Cybersecurity News
Aggregated daily from 25 sources. Updated automatically every morning.
CISA
NCSC UK
SANS ISC
The Hacker News
Bleeping Computer
Krebs on Security
Dark Reading
SecurityWeek
Exploit-DB
CERT-In
Google Project Zero
PortSwigger Research
Check Point Research
Cisco Talos
CrowdStrike
Unit 42
Elastic Security Labs
SentinelOne
WithSecure Labs
Avast Threat Labs
ZDI
0days in the Wild
Lakera AI Security
Embrace the Red
Simon Willison
A list of topics we covered in the week of October 19 to October 25 of 2026
Exposed email addresses could put CAPCOM ID users at risk of phishing. Passwords were also changed without permission on 196 accounts.
A Crime Stoppers chapter has stopped accepting tips after a breach exposed information about anonymous tipsters.
The Earth is speeding up, the leap second is being abolished, oh, and there's critical vulnerabilities in PHP.
Users were misled about who could access their personal information on Facebook. Now Meta has been ordered to pay $25 billion.
One in three people now tune out scam warnings, and scammers are counting on it.
A woman faces up to six years in prison over a Cash App account she says someone opened using her stolen identity.
Two lawsuits allege delivery robots scanned customers’ faces without consent, linked scans to names and addresses, and used them to train AI.
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
Explore Japan's 2026 cyber crisis, rising breach trends, AI tooling, legacy systems, and key mitigation strategies to protect organizations.
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
Hidden instructions told WhatsApp’s chatbot not to suggest privacy regulators to users struggling to delete their accounts.
Websites are temporarily going offline as admins address two critical PHP flaws that could let attackers run malicious code on their servers.
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset.
A convincing “creator portal” uses your own YouTube videos and viewing figures to steal your Google login.
A flaw in Signal’s calling library could let another participant keep hearing you after you hang up. Update your app to get the latest fixes.
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment and other services to reach their targets.
Two critical PHP remote code execution flaws (PHP2Shell) are reportedly being exploited. See who’s exposed, how the exploits work, and how to remediate now.
Categories: Threat ResearchTags: advisory, vulnerability, php
The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?
Android users report that Google automatically added their phone number to accounts they wanted to keep separate. Here’s how to check yours.
Owners reported unexpected recordings of private conversations, but Meta hasn’t explained what went wrong or what happened to the audio.
An influencer’s invitation to join her on a farm shows how public videos can feel dangerously personal.
You can trust a social media platform and still get scammed by an ad running on it
<p>The China-based threat group uses DLL sideloading in these attacks</p>Categories: Threat ResearchTags: BRONZE SANDCASTLE, Meterpreter, Sandboxie
Attackers tampered with AOMEI Backupper’s update system to deliver malware that could give them remote access to users’ PCs.
This week on the Lock and Code podcast, we speak with John DeMay about a sextortion plot that targeted his son on the night of his suicide.
The California Department of Education notified students about a data breach at contractor Educational Testing Service.
A list of topics we covered in the week of October 12 to October 18 of 2026
No novelty required to be effectiveCategories: Threat Research, X-ops, Sophos SecOpsTags: incident response