tort litigation law firm - Our 82 GB extraction includes confidentiality agreements, stipulations, NDAs, internal board documents, privileged attorney-client communications, client rosters detailing medical conditions and settlement eligibility, active-case strategy documents, liability estimations, mediation term sheets, internal financial data, settlement payout memos, detailed bankruptcy settlement summaries, regulatory correspondence, internal board minutes and much more. Contacted us then timewasted, re-attacks incoming.","title":"\ud83c\udff4\u200d\u2620\ufe0f Falcon has just published a new victim : Weitz & Luxenberg","url":"https://www.ransomware.live/id/V2VpdHogJiBMdXhlbmJlcmdARmFsY29u"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-25T16:40:04.204107+00:00","id":39389,"published_date":"2026-10-25T15:49:38+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package. [...]","title":"AI coding agents hijacked using AGENTS.md file in Downloads folder","url":"https://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T16:40:04.217550+00:00","id":39387,"published_date":"2026-10-25T14:53:02+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Healthcare services \u00b7 NASDAQ: ASTH - Our 738 GB extraction includes internal documents, regulatory audit reports, payer financial dispute trackers, internal operational readiness reviews, acquisition pipelines, detailed reimbursement tables, internal system evaluations, regulatory notifications, funds transfer records showing liquidity status, company financial statements, user credential lists, client contact lists, employee PII decks and much more. Contacted us then timewasted, re-attacks incoming.","title":"\ud83c\udff4\u200d\u2620\ufe0f Falcon has just published a new victim : Astrana Health","url":"https://www.ransomware.live/id/QXN0cmFuYSBIZWFsdGhARmFsY29u"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T16:40:04.219630+00:00","id":39388,"published_date":"2026-10-25T14:52:33+00:00","severity":"medium","source_name":"Ransomware.live","summary":"We encrypted your servers and stole some of your source code, along with some sensitive information. If you do not pay the ransom, we will contact and attack your employees, clients, and partners to destroy your business. [Sector: Technology]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : A-RMS","url":"https://www.ransomware.live/id/QS1STVNAZW1wZXJhZG9y"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Primary cloud-security research (cross-tenant isolation, container escape, cloud IAM). Vendor context; filter_uncategorized drops heavy product marketing. Long archive but only 64 entries inside the 90-day guard (~0.8/day).","created_at":"2026-10-25T16:40:12.924194+00:00","id":39390,"published_date":"2026-10-25T14:46:53+00:00","severity":"critical","source_name":"Wiz","summary":"Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.","title":"Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability","url":"https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-25T14:40:20.478891+00:00","id":39375,"published_date":"2026-10-25T13:27:05+00:00","severity":"high","source_name":"Security Affairs","summary":"Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer WordPress Rank Math SEO PRO Plugin 3.0.123 is vulnerable [\u2026]","title":"SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120","url":"https://securityaffairs.com/201709/security/security-affairs-malware-newsletter-round-120.html"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-25T14:40:20.480254+00:00","id":39376,"published_date":"2026-10-25T12:28:47+00:00","severity":"critical","source_name":"Security Affairs","summary":"A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email Addresses U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known [\u2026]","title":"Security Affairs newsletter Round 601 by Pierluigi Paganini \u2013 INTERNATIONAL EDITION","url":"https://securityaffairs.com/201698/breaking-news/security-affairs-newsletter-round-601-by-pierluigi-paganini-international-edition.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T12:40:05.682207+00:00","id":39362,"published_date":"2026-10-25T11:53:17+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Aesthetic Dental Designs, P.A. (operating commercially as Dental Arts of Atlantis) is a fully licensed and accredited dental healthcare corporation headquartered at 5057 S Congress Ave, Suite 401, Lake Worth Beach, Florida (NPI: 1235501420). The practice is anchored by a distinguished clinical team, featuring Dr. Colleen Lam, D.M.D. and Dr. Serrano. The organization provides comprehensive clinical infrastructure specializing in advanced restorative, cosmetic, and multi-generational family dentistry. Its core competencies include high-precision digital prosthodontics, advanced smile designs, complex full-mouth reconstructions, and systematic preventive oral healthcare. Operating under a patient-centric administrative framework, Aesthetic Dental Designs, P.A. integrates cutting-edge dental technologies with rigorous clinical protocols. The enterprise maintains an established track record of therapeutic excellence, operational integrity, and superior patient outcomes within the South Florida healthcare market.","title":"\ud83c\udff4\u200d\u2620\ufe0f Hyflock has just published a new victim : Aesthetic Dental Designs, P.A","url":"https://www.ransomware.live/id/QWVzdGhldGljIERlbnRhbCBEZXNpZ25zLCBQLkFASFlGTE9DSw"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-25T12:40:06.002218+00:00","id":39367,"published_date":"2026-10-25T11:00:00+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Founded in 2025 by Unit 8200 alumni, Tel Aviv-based Mave uses AI agents to investigate alerts across existing security stacks. The post Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave appeared first on SecurityWeek.","title":"Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave","url":"https://www.securityweek.com/former-unit-8200-officers-raise-34-million-for-agentic-secops-startup-mave"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T12:40:05.682699+00:00","id":39363,"published_date":"2026-10-25T10:35:02+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : ECOM","url":"https://www.ransomware.live/id/RUNPTUBxaWxpbg"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-25T10:40:16.990866+00:00","id":39168,"published_date":"2026-10-25T09:56:32+00:00","severity":"medium","source_name":"Security Affairs","summary":"OpenAI paused frontier model training for 11 days after AI agents exposed security weaknesses, VM escapes and covert communication channels. OpenAI published a detailed report this week explaining how it improved security in the systems used to train and test its most advanced AI models. The company also described what happened when its AI agents [\u2026]","title":"OpenAI Paused Frontier AI Training After a Security Incident","url":"https://securityaffairs.com/201673/ai/openai-paused-frontier-ai-training-after-a-security-incident.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T12:40:05.683971+00:00","id":39364,"published_date":"2026-10-25T09:52:04+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Argentine Company operates in the field of electronic security systems, video surveillance, monitoring and IT infrastructure. There are many customer documents and employee data. Financial documents, customer cards with phone numbers and addresses. [Sector: Finance, Technology]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : AyT COMPUTERS SRL","url":"https://www.ransomware.live/id/QXlUIENPTVBVVEVSUyBTUkxAZW1wZXJhZG9y"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-25T10:40:14.743193+00:00","id":39134,"published_date":"2026-10-25T09:00:56+00:00","severity":"critical","source_name":"Help Net Security","summary":"Here\u2019s an overview of some of last week\u2019s most interesting news, articles, interviews and videos: A critical PHP security release is coming today, so get ready to update! The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0. The project will publish those details, along with the patched version numbers, when the release goes out. \u2026 More \u2192 The post Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw appeared first on Help Net Security.","title":"Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw","url":"https://www.helpnetsecurity.com/2026/10/25/week-in-review-php-vulnerabilities-patched-exploited-palo-alto-globalprotect-vpn-flaw"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T08:40:31.161850+00:00","id":38851,"published_date":"2026-10-25T07:24:50+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : ETO","url":"https://www.ransomware.live/id/RVRPQHFpbGlu"},{"category":"Cloud Security","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-25T07:26:30.568504+00:00","id":38708,"published_date":"2026-10-25T07:02:31+00:00","severity":"medium","source_name":"Reddit r/netsec","summary":"https://xplo1t-sec.github.io/posts/breaking-the-aws-mcp-python-sandbox/ submitted by /u/sn1ped_u [link] [comments]","title":"Breaking the AWS MCP Python Sandbox","url":"https://www.reddit.com/r/netsec/comments/1xevj5i/breaking_the_aws_mcp_python_sandbox"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T07:26:30.160490+00:00","id":38702,"published_date":"2026-10-25T06:56:34+00:00","severity":"medium","source_name":"Ransomware.live","summary":"fuel trading and construction materials \u00b7 Bulgaria | The complete counterparty ledger of a fuel trading company: 694 companies with full legal names, addresses, managing persons, national company numbers, tax numbers and bank account details; More than 3,100 live customs and fuel movement documents from December 2025 through October 2026, and a 12 year archive of more than 46,000 documents from 2014 through 2025; Records of 611 drivers and 651 tanker trucks with registration plates; More than 2.6 million automated tank gauge readings from fuel storage tanks; Named staff accounts of the accounting system | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : TOPLIVO AD","url":"https://www.ransomware.live/id/VE9QTElWTyBBREBOMG4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T07:26:30.163767+00:00","id":38703,"published_date":"2026-10-25T06:56:05+00:00","severity":"medium","source_name":"Ransomware.live","summary":"media production (audio description and accessibility media) \u00b7 Montreal, Quebec, Canada | Current 2026 client production files from your work in progress library, including active projects modified in October 2026; A job candidate resume with full personal contact details from your human resources records; Your archive of finished productions from 2016 through 2021, including a 2.1 GB demonstration archive; Internal technical documentation of your media production platform | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Technoleads Services Inc.","url":"https://www.ransomware.live/id/VGVjaG5vbGVhZHMgU2VydmljZXMgSW5jLkBOMG4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T07:26:30.165130+00:00","id":38704,"published_date":"2026-10-25T06:55:37+00:00","severity":"medium","source_name":"Ransomware.live","summary":"diamond and lab grown diamond trading \u00b7 New York, New York, United States | Diamond stock and inventory lists with stock codes and certificate numbers; Customer return records with customer names and tracking references; More than 2,200 bank deposit and invoice documents | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Pure Grow Diamonds Inc.","url":"https://www.ransomware.live/id/UHVyZSBHcm93IERpYW1vbmRzIEluYy5ATjBu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T07:26:30.167835+00:00","id":38705,"published_date":"2026-10-25T06:55:09+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Legal Services - Family Law (US) \u00b7 California, USA | Client case files of a San Diego family law practice: divorce, custody and support matters with California court filings (FL-150 financial declarations, FL-300 requests for orders, FL-335 proofs of service) and XSpouse support calculations; Client intake records with Social Security numbers and dates of birth; Client bank statements (Navy Federal, Discover and other institutions) and the practice trust account statements; Client billing roster with balances | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Mach Law APC (San Diego family law and divorce practice)","url":"https://www.ransomware.live/id/TWFjaCBMYXcgQVBDIChTYW4gRGllZ28gZmFtaWx5IGxhdyBhbmQgZGl2b3JjZSBwcmFjdGljZSlATjBu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T07:26:30.169921+00:00","id":38706,"published_date":"2026-10-25T06:54:40+00:00","severity":"medium","source_name":"Ransomware.live","summary":"plumbing and kitchen products distribution \u00b7 Cincinnati, Ohio, United States | Sales orders with customer names, item numbers and product descriptions; Customer and order detail files with over 16,000 records; A full backup image of the main application library | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Keidel Supply Company Incorporated","url":"https://www.ransomware.live/id/S2VpZGVsIFN1cHBseSBDb21wYW55IEluY29ycG9yYXRlZEBOMG4"},{"category":"AI Security","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-25T08:40:13.671182+00:00","id":38709,"published_date":"2026-10-25T06:54:29+00:00","severity":"medium","source_name":"The Hacker News","summary":"OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. \"Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no","title":"OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication","url":"https://thehackernews.com/2026/10/openai-ai-agents-demonstrate-vm-escapes.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T07:26:30.172313+00:00","id":38707,"published_date":"2026-10-25T06:54:11+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Financial Advisory & Restructuring (US) \u00b7 Chicago, Illinois, USA | Patient records with names and dates of birth from the patient database backup of December 2025 (3,698 records), taken from the office network; The complete patient database backup history, 2018 through 2025; More than 13,000 patient eye examination records with full ocular, medical and social history; OCT eye scan files from the imaging server on the network; Workstation profiles of office staff including stored system credentials | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Andrews Advisory Group LLC","url":"https://www.ransomware.live/id/QW5kcmV3cyBBZHZpc29yeSBHcm91cCBMTENATjBu"},{"category":"Cloud Security","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T03:26:29.137101+00:00","id":38695,"published_date":"2026-10-25T03:22:10+00:00","severity":"medium","source_name":"Ransomware.live","summary":"AB InBev is the world's largest brewer, headquartered in Belgium, known for Budweiser, Corona, and Stella Artois . We hold 329,244 AB InBev social-listening alerts, 2,510 corporate emails across all subsidiaries, 19K access logs, GBS portal records, internal PKI certificates, and 3.2GB of Azure blob assets. Our demand is $1,000,000 in BTC. [Sector: Retail, Manufacturing]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : AB InBev","url":"https://www.ransomware.live/id/QUIgSW5CZXZAZW1wZXJhZG9y"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-25T09:40:12.824975+00:00","id":39050,"published_date":"2026-10-25T03:13:38+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-85228 - Integer overflow in tensor buffer validation in Deep Java Library","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-106-aws"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-25T09:40:12.820599+00:00","id":39044,"published_date":"2026-10-25T03:13:38+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-25T09:40:12.820337+00:00","id":39043,"published_date":"2026-10-25T03:13:38+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-108-aws"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-25T09:40:12.818119+00:00","id":39040,"published_date":"2026-10-25T03:13:38+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-109-aws"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-25T09:40:12.812109+00:00","id":39033,"published_date":"2026-10-25T03:13:38+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-89090 - Denial of service in the event stream header decoder in AWS SDK for Go v2","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-110-aws"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-25T03:26:40.533081+00:00","id":38699,"published_date":"2026-10-25T03:07:57+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Bulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT Summary: AWS identified CVE-2026-111943, a key-generation flaw at external CA eMudhra/emSign that made intermediate CA private keys recoverable. Three roots are affected: AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3. They shipped in AWS-owned trust bundles, exposing soft-fail TLS clients to man-in-the-middle risk. AWS is removing the roots. Customers using CloudFront custom origins or ALB OIDC/JWT auth should check whether their certificates chain to an affected root and reissue from a different CA before enforcement. Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article","title":"CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-150-aws"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T03:26:29.139223+00:00","id":38696,"published_date":"2026-10-25T01:24:13+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known globally for televisions and home appliances. We hold Hisense's entire GCRM production document store, the full warranty-claims archive for Malaysia/Singapore: customer names, phones, emails, ID numbers, 2,549 suppliers, hundreds of invoices, payments, contracts, RMA forms, claim evidence, plus their internal CRM app binary. Our demand is $500,000 in BTC. Good luck. Contact: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : Hisense","url":"https://www.ransomware.live/id/SGlzZW5zZUBXaGl0ZWFybW9y"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-25T03:26:29.139857+00:00","id":38697,"published_date":"2026-10-25T00:31:56+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Customers' personal documents and the company's internal documents.","title":"\ud83c\udff4\u200d\u2620\ufe0f Anubis has just published a new victim : Newcomer Cremations, Funerals & Receptions","url":"https://www.ransomware.live/id/TmV3Y29tZXIgQ3JlbWF0aW9ucywgRnVuZXJhbHMgJiBSZWNlcHRpb25zQGFudWJpcw"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Primary npm/PyPI supply-chain research; the origin of the Shai-Hulud package-version figures this project already cites. Fills the Supply Chain category, which had keyword rules but no dedicated feed. filter_uncategorized drops product/marketing posts.","created_at":"2026-10-24T20:39:28.689869+00:00","id":38149,"published_date":"2026-10-24T19:46:00+00:00","severity":"medium","source_name":"Aikido Security","summary":"Aikido Security's AI pentesting fits into the stack you already run. You can add AI pentesting on top to catch the complex logic flaws deterministic tools miss. Category: Guides & Best Practices","title":"Adding Aikido AI pentesting to your existing security stack","url":"https://www.aikido.dev/blog/ai-pentesting-existing-security-stack"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-24T20:39:31.306433+00:00","id":38151,"published_date":"2026-10-24T18:58:38+00:00","severity":"critical","source_name":"Security Affairs","summary":"Pierluigi Paganini answers questions about the PHP2Shell vulnerability, early exploitation, AI-assisted attacks, and the risks to businesses, servers, and personal data. 1. Your latest report reveals that hackers began exploiting the PHP2Shell vulnerability four days before it was publicly disclosed. First, can you explain what PHP is, how widely it is used across the internet, [\u2026]","title":"Pierluigi Paganini answers questions about the PHP2Shell flaws","url":"https://securityaffairs.com/201662/hacking/pierluigi-paganini-answers-questions-about-the-php2shell-flaws.html"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-24T20:39:19.277098+00:00","id":38148,"published_date":"2026-10-24T17:17:43+00:00","severity":"medium","source_name":"Reddit r/netsec","summary":"submitted by /u/utku1337 [link] [comments]","title":"How LLM-Based Penetration Testing Harnesses Work","url":"https://www.reddit.com/r/netsec/comments/1xee9z1/how_llmbased_penetration_testing_harnesses_work"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-24T18:39:32.542512+00:00","id":38147,"published_date":"2026-10-24T16:53:59+00:00","severity":"critical","source_name":"Security Affairs","summary":"U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Collabora Collabora Online \u2013 Built-in CODE Server flaw, tracked as CVE-2026-110447 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. Collabora Online \u2013 Built-in CODE Server is [\u2026]","title":"U.S. CISA adds Collabora Online flaw to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/201652/security/u-s-cisa-adds-collabora-online-flaw-to-its-known-exploited-vulnerabilities-catalog.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T16:39:19.886533+00:00","id":38113,"published_date":"2026-10-24T16:34:49+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Castle Howard Estate","url":"https://www.ransomware.live/id/Q2FzdGxlIEhvd2FyZCBFc3RhdGVAcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T16:39:19.887941+00:00","id":38114,"published_date":"2026-10-24T16:30:40+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Vins Viallet is a French family-owned wine producer and distributor based in the Savoie region. Founded in 1966, the company produces and markets a range of wines, including white, red, ros\u00e9 and sparkling varieties, serving retail and wholesale","title":"\ud83c\udff4\u200d\u2620\ufe0f Lamashtu has just published a new victim : Vins Viallet","url":"https://www.ransomware.live/id/VmlucyBWaWFsbGV0QGxhbWFzaHR1"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T16:39:19.888316+00:00","id":38115,"published_date":"2026-10-24T15:26:13+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Heber City, UT","url":"https://www.ransomware.live/id/SGViZXIgQ2l0eSwgVVRAcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T16:39:19.889832+00:00","id":38116,"published_date":"2026-10-24T14:53:32+00:00","severity":"medium","source_name":"Ransomware.live","summary":"German company from Frankfurt am Main, which deals with building maintenance, construction services, logistics and security. Archived personal and corporate data of employees and customers. Here are the most important documents. [Sector: Manufacturing, Finance, Transportation]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : Phoenix S&S GmbH","url":"https://www.ransomware.live/id/UGhvZW5peCBTJlMgR21iSEBlbXBlcmFkb3I"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T16:39:19.891207+00:00","id":38117,"published_date":"2026-10-24T14:52:41+00:00","severity":"medium","source_name":"Ransomware.live","summary":"German company that sells and delivers fuels, primarily heating oil (Heiz\u00f6l), but also motor fuels and lubricants. Archived personal and corporate data of employees and customers. Here are the most important documents. [Sector: Manufacturing, Finance, Technology]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : Frommann Energie GmbH","url":"https://www.ransomware.live/id/RnJvbW1hbm4gRW5lcmdpZSBHbWJIQGVtcGVyYWRvcg"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-24T14:39:18.713330+00:00","id":38107,"published_date":"2026-10-24T14:17:32+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]","title":"BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot","url":"https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T16:39:19.891604+00:00","id":38118,"published_date":"2026-10-24T13:17:20+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : SLTN Inter Access","url":"https://www.ransomware.live/id/U0xUTiBJbnRlciBBY2Nlc3NAcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.748479+00:00","id":38082,"published_date":"2026-10-24T11:22:23+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Choice Group (Goodwill Projects) is a prominent Indian real estate developer founded in 1994, headquartered in Tingre Na...","title":"\ud83c\udff4\u200d\u2620\ufe0f Krybit has just published a new victim : www.choicegoodwill.com","url":"https://www.ransomware.live/id/d3d3LmNob2ljZWdvb2R3aWxsLmNvbUBrcnliaXQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.749690+00:00","id":38083,"published_date":"2026-10-24T11:21:47+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Main Place Mall is a lifestyle neighbourhood shopping mall located in USJ 21, Subang Jaya, Selangor, Malaysia, operating...","title":"\ud83c\udff4\u200d\u2620\ufe0f Krybit has just published a new victim : mainplace.com.my","url":"https://www.ransomware.live/id/bWFpbnBsYWNlLmNvbS5teUBrcnliaXQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.750790+00:00","id":38084,"published_date":"2026-10-24T11:21:10+00:00","severity":"medium","source_name":"Ransomware.live","summary":"MODON Developments S.A.E. (MODON For Urban Development) is an innovative Egyptian real estate development and management...","title":"\ud83c\udff4\u200d\u2620\ufe0f Krybit has just published a new victim : MODON Developments S.A.E","url":"https://www.ransomware.live/id/TU9ET04gRGV2ZWxvcG1lbnRzIFMuQS5FQGtyeWJpdA"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.751703+00:00","id":38085,"published_date":"2026-10-24T11:20:35+00:00","severity":"medium","source_name":"Ransomware.live","summary":"ZH Healthcare (Z & H Consultancy Services Private Limited) is an Indian health-tech platform and EMR/EHR solutions provi...","title":"\ud83c\udff4\u200d\u2620\ufe0f Krybit has just published a new victim : www.zhservices.com","url":"https://www.ransomware.live/id/d3d3Lnpoc2VydmljZXMuY29tQGtyeWJpdA"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.752630+00:00","id":38086,"published_date":"2026-10-24T11:19:59+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Grupo Euro Corporativo is a 100% Mexican business conglomerate (corporativo empresarial 100% potosino) founded in 1990, ...","title":"\ud83c\udff4\u200d\u2620\ufe0f Krybit has just published a new victim : grupoeuro.com.mx","url":"https://www.ransomware.live/id/Z3J1cG9ldXJvLmNvbS5teEBrcnliaXQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.753463+00:00","id":38087,"published_date":"2026-10-24T11:19:23+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Optika Eye Care Center (Centre Visuel Optika Optom\u00e9tristes) is a Canadian optometry and optical care clinic located in ...","title":"\ud83c\udff4\u200d\u2620\ufe0f Krybit has just published a new victim : www.optika.ca","url":"https://www.ransomware.live/id/d3d3Lm9wdGlrYS5jYUBrcnliaXQ"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-24T12:39:17.432002+00:00","id":38078,"published_date":"2026-10-24T11:09:29+00:00","severity":"critical","source_name":"The Hacker News","summary":"A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially","title":"Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software","url":"https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html"},{"category":"Supply Chain","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-24T12:39:19.167575+00:00","id":38079,"published_date":"2026-10-24T11:03:33+00:00","severity":"medium","source_name":"The Hacker News","summary":"LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. \"On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of","title":"Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline","url":"https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-24T12:39:20.173689+00:00","id":38105,"published_date":"2026-10-24T10:57:59+00:00","severity":"medium","source_name":"Reddit r/netsec","summary":"submitted by /u/amnioticboy [link] [comments]","title":"Full source release: autonomous root chain for TCL 50C721 Android TV via CVE-2022-22706 (Mali GPU page-cache write)","url":"https://www.reddit.com/r/netsec/comments/1xe5oy7/full_source_release_autonomous_root_chain_for_tcl"},{"category":"AI Security","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-24T12:39:19.170824+00:00","id":38080,"published_date":"2026-10-24T10:36:33+00:00","severity":"medium","source_name":"The Hacker News","summary":"Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. \"You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,","title":"Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads","url":"https://thehackernews.com/2026/10/google-says-gmail-and-photos-data.html"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-24T12:39:28.914986+00:00","id":38106,"published_date":"2026-10-24T10:21:53+00:00","severity":"medium","source_name":"Security Affairs","summary":"Capcom disclosed a data breach exposing 11.7 million email addresses and account details after hackers accessed its CAPCOM ID service. Japanese gaming company Capcom has disclosed a data breach discovered on October 19 involving its CAPCOM ID service, which provides access to online services and games. As of October 22, attackers stole 11,774,247 email addresses, [\u2026]","title":"Capcom Data Breach Exposes 11.7 Million Email Addresses","url":"https://securityaffairs.com/201626/data-breach/capcom-data-breach-exposes-11-7-million-email-addresses.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.754755+00:00","id":38088,"published_date":"2026-10-24T09:55:07+00:00","severity":"medium","source_name":"Ransomware.live","summary":"wholesale distribution \u00b7 Dallas, Texas, United States | Vendor and contractor tax records with Social Security numbers and employer identification numbers; Customer account number lists; Monthly operations scheduling and order logs active through October 2026 | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Texcar Inc.","url":"https://www.ransomware.live/id/VGV4Y2FyIEluYy5ATjBu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.756720+00:00","id":38089,"published_date":"2026-10-24T09:54:32+00:00","severity":"medium","source_name":"Ransomware.live","summary":"engineering design and installations \u00b7 Portugal | The full project archive of an engineering design office, spanning 2000 through 2026, including tender submissions, client proposals and technical drawings; Project folders for named clients including hospital installations for a private hospital group; Scanned office documents with activity through October 2026; A company bank account document with the full IBAN and tax number; Staff curricula with photos and personal details | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : GPIC Projectos Con Instalacoes Lda","url":"https://www.ransomware.live/id/R1BJQyBQcm9qZWN0b3MgQ29uIEluc3RhbGFjb2VzIExkYUBOMG4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.758956+00:00","id":38090,"published_date":"2026-10-24T09:53:58+00:00","severity":"medium","source_name":"Ransomware.live","summary":"health insurance administration \u00b7 Guayaquil, Ecuador | Identity and contact records of 139,006 named insurance clients, including identity document numbers and dates of birth; 383,159 policy beneficiary records with insured amounts; 402,988 medical and insurance claims with diagnosis codes and dollar amounts, current through 20 October 2026; Policy billing, home and work addresses and bank account details | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Asisken Asistencia M\u00e9dica S.A.","url":"https://www.ransomware.live/id/QXNpc2tlbiBBc2lzdGVuY2lhIE3DqWRpY2EgUy5BLkBOMG4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.760683+00:00","id":38091,"published_date":"2026-10-24T09:53:23+00:00","severity":"medium","source_name":"Ransomware.live","summary":"network and IT services \u00b7 New York, United States | The live accounting database of the company, more than 627 megabytes, active through 20 October 2026; A second company accounting database of Elevate Networks, Inc., more than 331 megabytes, active through 20 October 2026; Transaction logs and scheduled accounting backups | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Adirondack Networks, Inc.","url":"https://www.ransomware.live/id/QWRpcm9uZGFjayBOZXR3b3JrcywgSW5jLkBOMG4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.763187+00:00","id":38092,"published_date":"2026-10-24T09:52:48+00:00","severity":"medium","source_name":"Ransomware.live","summary":"rheumatology medical practice \u00b7 Riverside, California, United States | Scanned laboratory requisitions of named patients with dates of birth, home addresses and Medicare subscriber details, April through October 2026; Accounts receivable aging with patient names, account numbers, insurers and balances; Patient billing files and records correspondence of the practice | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Arthritis Center of Riverside","url":"https://www.ransomware.live/id/QXJ0aHJpdGlzIENlbnRlciBvZiBSaXZlcnNpZGVATjBu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.764493+00:00","id":38093,"published_date":"2026-10-24T09:36:39+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Albertin Alcide e Figli S.n.c. manufactures plates, stamps, and printing forms for hot stamping, flexography, and printing. HQ: Via Casignolo 30, 20092 Cinisello Balsamo (MI) Phone: +39 02 66046256...","title":"\ud83c\udff4\u200d\u2620\ufe0f Majinahanashi has just published a new victim : Albertin Alcide e Figli S.n.c.","url":"https://www.ransomware.live/id/QWxiZXJ0aW4gQWxjaWRlIGUgRmlnbGkgUy5uLmMuQE1hamluYWhhbmFzaGk"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.765523+00:00","id":38094,"published_date":"2026-10-24T09:36:07+00:00","severity":"medium","source_name":"Ransomware.live","summary":"SA BAUFER VF is a Swiss company that specializes in the processing, supply, and installation of reinforcing steel for reinforced concrete structures HQ: Via Industrie 14, 6512 Giubiasco, Switzerlan...","title":"\ud83c\udff4\u200d\u2620\ufe0f Majinahanashi has just published a new victim : SA BAUFER V.F","url":"https://www.ransomware.live/id/U0EgQkFVRkVSIFYuRkBNYWppbmFoYW5hc2hp"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.766616+00:00","id":38095,"published_date":"2026-10-24T09:35:35+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Tema Energy S.r.l. manufactures and processes components and equipment for the oil and gas and power generation industries, including components for gas turbine and power generation systems. HQ: Vi...","title":"\ud83c\udff4\u200d\u2620\ufe0f Majinahanashi has just published a new victim : Tema Energy S.r.l.","url":"https://www.ransomware.live/id/VGVtYSBFbmVyZ3kgUy5yLmwuQE1hamluYWhhbmFzaGk"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.767635+00:00","id":38096,"published_date":"2026-10-24T09:35:01+00:00","severity":"medium","source_name":"Ransomware.live","summary":"CFG Serramenti S.r.l. is an Italian manufacturer and installer of windows, doors, and other window and door systems\u2014primarily made of PVC\u2014operating in Bergamo, Milan, and throughout Lombardy; the c...","title":"\ud83c\udff4\u200d\u2620\ufe0f Majinahanashi has just published a new victim : CFG SERRAMENTI S.r.l.","url":"https://www.ransomware.live/id/Q0ZHIFNFUlJBTUVOVEkgUy5yLmwuQE1hamluYWhhbmFzaGk"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.768681+00:00","id":38097,"published_date":"2026-10-24T09:34:29+00:00","severity":"medium","source_name":"Ransomware.live","summary":"i2r Packaging Solutions Limited manufactures aluminium packaging and containers for the food industry. HQ: Capital House, Hadley Park East, Telford, Shropshire, TF1 6QJ, UK Phone: +44 845 371 5111...","title":"\ud83c\udff4\u200d\u2620\ufe0f Majinahanashi has just published a new victim : i2r Packaging Solutions Limited","url":"https://www.ransomware.live/id/aTJyIFBhY2thZ2luZyBTb2x1dGlvbnMgTGltaXRlZEBNYWppbmFoYW5hc2hp"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.769703+00:00","id":38098,"published_date":"2026-10-24T09:33:57+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Founded in 1981, it is Ireland's largest chain of supermarkets and wholesale suppliers, specializing in the sale of authentic Asian food, tableware, and household goods. HQ: 18 Drury Street, Dublin...","title":"\ud83c\udff4\u200d\u2620\ufe0f Majinahanashi has just published a new victim : Asia Market Ltd","url":"https://www.ransomware.live/id/QXNpYSBNYXJrZXQgTHRkQE1hamluYWhhbmFzaGk"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.771615+00:00","id":38099,"published_date":"2026-10-24T09:32:43+00:00","severity":"medium","source_name":"Ransomware.live","summary":"[AI generated] Morrow Meadows Corporation is a United States-based electrical contracting company. It provides electrical construction, design-build, and engineering services for commercial, industrial, institutional, and data center projects. Operating primarily in California, the company serves sectors such as technology, healthcare, education, and manufacturing, offering services including power distribution, lighting, fire alarm systems, and electrical infrastructure installation.","title":"\ud83c\udff4\u200d\u2620\ufe0f Payoutsking has just published a new victim : Morrow Meadows Corporation","url":"https://www.ransomware.live/id/TW9ycm93IE1lYWRvd3MgQ29ycG9yYXRpb25AcGF5b3V0c2tpbmc"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.772441+00:00","id":38100,"published_date":"2026-10-24T09:30:38+00:00","severity":"medium","source_name":"Ransomware.live","summary":"","title":"\ud83c\udff4\u200d\u2620\ufe0f Payoutsking has just published a new victim : P****y","url":"https://www.ransomware.live/id/UCoqKip5QHBheW91dHNraW5n"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.775555+00:00","id":38101,"published_date":"2026-10-24T09:28:38+00:00","severity":"medium","source_name":"Ransomware.live","summary":"weld8.org Weld Re-8 School District public school district founded in 1914 in Fort Lupton, Colorado, serving about 2500 students across 7 schools with a 43.5 million dollar budget. The student body is 76 percent minority with over half on free lunch, and academics are weak, math proficiency 16 to 19 percent, reading 22 to 26 percent, far below state averages. The core problem is teacher pay, starting salaries 47500 dollars versus 53000 to 64500 nearby, driving 23 percent yearly turnover. Voters rejected four tax requests since 2023, and on November 3 2026 they vote Issue 5C, a 4.9 million dollar tax hike, or face 1.3 million in mid-year cuts. New superintendent Dr. Justin Ralston launched a 2026 to 2029 plan reviving agriculture and adding IT and cybersecurity tracks. Oil and gas covers over half the local tax base.","title":"\ud83c\udff4\u200d\u2620\ufe0f Thegentlemen has just published a new victim : Weld Re 8 School District","url":"https://www.ransomware.live/id/V2VsZCBSZSA4IFNjaG9vbCBEaXN0cmljdEB0aGVnZW50bGVtZW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.779031+00:00","id":38102,"published_date":"2026-10-24T09:28:18+00:00","severity":"medium","source_name":"Ransomware.live","summary":"redoaktech.com Red Oak Technologies private IT staffing and managed services company founded in 1995 and headquartered in San Jose, California, with offices in Austin and Denver. It has about 250 employees across 5 countries and estimated revenue of roughly 105 million dollars. The company provides contract tech talent, direct hire and full project delivery with offshore and nearshore teams. It specializes in cloud, DevOps, semiconductor and life sciences clients from startups to Fortune 500. Led by President Joel Leege, ex-Randstad Technology, it has completed over 1700 projects in 30 years with 92 percent client retention.","title":"\ud83c\udff4\u200d\u2620\ufe0f Thegentlemen has just published a new victim : Red Oak Technologies","url":"https://www.ransomware.live/id/UmVkIE9hayBUZWNobm9sb2dpZXNAdGhlZ2VudGxlbWVu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.782474+00:00","id":38103,"published_date":"2026-10-24T09:27:57+00:00","severity":"medium","source_name":"Ransomware.live","summary":"pencoproducts.com Penco Products US metal manufacturer founded in 1869, now based in Greenville, North Carolina, making steel lockers, shelving, pallet racks and garment dispensers at its 375,000 square foot ISO certified plant in Hamilton. It is part of the IMC industrial group and has around 200 employees, up to 350 in summer peaks. Its lockers are an American standard in schools, gyms, hospitals and military facilities, with new smart locker lines for contactless pickup. Led by CEO Craig Atwater since 2021, it sells through a national distributor network with QuickShip warehouses across the country. Strengths are 157 years of brand trust, full US vertical production and diversification into school furniture.","title":"\ud83c\udff4\u200d\u2620\ufe0f Thegentlemen has just published a new victim : Penco Products","url":"https://www.ransomware.live/id/UGVuY28gUHJvZHVjdHNAdGhlZ2VudGxlbWVu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T12:39:19.786609+00:00","id":38104,"published_date":"2026-10-24T09:27:35+00:00","severity":"medium","source_name":"Ransomware.live","summary":"conaxtechnologies.com Conax Technologies US manufacturer founded in 1952 in Buffalo, New York, producing temperature sensors like thermocouples and RTDs together with high-pressure compression seal fittings for extreme conditions. Owned by the private equity firm May River Capital, it has around 200 to 500 employees and estimated revenue of roughly 41 million dollars. Its products operate in extreme temperatures up to 2000 Fahrenheit and pressures up to 100,000 psi across aerospace, defense, semiconductor, medical and energy markets. The company runs a 101,000 square foot plant with 150 machines, holds AS9100, NADCAP and ISO certifications, and has over 45 patents with 100 million products installed worldwide. Under CEO John LeFevre since 2023 it is expanding through acquisitions such as Vulcan Electric and Sorregosa Spain plus growth in semiconductor and medical verticals.","title":"\ud83c\udff4\u200d\u2620\ufe0f Thegentlemen has just published a new victim : Conax Technologies","url":"https://www.ransomware.live/id/Q29uYXggVGVjaG5vbG9naWVzQHRoZWdlbnRsZW1lbg"},{"category":"Malware/Infostealer","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-24T12:39:19.174449+00:00","id":38081,"published_date":"2026-10-24T09:04:24+00:00","severity":"medium","source_name":"The Hacker News","summary":"Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an abandoned copy of Popcorn Time, a free app that streamed pirated films and TV over BitTorrent. Popcorn Time was","title":"Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet","url":"https://thehackernews.com/2026/10/researchers-push-over-2-million-updates.html"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-24T10:39:30.301036+00:00","id":38068,"published_date":"2026-10-24T08:30:44+00:00","severity":"critical","source_name":"Security Affairs","summary":"U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical Arista VeloCloud Orchestrator flaw, tracked as CVE-2026-114625 (CVSS score of 9.4), to its Known Exploited Vulnerabilities (KEV) catalog. VeloCloud Orchestrator (VCO) is the central management system for [\u2026]","title":"U.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalog","url":"https://securityaffairs.com/201609/hacking/u-s-cisa-adds-arista-velocloud-orchestrator-flaw-to-its-known-exploited-vulnerabilities-catalog.html"},{"category":"Industry/Policy","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-24T08:39:20.577348+00:00","id":38066,"published_date":"2026-10-24T08:17:51+00:00","severity":"medium","source_name":"Reddit r/netsec","summary":"I spent the week pulling apart Cloudflare's PQ GeoKey Manager announcement (Oct 23, closed beta, GA planned Q1 2027) and wrote up how the mechanism actually works, with a simulator you can break. The part I found most interesting: the wrapped key travels everywhere on the network, but the regional root key never does. It only reaches authorized edge servers through a separate provisioning path, and on those servers it lives in volatile kernel keyring memory. A request that lands in the wrong region fails closed instead of rerouting somewhere helpful. The wrapping is hybrid HPKE: ML-KEM-768 plus X25519, so it holds as long as either one holds. The part I'm still unsure about: a 'region' here is a living inventory list that changes several times a day, not a fixed line on a map. That makes the audit question interesting. Original announcement: https://blog.cloudflare.com/post-quantum-geo-key-manager/ My writeup with the interactive key-check simulator: https://movahedi.ca/insights/post-quantum-geo-key-manager/ (a French version is on the same site too) submitted by /u/masiha97 [link] [comments]","title":"Cloudflare's new PQ GeoKey Manager: keys that can only unwrap inside a chosen region, wrapped with hybrid ML-KEM + X25519","url":"https://www.reddit.com/r/netsec/comments/1xe33sw/cloudflares_new_pq_geokey_manager_keys_that_can"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-24T08:39:20.566115+00:00","id":38065,"published_date":"2026-10-24T07:18:36+00:00","severity":"high","source_name":"Reddit r/netsec","summary":"submitted by /u/vaizor [link] [comments]","title":"We used RCE on 3 million PCs to prevent a botnet","url":"https://www.reddit.com/r/netsec/comments/1xe25f5/we_used_rce_on_3_million_pcs_to_prevent_a_botnet"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-24T08:39:17.660394+00:00","id":38064,"published_date":"2026-10-24T06:25:57+00:00","severity":"critical","source_name":"The Hacker News","summary":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating","title":"CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud","url":"https://thehackernews.com/2026/10/cisa-flags-two-actively-exploited.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T04:39:18.520881+00:00","id":38060,"published_date":"2026-10-24T03:30:27+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Commonwealth Community Bank","url":"https://www.ransomware.live/id/Q29tbW9ud2VhbHRoIENvbW11bml0eSBCYW5rQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T04:39:18.522070+00:00","id":38061,"published_date":"2026-10-24T02:53:03+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Trinity Custom Homes is a custom home builder that specializes in building 100% custom, solid wood homes directly on the customer\u2019s land across several states in the Southeast, including Georgia, Alabama, North Carolina, South Carolina, and Tennessee.","title":"\ud83c\udff4\u200d\u2620\ufe0f Deadlock has just published a new victim : Trinity Custom Homes","url":"https://www.ransomware.live/id/VHJpbml0eSBDdXN0b20gSG9tZXNARGVhZGxvY2s"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-24T00:39:49.167744+00:00","id":37312,"published_date":"2026-10-24T00:24:57+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Rahnuma-FPAP is one of the largest and oldest civil society organizations in Pakistan focused on reproductive health and contraceptive care. The organization aims to empower individuals to make informed decisions about their sexual and reproductive health rights. It provides a wide range of services including family planning, HIV/AIDS care, gynecology, and obstetrics, particularly targeting vulnerable and underserved populations. Rahnuma-FPAP operates a network of clinics across Pakistan, ensuring accessible and confidential health services for all individuals.","title":"\ud83c\udff4\u200d\u2620\ufe0f Panzer has just published a new victim : Family Planning Association of Pakistan","url":"https://www.ransomware.live/id/RmFtaWx5IFBsYW5uaW5nIEFzc29jaWF0aW9uIG9mIFBha2lzdGFuQFBhbnplcg"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Container/Kubernetes runtime-security research and cryptomining campaign analysis. NOTE: removed 2026-07-11 as a 404 on a guessed URL; this path was re-verified live 2026-08-29 (HTTP 200, 100 entries) and works.","created_at":"2026-10-24T20:39:29.417545+00:00","id":38150,"published_date":"2026-10-24T00:00:00+00:00","severity":"critical","source_name":"Sysdig","summary":"","title":"Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE","url":"https://webflow.sysdig.com/blog/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Container/Kubernetes runtime-security research and cryptomining campaign analysis. NOTE: removed 2026-07-11 as a 404 on a guessed URL; this path was re-verified live 2026-08-29 (HTTP 200, 100 entries) and works.","created_at":"2026-10-24T18:39:30.910140+00:00","id":38129,"published_date":"2026-10-24T00:00:00+00:00","severity":"medium","source_name":"Sysdig","summary":"","title":"Detecting and mitigating ZDI-CAN-33367 and five other Linux flaws","url":"https://webflow.sysdig.com/blog/detecting-and-mitigating-zdi-can-33367-and-five-other-linux-flaws"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T22:14:28.831543+00:00","id":36292,"published_date":"2026-10-23T21:50:47+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Hensel Elektrik is the Turkish subsidiary of the German company Gustav Hensel GmbH & Co. KG, which manufactures electrical installation equipment and power distribution systems. The company was founded in 1931. https://temp.sh/BcIQY/Data_list.txt","title":"\ud83c\udff4\u200d\u2620\ufe0f Deadlock has just published a new victim : Hensel Elektrik","url":"https://www.ransomware.live/id/SGVuc2VsIEVsZWt0cmlrQERlYWRsb2Nr"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-23T22:14:06.020449+00:00","id":36164,"published_date":"2026-10-23T20:55:05+00:00","severity":"high","source_name":"Bleeping Computer","summary":"Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. [...]","title":"Abandoned Popcorn Time app exposed millions of devices to RCE attacks","url":"https://www.bleepingcomputer.com/news/security/abandoned-popcorn-time-app-exposed-millions-of-device-to-rce-attacks"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Primary npm/PyPI supply-chain research; the origin of the Shai-Hulud package-version figures this project already cites. Fills the Supply Chain category, which had keyword rules but no dedicated feed. filter_uncategorized drops product/marketing posts.","created_at":"2026-10-23T22:14:33.581664+00:00","id":36293,"published_date":"2026-10-23T20:45:00+00:00","severity":"critical","source_name":"Aikido Security","summary":"The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python apps with Brotli or brotlicffi installed. Check your versions and upgrade to the fix. Category: Vulnerabilities & Threats","title":"Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)","url":"https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.963972+00:00","id":36139,"published_date":"2026-10-23T20:18:08+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Sanders Law Group DATA SALE LISTING - Sanders Law Group / Sanders Law Firm, PLLC (Uniondale, NY)Target: Sanders Law Firm, PLLC (d/b/a Sanders Law Group; former brands - Barshay Sanders PLLC, Baker Sanders) Addresses: 333 Earle Ovington Blvd, Suite 402, Uniondale, NY 11553 100 Garden City Plaza, Garden City, NY 11530 Phone: (516) 203-7600 Owner: Craig B. Sanders, Esq. (founding partner) Size: ~8 TB 4.5 million files 2005 2026, history through most recent Format: full file-server clones + 2 dumps of the firm's ARES case-management DB + mail archives (33 PST, ~120 GB + 2,479 mailbox dumps)Who they are and who they work withA high-volume litigation factory out of Long Island, NY, running three conveyor-belt practices:FDCPA mill - 9,332 mass cases against banks and collectors. Their evidence pipeline: 1,144 audio recordings of their own clients' calls with banksCopyright machine - ~17,000 'photo-enforcement' suits. In January 2022 Sanders bought the entire practice of Richard Liebowitz the most-sanctioned copyright attorney in U.S. history (discredited, bar-suspended). Included: the executed Asset Purchase Agreement, a confidential WZMP settlement (7 versions incl. redlines), the acquired book of cases and clients, and solicitation letters to poach his client listFCRA litigation vs Equifax, Experian, TransUnion 953 cases. Plus a dedicated Equifax SRAs folder: executed settlements with Equifax LLC, named client by client, alongside their full credit disclosuresCorporate clients/partners in the files: The Mega Agency, Pixsy (exclusive enforcement deals), Signature Health Center / CareHealth (healthcare), Chase debt-buyer packages, Esquire Funding (litigation finance - loan agreements, commission invoices). Case-management dev outsourced to an Indian shop (neuralit.com).Active matters right now: 6,098 (of 30,671 total in the DB).What's inside - value breakdownPractice-side (the firm's jugular)Full ARES DB (2 dumps) - all 30,671 cases with settlement offers/demand ceilings in 13,413 files (up to $4,000,000 per case), statuses, internal notes, deadlines. Publication - burned negotiation positions across every active case at once2,342 executed CONFIDENTIAL settlement agreements (e.g., NationalPhoto v. Entravision + dozens more) - bearing secrecy clauses the firm itself is liable for1,315 documents of the firm's own sanctions and discipline: court orders on sanctions motions, a DFS Disciplinary Stipulation, 6 'Notice of Attorney Sanction' filings, public discipline ordersBanking & trusts11 accounts, 562 statements, incl. attorney trust accounts IOLTA NY ( 9068) and IOLTA NJ ( 2302) - bar-mandated audit territory = direct license threat for every named attorneyWire instructions for the client fund 6327 (JPMorgan Chase)Partnership tax returns 2015 2020 (Form 1065, TurboTax source files), payroll, full HR (I-9s, staff employment contracts, employee handbook)Client PII industrial scale12,803 full credit reports of the firm's own plaintiff-clients20,106 W-9/1099 forms, 520 files: SSN cards / passports / driver licenses / birth certificates1,471+ medical records (named patients, incl. NYUI files)CRM: 5,352 clients + 13,178 leads with phones/emails32,816 executed retainer agreementsOwner-level leverage (Craig B. Sanders)His 2022 divorce: Judgment of Divorce (Michelle Sanders v. Craig Sanders) + settlement stipulation + sworn Net Worth Statement + brokerage/bank statementsBonus: the firm's 78-page FBI IC3 criminal complaint dated 08/22/2026Email 20 years33 legacy PSTs (~120 GB) + 2,479 mailbox dumps + daily email backups (2013 2014)Freebies: office password lists in plaintext, owner's Chrome password export, court ECF login sheets. More","title":"\ud83c\udff4\u200d\u2620\ufe0f Rhysida has just published a new victim : Sanders Law Group","url":"https://www.ransomware.live/id/U2FuZGVycyBMYXcgR3JvdXBAcmh5c2lkYQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.965456+00:00","id":36140,"published_date":"2026-10-23T20:17:19+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Miljaus Producciones S.L (www.miljaus.com)","url":"https://www.ransomware.live/id/TWlsamF1cyBQcm9kdWNjaW9uZXMgUy5MICh3d3cubWlsamF1cy5jb20pQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.965974+00:00","id":36141,"published_date":"2026-10-23T20:16:50+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : von Schaewen","url":"https://www.ransomware.live/id/dm9uIFNjaGFld2VuQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.966360+00:00","id":36142,"published_date":"2026-10-23T20:16:21+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Tamponnt","url":"https://www.ransomware.live/id/VGFtcG9ubnRAcWlsaW4"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Handler diaries \u2014 expert practitioner analysis, not primary research but high-quality synthesis.","created_at":"2026-10-23T20:30:56.375969+00:00","id":36157,"published_date":"2026-10-23T20:04:47+00:00","severity":"critical","source_name":"SANS Internet Storm Center","summary":"Yesterday everyone was running around like crazy (me included :) because of the php2shell vulnerability.","title":"(Reliable)? php2shell exploitability, (Fri, Oct 23rd)","url":"https://isc.sans.edu/diary/rss/33452"},{"category":"OT/ICS","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.966582+00:00","id":36143,"published_date":"2026-10-23T19:52:50+00:00","severity":"medium","source_name":"Ransomware.live","summary":"smart grid engineering firm \u00b7 Spain | [PENDING EXPOSURE]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Company #110","url":"https://www.ransomware.live/id/Q29tcGFueSAjMTEwQE4wbg"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-23T20:30:45.698829+00:00","id":36155,"published_date":"2026-10-23T19:41:23+00:00","severity":"critical","source_name":"Dark Reading","summary":"Fixing the critical PHP flaws is not as simple as clicking \"Update.\" Here's how to assess your risk, and what you can do to protect yourself.","title":"Exposed to PHP2Shell? Cyber Experts Weigh in With Advice","url":"https://www.darkreading.com/application-security/exposed-php2shell-cyber-experts-advice"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism with strong enterprise-app and non-US coverage. filter_uncategorized drops non-security/opinion items.","created_at":"2026-10-23T20:30:56.698146+00:00","id":36158,"published_date":"2026-10-23T19:14:57+00:00","severity":"medium","source_name":"The Register (Security)","summary":"Monitoring was only partial and was easily bypassed","title":"Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack","url":"https://www.theregister.com/ai-and-ml/2026/10/23/red-team-report-found-openai-utterly-failed-to-monitor-its-agents-during-hugging-face-attack/5305200"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-23T19:30:55.922626+00:00","id":36135,"published_date":"2026-10-23T19:09:22+00:00","severity":"high","source_name":"AWS Security Bulletins","summary":"Bulletin ID: 2026-149-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 12:00 PM PDT Description: AWS MCP Server is a managed server that gives AI agents access to AWS through the Model Context Protocol (MCP), including a run_script tool that runs Python scripts in a sandboxed environment. We identified CVE-2026-115845, an issue in the Python code validator of the run_script tool in AWS MCP Server. An incomplete list of disallowed inputs might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. Impacted versions: N/A (managed service, exclusively hosted) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article","title":"CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-149-aws"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-23T20:30:44.952993+00:00","id":36154,"published_date":"2026-10-23T18:54:41+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026. [...]","title":"Microsoft Teams to get AI-powered, context-aware phishing detection","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-teams-to-get-ai-powered-context-aware-phishing-detection"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T20:30:44.324419+00:00","id":36136,"published_date":"2026-10-23T18:50:13+00:00","severity":"medium","source_name":"The Hacker News","summary":"Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report","title":"BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations","url":"https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html"},{"category":"Phishing & Social Engineering","confidence":"HIGH","confidence_reason":"Curated Microsoft threat research, Patch Tuesday summaries, and incident analysis. Replaced the MSRC Update Guide CVE firehose (~3k advisories/quarter) with this high-signal blog feed.","created_at":"2026-10-23T19:30:48.012934+00:00","id":36133,"published_date":"2026-10-23T18:12:19+00:00","severity":"medium","source_name":"Microsoft Security Blog","summary":"Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog.","title":"Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks","url":"https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-23T20:31:03.523992+00:00","id":36159,"published_date":"2026-10-23T18:07:27+00:00","severity":"critical","source_name":"Security Affairs","summary":"PHP warns of a new, unlikely code execution flaw, CVE-2026-115560, and advises disabling session upload progress until a fix is released. PHP has warned of a new code execution vulnerability, tracked as CVE-2026-115560, just two days after releasing emergency patches for the critical PHP2Shell flaws. The vulnerability affects only a specific PHP configuration that PHP [\u2026]","title":"PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches","url":"https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"First-party analysis of record-scale DDoS campaigns and internet-wide attack trends, plus post-incident write-ups. Mixed with heavy product launch content; filter_uncategorized is essential.","created_at":"2026-10-23T18:31:19.531069+00:00","id":36112,"published_date":"2026-10-23T18:06:56+00:00","severity":"medium","source_name":"Cloudflare","summary":"Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.","title":"Bringing post-quantum cryptography to geographically fenced key management","url":"https://blog.cloudflare.com/post-quantum-geo-key-manager"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.967887+00:00","id":36144,"published_date":"2026-10-23T18:00:12+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Mickey Truck Bodies has been family owned and operated since the company was started in High Point, NC in 1904. Today Mickey manufactures all-aluminum beverage bodies and beverage trailers, dry freight and refrigerated van bodies, emergency vehicles and specially engineered equipment for customers t\u2026","title":"\ud83c\udff4\u200d\u2620\ufe0f Chaos has just published a new victim : mickeybody.com","url":"https://www.ransomware.live/id/bWlja2V5Ym9keS5jb21AY2hhb3M"},{"category":"OT/ICS","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.968864+00:00","id":36145,"published_date":"2026-10-23T17:57:21+00:00","severity":"medium","source_name":"Ransomware.live","summary":"[consultancies, engineering] ARX Group SA \u2014 one of Switzerland's premier engineering consultancies, with 25+ offices in 17+ countries, known for iconic projects including the Ceneri Base Tunnel and dozens of USTRA/SBB federal infrastructure contracts. The exposed material includes: 9,510 project fee structures with internal/external billing rates for every engineer \u2014 the complete pricing intelligence for one of Switzerland's largest infrastructure consultancies. 8 GB of Ceneri Base Tunnel documentation \u2014 as-built engineering records for Swiss national critical infrastructure. 881,205 time entries spanning years of daily work activity for every employee, with task descriptions and project assignments.","title":"\ud83c\udff4\u200d\u2620\ufe0f Aurora has just published a new victim : ARX Group SA","url":"https://www.ransomware.live/id/QVJYIEdyb3VwIFNBQGF1cm9yYQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.969449+00:00","id":36146,"published_date":"2026-10-23T17:55:10+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Hi! We now have a clearnet domain for easy-access. WhiteArmor.cc","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : whitearmor.cc","url":"https://www.ransomware.live/id/d2hpdGVhcm1vci5jY0BXaGl0ZWFybW9y"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T20:30:44.336045+00:00","id":36137,"published_date":"2026-10-23T17:54:08+00:00","severity":"critical","source_name":"The Hacker News","summary":"Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any","title":"Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws","url":"https://thehackernews.com/2026/10/ruby-fixes-three-regex-engine-bugs.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T20:30:44.338524+00:00","id":36138,"published_date":"2026-10-23T17:50:47+00:00","severity":"medium","source_name":"The Hacker News","summary":"Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an \"Autonomous Red Team Kill Chain Framework\" referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data-extortion operator, as well as an","title":"Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions","url":"https://thehackernews.com/2026/10/exposed-infrastructure-reveals-how.html"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-23T18:31:13.898496+00:00","id":35898,"published_date":"2026-10-23T17:45:37+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Bulletin ID: 2026-148-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/23/2026 10:30 AM PDT Description: Amazon Web Services Multi Model Server (MMS) is an open source tool for serving machine learning models for inference. It was published by AWS on GitHub, PyPI, and Docker Hub, and reached end of life; its source repository has been archived and read-only since November 20, 2025. CVE-2026-115812: An issue in model archive extraction could allow a crafted model archive to write files outside the intended directory, potentially resulting in code execution with the privileges of the MMS process. CVE-2026-115813: An issue in the model download path could allow the MMS management interface to be directed to make requests to unintended network destinations. Impacted versions: <=1.1.11 (all released versions) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. Read this article","title":"CVE-2026-115812 and CVE-2026-115813: Issue in Amazon Web Services Multi Model Server","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-148-aws"},{"category":"Cloud Security","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-23T18:31:13.902504+00:00","id":35903,"published_date":"2026-10-23T17:45:18+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-23T18:31:13.905723+00:00","id":35906,"published_date":"2026-10-23T17:44:51+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-87911","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-104-aws"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-23T18:31:13.890755+00:00","id":35887,"published_date":"2026-10-23T17:44:25+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-85788 - Issue with awslabs mysql-mcp-server","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-103-aws"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-23T18:31:13.895189+00:00","id":35894,"published_date":"2026-10-23T17:43:59+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-102-aws"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party AWS security bulletins. Authoritative for the largest cloud provider; bursty (~3.0/day measured) so filter_uncategorized is required to keep non-security service notices out.","created_at":"2026-10-23T18:31:13.891691+00:00","id":35888,"published_date":"2026-10-23T17:43:25+00:00","severity":"medium","source_name":"AWS Security Bulletins","summary":"Read this article","title":"CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server to modify data beyond the read-only scope","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-101-aws"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-23T18:30:46.249613+00:00","id":35802,"published_date":"2026-10-23T17:28:00+00:00","severity":"medium","source_name":"The Record","summary":"The banned items \u2014 a wireless video transmitter and dashboard camera \u2014 are made with chips manufactured by Huawei subsidiary HiSilicon, which markets its products as \u201cdesigned for the surveillance market.\u201d","title":"FCC bans two devices with surveillance chips linked to Huawei","url":"https://therecord.media/fcc-bans-devices-huawei-surveillance-chips"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-23T18:30:45.796920+00:00","id":35801,"published_date":"2026-10-23T17:26:59+00:00","severity":"medium","source_name":"Dark Reading","summary":"One campaign targets 105 sites using open-weight models; in another, public models gained full domain control for $12. Cyber-defense will have to change.","title":"AI Tools Are Generating Massive Attacks for Little Cost","url":"https://www.darkreading.com/cybersecurity-operations/ai-tools-massive-attacks-little-cost"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.971087+00:00","id":36147,"published_date":"2026-10-23T17:19:41+00:00","severity":"medium","source_name":"Ransomware.live","summary":"ART SCHOOL: Dove la Creativit\u00e0 Prende Forma Benvenuti in Art School, il luogo dove il talento incon...","title":"\ud83c\udff4\u200d\u2620\ufe0f Lockbit5 has just published a new victim : dorsiacademy.it","url":"https://www.ransomware.live/id/ZG9yc2lhY2FkZW15Lml0QGxvY2tiaXQ1"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research. Caveat: already filtered for noise via filter_uncategorized.","created_at":"2026-10-23T18:30:54.055641+00:00","id":35808,"published_date":"2026-10-23T17:18:43+00:00","severity":"high","source_name":"SentinelOne","summary":"U.S. courts sentence tax fraudster, Chinese-linked actors use agentic AI in cloud supply chain attack, and PHP issues warning of two critical-level RCE flaws.","title":"The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)","url":"https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-43-8"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.971792+00:00","id":36148,"published_date":"2026-10-23T17:17:24+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Mount Lebanon Hospital University Medical Center (MLHUMC) is a healthcare institution that offers a...","title":"\ud83c\udff4\u200d\u2620\ufe0f Lockbit5 has just published a new victim : mlh.com.lb","url":"https://www.ransomware.live/id/bWxoLmNvbS5sYkBsb2NrYml0NQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.972448+00:00","id":36149,"published_date":"2026-10-23T17:16:47+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Lido boutique hotel, with 100 rooms, shops, restaurants and gym, creates a comfortable and intimate...","title":"\ud83c\udff4\u200d\u2620\ufe0f Lockbit5 has just published a new victim : lidoway.com","url":"https://www.ransomware.live/id/bGlkb3dheS5jb21AbG9ja2JpdDU"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.973066+00:00","id":36150,"published_date":"2026-10-23T17:16:08+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Founded in 2015, we have become the leading firm in comprehensive, technology-driven legal debt reco...","title":"\ud83c\udff4\u200d\u2620\ufe0f Lockbit5 has just published a new victim : zelsior.es","url":"https://www.ransomware.live/id/emVsc2lvci5lc0Bsb2NrYml0NQ"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Cloud security posture and vulnerability research. Vendor context; filter_uncategorized drops product marketing.","created_at":"2026-10-23T18:31:15.536818+00:00","id":35940,"published_date":"2026-10-23T17:14:32+00:00","severity":"critical","source_name":"Orca Security","summary":"The week the web\u2019s plumbing failed On Wednesday afternoon, most of the world\u2019s websites became exploitable at the same moment. The reason was PHP, the thirty-year-old language that still serves roughly seven out of ten sites you visit, including nearly every WordPress, Drupal, Magento and Joomla deployment on earth. Two bugs, CVE-2026-109618 and CVE-2026-109619, now [\u2026]","title":"PHP2Shell: What This Week Tells Us About the Web We Built","url":"https://orca.security/resources/blog/php2shell-what-this-week-tells-us-about-the-web-we-built"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-23T18:30:45.441350+00:00","id":35799,"published_date":"2026-10-23T17:05:07+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. [...]","title":"Microsoft: Windows Server 2016 reaches end of support in January","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2016-reaches-end-of-support-in-january"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.977847+00:00","id":36151,"published_date":"2026-10-23T16:52:22+00:00","severity":"medium","source_name":"Ransomware.live","summary":"JS Contractor Inc. is a Philippine recruitment and manpower agency that specializes in recruiting, screening, processing, and deploying Filipino workers for overseas employment. Established in 1977, the company connects qualified applicants with international employers across industries such as manufacturing, engineering, technical services, and skilled labor. Through its website, applicants can explore job opportunities, submit applications, and access information about overseas employment. We have all your critical files, encrypted with the strongest encryption, along with over 150,000 resumes and applicants' vaccination records. This includes 3.5 GB of your databases containing sensitive applicant information. PI and SPI data. A total of millions. Contact us, or we will publish your applicants' data and critical files. Other threat actors will use it for identity theft and other crimes. We will ensure your company's reputation will be in hell. Your business integrity will be compromised. Loss of stakeholders will follow. And the company's credibility will be damaged. This will be your downfall. session: 05690c095fbbc61a04e6bdb09d92c535f4866f571db2e2d54e31bbb245ac886d43 Homepage: emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion Client: emprdrcfhpvym7uwqvxky6ympquibzxfxuor6qeexk7lz3sxz5t2ubqd.onion/client [Sector: Other]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : JS Constructor, INC","url":"https://www.ransomware.live/id/SlMgQ29uc3RydWN0b3IsIElOQ0BlbXBlcmFkb3I"},{"category":"Phishing & Social Engineering","confidence":"MEDIUM","confidence_reason":"Mainstream technical journalism with unusually rigorous security reporting (Dan Goodin). Fills the general-audience gap between trade press and vendor research. filter_uncategorized drops non-security items.","created_at":"2026-10-23T18:31:17.925081+00:00","id":36096,"published_date":"2026-10-23T16:51:59+00:00","severity":"medium","source_name":"Ars Technica (Security)","summary":"Corporate phishing tests are common, but this one was especially cruel.","title":"Knicks sent employees fake offer of championship rings in phishing test: Report","url":"https://arstechnica.com/tech-policy/2026/10/knicks-sent-employees-fake-offer-of-championship-rings-in-phishing-test-report"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-23T18:30:45.442050+00:00","id":35800,"published_date":"2026-10-23T16:40:07+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]","title":"Quest Diagnostics confirms data breach exposed patient records","url":"https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.980745+00:00","id":36152,"published_date":"2026-10-23T16:39:37+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion. We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public. We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed. Samples: https://biteblob.com/Information/mNTP6w0lBW8P9l/#samples.zip Contact: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : Whirlpool","url":"https://www.ransomware.live/id/V2hpcmxwb29sQFdoaXRlYXJtb3I"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T20:30:44.981631+00:00","id":36153,"published_date":"2026-10-23T16:39:22+00:00","severity":"medium","source_name":"Ransomware.live","summary":"J.B. Hunt is a major North American transportation and logistics company providing intermodal, dedicated, and truckload services via its digital freight marketplace. We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations. Our demand: $5,000,000, in BTC or XMR. Instructions to follow by email. To verify, samples can be found below. Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me","title":"\ud83c\udff4\u200d\u2620\ufe0f Whitearmor has just published a new victim : JB Hunt","url":"https://www.ransomware.live/id/SkIgSHVudEBXaGl0ZWFybW9y"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:31:16.743893+00:00","id":35721,"published_date":"2026-10-23T16:26:27+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Labaid Cancer Hospital And Super Speciality Center","url":"https://www.ransomware.live/id/TGFiYWlkIENhbmNlciBIb3NwaXRhbCBBbmQgU3VwZXIgU3BlY2lhbGl0eSBDZW50ZXJAcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:31:16.744309+00:00","id":35722,"published_date":"2026-10-23T16:26:08+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Kale Balata A","url":"https://www.ransomware.live/id/S2FsZSBCYWxhdGEgQUBxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:31:16.744628+00:00","id":35723,"published_date":"2026-10-23T16:25:48+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : MaxiSeguridad","url":"https://www.ransomware.live/id/TWF4aVNlZ3VyaWRhZEBxaWxpbg"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Cybersecurity policy and industry journalism. Fills the Industry/Policy category gap.","created_at":"2026-10-23T16:31:15.438962+00:00","id":35720,"published_date":"2026-10-23T16:23:06+00:00","severity":"medium","source_name":"CyberScoop","summary":"Citizen Lab\u2019s AdFection findings have senators pushing for industry improvements, while IAB Europe and Google defend their vetting practices. The post Senators say targeted ads are a security risk. Ad groups say the critics are off base. appeared first on CyberScoop.","title":"Senators say targeted ads are a security risk. Ad groups say the critics are off base.","url":"https://cyberscoop.com/targeted-ads-spyware-government-threat"},{"category":"AI Security","confidence":"HIGH","confidence_reason":"University of Toronto \u2014 gold-standard surveillance/spyware research. NSO Group, Predator, Pegasus. filter_uncategorized drops political commentary, keeps classified threat research.","created_at":"2026-10-23T16:22:24.297568+00:00","id":35609,"published_date":"2026-10-23T16:17:06+00:00","severity":"medium","source_name":"The Citizen Lab","summary":"Senior research associate Kate Robertson spoke about the legal concerns that Canada\u2019s proposed Lawful Access Act poses with the Canadian Internet Society. The post Built-In Weakness: Lawful Access and Encryption in the Age of AI-Powered Cyber Threats appeared first on The Citizen Lab.","title":"Built-In Weakness: Lawful Access and Encryption in the Age of AI-Powered Cyber Threats","url":"https://citizenlab.ca/built-in-weakness-lawful-access-and-encryption-in-the-age-of-ai-powered-cyber-threats"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"First-party Cisco PSIRT advisories (IOS/ASA/FTD/NX-OS). Authoritative earliest source for a heavily-exploited enterprise network product line. Pure advisory feed \u2014 no filter_uncategorized, an uncategorized Cisco advisory is still signal.","created_at":"2026-10-23T22:28:40.262910+00:00","id":36373,"published_date":"2026-10-23T16:00:00+00:00","severity":"medium","source_name":"Cisco PSIRT","summary":"Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise and the Cisco Talos blog post Compromised eMudhra intermediate certificates. Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r Security Impact Rating: Informational","title":"Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Informational+for+Emergency+Distrust+of+eMudhra+Root+and+Intermediate+Certificate+Authorities%26vs_k%3D1"},{"category":"Identity & Access","confidence":"HIGH","confidence_reason":"Emergent threat response team. Primary exploit analysis on actively exploited vulns, peer-quality with ZDI.","created_at":"2026-10-23T16:22:14.986065+00:00","id":35588,"published_date":"2026-10-23T15:38:56+00:00","severity":"critical","source_name":"Rapid7","summary":"This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 through 1.11.4. Thanks to the work of rmhowe425, with research credit to Peter Girnus and n0k0. Beyond Langflow, open source contributor kmkz contributed a pre-auth RCE chain against OpenCTI. MongoDB coverage has also been expanded with 3 new auxiliary modules plus an Apache Solr version scanner thanks to the work of community member h00die. New Module Content (11) 4gaBoards Mass User Information Disclosure (CVE-2026-53959) Authors: Balachandar Gowrisankar, de3erve (GitHub), and lucquach (GitHub) Type: Auxiliary Pull request: #21831 contributed by anirbala98 Path: gather/4gaboards_users_info_disclosure_cve_2026_53959 CVE reference: CVE-2026-53959 Description: Adds a module that exploits CVE-2026-53959, a broken access control vulnerability allowing mass user information disclosure in 4gaBoards versions 3.3.8 and below. The application's /api/users REST endpoint lets any authenticated user retrieve a full, unpaginated list of every user in the system. Missing authorization checks allow an attacker to retrieve the email, phone, organization, name, and SSO email addresses (ssoGoogleEmail, ssoGithubEmail, and others) of every user. Langflow AI Authentication Bypass (CVE-2026-93680) Author: Richard Howe Type: Auxiliary Pull request: #21942 contributed by rmhowe425 Path: gather/langflow_auth_bypass_cve_2026_93680 CVE reference: CVE-2026-93680 Description: Adds a new auxiliary module that leverages CVE-2026-93680, an authentication bypass vulnerability impacting Langflow versions 1.5.0 through 1.11.4. Apache Solr Version Scanner Author: h00die Type: Auxiliary Pull request: #22006 contributed by h00die Path: scanner/http/apache_solr_version Description: Adds a new scanner that identifies Apache Solr and reports its version. MongoDB Auxiliary Module Suite Authors: h00die and prithvee07 Type: Auxiliary Pull request: #21785 contributed by h00die Description: Adds the mongodb_version, mongodb_schemadump, and mongodb_hashdump auxiliary modules, and updates the existing mongodb_login module. This PR adds the following modules: scanner/mongodb/mongodb_hashdump scanner/mongodb/mongodb_schemadump scanner/mongodb/mongodb_version OpenCTI Authentication Bypass and Notifier EJS Remote Code Execution Author: Jean-Marie Bourbon Type: Exploit Pull request: #21826 contributed by kmkz Path: linux/http/opencti_notifier_rce CVE references: CVE-2026-27960 and CVE-2026-39980 Description: Adds a new exploit module for OpenCTI that chains CVE-2026-27960 and CVE-2026-39980 to achieve unauthenticated remote command execution. Grafana SQL Expressions DuckDB Command Injection (CVE-2024-9264) Author: \u00d6zcan Ersan (@ozcanpng) Type: Exploit Pull request: #21901 contributed by ozcanpng Path: multi/http/grafana_sql_expressions_rce_cve_2024_9264 CVE reference: CVE-2024-9264 Description: Adds an authenticated exploit module for CVE-2024-9264, a DuckDB command injection in Grafana SQL Expressions. Langflow AI Code Validation Authenticated RCE (CVE-2026-7873) Authors: Richard Howe and n0k0 Type: Exploit Pull request: #21877 contributed by rmhowe425 Path: multi/http/langflow_auth_rce_cve_2026_7873 CVE reference: CVE-2026-7873 Description: Adds a new exploit module that detects and exploits CVE-2026-7873, an authenticated RCE vulnerability impacting Langflow versions 1.0.0 through 1.10.0. Langflow AI Authenticated Command Injection (CVE-2026-93674) Author: Richard Howe Type: Exploit Pull request: #21939 contributed by rmhowe425 Path: multi/http/langflow_auth_command_injection_cve_2026_93674 CVE reference: CVE-2026-93674 Description: Adds a new exploit module that detects and exploits CVE-2026-93674, an authenticated blind command injection vulnerability impacting Langflow versions 1.5.0 through 1.9.0. Langflow AI Validate Code Injection Unauth RCE (CVE-2026-0768) Authors: Peter Girnus and Richard Howe Type: Exploit Pull request: #21864 contributed by rmhowe425 Path: multi/http/langflow_unauth_rce_cve_2026_0768 CVE reference: CVE-2026-0768 Description: Adds a new exploit module that detects and exploits CVE-2026-0768, an unauthenticated remote code execution vulnerability impacting Langflow version 1.4.2. Langflow AI Custom Component Eval Injection Unauth RCE (CVE-2026-0769) Authors: Peter Girnus and Richard Howe Type: Exploit Pull request: #21867 contributed by rmhowe425 Path: multi/http/langflow_unauth_rce_cve_2026_0769 CVE reference: CVE-2026-0769 Description: Adds a new exploit module that detects and exploits CVE-2026-0769, an unauthenticated RCE vulnerability impacting Langflow version 1.3.2. Langflow AI Public Flow Build Unauth RCE (CVE-2026-10134) Author: Richard Howe Type: Exploit Pull request: #21875 contributed by rmhowe425 Path: multi/http/langflow_unauth_rce_cve_2026_10134 CVE reference: CVE-2026-10134 Description: Adds a new exploit module that detects and exploits CVE-2026-10134, an unauthenticated remote code execution vulnerability impacting Langflow versions 1.0.0 through 1.9.3. Enhancements and Features (3) #20944 from Nayeraneru - Adds specs to ensure the mkdir post API behaves consistently. #21915 from vjonline - Consolidates reverse handler bind address handling into a shared Msf::Handler::Reverse::Bind module. #22041 from adfoster-r7 - Adds multiple Meterpreter improvements. The Windows Meterpreter has a major reflective-loader/IAT-import reduction, as well as improved WinAPI/error handling, and MinGW/CMake build refinements. The Python Meterpreter has improvements to Windows stat support and FreeBSD process listing. The PHP Meterpreter resolves PHP UDP channel read bugs. All Meterpreters now align on\u2026","title":"Metasploit Wrap Up: Langflow, MongoDB, and More","url":"https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-langflow-mongodb-and-more"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-23T16:22:09.890749+00:00","id":35555,"published_date":"2026-10-23T15:38:05+00:00","severity":"high","source_name":"Bleeping Computer","summary":"The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...]","title":"PHP shares mitigation for new RCE vulnerability with no patch","url":"https://www.bleepingcomputer.com/news/security/php-shares-mitigation-for-new-and-unpatched-rce-vulnerability"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.762250+00:00","id":35635,"published_date":"2026-10-23T15:26:27+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Aryza","url":"https://www.ransomware.live/id/QXJ5emFAcWlsaW4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.762724+00:00","id":35636,"published_date":"2026-10-23T15:26:07+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Aerotop","url":"https://www.ransomware.live/id/QWVyb3RvcEBxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.763138+00:00","id":35637,"published_date":"2026-10-23T15:25:48+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : CDG Chartered Accounting","url":"https://www.ransomware.live/id/Q0RHIENoYXJ0ZXJlZCBBY2NvdW50aW5nQHFpbGlu"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.763505+00:00","id":35638,"published_date":"2026-10-23T15:25:28+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Revi Group","url":"https://www.ransomware.live/id/UmV2aSBHcm91cEBxaWxpbg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.765904+00:00","id":35639,"published_date":"2026-10-23T15:00:10+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Bankruptcy Software Specialists, LLC (BSS) is one of the nation's leading providers of debt man agement software. The major business focus is geared toward providing business application soft ware that handles the tracking of trust funds to Chapter 13 Bankruptcy Trustees. A Tennessee ba sed company, BSS provides a vast array of services for Bankruptcy Trustees. We will upload 19gb of corporate data soon. Employee and clients information (personal informat ion, financials and so on), contracts and agreements, lots of payment details and so on.","title":"\ud83c\udff4\u200d\u2620\ufe0f Akira has just published a new victim : Bankruptcy Software Specialists","url":"https://www.ransomware.live/id/QmFua3J1cHRjeSBTb2Z0d2FyZSBTcGVjaWFsaXN0c0Bha2lyYQ"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-23T16:22:33.999368+00:00","id":35645,"published_date":"2026-10-23T14:37:35+00:00","severity":"high","source_name":"Reddit r/netsec","summary":"submitted by /u/MrTuxracer [link] [comments]","title":"Imperia CMS SiteActive TEMPLATE Unauthenticated SSTI Remote Code Execution (CVE-2026-110355)","url":"https://www.reddit.com/r/netsec/comments/1xdfues/imperia_cms_siteactive_template_unauthenticated"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T14:33:46.764418+00:00","id":35193,"published_date":"2026-10-23T14:23:37+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Noteworthy stories that might have slipped under the radar: Russia\u2019s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe. The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek.","title":"In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware","url":"https://www.securityweek.com/in-other-news-tor-exit-relays-hijacked-banks-spot-rogue-ai-agents-self-rebuilding-macos-ransomware"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-23T14:33:46.183142+00:00","id":35189,"published_date":"2026-10-23T14:00:10+00:00","severity":"medium","source_name":"Bleeping Computer","summary":"AI agents can be manipulated through malicious emails, websites, and plugins into executing commands, stealing data, or deleting files using their legitimate permissions. Gen Digital explains how its Agent Trust Hub helps protect agents through skill verification, secure connectivity, and runtime controls that intercept dangerous act [...]","title":"You gave your AI agent access, but who is giving it orders?","url":"https://www.bleepingcomputer.com/news/security/you-gave-your-ai-agent-access-but-who-is-giving-it-orders"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-23T14:33:46.657825+00:00","id":35191,"published_date":"2026-10-23T14:00:00+00:00","severity":"medium","source_name":"Dark Reading","summary":"The region is demonstrating what happens when exploits accelerate but assurance does not.","title":"Why Caribbean Threats Cascade Into Global Cyber-Risk","url":"https://www.darkreading.com/cyber-risk/why-caribbean-threats-cascade-global-cyber-risk"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T16:22:09.168268+00:00","id":35554,"published_date":"2026-10-23T13:50:56+00:00","severity":"critical","source_name":"The Hacker News","summary":"Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. \"Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims,","title":"Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials","url":"https://thehackernews.com/2026/10/hackers-breach-enterprise-firewalls-and.html"},{"category":"Cloud Security","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-23T16:22:33.999948+00:00","id":35646,"published_date":"2026-10-23T13:44:52+00:00","severity":"high","source_name":"Reddit r/netsec","summary":"submitted by /u/sethsec [link] [comments]","title":"Introducing pathrunner: An AWS privilege escalation framework","url":"https://www.reddit.com/r/netsec/comments/1xdegk4/introducing_pathrunner_an_aws_privilege"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Handler diaries \u2014 expert practitioner analysis, not primary research but high-quality synthesis.","created_at":"2026-10-23T14:34:01.741467+00:00","id":35293,"published_date":"2026-10-23T13:43:20+00:00","severity":"medium","source_name":"SANS Internet Storm Center","summary":"This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go back to \"business as usual\".","title":"PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)","url":"https://isc.sans.edu/diary/rss/33450"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.768613+00:00","id":35640,"published_date":"2026-10-23T13:30:32+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Bravilor Bonamat is a family-owned manufacturer of professional coffee machines and hot water d ispensers. The company offers espresso, filter, fresh brew, instant coffee, and bulk brewing so lutions designed for offices, restaurants, hotels, retail locations, and other commercial envir onments. We will upload 100gb of corporate data soon. Employee personal information (passports, drivers licenses and so on), customer information, contracts and agreements, confidential information ( partners personal documents), lots of NDAs and so on.","title":"\ud83c\udff4\u200d\u2620\ufe0f Akira has just published a new victim : Bravilor Bonamat","url":"https://www.ransomware.live/id/QnJhdmlsb3IgQm9uYW1hdEBha2lyYQ"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.771800+00:00","id":35641,"published_date":"2026-10-23T13:30:30+00:00","severity":"medium","source_name":"Ransomware.live","summary":"The company provides solutions in the field of wood construction. Their primary motivation in e very project we undertake is to design and build structures that perfectly meet all the needs o f the people we work for. We will upload 19gb of corporate data soon. Employee personal information (passports and other personal docs), clients information, contracts and agreements, confidential information so on.","title":"\ud83c\udff4\u200d\u2620\ufe0f Akira has just published a new victim : SCHWAB-SYSTEM","url":"https://www.ransomware.live/id/U0NIV0FCLVNZU1RFTUBha2lyYQ"},{"category":"Phishing & Social Engineering","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-23T14:33:46.659400+00:00","id":35192,"published_date":"2026-10-23T13:30:00+00:00","severity":"medium","source_name":"Dark Reading","summary":"Rising AI, social engineering, and cloud risks are pushing carriers beyond risk transfer and deeper into cybersecurity itself.","title":"Cyber Insurance's New Reality: Underwriting Isn't Enough","url":"https://www.darkreading.com/cyber-risk/cyber-insurances-underwriting-isnt-enough"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.774820+00:00","id":35642,"published_date":"2026-10-23T13:27:35+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Today, Wah Chan stands as a prominent name in Malaysia\u2019s jewelry industry. Our extensive network boasts over 50 boutiques strategically located across key urban centers like Pahang, Selangor, Kuala Lumpur, Penang, Perak, Melaka, Negeri Sembilan, and Johor.","title":"\ud83c\udff4\u200d\u2620\ufe0f Orova has just published a new victim : Wah Chan Consolidated Sdn Bhd","url":"https://www.ransomware.live/id/V2FoIENoYW4gQ29uc29saWRhdGVkIFNkbiBCaGRAT3JvdmE"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.776180+00:00","id":35643,"published_date":"2026-10-23T13:27:20+00:00","severity":"medium","source_name":"Ransomware.live","summary":"\u7279\u96f7\u7dad\u79d1\u6280\u6210\u7acb\u65bc2017\u5e74\uff0c\u7279\u96f7\u7dad\u9019\u500b\u540d\u5b57\u4f86\u81ea\u82f1\u6587Trevi\uff0c\u800cTrevi\u662f\u53d6\u81ea\u7fa9\u5927\u5229\u7f85\u99ac\u8457\u540d\u666f\u9ede\u300c\u8a31\u9858\u6c60-Fontana di Trevi\u300d\uff0c\u6211\u5011\u7684\u9858\u671b\u5c31\u662f\u5b8c\u6210\u5ba2\u6236\u7684\u671f\u671b\uff0c\u751a\u81f3\u8d85\u4e4e\u5ba2\u6236\u7684\u671f\u5f85\u3002\u6211\u5011\u662f\u500b\u5275\u65b0\u670d\u52d9\u7684\u5718\u968a\uff0c\u975e\u5e38\u91cd\u8996\u6bcf\u500b\u7d30\u7bc0\uff0c\u53c8\u5177\u5099\u6574\u5408\u6027\u5927\u5c40\u601d\u8003\u529b\u3002\u63d0\u4f9b\u6d77\u5916\u5ba2\u6236\u5e73\u53f0\uff0c\u5e0c\u671b\u4ee5\u5148\u9032\u8edf\u9ad4\u6280\u8853\uff0c\u6574\u5408\u8cc7\u8a0a\u79d1\u6280\u8b93\u4f7f\u7528\u8005\u6709\u66f4\u597d\u7684\u9ad4\u9a57","title":"\ud83c\udff4\u200d\u2620\ufe0f Orova has just published a new victim : Trevi Technology","url":"https://www.ransomware.live/id/VHJldmkgVGVjaG5vbG9neUBPcm92YQ"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-23T14:33:46.834220+00:00","id":35195,"published_date":"2026-10-23T13:26:00+00:00","severity":"medium","source_name":"The Record","summary":"In an era of hybrid threats, the British government wants to update the Submarine Telegraph Act 1885, which carries a maximum fine of \u00a31,000 and five years\u2019 imprisonment in cases of deliberate damage.","title":"UK proposes 14-year prison terms for undersea cable sabotage","url":"https://therecord.media/uk-undersea-cables-sabotage-new-sentencing-guidelines"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T16:22:32.777592+00:00","id":35644,"published_date":"2026-10-23T13:24:06+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Status: upcoming | Deadline: 2026-10-25T12:00:00Z","title":"\ud83c\udff4\u200d\u2620\ufe0f Doommageddon has just published a new victim : R*********b R**-L**","url":"https://www.ransomware.live/id/UioqKioqKioqKmIgUioqLUwqKkBEb29tbWFnZWRkb24"},{"category":"OT/ICS","confidence":"LOW","confidence_reason":"User-submitted link aggregator, no editorial review. Signal varies wildly by submitter.","created_at":"2026-10-23T16:22:34.002420+00:00","id":35647,"published_date":"2026-10-23T13:08:19+00:00","severity":"medium","source_name":"Reddit r/netsec","summary":"submitted by /u/Much-Television-9449 [link] [comments]","title":"Incident Response and Threat Landscape Report: Critical Infrastructure Vulnerabilities and Extortion Tactics","url":"https://www.reddit.com/r/netsec/comments/1xddkk1/incident_response_and_threat_landscape_report"},{"category":"Phishing & Social Engineering","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research, consumer-threat focused.","created_at":"2026-10-23T14:33:50.306258+00:00","id":35234,"published_date":"2026-10-23T13:07:52+00:00","severity":"medium","source_name":"Malwarebytes Labs","summary":"Exposed email addresses could put CAPCOM ID users at risk of phishing. Passwords were also changed without permission on 196 accounts.","title":"Resident Evil maker Capcom warns of phishing after 11.7 million records exposed","url":"https://www.malwarebytes.com/blog/data-breaches/2026/10/resident-evil-maker-capcom-warns-of-phishing-after-11-7-million-records-exposed"},{"category":"Malware/Infostealer","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research. Good primary work but commercial context.","created_at":"2026-10-23T14:33:47.414098+00:00","id":35201,"published_date":"2026-10-23T13:00:09+00:00","severity":"critical","source_name":"Check Point Research","summary":"Key Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments. This expanded targeting reflects [\u2026] The post Infostealer riding the AI Train appeared first on Check Point Research.","title":"Infostealer riding the AI Train","url":"https://research.checkpoint.com/2026/infostealer-riding-the-ai-train"},{"category":"Uncategorized","confidence":"MEDIUM","confidence_reason":"Established security journalism (Recorded Future-owned), strong on nation-state reporting.","created_at":"2026-10-23T14:33:46.836442+00:00","id":35196,"published_date":"2026-10-23T12:52:00+00:00","severity":"medium","source_name":"The Record","summary":"Nationwide lab test company Quest Diagnostics said one of its key systems may have experienced a breach of patient data.","title":"Quest Diagnostics warns of potential data theft after attack on lab service system","url":"https://therecord.media/quest-diagnostics-network-intrusion"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established technical security journalism. Fast, technically literate, breaks news on ransomware and malware.","created_at":"2026-10-23T14:33:46.185441+00:00","id":35190,"published_date":"2026-10-23T12:48:00+00:00","severity":"high","source_name":"Bleeping Computer","summary":"Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...]","title":"HPE patches eight max severity RCE and auth bypass AOS flaws","url":"https://www.bleepingcomputer.com/news/security/hpe-patches-eight-max-severity-rce-and-auth-bypass-aos-flaws"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T14:33:46.766901+00:00","id":35194,"published_date":"2026-10-23T12:45:52+00:00","severity":"critical","source_name":"SecurityWeek","summary":"Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet. The post Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge appeared first on SecurityWeek.","title":"Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge","url":"https://www.securityweek.com/mirai-botnet-operators-join-php2shell-attacks-as-aslr-bypass-exploits-emerge"},{"category":"Ransomware","confidence":"MEDIUM","confidence_reason":"Veteran independent security commentator; fast on breach and ransomware news. Single-author caveat applies, hence Tier 2. filter_uncategorized drops podcast/sponsor posts.","created_at":"2026-10-23T14:34:07.168159+00:00","id":35521,"published_date":"2026-10-23T12:29:16+00:00","severity":"medium","source_name":"Graham Cluley","summary":"The AfD has confirmed that hackers breached its hosting provider. A leak site now claims to offer 421,179 of the party\u2019s internal emails, and shows AI-written summaries rather than the emails themselves. Read more in my article on the Hot for Security blog.","title":"Hacker leaks 281 GB of data from Germany\u2019s far-right AfD party","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/hacker-leaks-281-gb-data-germany-afd"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Nordic incident-response firm publishing from live engagements \u2014 the highest signal-to-noise of this batch on inspection (Citrix NetScaler overflow, Iranian critical-infrastructure attacks, Shai-Hulud follow-up, all on-topic). Field IR reporting rather than lab research, which complements the vendor TI already in the roster.","created_at":"2026-10-23T12:34:27.982834+00:00","id":35061,"published_date":"2026-10-23T12:19:58+00:00","severity":"critical","source_name":"Truesec","summary":"It sounds like a disaster. So far, it isn\u2019t. Of the thousands of alleged exploits on GitHub, most are either broken or assume the server /../ The post PHP2Shell: The Internet Hasn\u2019t Burned Down, but the Danger Isn\u2019t Over appeared first on Truesec.","title":"PHP2Shell: The Internet Hasn\u2019t Burned Down, but the Danger Isn\u2019t Over","url":"https://www.truesec.com/hub/blog/php2shell-the-internet-hasnt-burned-down-but-the-danger-isnt-over"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T12:34:18.394936+00:00","id":35021,"published_date":"2026-10-23T11:48:24+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Don Pickett & Associates is a family-owned and operated corporation located in Fresno, California. Founded in August of 1988, we have grown into a unique company that offers in-house architectural design, drafting, and civil engineering services.Geo: USA - Leak size: 1.2 tb - Contains: files.dump pst","title":"\ud83c\udff4\u200d\u2620\ufe0f Sarcoma has just published a new victim : Don Pickett & Associates","url":"https://www.ransomware.live/id/RG9uIFBpY2tldHQgJiBBc3NvY2lhdGVzQHNhcmNvbWE"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-23T12:34:20.556113+00:00","id":35022,"published_date":"2026-10-23T11:45:12+00:00","severity":"medium","source_name":"Help Net Security","summary":"An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tracked the campaign between July 14 and September 22, 2026, counting 497 successful sign-ins and more than 200,000 failed login attempts. The stolen sessions were replayed from servers at 1337 Services GmbH, a hosting provider incorporated \u2026 More \u2192 The post Microsoft 365 accounts compromised at 79 organizations, no passwords needed appeared first on Help Net Security.","title":"Microsoft 365 accounts compromised at 79 organizations, no passwords needed","url":"https://www.helpnetsecurity.com/2026/10/23/microsoft-365-accounts-stolen-sessions"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-23T12:34:26.709513+00:00","id":35049,"published_date":"2026-10-23T11:45:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Japanese video games giant Capcom confirmed unauthorized access to its online account system","title":"Gaming Giant Capcom Confirms Data Breach Exposed Users\u2019 Personal Information","url":"https://www.infosecurity-magazine.com/news/capcom-confirms-data-breach"},{"category":"AI Security","confidence":"MEDIUM","confidence_reason":"Established security journalism, enterprise-focused analysis. filter_uncategorized drops vendor press releases and thought-leadership fluff.","created_at":"2026-10-23T12:33:57.556188+00:00","id":34906,"published_date":"2026-10-23T11:38:28+00:00","severity":"medium","source_name":"Dark Reading","summary":"Microsoft's Project Perception adds Guardian Agents to monitor and contain anomalous AI agents, but experts warn that policing unpredictable agents with other agents may multiply \u2014 not contain \u2014 the risk.","title":"AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack","url":"https://www.darkreading.com/cybersecurity-operations/ai-agents-insider-threats-inside-microsoft-unified-security-stack"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T11:34:30.097325+00:00","id":34869,"published_date":"2026-10-23T11:25:43+00:00","severity":"critical","source_name":"The Hacker News","summary":"PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called","title":"URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches","url":"https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T11:34:31.029288+00:00","id":34870,"published_date":"2026-10-23T11:11:23+00:00","severity":"medium","source_name":"The Hacker News","summary":"The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of","title":"Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack","url":"https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.721447+00:00","id":34875,"published_date":"2026-10-23T10:58:40+00:00","severity":"medium","source_name":"Ransomware.live","summary":"VinSolutions is an automotive CRM platform that helps car dealerships manage leads, track sales, and improve customer relationships.","title":"\ud83c\udff4\u200d\u2620\ufe0f Scarlettgroup has just published a new victim : vinsolutions.com","url":"https://www.ransomware.live/id/dmluc29sdXRpb25zLmNvbUBTY2FybGV0dGdyb3Vw"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-23T11:34:47.810983+00:00","id":34890,"published_date":"2026-10-23T10:52:00+00:00","severity":"critical","source_name":"Security Affairs","summary":"PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2), affecting every PHP version that handles web requests. The bug code dates back to PHP 5.4 from 2012, lives [\u2026]","title":"PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet","url":"https://securityaffairs.com/201538/hacking/php2shell-millions-of-attacks-no-confirmed-successful-exploits-yet.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.725185+00:00","id":34876,"published_date":"2026-10-23T10:51:25+00:00","severity":"medium","source_name":"Ransomware.live","summary":"ADL Lift Services Limited is a Scotland-based commercial lift specialist, incorporated in 2010 and now headquartered in Bellshill at Strathclyde Business Park, that under the leadership of Brian Harkin employs around 40 people with assets and shareholders\u2019 funds in the low-millions-of-pounds range, focuses on Glasgow and other major Scottish cities while offering UK-wide 24-hour emergency call-out, and provides full-lifecycle passenger, goods, service, accessibility and bespoke lift design and installation, maintenance, repairs and modernisation for commercial properties, local authorities, health boards and housing associations, holding credentials such as LEIA membership, ISO 9001/45001 and Safecontractor, primarily through adlliftservices.com (with adlliftservices.co.uk redirecting there).","title":"\ud83c\udff4\u200d\u2620\ufe0f Auditteam has just published a new victim : ADL Lift Services Limited","url":"https://www.ransomware.live/id/QURMIExpZnQgU2VydmljZXMgTGltaXRlZEBBdWRpdFRlYW0"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.728009+00:00","id":34877,"published_date":"2026-10-23T10:51:09+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Zena Office S.r.l. is a regional small-to-mid-sized IT and office technology provider based in Piacenza, Italy, formally registered around 2000 and claiming roots that stretch back to 1930s office-furniture tradition, that with roughly 9\u201310 employees and about \u20ac2.2 million in annual revenue serves local businesses and public-procurement clients with an end-to-end mix of computer, peripheral and software retail, cybersecurity, ERP, cloud backup, enterprise networking, smart working and videoconferencing, multifunction printer and operational leasing, office furniture and custom software, partnering with vendors such as Microsoft, HP, Lenovo, VMware and Veeam, primarily through zenaoffice.it while also holding the largely unused zenaware.it domain.","title":"\ud83c\udff4\u200d\u2620\ufe0f Auditteam has just published a new victim : Zena Office","url":"https://www.ransomware.live/id/WmVuYSBPZmZpY2VAQXVkaXRUZWFt"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.728389+00:00","id":34878,"published_date":"2026-10-23T10:50:53+00:00","severity":"medium","source_name":"Ransomware.live","summary":"","title":"\ud83c\udff4\u200d\u2620\ufe0f Auditteam has just published a new victim : Ca***ka","url":"https://www.ransomware.live/id/Q2EqKiprYUBBdWRpdFRlYW0"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T11:34:31.225790+00:00","id":34887,"published_date":"2026-10-23T10:31:16+00:00","severity":"critical","source_name":"SecurityWeek","summary":"The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments. The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.","title":"China APT Uses AI Pentest Tool Artex in ConnectWise Attacks","url":"https://www.securityweek.com/china-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-23T11:34:47.962842+00:00","id":34891,"published_date":"2026-10-23T10:30:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering","title":"Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise","url":"https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target"},{"category":"SaaS Breach","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.730352+00:00","id":34879,"published_date":"2026-10-23T10:20:13+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Line2Line Coatings 796,433 files - 641.0 GB~20 years of email: 34 mailboxes (PST/OST), 107,279 messages, 13,068 contacts - including the president's own mailbox (4.0 GB).The entire QuickBooks history: 1,232 backups (.QBB) + 174 live company files (.QBW) for both entities, 15+ years of revenue.Full banking footprint: Chase statements, Clarkston State Bank, account and routing numbers, credit card numbers with CVV.Personal data: 3,614 Social Security Numbers; 64,907 files containing PII - W-2s of all employees, contractor 1099/W-9s, passport and driver license scans, HR files.77,118 PDFs, 66,691 Excel spreadsheets, 38,688 Word documents.Military material: SBIR/ONR/TARDEC files, CUI, patent correspondence.Customer base: Eaton (15,320 emails), GM, Chrysler, Linamar, Whipple (~50% of revenue), Honda R&D, TVS, Mercury Marine, Stihl. More","title":"\ud83c\udff4\u200d\u2620\ufe0f Rhysida has just published a new victim : Line2Line Coatings","url":"https://www.ransomware.live/id/TGluZTJMaW5lIENvYXRpbmdzQHJoeXNpZGE"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.732243+00:00","id":34880,"published_date":"2026-10-23T10:17:34+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Offers a wide range of top-quality products that meet the needs of customers in the foodservice, retail, and industrial sectors, including export markets","title":"\ud83c\udff4\u200d\u2620\ufe0f Pear has just published a new victim : Fresh Farms","url":"https://www.ransomware.live/id/RnJlc2ggRmFybXNAcGVhcg"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.734015+00:00","id":34881,"published_date":"2026-10-23T10:10:20+00:00","severity":"medium","source_name":"Ransomware.live","summary":"[AI generated] EMARKETER is a market research and business intelligence company based in the United States, specializing in digital marketing, media, and commerce data. It provides forecasts, analysis, reports, and trends on topics like advertising, e-commerce, social media, and emerging technology. The company serves marketers, advertisers, and businesses seeking insights into consumer behavior and industry trends.","title":"\ud83c\udff4\u200d\u2620\ufe0f Fulcrumsec has just published a new victim : EMARKETER","url":"https://www.ransomware.live/id/RU1BUktFVEVSQGZ1bGNydW1zZWM"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established security trade journalism with strong breach and regulatory coverage. Highest-volume addition in this batch (~3.8/day measured) \u2014 filter_uncategorized is required, not optional.","created_at":"2026-10-23T11:34:47.963290+00:00","id":34892,"published_date":"2026-10-23T10:00:00+00:00","severity":"medium","source_name":"Infosecurity Magazine","summary":"Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause","title":"Attacks on Tech Firms Behind Most Third-Party Data Breach Victims","url":"https://www.infosecurity-magazine.com/news/tech-third-party-breach-victims"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T11:34:31.760534+00:00","id":34888,"published_date":"2026-10-23T09:58:34+00:00","severity":"critical","source_name":"SecurityWeek","summary":"The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges. The post Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months appeared first on SecurityWeek.","title":"Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months","url":"https://www.securityweek.com/attackers-exploit-third-velocloud-orchestrator-zero-day-in-four-months"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Vendor threat intelligence research, consumer-threat focused.","created_at":"2026-10-23T11:34:35.461913+00:00","id":34889,"published_date":"2026-10-23T09:57:48+00:00","severity":"medium","source_name":"Malwarebytes Labs","summary":"A Crime Stoppers chapter has stopped accepting tips after a breach exposed information about anonymous tipsters.","title":"Crime Stoppers chapter freezes tips after breach breaks anonymity promise","url":"https://www.malwarebytes.com/blog/data-breaches/2026/10/crime-stoppers-chapter-freezes-tips-after-breach-breaks-anonymity-promise"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T11:34:31.031019+00:00","id":34871,"published_date":"2026-10-23T09:36:00+00:00","severity":"medium","source_name":"The Hacker News","summary":"Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name to Ghostscript, a separate program it runs to turn the image into pixels, without checking the name first.","title":"Critical Flaw in Python\u2019s Popular Pillow Image Library Allows Code Execution via a Crafted Image","url":"https://thehackernews.com/2026/10/critical-flaw-in-pythons-popular-pillow.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.736085+00:00","id":34882,"published_date":"2026-10-23T09:23:08+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Environmental NGO \u00b7 Ethiopia | The complete SAP Business One production database of the organization: 15,275 journal transactions with 89,929 journal lines, 1,007 business partner records of regional partner organizations with contacts, 333 general ledger accounts, procurement and inventory records; A verified full backup of the production ERP database and a fresh copy of the landscape database; The complete financial and operational record of a donor funded environmental organization | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : Horn of Africa Regional Environment Centre and Network","url":"https://www.ransomware.live/id/SG9ybiBvZiBBZnJpY2EgUmVnaW9uYWwgRW52aXJvbm1lbnQgQ2VudHJlIGFuZCBOZXR3b3JrQE4wbg"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-23T09:34:47.089979+00:00","id":34829,"published_date":"2026-10-23T09:07:31+00:00","severity":"medium","source_name":"Help Net Security","summary":"Players who signed up for Capcom\u2019s online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the account people use to sign in to the company\u2019s web services and to play some of its games online. It detected suspicious activity on October 19 and confirmed the intrusion the same day. \u2026 More \u2192 The post Capcom data breach exposes 11.7 million account records appeared first on Help Net Security.","title":"Capcom data breach exposes 11.7 million account records","url":"https://www.helpnetsecurity.com/2026/10/23/capcom-id-data-breach-11-million-records-exposed"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T11:34:31.034573+00:00","id":34872,"published_date":"2026-10-23T08:40:43+00:00","severity":"critical","source_name":"The Hacker News","summary":"Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their \"Node2Shell\" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw","title":"Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data","url":"https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html"},{"category":"AI Security","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T11:34:31.039577+00:00","id":34873,"published_date":"2026-10-23T08:35:45+00:00","severity":"medium","source_name":"The Hacker News","summary":"AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set","title":"Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents\u2019 Token Balances","url":"https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T09:34:32.206292+00:00","id":34824,"published_date":"2026-10-23T08:34:14+00:00","severity":"medium","source_name":"SecurityWeek","summary":"The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts. The post 11 Million Impacted by Capcom Data Breach appeared first on SecurityWeek.","title":"11 Million Impacted by Capcom Data Breach","url":"https://www.securityweek.com/11-million-impacted-by-capcom-data-breach"},{"category":"SaaS Breach","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T09:34:32.207367+00:00","id":34825,"published_date":"2026-10-23T08:25:06+00:00","severity":"medium","source_name":"SecurityWeek","summary":"In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders. The post Quest Diagnostics Reports Cyber Breach Affecting \u2018Certain Patient Records\u2019 appeared first on SecurityWeek.","title":"Quest Diagnostics Reports Cyber Breach Affecting \u2018Certain Patient Records\u2019","url":"https://www.securityweek.com/quest-diagnostics-reports-cyber-breach-affecting-certain-patient-records"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-23T09:34:47.093121+00:00","id":34830,"published_date":"2026-10-23T08:21:48+00:00","severity":"medium","source_name":"Help Net Security","summary":"An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model\u2019s owner pays for the computing power. Symantec captured the agent\u2019s instruction set this summer through a honeypot posing as an unprotected AI service, researchers Priti More and Susmit Yenkar wrote. Its operators sent their entire working prompt to the decoy, expecting a live model on the other end \u2026 More \u2192 The post Hackers hijack exposed AI models to launch cyberattacks at victims\u2019 expense appeared first on Help Net Security.","title":"Hackers hijack exposed AI models to launch cyberattacks at victims\u2019 expense","url":"https://www.helpnetsecurity.com/2026/10/23/llmjacking-agent-hijacks-exposed-ai-models"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T09:34:32.208412+00:00","id":34826,"published_date":"2026-10-23T08:10:46+00:00","severity":"medium","source_name":"SecurityWeek","summary":"Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek.","title":"LiteLLM Compromised in Fresh Supply Chain Attack","url":"https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.737310+00:00","id":34883,"published_date":"2026-10-23T07:58:37+00:00","severity":"medium","source_name":"Ransomware.live","summary":"Prism Medical Products is a U.S. home medical supplies provider specializing in wound care, along with ostomy, urological, compression, and other prescribed supplies. It works with clinicians and insurers to coordinate coverage and deliver supplies directly to patients\u2019 homes","title":"\ud83c\udff4\u200d\u2620\ufe0f Wallstreet has just published a new victim : Prism Medical Products","url":"https://www.ransomware.live/id/UHJpc20gTWVkaWNhbCBQcm9kdWN0c0BXYWxsc3RyZWV0"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.739334+00:00","id":34884,"published_date":"2026-10-23T07:55:08+00:00","severity":"medium","source_name":"Ransomware.live","summary":"textile manufacturing \u00b7 Tunisia | Client master records of the group's accounting and commercial dossiers: 84 records with client names, addresses, Tunisian tax registration numbers, phones and emails; Supplier master records: 32 records with the same level of detail; Article and inventory data of both confection workshops and the Bizerte branch; Business documents of 2026: quotes, invoices and delivery notes for named clients; Print and production templates of the group | The victim can verify everything in their private negotiation room. | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : PROTEX Confection","url":"https://www.ransomware.live/id/UFJPVEVYIENvbmZlY3Rpb25ATjBu"},{"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T09:34:32.210203+00:00","id":34827,"published_date":"2026-10-23T07:54:47+00:00","severity":"critical","source_name":"SecurityWeek","summary":"Atlassian\u2019s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components. The post Atlassian Patches 75 Flaws in Data Center and Server Products appeared first on SecurityWeek.","title":"Atlassian Patches 75 Flaws in Data Center and Server Products","url":"https://www.securityweek.com/atlassian-patches-75-third-party-flaws-in-data-center-and-server-products"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.740669+00:00","id":34885,"published_date":"2026-10-23T07:54:36+00:00","severity":"medium","source_name":"Ransomware.live","summary":"solar energy company \u00b7 Switzerland | Financial and bank records of a Swiss solar energy company, including annual accounts and audit files; Payroll and staff data with employee names and social insurance records; Customer and project files for solar installations at four sites; The accounting database with its backups | [NOT PAID \u2014 EXPOSED]","title":"\ud83c\udff4\u200d\u2620\ufe0f N0n has just published a new victim : SunTechnics Fabrisolar AG","url":"https://www.ransomware.live/id/U3VuVGVjaG5pY3MgRmFicmlzb2xhciBBR0BOMG4"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T11:34:31.743295+00:00","id":34886,"published_date":"2026-10-23T07:52:10+00:00","severity":"medium","source_name":"Ransomware.live","summary":"B2Chat is a multimillion dollar business communication platform based in Spain that provides tools for customer support, sales, and engagement. It allows businesses to interact with customers through various channels, such as live chat, chatbots, and messaging apps (for example, WhatsApp, Facebook Messenger, and Telegram). The platform is designed to help companies streamline communication, improve response times, and enhance customer satisfaction. This leak includes sensitive financial information, employees' names, emails, and phone numbers, as well as clients' and partners' data. If you do not pay the ransom, we will contact and attack your employees, clients, and partners to destroy your business. [Sector: Technology]","title":"\ud83c\udff4\u200d\u2620\ufe0f Emperador has just published a new victim : B2Chat","url":"https://www.ransomware.live/id/QjJDaGF0QGVtcGVyYWRvcg"},{"category":"Vulnerability/CVE","confidence":"LOW","confidence_reason":"High-volume aggregator. Re-tiered 2 -> 3 on 2026-08-29: it is SEO-heavy and rewrite-reliant, reframing other outlets rather than reporting primary, which is a Tier 3 description \u2014 the entry carried that caveat while conferring a Tier 2 MEDIUM badge on ~11.5 articles/day, the single largest confidence inflation in this file by volume. Factually reliable but derivative; readers should follow it to the original source, and LOW says that.","created_at":"2026-10-23T11:34:31.042486+00:00","id":34874,"published_date":"2026-10-23T07:40:45+00:00","severity":"critical","source_name":"The Hacker News","summary":"Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote","title":"PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware","url":"https://thehackernews.com/2026/10/php2shell-exploit-attempts-hit-millions.html"},{"category":"Ransomware","confidence":"LOW","confidence_reason":"Open-source ransomware leak-site monitor (~150 groups). Scrapes victim claims, not verified journalism \u2014 treat as unverified OSINT. High volume (100 entries/batch); filter_uncategorized drops noise. Canonical www. URL preferred (bare domain 301s; _safe_get handles redirects but saves a hop).","created_at":"2026-10-23T07:34:31.474591+00:00","id":34806,"published_date":"2026-10-23T07:20:02+00:00","severity":"medium","source_name":"Ransomware.live","summary":"N/A","title":"\ud83c\udff4\u200d\u2620\ufe0f Qilin has just published a new victim : Coop Italia","url":"https://www.ransomware.live/id/Q29vcCBJdGFsaWFAcWlsaW4"},{"category":"Nation State/APT","confidence":"MEDIUM","confidence_reason":"Established security journalism with consistent editorial quality.","created_at":"2026-10-23T07:34:31.566235+00:00","id":34821,"published_date":"2026-10-23T06:39:29+00:00","severity":"medium","source_name":"SecurityWeek","summary":"After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. The post Iran\u2019s Prince of Persia APT Hosts C&C in US for First Time Since 2016 appeared first on SecurityWeek.","title":"Iran\u2019s Prince of Persia APT Hosts C&C in US for First Time Since 2016","url":"https://www.securityweek.com/irans-prince-of-persia-apt-hosts-cc-in-us-for-first-time-since-2016"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Established independent security journalism (Pierluigi Paganini). High cadence, broad incident coverage, consistently the fastest of the wire sources tested. filter_uncategorized drops newsletter/roundup filler.","created_at":"2026-10-23T07:34:52.327921+00:00","id":34823,"published_date":"2026-10-23T06:08:00+00:00","severity":"medium","source_name":"Security Affairs","summary":"INTERPOL\u2019s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. The operation brought together law enforcement [\u2026]","title":"INTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime Crackdown","url":"https://securityaffairs.com/201500/cyber-crime/interpol-operation-serengeti-iii-nets-1462-arrests-and-recovers-105-million-in-cybercrime-crackdown.html"},{"category":"Cloud Security","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-23T07:34:49.405873+00:00","id":34822,"published_date":"2026-10-23T06:00:31+00:00","severity":"medium","source_name":"Help Net Security","summary":"Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna. Google positions them as options for demanding work, lower-cost professional tasks and everyday use that requires fast responses. More choice, one bill Businesses will purchase access through Google Cloud Marketplace. Usage will appear on a single Google Cloud invoice and count toward existing cloud spending commitments. It \u2026 More \u2192 The post Google opens its cloud to rival OpenAI, promises business data won\u2019t train models appeared first on Help Net Security.","title":"Google opens its cloud to rival OpenAI, promises business data won\u2019t train models","url":"https://www.helpnetsecurity.com/2026/10/23/google-cloud-openai-models-private-preview"},{"category":"Vulnerability/CVE","confidence":"HIGH","confidence_reason":"Top-tier threat intelligence research. Caveat: mixed with commercial marketing \u2014 filter_uncategorized drops partnership promos and thought-leadership fluff.","created_at":"2026-10-24T00:30:41.956510+00:00","id":36998,"published_date":"2026-10-23T05:00:00+00:00","severity":"critical","source_name":"CrowdStrike Blog","summary":"","title":"Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation","url":"https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation"},{"category":"Industry/Policy","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","created_at":"2026-10-23T05:34:48.085560+00:00","id":34804,"published_date":"2026-10-23T04:30:39+00:00","severity":"medium","source_name":"Help Net Security","summary":"Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda\u2019s Cybersecurity Skills Gap Report. 56% have experienced professional workforce reductions linked to AI, evenly divided between entry-level and higher-level roles. The post AI is taking cybersecurity jobs at junior and experienced levels alike appeared first on Help Net Security.","title":"AI is taking cybersecurity jobs at junior and experienced levels alike","url":"https://www.helpnetsecurity.com/2026/10/23/barracuda-cybersecurity-career-development-report"}]