Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature
Interpol's annual Operation Serengeti, now in its third iteration, led to 1,462 arrests across 20 African countries and the US, recovering $105 million in stolen funds.
Latest
Bank of America kindly asks that you don’t share your banking password with your AI assistant
The banking giant reminds customers that "you're responsible for activity" resulting from your AI agents' access.
3 Frameworks to Protect CISOs & Orgs Against AI Liability
Cyber leaders can get ahead of AI liability with rigorous documentation, transparency, and smart contract negotiations with AI vendors.
Ransomware
External Teams Chats Anchor 15-Minute Malware Delivery
Mail bombing is getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.
Vulnerabilities
Adobe security advisory (AV26-697) – Update 1
Serial number: AV26–697Date: July 14, 2026Updated: October 27, 2026 On July 14, 2026, Adobe published security advisories to address critical vulnerabilities in the following products: Adobe After Effects - version…
Vulnerabilities
Google security advisory (AV26-1085) - Update 1
Serial number: AV26-1085Date: October 26, 2026Updated: October 27, 2026 As of October 22, 2026, Google is affected by a vulnerability in the following product: Brotli Versions 1.0.3 to versions prior to v1.0.10 Versions…
Vulnerabilities
Tech Life
We hear from Ondřej Surý, the programmer whose PHP patches helped avert a cyber crisis.
Vulnerabilities
Code-execution flaw in UEFI firmware affects most servers on planet Earth
Critical flaw in EDK2 allows attackers to execute code early in the boot process.
Supply Chain
SBOMs Alone Can't Reveal the Scope of a Supply Chain Attack
A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.
ICS / OT
AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours
One critical, three high-severity EPICS bugs could disrupt research experiments
Beware the Slasher: AI Could Kill Off Cybersecurity Pros' Skills
Nathan Hamiel outlines potential SecOps horror in the AI midst, as core technical capabilities go the way of reading an atlas or remembering phone numbers.
Vulnerabilities
AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2
Number: AL26-026Date: October 21, 2026Updated: October 27, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that…
Malware
'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants
The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.
Vulnerabilities
[Control systems] Hitachi security advisory (AV26-1091)
Serial Number: AV26-1091Date: October 27, 2026 As of October 27, 2026, Hitachi is affected by vulnerabilities in the following products: HiRDB Server Version 10 Multiple versions HiRDB Server Version 9 Multiple versions…
Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack
University hospitals once again accepting patients after initial ambulance diversion, but recovery to continue in phases
Vulnerabilities
CISA confirms PHP2Shell under attack as researchers clock successful exploits
Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells
Vulnerabilities
PHP2Shell: US updates Kev catalogue as exploits spread
After live exploitation of PHP2Shell was verified at the weekend, the US Cisa cyber agency has updated its vulnerability catalogue, urging organisations to prioritise their fixes
Vulnerabilities
OpenAI’s Altman: Only way out of patch apocalypse is through
OpenAI CEO Sam Altman took to the keynote stage at Oracle AI World, calling for the security community to keep focus in the face of AI-enabled vulnerability discovery
Microsoft releases out-of-band Windows fixes with certificate updates
Did you hear the one about eMudhra and the power of 4? Time to get connected to certificate trust list updates
Vulnerabilities
Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary…
Zero-day
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous…
Vulnerabilities
EPICS Base
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code…
From industry concern to practical action: the value of working with regulators
How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity
Vulnerabilities
Vulnerability in KGS Software tia Viewer software
Stored Cross-Site Scripting vulnerability (CVE-2026-105987) has been found in KGS Software tia Viewer software.
Data Breaches
Attack on email hosting provider for German far right party AfD exposed 345k accounts
Alternative für Deutschland swats away scandals as reporters swarm leaked email tranche
Vulnerabilities
Vulnerabilities in twofactor_gauthenticator plugin for Roundcube
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-107145 to CVE-2026-107147) found in twofactor_gauthenticator plugin for Roundcube.
From federal SOCs to Talos: Ryan Fetterman on practical security research
What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.
Autumn Budget 2026: Healey sets out AI funding
The chancellor wants to boost UK tech sovereignty and has unveiled plans to support chip development, AI defence and biosecurity
Vulnerabilities
AI World: AI vulnerability surge brings change for Oracle’s cyber practice
With CVE volumes spiking amid AI-assisted vulnerability discovery, Oracle is responding with cyber initiatives and practices for its customers
Cloud & Identity
Japanese virtual desktop cloud hacked so hard it asks to be banned
CEO admits service used for foreign exchange trading had holes company was slow to fix
