Cybersecurity

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package.

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the…

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV)…

Abandoned Popcorn Time app exposed millions of devices to RCE attacks

Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated…

Microsoft Teams to get AI-powered, context-aware phishing detection

Microsoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026.

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.

Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0

Oracle has patched 1295 security vulnerabilities with its October Critical Patch Update Advisory; six of them scored the highest vulnerability rating of 10.0 on the CVSS version 3.1 scale.

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month.

Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.

PHP shares mitigation for new RCE vulnerability with no patch

The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch.

In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware

Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.

HPE patches eight max severity RCE and auth bypass AOS flaws

Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues.

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.

The most online generation is also the least protected: over half of Gen Z have already faced a cyberattack

Kaspersky recommends that users treat cybersecurity as an ongoing part of their digital routine rather than something to consider only after an incident.

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.

Cisco study: UAE cyber defence advances, but visibility and coordination gaps remain

Among UAE organisations using AI-powered security, 89% report at least a 25% improvement in threat-detection speed, and 85% report a similar improvement in response and remediation.

Airtel Rwanda Partners With NCSA to Boost Cybersecurity Skills Among Youth

Airtel Rwanda has partnered with the National Cyber Security Authority (NCSA) through its Cyber Hub to strengthen cybersecurity capabilities and develop practical digital skills among…

Attackers Exploit Third Arista VCO Zero-Day in Four Months

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open.

Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’

In a regulatory filing, Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, a platform where certain clients can place test orders.

Also: BleepingComputer, TechCrunch

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.

Railway warns devs to rotate secrets after potential breach

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week.