What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
BlackX UEFI bootkit targets diplomatic organizations.
The Hacker News reports BlackX UEFI bootkit targets diplomatic organizations in Central Asia. Kaspersky says it bypasses Secure Boot on patched Windows systems. The activity is suspected to be orchestrated by APT41, a China-linked group. Kaspersky identified the bootkit in a technical report.
Read the original at thehackernews.com · Machine-written brief
Ruby fixes regex engine bugs.
The Hacker News reports Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to fix three Onigmo bugs. GitLab found these bugs could lead to code execution. The bugs were behind four critical GitLab RCE flaws. Ruby says these bugs could corrupt memory.
Recommended by the publisher: Update to Ruby versions 4.0.9, 3.4.12, or 3.3.13.
Read the original at thehackernews.com · Machine-written brief
Ransomware affiliates used AI agents for intrusions.
The Hacker News reports affiliates of INC and The Gentlemen ransomware groups used an AI-driven framework. The threat actor is assessed to be Russian-speaking. The framework is referred to as Phantom.
Read the original at thehackernews.com · Machine-written brief
Hackers breached firewalls and VPNs, exposing credentials.
The Hacker News reports a campaign targeted Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. Operators obtained access to numerous organizations worldwide. They attempted to compromise some victims further. The Hacker News says over 70,000 credentials were exposed.
Read the original at thehackernews.com · Machine-written brief
PHP warns of unpatched RCE CVE-2026-115560.
The Hacker News reports PHP has found another code execution issue, assigned CVE-2026-115560, affecting certain web applications. PHP considers it an unlikely risk. The issue affects web applications configured in an unusual way. PHP is not issuing an emergency fix for it.
Recommended by the publisher: PHP recommends turning off a feature to mitigate the issue.
Read the original at thehackernews.com · Machine-written brief
Sandworm and UAC-0099 attacked a Ukrainian logistics company.
ESET reports the attack occurred via a spear-phishing email on July 16, 2025, deploying malware. The target was a Ukrainian logistics company. ESET says the attackers used a new mesh network backdoor. The attack was destructive.
Read the original at thehackernews.com · Machine-written brief
Pillow library flaw allows code execution.
The Hacker News reports a flaw in Pillow, a Python image library, allows code execution via crafted EPS images. The flaw, CVE-2026-112900, is in Pillow's handling of EPS images. It passes file names to Ghostscript without checking. This affects Pillow users.
Recommended by the publisher: The Hacker News does not recommend any action.
Read the original at thehackernews.com · Machine-written brief
Imperva demonstrates RCE exploit on Node.js.
Imperva researchers found a flaw in Node.js, The Hacker News reports. The flaw affects Node.js 24.22.0 for Linux arm64. Imperva's proof of concept ran code by feeding crafted Brotli data to the decoder. The issue is tracked as CVE-2026-111497.
Recommended by the publisher: Node.js disclosed the flaw.
Read the original at thehackernews.com · Machine-written brief
V12 found x402 SDK flaw affecting AI agents.
V12 said AI agents using x402 SDKs could lose their full token balance to malicious APIs. The SDKs' default client had no spending limit until August 18 releases. The risk affects agents that automatically sign payments.
Read the original at thehackernews.com · Machine-written brief
Attackers try to exploit PHP2Shell vulnerabilities.
The Hacker News reports that threat actors attempt to exploit CVE-2026-109618 and CVE-2026-109619 to deploy Mirai malware. The attacks aim to infect systems with a Mirai botnet variant. The vulnerabilities have CVSS scores of 9.2. Exploitation may be harder than thought.
Read the original at thehackernews.com · Machine-written brief
AI agent poses insider threat.
The Hacker News reports an AI agent may be running on a laptop in a network, storing API keys and database passwords, with little oversight. It can access internal systems. This agent is not reviewed or owned by anyone.
Read the original at thehackernews.com · Machine-written brief
Arista's VeloCloud has a SQL injection flaw.
The Hacker News reports Arista found a zero-day SQL injection flaw in VeloCloud Orchestrator. Attackers can exploit it to gain operator privileges. Anyone with a login can exploit the flaw. The company issued an advisory on October 22.
Recommended by the publisher: The company issued an advisory.
Read the original at thehackernews.com · Machine-written brief
eMudhra exits global SSL/TLS business after key issue.
The Hacker News reports eMudhra found 8 intermediate CA keys easily guessable. eMudhra will replace affected customers' certificates. The issue was reported by a researcher.
Recommended by the publisher: eMudhra will provide free replacement certificates from partners.
Read the original at thehackernews.com · Machine-written brief
The Hacker News reports multiple security flaws and breaches.
The Hacker News reports critical PHP and GitLab RCE flaws, Linux security bugs, and compromised eMudhra certificates. A Node.js RCE flaw and a hacked LiteLLM release were also found. Hundreds of Tor relays were hijacked.
Read the original at thehackernews.com · Machine-written brief
Linux servers are exposed to two RCE flaws.
The Hacker News reports Linux servers running KSMBD are vulnerable to two remote code execution flaws, rated 9.0 by Trend Micro's Zero Day Initiative. One flaw can be triggered before network authentication. The other requires SMB Direct transport and an RDMA-capable network. No fix is yet available in the mainline kernel.
Recommended by the publisher: No recommended action is given.
Read the original at thehackernews.com · Machine-written brief
Meta ordered to pay $25 billion for privacy violations.
The Hacker News reports Meta was ordered to pay $25 billion by a New Mexico court. The lawsuit stems from the Cambridge Analytica data scandal. Multiple reports confirm the ruling.
Read the original at thehackernews.com · Machine-written brief
INTERPOL disrupts 10,909 cybercrime networks.
The Hacker News reports INTERPOL arrested 1,462 suspects and recovered $105 million in illicit funds. Law enforcement agencies from 21 countries participated. The operation took place between June 29 and August 31, 2026.
Read the original at thehackernews.com · Machine-written brief
Railway says an intruder may have accessed customer secrets.
The Hacker News reports Railway found anomalous activity in systems storing customer environment variables. An unauthorized party may have gained access to encrypted variables and decrypted contents. The impact is limited to a subset of users. Railway investigated the activity.
Recommended by the publisher: Railway urges credential rotation.
Read the original at thehackernews.com · Machine-written brief
OpenCode flaw lets malicious MCP servers execute code on Windows and WSL.
The Hacker News reports a flaw in OpenCode AI coding agent allowed malicious MCP servers to run code on developers' machines. This code ran with the developer's access when signing in. Anomaly fixed the flaw in version 1.18.33.
Recommended by the publisher: Update to version 1.18.33 to fix the flaw.
Read the original at thehackernews.com · Machine-written brief
LiteLLM suspects GitHub token leak.
The Hacker News reports LiteLLM's release pipeline was compromised. A malicious Python package was pushed to Docker Hub and PyPI. The package contains a credential stealer and a backdoor. This happened on October 21, 2026.
Read the original at thehackernews.com · Machine-written brief