[ News | Newsletters | Blogs | Lists | Media | Jobs ] HoneyDB
DarkReading
State Bank of India Suffers a Customer PII Data Leak
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
What We Missed: Feds Lasso Texas Laptop Farms
Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour
UAE Transitions 50% of Gov't Services to Agentic AI
TiDB Breach Exposes Flawed Cloud Security Assumptions
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
'PHP2Shell' Bugs Signal Red Alert for Security Industry
OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
Ars Technica
Disgraced eMudhra drops out of TLS business after using cert private key of 4
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Enterprises keep buying software upgrades that IT thinks will make things worse
PHP warns it plans to release 2 emergency patches imminently
The Internet goes on high alert after discovery of 8 compromised TLS certs
Meta Muse exposes users' personal and business secrets when they share conversations
PSA: Patch your Plex media server before someone hacks it
ReactOS reaches major milestone with NTFS install support
OpenAI models hacked a crypto wallet and breached more websites
Targeted ads delivered 0-click exploits to install mercenary malware
CyberScoop
Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
eMudhra kills its certificate business after researchers cracked its private keys in under a second
Encryption isn’t enough to protect data wherever it goes 
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
PHP releases emergency fixes for 2 critical vulnerabilities
Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers
Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
ConnectWise customers hit by supply-chain attack linked to compromised API secret
DOJ escalates fight for election supremacy with California raids
InfoSecurity Magazine
EU Regulators to Investigate Booking.com Over Scam Risks
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Cloud Security Maturity Lags Despite Widespread Adoption, SANS Warns
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
SecurityWeek
11 Million Impacted by Capcom Data Breach
Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’
LiteLLM Compromised in Fresh Supply Chain Attack
Atlassian Patches 75 Flaws in Data Center and Server Products
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Hacker Conversations: Corey Thuen and the Evil Bit
Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Splunk, SolarWinds Release Fresh Security Updates
ZDNet
Amazon’s Kindle Unlimited is now Kindle+, and the 2 big changes include AI audiobooks
The latest PowerToys gives your mouse 2 new tricks for free – how to use them
GridCraft is the open-source Excel clone for Linux I’ve been waiting for
Not impressed with Google Maps? Make Waze your default on Pixel – here’s how
Hold onto your old HomePod – an upgrade is on the way
OpenAI’s most powerful AI models turned off safety monitoring – then lied about it
Chrome warns you about suspicious websites now – how to turn on Google’s new scam protection
Amazon unveiled 5 new Blink cameras, including a 4K model that caught my eye
ServiceNow and Nvidia launch Arc, a new AI agent for enterprise
Gemini on Android Auto can access my photos, emails, and calendar now – why I’m OK with that (mostly)
The Hacker News
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
BleepingComputer
Railway warns devs to rotate secrets after potential breach
Capcom confirms data breach affecting 11.7 million accounts
LiteLLM release pipeline hacked to distribute info-stealer malware
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Microsoft shares how to fix broken Exchange Online EWS apps
Machine speed attacks require machine speed detection and response
Amazon says PHP2Shell exploitation began 4 days before patches
GitLab warns of new max severity code execution vulnerability
Authorities disrupt nearly 11,000 cybercrime networks in Africa
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
gbhackers
PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks
Suspected Chinese APT41 Hackers Use BlackX Bootkit to Bypass Windows Secure Boot
11 Data Classification Tools: The 2026 Buyer’s Verdict Guide
12 Tokenization Solutions: The 2026 Buyer’s Verdict Guide
12 Encryption & Key Management Solutions: The 2026 Buyer’s Verdict Guide
12 Data Loss Prevention (DLP) Software: The 2026 Buyer’s Verdict Guide
12 Malware Analysis Tools: The 2026 Buyer’s Verdict Guide
Critical Citrix NetScaler RCE Vulnerability Under Active Attack as Hackers Deliver FreeBSD Malware
North Korea Hit by Multiple Waves of DDoS Attacks, Knocking Over 40 Websites Offline
Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks
Cybersecurity Dive
China-nexus actor linked to attack on ConnectWise Cloud Backup
Agentic AI helps hackers level up, even without detailed instructions
Weak encryption certificates could have let hackers easily spoof websites
FBI, CISA warn that SafePay ransomware poses threat to critical infrastructure
Critical PHP vulnerabilities expose most websites to potential compromise
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Ransomware groups expand targeting of Palo Alto Networks vulnerability
AI security hiring focuses on red-teaming, SOC orchestration and governance
Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness
ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users
Threatpost
Student Loan Breach Exposes 2.5M Records
Watering Hole Attacks Push ScanBox Keylogger
Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
Ransomware Attacks are on the Rise
Cybercriminals Are Selling Access to Chinese Surveillance Cameras
Twitter Whistleblower Complaint: The TL;DR Version
Firewall Bug Under Active Attack Triggers CISA Warning
Fake Reservation Links Prey on Weary Travelers
iPhone Users Urged to Update to Patch 2 Zero-Days
Google Patches Chrome’s Fifth Zero-Day of the Year
The Register
UK threatens subsea cable saboteurs with 14 years behind bars
PHP2Shell exploit bypasses protections designed to stop remote code execution
Max-severity GitLab bug allows remote code execution over 12 years of releases
Disgraced Indian cert issuer leaves the cert issuing business
PHP2Shell puts dozens of UK government services out of service
When the attacker becomes the user: Rethinking account takeover
Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall
Certification authority eMudhra defends its laughably weak private keys
VentureBeat
AI agents are about to put least privilege to the test
DeepSeek-V4.1-Flash-1017 arrives with improved benchmarks just as the U.S. government bans it from agencies — what enterprises should do
AI cloud security needs to prove control before agents reach production
Anyone can build apps with AI. But who owns them?
17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them
Browser security’s buying spree rests on one engine, without a clear Plan B
Anthropic’s Cyber Mission starts with 6,157 findings reported to maintainers and 516 patched
TechCrunch
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
The internet is having a very bad cybersecurity day
PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
Blackwall quadruples valuation to $2.2B as websites wrangle an increasingly crowded internet
Governments are hacking people with ‘zero-click’ spyware by showing them online ads
Flock CEO defends surveillance technology amid national backlash: ‘We shouldn’t pause progress’
Flock CEO says its microphones detect ‘just gunshots’ — its website says different
Flock CEO: We haven’t ‘fired’ any police departments as customers
Apate sends AI agents undercover to get scammed so they can gather fraud intelligence
Network World Security
Nvidia’s Berlin GTC: Faster AI factories, lower power use and more secure agents
Gartner forecasts 15% global IT spending growth, recaps top tech predictions
Extreme wants to use idle network compute capacity for local AI
IT/OT convergence exposes skills gap. Cisco responds with new OT security certification
Microsoft exits UK AI data center project over electricity delays
AI networks drive SONiC boom
Microsoft expands sovereign cloud offerings as data control concerns grow
SONiC momentum continues at OCP Global Summit
2026 network outage report and internet health check
Gartner’s top tech trends for 2027 expand—and constrain—AI capabilities
Help Net Security
Capcom data breach exposes 11.7 million account records
Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
Google opens its cloud to rival OpenAI, promises business data won’t train models
Drone program compliance: What a CTO says most agencies get wrong
AI is taking cybersecurity jobs at junior and experienced levels alike
New infosec products of the week: October 23, 2026
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
OpenAI’s coding agents talked themselves out of being monitored
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Fingerprint uses AI coding tools to automate fraud detection setup
SC Magazine
XRP Ledger updates delayed following validator support fluctuation
Arista Networks patches actively exploited zero-day vulnerability in VeloCloud Orchestrator
Bipartisan house bill targets AI distillation attacks
Rethinking data protection strategies beyond traditional encryption
SANS report highlights cloud security maturity gap and misconfiguration risks
Microsoft links agentic AI to ConnectWise supply chain breach
Malicious Google Search ads distribute weaponized putty installers
Microsoft expands sovereign cloud options for European customers
Moving images: How a runtime bill of materials provides total dependency visibility
PHP2Hell - Joshua Wright - PSW #949
© 2026 RiskDiscovery | Sponsored by: Deception Logic