Cybersecurity

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.

Lazarus hackers use post-quantum cryptography for malware delivery

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.

CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.

Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections

Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis.

PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors

Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches.

High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7

Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.

Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands

Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled.

Also: BleepingComputer

Microsoft PowerToys adds CursorHide, Button Lock mouse tools

Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements.

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI

Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.

Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities

The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training.

Stolen UpdraftCentral keys used to backdoor WordPress sites

A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.

Mozilla, Google, Apple block compromised eMudhra CA certificates

Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for…

Auto tech startup claims it traced hack attempt back to rival's IP address

IQ.Lvbs implies that rival Comma.ai isn't playing fair

PHP warns admins of two critical flaws, emergency patches coming tomorrow

The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.

Zeabur shutting down after second security breach in two months

Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable…

Palo Alto's firewall OS has been under attack from multiple ransomware groups since June

Unit 42 investigates network compromises across numerous industries

Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'

From October 26, only high and critical cases stay private as project seeks help sharing the workload

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.

DHS bans DeepSeek products across US federal civilian agencies

The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems.

Also: CIO

Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites

A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet.

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.