[ News | Newsletters | Blogs | Lists | Media | Jobs ] HoneyDB
DarkReading
So Many AI Security Benchmarks, But None Tell the Whole Story
Risks & Rewards: How AI Is Redefining the CISO's Role
In-the-Wild Attack Abuses AI Agents' Trust in Markdown
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
10 Software Security Practices Built for the Next 250 Years
Trust Is Not What It Seems — and Fraudsters Are Counting on It
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
AI Tools Are Generating Massive Attacks for Little Cost
Why Caribbean Threats Cascade Into Global Cyber-Risk
Cyber Insurance's New Reality: Underwriting Isn't Enough
Ars Technica
Disgraced eMudhra drops out of TLS business after using cert private key of 4
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Enterprises keep buying software upgrades that IT thinks will make things worse
PHP warns it plans to release 2 emergency patches imminently
The Internet goes on high alert after discovery of 8 compromised TLS certs
Meta Muse exposes users' personal and business secrets when they share conversations
PSA: Patch your Plex media server before someone hacks it
ReactOS reaches major milestone with NTFS install support
OpenAI models hacked a crypto wallet and breached more websites
Targeted ads delivered 0-click exploits to install mercenary malware
CyberScoop
Experts temper emergency-level alarms over critical Brotli defect
Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion
Authorities extradite Chinese national for alleged $37M investment scam
CISA publishes strategy with eye on the next four years
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
eMudhra kills its certificate business after researchers cracked its private keys in under a second
Encryption isn’t enough to protect data wherever it goes 
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
PHP releases emergency fixes for 2 critical vulnerabilities
InfoSecurity Magazine
CISA 2030 Sets Out ‘Aggressive, Anticipatory’ Cyber Defense Strategy for Critical Infrastructure
Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens
Linux Flaws Exposed Before Fixes as Root Exploit Goes Public
Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw
Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database
PHP Publishes Mitigation Advice for New RCE Flaw
Gaming Giant Capcom Confirms Data Breach Exposed Users’ Personal Information
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
EU Regulators to Investigate Booking.com Over Scam Risks
SecurityWeek
Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI
Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Genesys Hack Exposes Customer Data From Internal Systems
Stolen AI Reasoning Could Help China Build Cheaper Rivals
PHP2Shell Exploitation Moves From Probes to Working Shells 
953 Online Stores Infected in Long-Lasting Malware Campaign
Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
ZDNet
Apple’s iOS 27.2 update offers major Siri AI upgrades, dual camera support for FaceTime
Github competitor Entire is live now – how the agent-first platform works
Apple’s new OLED iPad Mini is the upgrade I’ve been waiting for – here’s why
iPhone Duo screens are already cracking: What buyers need to know
Android lets you ‘bubble’ apps for easy access now – how it works
PHP2Shell: Haven’t patched yet? Take these steps now to mitigate
Amazon’s Kindle Unlimited is now Kindle+, and the 2 big changes include AI audiobooks
The latest PowerToys gives your mouse 2 new tricks for free – how to use them
GridCraft is the open-source Excel clone for Linux I’ve been waiting for
Not impressed with Google Maps? Make Waze your default on Pixel – here’s how
The Hacker News
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
BleepingComputer
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
University of Copenhagen data breach exposes data of 525,000 people
Former pentester used ARTEX AI to steal 8.2 million data records
OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
DreamHost forces password resets in ongoing "incident"
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
Microsoft releases emergency .NET patches for critical Brotli flaw
When an AI Agent Is the Incident, the Identity Record Is the Evidence
Chinese man extradited for role in $36 million cryptocurrency scam
Kali Linux 2026.3 released with 6 new tools, desktop updates
gbhackers
9 Managed File Transfer (MFT) Solutions: The 2026 Buyer’s Verdict Guide
12 Secure File Sharing Solutions: The 2026 Buyer’s Verdict Guide
12 Digital Rights Management (DRM/IRM) Solutions: The 2026 Buyer’s Verdict Guide
12 File Integrity Monitoring (FIM) Tools: The 2026 Buyer’s Verdict Guide
University of Copenhagen Confirms Data Breach Affecting 525,000 People
Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections
OpenAI Releases GPT-6.1 Terra With Advanced Computer Use and AI Agent Capabilities
Hacker Uses Generative AI to Breach 90 Companies and Steal 8.2 Million Records
Microsoft 365 Token Replay Attacks Let Hackers Access Business Emails Without Passwords
Hackers Use Instagram Ads to Deploy Coruna and DarkSword Spyware on iPhones
Cybersecurity Dive
CISA promises proactive defense in new strategic plan
Security anchors a modern hybrid sovereign architecture
PHP exploitation moves at slower-than-expected pace, but millions remain at risk
Large businesses’ cybersecurity insurance claims are now less frequent but more expensive
China-nexus actor linked to attack on ConnectWise Cloud Backup
Agentic AI helps hackers level up, even without detailed instructions
Weak encryption certificates could have let hackers easily spoof websites
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
Critical PHP vulnerabilities expose most websites to potential compromise
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Threatpost
Student Loan Breach Exposes 2.5M Records
Watering Hole Attacks Push ScanBox Keylogger
Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
Ransomware Attacks are on the Rise
Cybercriminals Are Selling Access to Chinese Surveillance Cameras
Twitter Whistleblower Complaint: The TL;DR Version
Firewall Bug Under Active Attack Triggers CISA Warning
Fake Reservation Links Prey on Weary Travelers
iPhone Users Urged to Update to Patch 2 Zero-Days
Google Patches Chrome’s Fifth Zero-Day of the Year
The Register
Japanese virtual desktop cloud hacked so hard it asks to be banned
Worm armed 42 GitHub repos by hiding a payload too big to fail
Alibaba's Qwen AI caught trying to contact server in China
LiteLLM supply chain attack started with an exposed master key
Microsoft releases emergency .NET security fixes for Google Brotli bug
UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest
Trumpets blare and skies part as AI hypefest culminates in Anthropic IPO filing
We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue
UK Biobank back online soon, months after someone tried to sell 500k people's data on Alibaba
Britain bets big on AI to defend against the threats AI is helping create
VentureBeat
AI agents are about to put least privilege to the test
DeepSeek-V4.1-Flash-1017 arrives with improved benchmarks just as the U.S. government bans it from agencies — what enterprises should do
AI cloud security needs to prove control before agents reach production
Anyone can build apps with AI. But who owns them?
17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them
Browser security’s buying spree rests on one engine, without a clear Plan B
Anthropic’s Cyber Mission starts with 6,157 findings reported to maintainers and 516 patched
TechCrunch
Will AI expose the rickety infrastructure of the internet?
PHP-ocalypse: How two critical web bugs almost broke the internet
Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
The internet is having a very bad cybersecurity day
PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
Blackwall quadruples valuation to $2.2B as websites wrangle an increasingly crowded internet
Governments are hacking people with ‘zero-click’ spyware by showing them online ads
Flock CEO defends surveillance technology amid national backlash: ‘We shouldn’t pause progress’
Network World Security
Key security concepts NetOps must understand to proactively support SecOps
Is it time to retire VPNs?
Google will pay people to use less electricity so its data centers can use more
Hyperscalers allow more scrutiny of controversial data center plans
Midmarket AI gap: Small IT teams are being asked to do enterprise-sized jobs
Nvidia GTC Berlin: Faster AI factories, lower power use, more secure agents
Gartner forecasts 15% global IT spending growth, recaps top tech predictions
Extreme wants to use idle network compute capacity for local AI
IT/OT convergence exposes skills gap. Cisco responds with new OT security certification
Microsoft exits UK AI data center project over electricity delays
Help Net Security
Several AI security market categories are headed for bigger platforms
Microsoft Authenticator vulnerability let rogue Android apps steal work account access
LLM agent security needs more than guardrails
Amutable Foundations is a Linux system with no SSH and no package manager
71% of vulnerability exploitation starts within a week of disclosure
Cybersecurity jobs available right now: October 27, 2026
GPT-6.1 Terra meets OpenAI’s Critical cyber threshold, and it’s cheaper than GPT-5.6 Terra
Kali Linux 2026.3 ships kernel 7.1.5, brings wardriving to the TicWatch Pro 3
Security pros reckon the biggest AI risk comes with an employee badge
AI coding agents fall for malicious instructions planted in the Downloads folder
SC Magazine
Securing Modern Financial Systems in the Age of AI - Rashid Feroze - ASW #406
DreamHost resets user passwords following service disruption
Dutch police arrest two men over AI-powered bank fraud scheme
Sweden bans ChatGPT and Claude for government use
UK Biobank prepares to reopen research platform following major data breach
PHP2Shell exploitation confirmed, but mass attacks remain elusive
The lagging indicator problem: why we measure security burnout after it has already cost us
De-identification is an access control wearing a data-transformation label
Centralised inspection: why the hub exists and what it costs
Security groups, network ACLs and policy: what each one can actually express
© 2026 RiskDiscovery | Sponsored by: Deception Logic