[ News | Newsletters | Blogs | Lists | Media | Jobs ] HoneyDB
DarkReading
What We Missed: Feds Lasso Texas Laptop Farms
Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour
UAE Transitions 50% of Gov't Services to Agentic AI
TiDB Breach Exposes Flawed Cloud Security Assumptions
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
'PHP2Shell' Bugs Signal Red Alert for Security Industry
OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
Optiv Launches CyberBOT Cybersecurity Awareness Training Program
Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
Ars Technica
Disgraced eMudhra drops out of TLS business after using cert private key of 4
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Enterprises keep buying software upgrades that IT thinks will make things worse
PHP warns it plans to release 2 emergency patches imminently
The Internet goes on high alert after discovery of 8 compromised TLS certs
Meta Muse exposes users' personal and business secrets when they share conversations
PSA: Patch your Plex media server before someone hacks it
ReactOS reaches major milestone with NTFS install support
OpenAI models hacked a crypto wallet and breached more websites
Targeted ads delivered 0-click exploits to install mercenary malware
CyberScoop
Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
eMudhra kills its certificate business after researchers cracked its private keys in under a second
Encryption isn’t enough to protect data wherever it goes 
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
PHP releases emergency fixes for 2 critical vulnerabilities
Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers
Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
ConnectWise customers hit by supply-chain attack linked to compromised API secret
DOJ escalates fight for election supremacy with California raids
InfoSecurity Magazine
EU Regulators to Investigate Booking.com Over Scam Risks
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Cloud Security Maturity Lags Despite Widespread Adoption, SANS Warns
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
SecurityWeek
Hacker Conversations: Corey Thuen and the Evil Bit
Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Splunk, SolarWinds Release Fresh Security Updates
Cisco Patches 34 Vulnerabilities Across Multiple Products
PHP2Shell Exploitation Started Days Before Patches
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
ZDNet
Amazon’s Kindle Unlimited is now Kindle+, and the 2 big changes include AI audiobooks
The latest PowerToys gives your mouse 2 new tricks for free – how to use them
GridCraft is the open-source Excel clone for Linux I’ve been waiting for
Not impressed with Google Maps? Make Waze your default on Pixel – here’s how
Hold onto your old HomePod – an upgrade is on the way
OpenAI’s most powerful AI models turned off safety monitoring – then lied about it
Chrome warns you about suspicious websites now – how to turn on Google’s new scam protection
Amazon unveiled 5 new Blink cameras, including a 4K model that caught my eye
ServiceNow and Nvidia launch Arc, a new AI agent for enterprise
Gemini on Android Auto can access my photos, emails, and calendar now – why I’m OK with that (mostly)
The Hacker News
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
BleepingComputer
Railway warns devs to rotate secrets after potential breach
Capcom confirms data breach affecting 11.7 million accounts
LiteLLM release pipeline hacked to distribute info-stealer malware
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Microsoft shares how to fix broken Exchange Online EWS apps
Machine speed attacks require machine speed detection and response
Amazon says PHP2Shell exploitation began 4 days before patches
GitLab warns of new max severity code execution vulnerability
Authorities disrupt nearly 11,000 cybercrime networks in Africa
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
gbhackers
Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year
Cybercriminals Used Claude and Grok to Launch Automated Attacks Against Banks
K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign
Critical Cisco Expressway Flaw Lets Attackers Execute Commands as Root
New ScarlettGroup Extortion Gang Threatens to Leak Company Data Using Dark Web Countdown Timers
Scammers Exploit Dell and Staples Order Emails to Bypass Traditional Phishing Detection
Fortinet Releases Critical Security Updates for FortiOS, FortiManager, and FortiAnalyzer
Samsung and Vizio Smart TVs Continue Sending Viewing Data Even After Users Opt Out
Hackers Used AI-Generated Scripts to Break Into Government Linux Servers and Hunt for Secrets
Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions
Cybersecurity Dive
China-nexus actor linked to attack on ConnectWise Cloud Backup
Agentic AI helps hackers level up, even without detailed instructions
Weak encryption certificates could have let hackers easily spoof websites
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
Critical PHP vulnerabilities expose most websites to potential compromise
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Ransomware groups expand targeting of Palo Alto Networks vulnerability
AI security hiring focuses on red-teaming, SOC orchestration and governance
Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness
ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users
Threatpost
Student Loan Breach Exposes 2.5M Records
Watering Hole Attacks Push ScanBox Keylogger
Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
Ransomware Attacks are on the Rise
Cybercriminals Are Selling Access to Chinese Surveillance Cameras
Twitter Whistleblower Complaint: The TL;DR Version
Firewall Bug Under Active Attack Triggers CISA Warning
Fake Reservation Links Prey on Weary Travelers
iPhone Users Urged to Update to Patch 2 Zero-Days
Google Patches Chrome’s Fifth Zero-Day of the Year
The Register
PHP2Shell exploit bypasses protections designed to stop remote code execution
Max-severity GitLab bug allows remote code execution over 12 years of releases
Disgraced Indian cert issuer leaves the cert issuing business
PHP2Shell puts dozens of UK government services out of service
When the attacker becomes the user: Rethinking account takeover
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall
Certification authority eMudhra defends its laughably weak private keys
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
VentureBeat
AI agents are about to put least privilege to the test
DeepSeek-V4.1-Flash-1017 arrives with improved benchmarks just as the U.S. government bans it from agencies — what enterprises should do
AI cloud security needs to prove control before agents reach production
Anyone can build apps with AI. But who owns them?
17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them
Browser security’s buying spree rests on one engine, without a clear Plan B
Anthropic’s Cyber Mission starts with 6,157 findings reported to maintainers and 516 patched
TechCrunch
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
The internet is having a very bad cybersecurity day
PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
Blackwall quadruples valuation to $2.2B as websites wrangle an increasingly crowded internet
Governments are hacking people with ‘zero-click’ spyware by showing them online ads
Flock CEO defends surveillance technology amid national backlash: ‘We shouldn’t pause progress’
Flock CEO says its microphones detect ‘just gunshots’ — its website says different
Flock CEO: We haven’t ‘fired’ any police departments as customers
Apate sends AI agents undercover to get scammed so they can gather fraud intelligence
Network World Security
Nvidia’s Berlin GTC: Faster AI factories, lower power use and more secure agents
Gartner forecasts 15% global IT spending growth, recaps top tech predictions
Extreme wants to use idle network compute capacity for local AI
IT/OT convergence exposes skills gap. Cisco responds with new OT security certification
Microsoft exits UK AI data center project over electricity delays
AI networks drive SONiC boom
Microsoft expands sovereign cloud offerings as data control concerns grow
SONiC momentum continues at OCP Global Summit
2026 network outage report and internet health check
Gartner’s top tech trends for 2027 expand—and constrain—AI capabilities
Help Net Security
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
OpenAI’s coding agents talked themselves out of being monitored
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Fingerprint uses AI coding tools to automate fraud detection setup
XTIUM expands XTAI with centralized AI governance and cost management
SentinelOne brings runtime threat detection and response to AI agents
Broadcom adds real-time scam detection to 3-D Secure authentication
Claude Security can now spot vulnerabilities that reappear in code
Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
SC Magazine
PHP2Hell - Joshua Wright - PSW #949
PHP2Shell attacks surge worldwide as governments rush to patch
5 things security pros need to know about PHP2Shell
Onamae Desktop Cloud suffers security breach affecting thousands of servers
Lazarus Group adopts post-quantum encryption in new cyberattacks
AI agents circumvent security measures on Alibaba mapping platform
Broadcom and NTT DoCoMo sign 10-year VMware agreement
US Army fields new biometric system amid data protection concerns
New phishing-as-a-service platform uses artificial intelligence
AdvaMed addresses cybersecurity and policy concerns in medical device industry
© 2026 RiskDiscovery | Sponsored by: Deception Logic