A Chinese-speaking threat operator combined ARTEX, Claude Code, Codex, and configurations requesting DeepSeek, GLM, and Grok models to coordinate attacks against organizations worldwide. The investigation expands earlier reporting on South Korean financial institutions, exposing a workflow built around shared instructions, persistent project records, and automated handoffs between AI sessions. Recovered prompts, dated August 4 through…

Read more →

A critical vulnerability in Signal’s RingRTC calling library could let a malicious call participant keep receiving audio after another user tries to hang up. This vulnerability, tracked as CVE-2026-113380, affects versions of RingRTC before 2.72.0 and carries a CVSS v4.0 score of 9.3. While video tracks could also remain active, the official vulnerability description does…

Read more →

In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why organizations underestimate speed, the time it takes to detect and stop an attacker, and why the cost curve turns steep once workloads move on premises. Halbheer says boards ask…

Read more →

The Node.js Project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 26.x, 24.x, and 22.x release lines. The updates fix a critical Brotli decoder flaw that allows remote code execution, as well as weaknesses in DNS resolution, TLS certificate validation, cryptographic randomness, and filesystem permissions. The release addresses four high-severity, three…

Read more →

LiteLLM version 1.107.0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images. On October 21, 2026, researchers at Socket reported that malicious Python startup hooks could activate even if applications didn’t import LiteLLM, potentially exposing cloud credentials, developer secrets, and AI authentication files. Socket flagged seven malicious…

Read more →

Today, Google Cloud announced that it is launching OpenAI models in Google Cloud’s model garden. This makes Google Cloud the only hyperscale cloud provider offering access to…

Read more →

Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make decisions and take actions that would have required human approval a year ago. That new authority is already causing trouble. Three in four organizations ran…

Read more →

PHP released emergency security updates to address two critical vulnerabilities that could allow unauthenticated attackers to execute code on vulnerable servers. These vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and both have a CVSS v4.0 score of 9.2. The fixes are included in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should update immediately, as…

Read more →

The detected exploitation attempts targeting two critical PHP vulnerabilities on October 17, 2026, four days before their public disclosure and security updates. Tracked as CVE-2026-109618 and CVE-2026-109619, the vulnerabilities are collectively called PHP2Shell and can enable unauthenticated remote code execution on vulnerable web servers. Both carry CVSS v4.0 scores of 9.2. The earliest attempt reached…

Read more →

GoDaddy has revoked 404,607 SSL/TLS certificates after discovering that certain subscriber certificates were issued outside the defined profiles in its Certification Practice Statement (CPS) and Certificate Policy (CP). The revocation took effect on October 21, 2026, requiring affected customers to obtain and install replacement certificates to avoid browser security warnings and potential website outages. This…

Read more →

Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person spoke, the models produced output the attacker had picked in advance. In one test, that output was a request to send $5,000, and AI agents reading the transcript made the transfer…

Read more →

The United Arab Emirates says it’s creating a foundation of security and safety as it transforms its public service footprint.

Read more →

The Meta CEO feared a proposed billionaire tax in the state would force a major share sale, threatening his voting control of the company.

Read more →

GitLab has released emergency security updates to address a critical remote code execution vulnerability that could allow unauthenticated attackers to execute arbitrary code on affected servers. This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the patches on October 21,…

Read more →

Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they produce, according to LocalStack’s 2026 State of AI in Cloud Development report. More code adds to the testing workload Sixty-five percent of respondents say their teams now generate at least twice as much code as…

Read more →

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse against South Korean financial institutions, to speed up…

Read more →

Sixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than half have no way to measure whether the agents get it right. Splunk surveyed 2,050 of them across ten countries. Source: Splunk Agents diagnose, people still ship the code Teams have been…

Read more →

Longtime ECI leader returns as CEO; Trevor Gruenewald to remain a board member after 18 years with the company

Read more →

VeroID launches to support customer identity checks for businesses and the software platforms that serve them.

Read more →

Helping protect astronauts from radiation risks while promoting the use of satellite data and the creation of future lunar industries.

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

If spreadsheets are your thing, but Microsoft Office isn’t, you might want to give the open-source clone, GridCraft, a try.

Read more →

If you’re tired of Google Maps failing to get you where you need to go, set Waze as the default on your Pixel. I’ve finally figured out how.

Read more →

For decades, Elon Musk has mixed resources and ambitions at his two largest companies.

Read more →

October is Cyber Security Awareness Month, an opportunity for all Australians to strengthen their cyber security knowledge and take practical steps to protect their devices,…

Read more →

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell. Both are rated 9.2 (Critical) under CVSS v4.0, and both allow an unauthenticated attacker to run code on a vulnerable server. The fixed…

Read more →

New Tenable OPEN for AI program enables customers to use preferred AI models, agents and tools to improve visibility, insight and action

Read more →

CVE-2026-103111, CVE-2026-109618, CVE-2026-109619

Read more →

Attacker adoption of agentic AI is lagging the technology, but adversaries are already exploiting high-severity vulnerabilities in an average of just three days, leaving…

Read more →

Planned for the first half of CY27, Extreme Exchange zones will bring AI skills to branch and edge sites, designed for data sovereignty, localization, survivability, and better…

Read more →

New Agent Sandbox Foundation Stack combines the VAST AI Operating System with NVIDIA NemoClaw and NVIDIA OpenShell to give every sandboxed agent a fast, isolated workspace, the…

Read more →

As banks and insurers deploy AI agents against customer data, Meiro’s Local AI CDP delivers sovereign AI inference: AI models run inside the institution-controlled environment…

Read more →

Ukraine is using a basic Starshield service, which uses Starlink’s standard equipment with different features

Read more →

AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed. On Tuesday, it reported two incidents, both involving the agent disabling or interfering with its alignment monitoring, and in one case directly lying about having done so.  “In two internal coding tasks, agents weakened misalignment monitoring…

Read more →

New capability delivers fine-grained, cross-application access insights to AI assistants

Read more →

Deeper Network Promo

EPIC allows customers to test and validate liquid-cooled infrastructure in real-world environments alongside leading technology partners

Read more →

EVENT NEWS: Marking its 70th anniversary milestone, Phase One of the 140th China Import and Export Fair Canton Fair underlines a structural transformation in regional…

Read more →

Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on… what could possibly be hiding inside? We break out a Geiger counter and a cat to find out. Meanwhile, malicious ads are targeting journalists with zero-click attacks. Plus, Origin’s Spencer Thompson reveals what AI agents are really getting up to…

Read more →

New Teradata Factory and Teradata Sovereign Cloud on Google Distributed Cloud capabilities give enterprises greater control over where their most sensitive data and AI operate

Read more →

Azul’s Security-only, Stability-first™ updates can be deployed immediately to counter the speed of agentic AI threats

Read more →

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address…

Read more →

Qing Liu appointed General Manager, Asia Pacific, as the company expands investment and customer support across the region.

Read more →

Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode. The vast majority of connections made by Chrome use HTTPS, according to…

Read more →

Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. […]

Read more →

Losing original hospital bills can make a health insurance claim more difficult, especially when you are filing a reimbursement claim. These bills help show what treatment you…

Read more →

Microsoft researchers attributed the recent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940. “As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries,” Microsoft Security Research wrote…

Read more →

Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers’ servers. […]

Read more →

Plus, the Starlink slowdown hurt Ukraine’s ability to stop Russian attacks, and U.S. special envoy Steve Witkoff praised Vladimir Putin as a ‘humanitarian.’

Read more →

A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less than…

Read more →

Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE). On Wednesday morning, the PHP Foundation released patches for affected versions, and said it…

Read more →

Fleet Device Management is expanding its endpoint management platform to support NVIDIA DGX Station and RTX PRO workstations, enabling enterprise IT teams to manage AI computing systems alongside existing macOS, Windows, and Linux devices. The expansion is designed to bring AI workstations into established device security, vulnerability management, and compliance workflows as organizations deploy more…

Read more →

Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.

Read more →

EVP of Microsoft Security Hayete Gallot writes in a blog post that AI agents operating independently within companies could be a serious security threat. According to Microsoft, today’s most advanced AI models cannot be fully trusted. Not because they are malicious, but because they are trained to achieve goals and can take unexpected shortcuts to achieve them.…

Read more →

Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra. Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromised intermediate CAs to impersonate any website or service.…

Read more →

Oracle’s October 2026 update fixes 1,209 vulnerabilities, including six CVSS 10.0 flaws. See the affected products and what security teams should patch first.

Read more →

Ahold Delhaize took IT systems offline after a cyberattack disrupted grocery services in the US and Europe, highlighting business continuity challenges.

Read more →

Hackers used open-banking services to test stolen bank logins for free. Group-IB uncovered related phishing activity and verification costs for platforms.

Read more →

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. […]

Read more →

The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.

Read more →

The company, which reported record revenue of $64.2 billion for the third quarter, said the new stock won’t affect Mark Zuckerberg’s voting control.

Read more →

Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.

Read more →

OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misaligned behavior, in both cases while carrying out routine coding…

Read more →

Elon Musk is considering putting electric cars, rockets, satellites and artificial intelligence under one corporate roof. Tesla and SpaceX have established committees of independent directors to examine a potential merger, marking a significant step toward combining two of Musk’s largest businesses. However, neither company has agreed to transaction terms, and the deal remains uncertain. For…

Read more →

Major enterprise AI contracts involve more than selecting a cloud platform. Buyers also have to consider the engineering resources and consulting expertise available to support their investments. Cognizant said it committed more than 18,000 engineers to a new Gemini Frontier Capability Group under its expanded partnership with Google Cloud, announced Oct. 19. Its specialists will…

Read more →

Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.

Read more →

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions…

Read more →

WhatsApp instructed its AI support chatbot not to recommend contacting privacy regulators when users couldn’t delete their accounts, researchers found. Privacy software company Redact discovered the hidden text on October 8. Its researchers then examined and saved copies of all 545 pages linked from WhatsApp’s help center, finding 102 instruction blocks across 80 pages. The…

Read more →

Every IT and security team knows the feeling of opening a vulnerability report and seeing a number that only goes up. Thousands of findings. Hundreds marked critical. A backlog that grows faster than any team can close it. For years, the default response has been to work harder: more scans, more tickets, more overtime. But…

Read more →

An upcoming update will bring new features to existing HomePods. Here’s what to know.

Read more →

Deeper Network Promo

For most IT teams, Patch Tuesday used to set the rhythm of the month. Updates arrived, teams tested them, change boards approved them, and deployments rolled out over the following weeks. It wasn’t painless, but it was predictable. That predictability is gone. Nearly 48,000 CVEs were published in 2025, and the average time to exploit…

Read more →

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. […]

Read more →

In this article What’s happening What is ARTEX? Mitigation and protection guidance References Learn more As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of these Storm-0940 ARTEX-driven attacks have resulted…

Read more →

For the past few years, most enterprise AI has been advisory. It summarized tickets, drafted knowledge articles, and suggested next steps. A person still decided what to do. That’s changing. Agentic AI systems can plan multistep tasks and carry them out: querying systems, triggering workflows, changing configurations, and closing tickets with little or no human…

Read more →

Director Ron Deibert spoke to a crowd in his keynote address at SecTor 2026, warning that the threats that the Citizen Lab investigates are being “super-charged” thanks to AI. In particular, he criticized the United States’ “descent into authoritarianism” and use of AI to spread propaganda. Read Dark Reading’s coverage of the talk here The…

Read more →

“Hallucination” has become the catch-all term for AI getting things wrong. It describes a real phenomenon: Large language models can generate confident, fluent answers that are simply untrue. But in IT operations, many errors labeled as hallucinations have a more ordinary explanation. The AI isn’t inventing facts. It’s faithfully reporting information that happens to be…

Read more →

The models Astra and Sol misinterpreted instructions during internal use, which has serious implications for alignment monitoring.

Read more →

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package…

Read more →

A state jury found the social-media giant liable for misleading the state’s consumers.

Read more →

New York, NY, USA, October 21st, 2026, CyberNewswire According to the 2026 Autonomous Agents Threat Report, published by Arrakis Security, 76% of active agents have not run in 60 days, but their credentials still work and their triggers still fire. 44% have not run in 180 days. 24% of dormant agents can be started by…

Read more →

Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and Access Management (IAM). IAM Roles Anywhere relies on public…

Read more →

A developer’s GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.

Read more →

New York, NY, USA, 21st October 2026, CyberNewswire

Read more →

Google’s browser will flash two types of warnings based on whether the site is deemed dangerous or just suspicious.

Read more →

OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astra, respectively, as part of an internal deployment.…

Read more →

Sens. Richard Blumenthal and Josh Hawley wrote to CEO Sundar Pichai following a Wall Street Journal investigation.

Read more →

OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. […]

Read more →

Sofia Liguori, a research engineer working at DeepMind, resigned in protest this week from Google’s pioneering artificial intelligence laboratory. Unlike a wave of other AI researchers who have quit over fears AI might someday turn against humanity, Liguori stepped down over concern about her employer’s current practices. Disenchanted and disturbed by Google’s military contracts with…

Read more →

Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow for remote code execution. PHP is a widely-used, open-source server-side scripting language designed primarily for web development. All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are considered at risk. Successful exploitation of the most…

Read more →

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a…

Read more →

Critical PHP flaws forced European government websites offline. Here’s what happened, why services were suspended, and what comes next.

Read more →

FBI and CISA warn SafePay ransomware has hit at least 600 organizations. Learn how the group attacks networks and what security teams can do to prevent breaches.

Read more →

Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities.

Read more →

360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.

Read more →

Expect to see quite a few websites serving “404” or “Page Not Found” errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these…

Read more →

Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key role…

Read more →

Overview Immediately after the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, a large number of repositories named “php2shell” were created in a short period of time on GitHub, a code repository platform. Of the top 100 repositories (excluding forks) found by searching for “php2shell,” 99 addressed these vulnerabilities, and nearly all…

Read more →

Researchers have uncovered Athena StealthRoute, a phishing-as-a-service platform featuring an AI Studio that generates phishing lures and decoy content designed to conceal attacks

Read more →

PHP releases emergency PHP2Shell fixes for two critical flaws allowing unauthenticated code execution. Website owners and hosting providers…

Read more →

Researchers found more than 6,800 Meta Muse chat-sharing links through passive DNS records, exposing sensitive conversations and prompting Meta to suspend sharing.

Read more →