[ News | Newsletters | Blogs | Lists | Media | Jobs ] HoneyDB
DarkReading
AI Tools Are Generating Massive Attacks for Little Cost
Why Caribbean Threats Cascade Into Global Cyber-Risk
Cyber Insurance's New Reality: Underwriting Isn't Enough
AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack
State Bank of India Suffers a Customer PII Data Leak
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
What We Missed: Feds Lasso Texas Laptop Farms
Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour
As AI Risks Grow, Insurers Split on Covering the Damage
UAE Transitions 50% of Government Services to Agentic AI
Ars Technica
Disgraced eMudhra drops out of TLS business after using cert private key of 4
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Enterprises keep buying software upgrades that IT thinks will make things worse
PHP warns it plans to release 2 emergency patches imminently
The Internet goes on high alert after discovery of 8 compromised TLS certs
Meta Muse exposes users' personal and business secrets when they share conversations
PSA: Patch your Plex media server before someone hacks it
ReactOS reaches major milestone with NTFS install support
OpenAI models hacked a crypto wallet and breached more websites
Targeted ads delivered 0-click exploits to install mercenary malware
CyberScoop
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
eMudhra kills its certificate business after researchers cracked its private keys in under a second
Encryption isn’t enough to protect data wherever it goes 
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
PHP releases emergency fixes for 2 critical vulnerabilities
Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers
Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
ConnectWise customers hit by supply-chain attack linked to compromised API secret
InfoSecurity Magazine
Gaming Giant Capcom Confirms Data Breach Exposed Users’ Personal Information
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
EU Regulators to Investigate Booking.com Over Scam Risks
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Cloud Security Maturity Lags Despite Widespread Adoption, SANS Warns
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
SecurityWeek
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Attackers Exploit Third Arista VCO Zero-Day in Four Months
11 Million Impacted by Capcom Data Breach
Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
LiteLLM Compromised in Fresh Supply Chain Attack
Atlassian Patches 75 Flaws in Data Center and Server Products
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Hacker Conversations: Corey Thuen and the Evil Bit
ZDNet
Android lets you ‘bubble’ apps for easy access now – how it works
PHP2Shell: Haven’t patched yet? Take these steps now to mitigate
Amazon’s Kindle Unlimited is now Kindle+, and the 2 big changes include AI audiobooks
The latest PowerToys gives your mouse 2 new tricks for free – how to use them
GridCraft is the open-source Excel clone for Linux I’ve been waiting for
Not impressed with Google Maps? Make Waze your default on Pixel – here’s how
Hold onto your old HomePod – an upgrade is on the way
OpenAI’s most powerful AI models turned off safety monitoring – then lied about it
Chrome warns you about suspicious websites now – how to turn on Google’s new scam protection
Amazon unveiled 5 new Blink cameras, including a 4K model that caught my eye
The Hacker News
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
BleepingComputer
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft: Windows Server 2016 reaches end of support in January
Quest Diagnostics confirms data breach exposed patient records
PHP shares mitigation for new RCE vulnerability with no patch
You gave your AI agent access, but who is giving it orders?
HPE patches eight max severity RCE and auth bypass AOS flaws
Railway warns devs to rotate secrets after potential breach
Capcom confirms data breach affecting 11.7 million accounts
LiteLLM release pipeline hacked to distribute info-stealer malware
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
gbhackers
WhatsApp and Telegram May Stop Working Without Registered SIM Cards From January 1, 2027
StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown
Critical Okta Access Gateway Vulnerability Enables Remote Command Execution
Critical HPE Aruba AOS-8 Flaw Allows Hackers to Bypass SSH Authentication and Take Over Systems
Capcom Confirms Data Breach Exposing 11.7 Million CAPCOM ID Records
Quest Diagnostics Confirms Cyberattack Exposing Patient Records in Quanum System
Unauthorized AI Agents Found Accessing Customer Accounts at Major U.S. Banks
SBI Notifies Customers Affected by Recent Cybersecurity Incident
PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks
Suspected Chinese APT41 Hackers Use BlackX Bootkit to Bypass Windows Secure Boot
Cybersecurity Dive
PHP exploitation moves at slower-than-expected pace, but millions remain at risk
Large businesses’ cybersecurity insurance claims are now less frequent but more expensive
China-nexus actor linked to attack on ConnectWise Cloud Backup
Agentic AI helps hackers level up, even without detailed instructions
Weak encryption certificates could have let hackers easily spoof websites
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
Critical PHP vulnerabilities expose most websites to potential compromise
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Ransomware groups expand targeting of Palo Alto Networks vulnerability
AI security hiring focuses on red-teaming, SOC orchestration and governance
Threatpost
Student Loan Breach Exposes 2.5M Records
Watering Hole Attacks Push ScanBox Keylogger
Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
Ransomware Attacks are on the Rise
Cybercriminals Are Selling Access to Chinese Surveillance Cameras
Twitter Whistleblower Complaint: The TL;DR Version
Firewall Bug Under Active Attack Triggers CISA Warning
Fake Reservation Links Prey on Weary Travelers
iPhone Users Urged to Update to Patch 2 Zero-Days
Google Patches Chrome’s Fifth Zero-Day of the Year
The Register
Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
UK threatens subsea cable saboteurs with 14 years behind bars
PHP2Shell exploit bypasses protections designed to stop remote code execution
Max-severity GitLab bug allows remote code execution over 12 years of releases
Disgraced Indian cert issuer leaves the cert issuing business
PHP2Shell puts dozens of UK government services out of service
When the attacker becomes the user: Rethinking account takeover
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
VentureBeat
AI agents are about to put least privilege to the test
DeepSeek-V4.1-Flash-1017 arrives with improved benchmarks just as the U.S. government bans it from agencies — what enterprises should do
AI cloud security needs to prove control before agents reach production
Anyone can build apps with AI. But who owns them?
17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them
Browser security’s buying spree rests on one engine, without a clear Plan B
Anthropic’s Cyber Mission starts with 6,157 findings reported to maintainers and 516 patched
TechCrunch
Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
The internet is having a very bad cybersecurity day
PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
Blackwall quadruples valuation to $2.2B as websites wrangle an increasingly crowded internet
Governments are hacking people with ‘zero-click’ spyware by showing them online ads
Flock CEO defends surveillance technology amid national backlash: ‘We shouldn’t pause progress’
Flock CEO says its microphones detect ‘just gunshots’ — its website says different
Flock CEO: We haven’t ‘fired’ any police departments as customers
Network World Security
Google will pay people to use less electricity so its data centers can use more
Hyperscalers allow more scrutiny of controversial data center plans
Midmarket AI gap: Small IT teams are being asked to do enterprise-sized jobs
Nvidia GTC Berlin: Faster AI factories, lower power use, more secure agents
Gartner forecasts 15% global IT spending growth, recaps top tech predictions
Extreme wants to use idle network compute capacity for local AI
IT/OT convergence exposes skills gap. Cisco responds with new OT security certification
Microsoft exits UK AI data center project over electricity delays
AI networks drive SONiC boom
Microsoft expands sovereign cloud offerings as data control concerns grow
Help Net Security
UK proposes 14-year jail terms for subsea cable saboteurs
Microsoft 365 accounts compromised at 79 organizations, no passwords needed
Capcom data breach exposes 11.7 million account records
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
Google opens its cloud to rival OpenAI, promises business data won’t train models
Drone program compliance: What a CTO says most agencies get wrong
AI is taking cybersecurity jobs at junior and experienced levels alike
New infosec products of the week: October 23, 2026
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
OpenAI’s coding agents talked themselves out of being monitored
SC Magazine
The contractor offboarding hap: When HR triggers don't apply
AI pentesting tool Artex used in recent ConnectWise compromise
After memory poisoning, an AI agent needs more than a restart
Recovery objectives are set per system and consumed in dependency order
AI framework vulnerabilities and model supply chain risk
Encrypted traffic analysis produces inferences and is bought on payload-era precision
Authenticity, provenance, and enterprise trust explained
How to evaluate AI-powered fraud detection and identity verification vendors
Why we don’t need an AI ‘kill switch’
Security researchers identify rapid data exfiltration patterns in enterprise environments
© 2026 RiskDiscovery | Sponsored by: Deception Logic