Security news
What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
BlackX UEFI bootkit targets diplomatic organizations.
The Hacker News reports BlackX UEFI bootkit targets diplomatic organizations in Central Asia. Kaspersky says it bypasses Secure Boot on patched Windows systems. The activity is suspected to be orchestrated by APT41, a China-linked group. Kaspersky identified the bootkit in a technical report.
Read the original at thehackernews.com · Machine-written brief
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
LiteLLM 1.107.0 was compromised, stealing credentials.
Microsoft Security reports a malicious LiteLLM 1.107.0 release was published to PyPI, distributing through official container images. The package added files that Python could execute during initialization, targeting authentication material across developer tools and cloud environments. The collector could run without importing LiteLLM, affecting various systems. Microsoft analyzed two execution paths in the affected wheels.
Recommended by the publisher: Microsoft recommends removing the package, addressing the affected Python environment, and credentials accessible to the compromised identity.
Read the original at www.microsoft.com · Machine-written brief
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby fixes regex engine bugs.
The Hacker News reports Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to fix three Onigmo bugs. GitLab found these bugs could lead to code execution. The bugs were behind four critical GitLab RCE flaws. Ruby says these bugs could corrupt memory.
Recommended by the publisher: Update to Ruby versions 4.0.9, 3.4.12, or 3.3.13.
Read the original at thehackernews.com · Machine-written brief
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Ransomware affiliates used AI agents for intrusions.
The Hacker News reports affiliates of INC and The Gentlemen ransomware groups used an AI-driven framework. The threat actor is assessed to be Russian-speaking. The framework is referred to as Phantom.
Read the original at thehackernews.com · Machine-written brief
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Hackers breached firewalls and VPNs, exposing credentials.
The Hacker News reports a campaign targeted Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. Operators obtained access to numerous organizations worldwide. They attempted to compromise some victims further. The Hacker News says over 70,000 credentials were exposed.
Read the original at thehackernews.com · Machine-written brief
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP warns of unpatched RCE CVE-2026-115560.
The Hacker News reports PHP has found another code execution issue, assigned CVE-2026-115560, affecting certain web applications. PHP considers it an unlikely risk. The issue affects web applications configured in an unusual way. PHP is not issuing an emergency fix for it.
Recommended by the publisher: PHP recommends turning off a feature to mitigate the issue.
Read the original at thehackernews.com · Machine-written brief
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Sandworm and UAC-0099 attacked a Ukrainian logistics company.
ESET reports the attack occurred via a spear-phishing email on July 16, 2025, deploying malware. The target was a Ukrainian logistics company. ESET says the attackers used a new mesh network backdoor. The attack was destructive.
Read the original at thehackernews.com · Machine-written brief
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow library flaw allows code execution.
The Hacker News reports a flaw in Pillow, a Python image library, allows code execution via crafted EPS images. The flaw, CVE-2026-112900, is in Pillow's handling of EPS images. It passes file names to Ghostscript without checking. This affects Pillow users.
Recommended by the publisher: The Hacker News does not recommend any action.
Read the original at thehackernews.com · Machine-written brief
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Imperva demonstrates RCE exploit on Node.js.
Imperva researchers found a flaw in Node.js, The Hacker News reports. The flaw affects Node.js 24.22.0 for Linux arm64. Imperva's proof of concept ran code by feeding crafted Brotli data to the decoder. The issue is tracked as CVE-2026-111497.
Recommended by the publisher: Node.js disclosed the flaw.
Read the original at thehackernews.com · Machine-written brief
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
V12 found x402 SDK flaw affecting AI agents.
V12 said AI agents using x402 SDKs could lose their full token balance to malicious APIs. The SDKs' default client had no spending limit until August 18 releases. The risk affects agents that automatically sign payments.
Read the original at thehackernews.com · Machine-written brief
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attackers try to exploit PHP2Shell vulnerabilities.
The Hacker News reports that threat actors attempt to exploit CVE-2026-109618 and CVE-2026-109619 to deploy Mirai malware. The attacks aim to infect systems with a Mirai botnet variant. The vulnerabilities have CVSS scores of 9.2. Exploitation may be harder than thought.
Read the original at thehackernews.com · Machine-written brief
Why Organizations Secure AI Agents with Falcon Guardian
Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
AI agent poses insider threat.
The Hacker News reports an AI agent may be running on a laptop in a network, storing API keys and database passwords, with little oversight. It can access internal systems. This agent is not reviewed or owned by anyone.
Read the original at thehackernews.com · Machine-written brief
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
Arista's VeloCloud has a SQL injection flaw.
The Hacker News reports Arista found a zero-day SQL injection flaw in VeloCloud Orchestrator. Attackers can exploit it to gain operator privileges. Anyone with a login can exploit the flaw. The company issued an advisory on October 22.
Recommended by the publisher: The company issued an advisory.
Read the original at thehackernews.com · Machine-written brief
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra exits global SSL/TLS business after key issue.
The Hacker News reports eMudhra found 8 intermediate CA keys easily guessable. eMudhra will replace affected customers' certificates. The issue was reported by a researcher.
Recommended by the publisher: eMudhra will provide free replacement certificates from partners.
Read the original at thehackernews.com · Machine-written brief
I had plans for that second
Talos reports PHP vulnerabilities.
Talos says two unauthenticated remote code execution flaws were discovered in PHP, affecting every build since 5.4. Talos assesses all industries running PHP applications are at risk. PHP runs many internet staples, including WordPress and Drupal. Older branches are end of life and will not receive patches.
Recommended by the publisher: Talos very strongly advises immediate update to PHP 8.2 or later.
Read the original at blog.talosintelligence.com · Machine-written brief
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
The Hacker News reports multiple security flaws and breaches.
The Hacker News reports critical PHP and GitLab RCE flaws, Linux security bugs, and compromised eMudhra certificates. A Node.js RCE flaw and a hacked LiteLLM release were also found. Hundreds of Tor relays were hijacked.
Read the original at thehackernews.com · Machine-written brief