Home/Threat Feed
STAY INFORMED

Threat Briefing

Why a security contractor runs a news page: most of what actually hits a small business or a household around here is not a movie-grade hacker, it is a known scam, a default password, an unpatched camera or a data broker. This is the current picture, pulled straight from the sources below and categorised.

Auto-Updated Hourly
Updated 09 Oct 2026 17:00 UTC 60 items indexed
1M AGO Ransomware Japan's GMO urges customers to shut down PCs amid ransomware threat Business + Home BleepingComputer The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a…
1M AGO Other OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests Business + Home BleepingComputer OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems. [...]
1M AGO Ransomware UNM Health ransomware attack disrupts patient care, surgeries Business BleepingComputer The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]
1M AGO IoT Hackers hijack Convertr analytics script to steal payment card data Home BleepingComputer A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]
1M AGO Breach CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Business + Home The Hacker News Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to…
1M AGO Breach Microsoft releases Windows OOB updates to distrust eMudhra certificates Business + Home BleepingComputer Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic…
1M AGO Privacy Warp discloses breach exposing AI agent logs, user telemetry data Business BleepingComputer Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure. [...]
1M AGO Breach Tailscale warns of SSH flaws allowing root privilege escalation Business BleepingComputer The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...]
1M AGO Other The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest Business BleepingComputer Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the…
1M AGO Ransomware GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Business The Hacker News The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on…
1M AGO IoT Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads Home The Hacker News Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is…
1M AGO Breach Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Home The Hacker News Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's…
1M AGO IoT Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz Business + Home CISA View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or…
1M AGO IoT EPICS Base Business + Home CISA View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially…
1M AGO Other CISA Adds Two Known Exploited Vulnerabilities to Catalog Business CISA CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload…
1M AGO Breach Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key Business The Hacker News An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key…
1M AGO Scam AI-Generated Fake Login Pages Are Making Account Takeovers Easier Business + Home The Hacker News Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing…
1M AGO Breach Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption Business + Home The Hacker News The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction…
1M AGO IoT Apple backports CoreGraphics zero-day patches to older iPhones Home BleepingComputer ​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
1M AGO Breach Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers Business + Home The Hacker News A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says…
1M AGO Breach Energy giant ENGIE discloses data breach affecting customers Business + Home BleepingComputer French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners…
1M AGO Other OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections Business + Home The Hacker News OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's…
1M AGO Other CISA confirms PHP2Shell vulnerabilities now exploited in attacks Business BleepingComputer The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch…
1M AGO IoT Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses Business + Home The Hacker News The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP…
1M AGO Other CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution Business + Home The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities…
1M AGO Breach University of Copenhagen data breach exposes data of 525,000 people Business + Home BleepingComputer The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]
1M AGO Breach Former pentester used ARTEX AI to steal 8.2 million data records Business + Home BleepingComputer South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks…
1M AGO Other OpenAI launches GPT-6.1 Terra with 3x faster AI agents, 50% lower pricing Business + Home BleepingComputer OpenAI has launched GPT-6.1 Terra, a new model focused on computer use, visual reasoning, coding, and everyday work, while costing significantly less than its larger models. [...]
1M AGO Other DreamHost forces password resets in ongoing "incident" Business + Home BleepingComputer DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...]
1M AGO Breach Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento Business The Hacker News An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec…
1M AGO Other PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Business + Home The Hacker News PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt…
1M AGO Ransomware Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware Business + Home The Hacker News Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat…
1M AGO Breach ⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More Business The Hacker News This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets…
1M AGO Other CISA Adds Two Known Exploited Vulnerabilities to Catalog Business CISA CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching : CVE-2026-109618 –…
1M AGO Other Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes Business + Home The Hacker News Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's…
1M AGO Other Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses Business + Home The Hacker News Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform…
1M AGO Privacy uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts Home The Hacker News A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who…
1M AGO Breach Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Business + Home The Hacker News Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen…
1M AGO Breach Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs Business + Home The Hacker News An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The…
1M AGO Breach Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware Business + Home The Hacker News A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report…
1M AGO Breach Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Business The Hacker News A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack…
1M AGO Other PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity Business The Hacker News In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the…
1M AGO Other OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication Business + Home The Hacker News OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models…
1M AGO Other Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Business + Home The Hacker News A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy…
1M AGO Breach Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Business + Home The Hacker News LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of…
1M AGO Privacy Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads Home The Hacker News Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on…
1M AGO IoT Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet Business + Home The Hacker News Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have…
1M AGO Other CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud Business The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its…
1M AGO IoT BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations Business + Home The Hacker News Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic…
1M AGO Other Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Business + Home The Hacker News Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab…
1M AGO Ransomware Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions Business + Home The Hacker News Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an…
1M AGO IoT Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials Business The Hacker News Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls…
1M AGO Other CISA Adds One Known Exploited Vulnerability to Catalog Business CISA CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-110447 Collabora Online – Built-in CODE Server OS…
1M AGO Other CISA Adds One Known Exploited Vulnerability to Catalog Business CISA CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection…
1M AGO Other PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Business The Hacker News PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects…
1M AGO IoT Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack Business The Hacker News The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET…
1M AGO Other Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Business The Hacker News Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in…
1M AGO Other Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Business + Home The Hacker News Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran…
1M AGO Other Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances Business + Home The Hacker News AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was…
1M AGO IoT PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware Business + Home The Hacker News Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it…

Aggregated from CISA, Krebs on Security, BleepingComputer and The Hacker News. Headlines link to the original sources — we index, we do not republish.

SOURCES

Where This Comes From

CISA
US advisories
Krebs on Security
Investigations
BleepingComputer
Breaking
The Hacker News
Vulnerabilities

Headlines are indexed and linked to the original publisher. We do not reproduce article text.

NEXT STEP

Most of this is preventable

Default passwords, unpatched cameras, flat networks and public personal data are what actually gets people here. All three of those we fix.

Request a Site Assessment Call (304) 555-0142