[ News | Newsletters | Blogs | Lists | Media | Jobs ] HoneyDB
DarkReading
In-the-Wild Attack Abuses AI Agents' Trust in Markdown
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
10 Software Security Practices Built for the Next 250 Years
Trust Is Not What It Seems — and Fraudsters Are Counting on It
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
AI Tools Are Generating Massive Attacks for Little Cost
Why Caribbean Threats Cascade Into Global Cyber-Risk
Cyber Insurance's New Reality: Underwriting Isn't Enough
AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack
State Bank of India Suffers a Customer PII Data Leak
Ars Technica
Disgraced eMudhra drops out of TLS business after using cert private key of 4
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Enterprises keep buying software upgrades that IT thinks will make things worse
PHP warns it plans to release 2 emergency patches imminently
The Internet goes on high alert after discovery of 8 compromised TLS certs
Meta Muse exposes users' personal and business secrets when they share conversations
PSA: Patch your Plex media server before someone hacks it
ReactOS reaches major milestone with NTFS install support
OpenAI models hacked a crypto wallet and breached more websites
Targeted ads delivered 0-click exploits to install mercenary malware
CyberScoop
Senators, rights groups say Trump administration breaking law by withholding surveillance court opinion
Authorities extradite Chinese national for alleged $37M investment scam
CISA publishes strategy with eye on the next four years
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
eMudhra kills its certificate business after researchers cracked its private keys in under a second
Encryption isn’t enough to protect data wherever it goes 
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
PHP releases emergency fixes for 2 critical vulnerabilities
Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers
InfoSecurity Magazine
CISA 2030 Sets Out ‘Aggressive, Anticipatory’ Cyber Defense Strategy for Critical Infrastructure
Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens
Linux Flaws Exposed Before Fixes as Root Exploit Goes Public
Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw
Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database
PHP Publishes Mitigation Advice for New RCE Flaw
Gaming Giant Capcom Confirms Data Breach Exposed Users’ Personal Information
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
EU Regulators to Investigate Booking.com Over Scam Risks
SecurityWeek
Anthropic Files for Potentially the Biggest IPO Ever as CEO Warns of Risk to Humanity From AI
Industrial Vendors Check Products for PHP2Shell Vulnerabilities
Genesys Hack Exposes Customer Data From Internal Systems
Stolen AI Reasoning Could Help China Build Cheaper Rivals
PHP2Shell Exploitation Moves From Probes to Working Shells 
953 Online Stores Infected in Long-Lasting Malware Campaign
Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Mythos 5 Ignored Real-World Harm in July Attack
Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
ZDNet
Apple’s iOS 27.2 update offers major Siri AI upgrades, dual camera support for FaceTime
Github competitor Entire is live now – how the agent-first platform works
Apple’s new OLED iPad Mini is the upgrade I’ve been waiting for – here’s why
iPhone Duo screens are already cracking: What buyers need to know
Android lets you ‘bubble’ apps for easy access now – how it works
PHP2Shell: Haven’t patched yet? Take these steps now to mitigate
Amazon’s Kindle Unlimited is now Kindle+, and the 2 big changes include AI audiobooks
The latest PowerToys gives your mouse 2 new tricks for free – how to use them
GridCraft is the open-source Excel clone for Linux I’ve been waiting for
Not impressed with Google Maps? Make Waze your default on Pixel – here’s how
The Hacker News
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
BleepingComputer
Former pentester used ARTEX AI to steal 8.2 million data records
OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing
DreamHost forces password resets in ongoing "incident"
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
Microsoft releases emergency .NET patches for critical Brotli flaw
When an AI Agent Is the Incident, the Identity Record Is the Evidence
Chinese man extradited for role in $36 million cryptocurrency scam
Kali Linux 2026.3 released with 6 new tools, desktop updates
PHP2Shell security flaws now sucessfully exploited in the wild
AI coding agents hijacked using AGENTS.md file in Downloads folder
gbhackers
Anthropic’s Claude AI Bypasses Paywall to Access US Election Data Without Permission
New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentials
Hackers Turn Mac Password Stealer Into RAT That Survives Reboots and Executes Remote Commands
KeePassXC 2.8.0 Released to Fix Multiple Security Vulnerabilities Affecting Password Manager
Apache Camel Vulnerabilities Allow Remote Code Execution, Authentication Bypass, and Data Theft
Kali Linux 2026.3 Released With 6 New Penetration Testing Tools and Major Updates
OpenBSD 8.0 Released With Enhanced Firewall Security and Critical Vulnerability Fixes
12 Ransomware Recovery Solutions: The 2026 Buyer’s Verdict Guide
Hackers Can Use DarkCore RAT to Hijack Gmail and WhatsApp Sessions Without Passwords
11 Backup & Recovery Solutions: The 2026 Buyer’s Verdict Guide
Cybersecurity Dive
CISA promises proactive defense in new strategic plan
Security anchors a modern hybrid sovereign architecture
PHP exploitation moves at slower-than-expected pace, but millions remain at risk
Large businesses’ cybersecurity insurance claims are now less frequent but more expensive
China-nexus actor linked to attack on ConnectWise Cloud Backup
Agentic AI helps hackers level up, even without detailed instructions
Weak encryption certificates could have let hackers easily spoof websites
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
Critical PHP vulnerabilities expose most websites to potential compromise
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Threatpost
Student Loan Breach Exposes 2.5M Records
Watering Hole Attacks Push ScanBox Keylogger
Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
Ransomware Attacks are on the Rise
Cybercriminals Are Selling Access to Chinese Surveillance Cameras
Twitter Whistleblower Complaint: The TL;DR Version
Firewall Bug Under Active Attack Triggers CISA Warning
Fake Reservation Links Prey on Weary Travelers
iPhone Users Urged to Update to Patch 2 Zero-Days
Google Patches Chrome’s Fifth Zero-Day of the Year
The Register
Alibaba's Qwen AI caught trying to contact server in China
LiteLLM supply chain attack started with an exposed master key
Microsoft releases emergency .NET security fixes for Google Brotli bug
UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest
Trumpets blare and skies part as AI hypefest culminates in Anthropic IPO filing
We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue
UK Biobank back online soon, months after someone tried to sell 500k people's data on Alibaba
Britain bets big on AI to defend against the threats AI is helping create
PHP2Shell: No login, no app code, no warning. What next?
Work to protect DNS from quantum decryption attacks is speeding up
VentureBeat
AI agents are about to put least privilege to the test
DeepSeek-V4.1-Flash-1017 arrives with improved benchmarks just as the U.S. government bans it from agencies — what enterprises should do
AI cloud security needs to prove control before agents reach production
Anyone can build apps with AI. But who owns them?
17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them
Browser security’s buying spree rests on one engine, without a clear Plan B
Anthropic’s Cyber Mission starts with 6,157 findings reported to maintainers and 516 patched
TechCrunch
Will AI expose the rickety infrastructure of the internet?
PHP-ocalypse: How two critical web bugs almost broke the internet
Lab testing giant Quest Diagnostics confirms patients’ personal and health data was compromised during breach
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
The internet is having a very bad cybersecurity day
PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
Blackwall quadruples valuation to $2.2B as websites wrangle an increasingly crowded internet
Governments are hacking people with ‘zero-click’ spyware by showing them online ads
Flock CEO defends surveillance technology amid national backlash: ‘We shouldn’t pause progress’
Network World Security
Is it time to retire VPNs?
Google will pay people to use less electricity so its data centers can use more
Hyperscalers allow more scrutiny of controversial data center plans
Midmarket AI gap: Small IT teams are being asked to do enterprise-sized jobs
Nvidia GTC Berlin: Faster AI factories, lower power use, more secure agents
Gartner forecasts 15% global IT spending growth, recaps top tech predictions
Extreme wants to use idle network compute capacity for local AI
IT/OT convergence exposes skills gap. Cisco responds with new OT security certification
Microsoft exits UK AI data center project over electricity delays
AI networks drive SONiC boom
Help Net Security
Kali Linux 2026.3 ships kernel 7.1.5, brings wardriving to the TicWatch Pro 3
Security pros reckon the biggest AI risk comes with an employee badge
AI coding agents fall for malicious instructions planted in the Downloads folder
Fortinet patches critical FortiOS flaws found with AI help
Anthropic details what stops Claude Duet from going rogue
Witness: Open-source framework for verifying how your software was built
AI slop is piling up highest on the biggest open-source projects
Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture
Forgotten AI agents may still access sensitive company data
Synthetic identities leave US lenders with $2.4 billion in fraud exposure
SC Magazine
PHP2Shell exploitation confirmed, but mass attacks remain elusive
The lagging indicator problem: why we measure security burnout after it has already cost us
De-identification is an access control wearing a data-transformation label
Centralised inspection: why the hub exists and what it costs
Security groups, network ACLs and policy: what each one can actually express
Validating an assumption that spans a vendor you do not operate
AI ‘solved’ the wrong half of the vulnerability management lifecycle
New AI tool identifies property locations from interior photos
Okta advances AI agent governance and identity security
Oracle experts discuss strategies for securing agentic AI against emerging threats
© 2026 RiskDiscovery | Sponsored by: Deception Logic