2026-10-27
2026-10-26
Cloudflare
Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
MIT Technology Review
Will the real Anthropic please stand up
Meta Security
Meta Networking at the 2026 OCP Global Summit: Open Innovation for Scale-Up, Scale-Out, and Scale-Across AI Networks
Step Security
litellm 1.107.0 Compromised on PyPI and Docker: Credential Stealer and Hourly Remote Code Loader
Malwarebytes
AI Halloween videos: Who’s getting your photos?
MIT Technology Review
The Download: everyday AI harms and the race to nuclear spaceflight
CISA News
CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security
CISA Alerts & Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Schneier on Security
Bias in Qwen3-Coder Model
MIT Technology Review
The focus on AI safety disasters ignores everyday harms
Malwarebytes
A week in security (October 19 – October 25)
Elastic Security Labs
Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform
Sansec Threat Research
Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics
Rosecurify
Seclog - #201
2026-10-25
2026-10-24
Step Security
OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
Sansec Threat Research
deepveindrilling.com: Magento CMS block loader hits 953 stores
2026-10-23
Schneier on Security
Friday Squid Blogging: Increasing Squid Populations
Microsoft Security
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Ars Technica Security
Knicks sent employees fake offer of championship rings in phishing test: Report
The Citizen Lab
Built-In Weakness: Lawful Access and Encryption in the Age of AI-Powered Cyber Threats
Offensive Security
Someone Will Click. Is Your Security Team Ready?
NVISO Labs
PHP2Shell Operational Guidance
Dark Reading
Why Caribbean Threats Cascade Into Global Cyber-Risk
MIT Technology Review
The Download: testing six tech promises and biotech’s blind spots
CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Alerts & Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
Schneier on Security
Compromised TLS Certificates
MIT Technology Review
In the biotech world, you can’t see everything
DarkRelay
OWASP Top 10 Penetration Testing
Dark Reading
State Bank of India Suffers a Customer PII Data Leak
Okta Security
Node2Shell: Node.js Brotli flaw (CVE-2026-111497)
Elastic Security Labs
How CVE-2026-73570 turns a Zimbra log file into remote code execution
2026-10-22
MIT Technology Review
Designing an AI serving harness built to last
Dark Reading
What We Missed: Feds Lasso Texas Laptop Farms
Ars Technica Security
Disgraced eMudhra drops out of TLS business after using cert private key of 4
Black Hills Info Sec
Detection Engineering: Stop Drowning in Alerts and Start Catching Bad Guys
MIT Technology Review
The Foundations of Scalable AI
Talos Intelligence
I had plans for that second
Github Security Blog
How bug bounty sharpens one researcher’s security skills
Offensive Security
PHP2Shell – Critical Vulnerabilities in PHP Core (CVE-2026-109618/CVE-2026-109619)
The Citizen Lab
How Generative AI is Scaling Transnational Repression
Ars Technica Security
Hackers got a four-day head start on epic PHP2Shell vulnerability
Malwarebytes
Scammers are finding new ways to target your phone. Here are 5 ways to protect yourself
Schneier on Security
New Serious PHP Vulnerabilities Released and Patched
Bishop Fox Security
The True Blast Radius of an AI Attack
Eye Security Research
PHP2Shell: Our assessment of the risk for systems running PHP
MIT Technology Review
The Download: computing’s next leap and permafrost’s climate threat
CISA Alerts & Advisories
Siemens Software Center
CISA Alerts & Advisories
Managing AI Token Consumption for Operational Resilience
CISA Alerts & Advisories
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
CISA Alerts & Advisories
Siemens WinCC
CISA Alerts & Advisories
Siemens Industrial Edge Device Kit
CISA Alerts & Advisories
Siemens Capital Embedded AR Classic
CISA Alerts & Advisories
InterSystems Corporation InterSystems IRIS for Health
CISA Alerts & Advisories
Siemens PSS(R)SINCAL
CISA Alerts & Advisories
Siemens SIMATIC S7 Webserver API
CISA Alerts & Advisories
Siemens SIMATIC IPCs
CISA Alerts & Advisories
Siemens Industrial Edge Devices
CISA Alerts & Advisories
Siemens Industrial Edge App Publisher
CISA Alerts & Advisories
Siemens SIMATIC S7-1500 TM MFP
CISA Alerts & Advisories
Kiloview E3 NDI Encoder
CISA Alerts & Advisories
Siemens SENTRON 3NA COM Fuse
CISA Alerts & Advisories
Siemens SIMATIC S7 PLCs Web Server
CISA Alerts & Advisories
Siemens RUGGEDCOM CROSSBOW Station Access Controller
CISA Alerts & Advisories
Siemens RUGGEDCOM APE1808 Devices
CISA Alerts & Advisories
Siemens RUGGEDCOM CROSSBOW
CISA Alerts & Advisories
Siemens APOGEE, TALON and Desigo PXC/PXM Products
Ars Technica Security
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Eye Security Research
Operation IXIM: Preventing a botnet of millions of Popcorn Time users
MIT Technology Review
Making the case for context-aware AI
MIT Technology Review
Three things you should know about permafrost
Escape DAST
php2shell (CVE-2026-109618 + CVE-2026-109619): unauthenticated RCE in PHP core, now detected by Escape
TrustedSec
Trimarc, 18 Months Later at TrustedSec
Amazon Security
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Datadog HQ
Optimize AI costs with Agent Observability
Okta Security
Okta's Response to PHP2Shell
2026-10-21
Amazon Security
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot
Talos Intelligence
Compromised eMudhra intermediate certificates
Dark Reading
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
Offensive Security
OffSec Aligns Its Cyber Workforce Development Programs to Global Workforce Frameworks
Microsoft Security
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Offensive Security
OSCP+ Scoring Update: What You Need to Know
Amazon Security
Best practices for integrating IAM Roles Anywhere with your PKI
Malwarebytes
PHP2Shell: Why many websites had to go offline
Palo Alto Networks
Millions of PHP Instances Exposed - What Organizations Need To Do Right Now
Dark Reading
Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
Socket
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
Krebs on Security
Widespread PHP Flaw May Cause Many Site Outages Today
Talos Intelligence
Two critical RCEs in PHP core
CISA Alerts & Advisories
Critical Vulnerabilities in PHP Require Immediate Patching
Palo Alto Networks
Advancing Agentic AI Security with Palo Alto Networks and NVIDIA
Schneier on Security
Workshop on Economics and Information Security (WEIS) Archive
Talos Intelligence
Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
Ars Technica Security
PHP warns it plans to release 2 emergency patches imminently
Snyk
AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered
Sansec Threat Research
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)
GMO Flatt Security Research
Software Supply Chain Attack on LiteLLM: Overview and Response Guidance
Fastly
Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619
Nebula Security
Investigating the PingCAP Security Incident: Credential Exposure and Cloud Data Collection
Flatt Security Research
Software Supply Chain Attack on LiteLLM: Overview and Response Guidance
Elastic Security Labs
php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619
2026-10-20
Ars Technica Security
The Internet goes on high alert after discovery of 8 compromised TLS certs
Amazon Security
Managing identity source transition for AWS IAM Identity Center
Talos Intelligence
There's only so much code: the rise in vulnerability numbers
ReversingLabs
Why the Tools You Already Own Won’t Make You PQC-Ready
Mozilla Security
Protecting Firefox users following the compromise of eMudhra intermediate certificates
Ars Technica Security
Meta Muse exposes users' personal and business secrets when they share conversations
CISA Alerts & Advisories
Hitachi Energy RTU500 Product
CISA Alerts & Advisories
#StopRansomware: SafePay Ransomware
CISA Alerts & Advisories
Hitachi Energy MicroSCADA X SYS600 Product
CISA Alerts & Advisories
Moxa AIG-302 ThingsPro Edge
CISA Alerts & Advisories
CISA Adds Six Known Exploited Vulnerabilities to Catalog
CISA Alerts & Advisories
HMS Networks PEAK-System PCAN Windows drivers
Schneier on Security
Possible new Cellebrite iPhone Radio Zero-Day