2026-10-21
Talos Intelligence
Compromised eMudhra intermediate certificates
Dark Reading
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Offensive Security
OffSec Aligns Its Cyber Workforce Development Programs to Global Workforce Frameworks
Microsoft Security
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Offensive Security
OSCP+ Scoring Update: What You Need to Know
Amazon Security
Best practices for integrating IAM Roles Anywhere with your PKI
Dark Reading
Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
Socket
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
Krebs on Security
Widespread PHP Flaw May Cause Many Site Outages Today
Talos Intelligence
Two critical RCEs in PHP core
Step Security
litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
MIT Technology Review
The Download: introducing the Impossible issue
CISA Alerts & Advisories
Critical Vulnerabilities in PHP Require Immediate Patching
Schneier on Security
Workshop on Economics and Information Security (WEIS) Archive
Talos Intelligence
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
MIT Technology Review
We can do impossible things
MIT Technology Review
Nuclear-powered spaceships
MIT Technology Review
Exercise in a pill
MIT Technology Review
Interspecies communication
MIT Technology Review
Cleaning up PFAS
MIT Technology Review
Solid-state batteries
MIT Technology Review
Eliminating traffic deaths
Ars Technica Security
PHP warns it plans to release 2 emergency patches imminently
Snyk
AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered
Sansec Threat Research
PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)
Fastly
Fastly’s Proactive Protection for PHP2Shell, Critical React RCE CVE-2026-109618 and CVE-2026-109619
Flatt Security Research
Software Supply Chain Attack on LiteLLM: Overview and Response Guidance
Elastic Security Labs
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
GMO Flatt Security Research
Software Supply Chain Attack on LiteLLM: Overview and Response Guidance
2026-10-20
MIT Technology Review
Here’s the tea
MIT Technology Review
It’s a bird, it’s a plane … it’s a robo-puffin?
Ars Technica Security
The Internet goes on high alert after discovery of 8 compromised TLS certs
Amazon Security
Managing identity source transition for AWS IAM Identity Center
Talos Intelligence
There's only so much code: the rise in vulnerability numbers
ReversingLabs
Why the Tools You Already Own Won’t Make You PQC-Ready
Ars Technica Security
Meta Muse exposes users' personal and business secrets when they share conversations
CISA Alerts & Advisories
HMS Networks PEAK-System PCAN Windows drivers
CISA Alerts & Advisories
CISA Adds Six Known Exploited Vulnerabilities to Catalog
CISA Alerts & Advisories
Moxa AIG-302 ThingsPro Edge
CISA Alerts & Advisories
Hitachi Energy RTU500 Product
CISA Alerts & Advisories
#StopRansomware: SafePay Ransomware
CISA Alerts & Advisories
Hitachi Energy MicroSCADA X SYS600 Product
Schneier on Security
Possible new Cellebrite iPhone Radio Zero-Day
TrustedSec
Handing Pre-Contract FCI and CUI
RCE Security
Imperia CMS <= 11.5.4 SiteActive TEMPLATE Unauthenticated SSTI Remote Code Execution (CVE-2026-110355)
Infernux Blog
Meat_proxy_01, reporting for duty!
2026-10-19
Ars Technica Security
PSA: Patch your Plex media server before someone hacks it
Meta Security
GenRecs Tokenization: Transforming Ads Recommendation at Meta with Stable Model Vocabulary
Meta Security
The Thin Orchestrator: How We Made Our AI Agents More Reliable by Giving the Router Less to Do
Rapid7
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild
Krebs on Security
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
Microsoft Security
Agents are your newest insiders. Security must move at their speed.
Schneier on Security
Training AIs to Solve CAPTCHAs
Malwarebytes
A week in security (October 12 – October 18)
Rosecurify
Seclog - #200
2026-10-18
2026-10-17
2026-10-16
Schneier on Security
Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact
Ars Technica Security
OpenAI models hacked a crypto wallet and breached more websites
Dark Reading
Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform
Filippo Valsorda
The NIST Elliptic Curves Seeds Bounty Has Been Claimed
Dark Reading
AI Takes Control of Robotic Arm in 16 Minutes Flat
Artem Golubin
The future of the internet could be paywalls
Offensive Security
OSCP Exam Guide: What to Expect and How to Prepare
Microsoft Security
Managing open-weight model risk in enterprise deployments
The Citizen Lab
The Lawful Access Act’s threats to Canada’s national security
Cloudflare
Continuous accountability for Verified bots
CISA Alerts & Advisories
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CISA Alerts & Advisories
Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials
CISA Alerts & Advisories
Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation
CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Schneier on Security
Backdooring Open-Weight AI Models
Malwarebytes
OpenAI sued over children safety and data use
Joshua Rogers
RCE (kind of) in Transmission BitTorrent’s daemon
2026-10-15
Ars Technica Security
Targeted ads delivered 0-click exploits to install mercenary malware
Artem Golubin
Python's binary wheels and supply chain attacks
Meta Security
How Meta Built Forum With AI-Native Engineering
Black Lantern Security
IIS Shortname Enumeration in the Big ‘26
Talos Intelligence
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Google Safety & Security
Check if a text message is a scam using Circle to Search.
Cloudflare
A fully programmable secure web gateway
Schneier on Security
Measuring Human Cryptanalysis Effort
Amazon Security
AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
Meta Security
Sapienz Receives ISSTA 2026 Impact Paper Award
Cloudflare
Deploy with Void
CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Alerts & Advisories
Thermo Fisher Torrent Suite Software
CISA Alerts & Advisories
J4Care dcm4che
CISA Alerts & Advisories
Guangzhou Juan IoT Technology EseeCloud
CISA Alerts & Advisories
Eclipse Foundation Eclipse Milo
CISA Alerts & Advisories
CISA Malcolm
Eye Security Research
Cooldown or compromise: the three-day rule for npm and PyPI
Sansec Threat Research
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
Star Labs
YuanKong RAT: the Android remote-control service that stamps its operators' names into every build