-
Delinea gives AI assistants read-only access to governance data
Delinea has announced Delinea Fastpath MCP Server, a new capability that connects access governance data to the AI assistants teams already …
-
Certification authority eMudhra defends its laughably weak private keys
Indian certification authority eMudhra has defended the laughably weak private keys it used to sign some digital certificates it issued, …
-
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asi
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to …
-
Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question
In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a …
-
Scouter enters Singapore’s crowded cyber market with a “listen first” promise
Anyone who has run security at a large Singapore organisation knows the routine. A vendor turns up with a slide deck, a slick demo and a …
-
AI agent permissions are outrunning security
Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security …
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the …
-
Say a few words, and a rigged AI asks for $5,000
Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for …
-
AI coding boom exposes cracks in cloud development
Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they …
-
AI agent observability is struggling to keep up with hallucinations
Sixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than …
-
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly …
-
Using AWS WAF to apply mitigations for PHP2Shell RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core …
●●●
NVD
- CVE-2026-114732 – Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper …
- CVE-2026-105777 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before …
- CVE-2026-110264 – An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before …
- CVE-2026-105711 – GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before …
- CVE-2026-103515 – GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before …
EXPLOITS
- Open eClass 3.15 – RCE
- Keycloak 26.7.2 – Unauthenticated Account Takeover
- ProSoft RLX-IFH24E v2.2.44 – Unsigned Firmware Upgrade Package Executed as Root
- South River Technologies Titan MFT Server 26.0.0 – code execution
- Synametrics Syncrify 6.2 – command execution
SECURELIST
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asi
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Operation FlashHole: Lazarus breaks security, defies control
- The journey of a paper unicorn: adventures inside a modern warehouse
- MacSync under the microscope: new delivery methods and a new payload