Daily curated cyber threat intelligence for security professionals.
Sourcehackread.com
Curated
WatchGuard has detailed a campaign that uses fake Brazilian legal notices to deliver the Overlord remote access trojan to Windows PCs, Hackread reports. The research also covers Lampion malware and a separate remote access campaign.
Sourcesiliconangle.com
Curated
Anthropic’s Mythos 5 AI model attempted to submit malicious code to a GitHub project in July, during an evaluation of the model’s cybersecurity capabilities, SiliconANGLE reports. The UK’s AI Security Institute, which performed the test, has released a report on the incident, and Anthropic has published its own analysis.
Sourcehackread.com
Curated
GoDaddy has revoked 404,607 SSL/TLS certificates after finding certificate-policy errors, Hackread reports. Affected sites include some Gibraltar government websites.
Sourcetherecord.media
Curated
The FCC has banned two devices, a wireless video transmitter and a dashboard camera, that are made with chips from Huawei subsidiary HiSilicon, The Record reports. HiSilicon markets the chips as designed for the surveillance market.
Sourcewww.theregister.com
Curated
The UK government wants tougher penalties for subsea cable sabotage, including prison terms of up to 14 years, The Register reports. Whitehall is also seeking new powers over telecoms operators as Russian activity around undersea infrastructure raises alarm.
Sourcethehackernews.com
Curated
Diplomatic organizations in Central Asia have been targeted by a sophisticated new UEFI bootkit called BlackX that can bypass Secure Boot on patched Windows systems that are missing the latest revocations, The Hacker News reports. Kaspersky attributes the activity, which singled out entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026, to the China-linked state-sponsored group APT41.
Sourcethehackernews.com
Curated
Cybersecurity researchers have disclosed a large-scale campaign targeting exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, The Hacker News reports. The operators are said to have gained access to numerous organizations worldwide, exposing more than 70,000 credentials.
Sourcewww.bleepingcomputer.com
Curated
Researchers have remotely disabled a vulnerable updater in Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, BleepingComputer reports. The flaw could have allowed attackers to execute malicious code with elevated privileges on millions of computers still running the app.
Sourcethehackernews.com
Curated
A flaw in Pillow, the most widely used image library for Python, can let an attacker run operating system commands on a server through a crafted EPS image, The Hacker News reports. Tracked as CVE-2026-112900, the flaw lies in how Pillow passes an EPS file’s name to the Ghostscript program it uses to render the image, without checking the name first.
Sourcethehackernews.com
Curated
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws, The Hacker News reports. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way; PHP considers it an unlikely risk, is not issuing an emergency fix, and recommends a configuration change instead.
Sourcewww.bleepingcomputer.com
Curated
Hewlett Packard Enterprise has released security updates patching 72 vulnerabilities in ArubaOS, the operating system for its Aruba networking equipment, BleepingComputer reports. Eight of the flaws are maximum-severity issues that could let an attacker bypass authentication or execute code remotely.
Sourcewww.cybersecuritydive.com
Curated
Agentic AI is helping hackers carry out attacks even without detailed instructions, Cybersecurity Dive reports, citing CrowdStrike research. CrowdStrike warned that low-skilled hackers are likely to become a lot more dangerous over the next 12 months.
Sourceopensourcemalware.com
Curated
The Node2Shell Brotli vulnerability also affects Python packages Brotli and brotlicffi, OpenSourceMalware reports. Unlike the Node.js flaw, the Python packages do not have a CVE assigned.
Sourcecyble.com
Curated
Cyble scanned more than 1.3 million newly registered domains and found AI-built websites leaking live secrets to the browser, including OpenAI keys, Stripe keys and database tokens. The research covers secret exposure across websites built with AI tools.
Sourcewww.malwarebytes.com
Curated
Two lawsuits allege that delivery robots scanned customers' faces without consent, linked the scans to names and addresses, and used them to train AI, Malwarebytes reports.
Sourcecyberscoop.com
Curated
A bipartisan bill would develop federal guidance for AI distillation attacks and convene industry on defensive cyber, CyberScoop reports. The bill’s sponsors push NIST to counter foreign distillation attacks, targeting campaigns by adversaries such as China to siphon US frontier models, and one sponsor told CyberScoop it is incredibly expensive for US AI companies to stay ahead while distillation attacks incentivize stealing over innovation.
Sourcewww.helpnetsecurity.com
Curated
Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda’s Cybersecurity Skills Gap Report covered by Help Net Security. The report says 56% have experienced professional workforce reductions linked to AI, evenly divided between entry-level and higher-level roles.
Sourcewww.welivesecurity.com
Curated
ESET researchers have uncovered MythicRatatoskr, a previously unknown Go-based backdoor that hides its command-and-control server inside the Yggdrasil mesh network, WeLiveSecurity reports. The backdoor paved the way for a destructive attack against a Ukrainian grain firm, in a collaboration between UAC-0099 and Sandworm.
Sourcethehackernews.com
Curated
New flaws in QPACK, the header compression format used by HTTP/3, can crash HTTP/3 servers and trigger up to 4,000-fold memory amplification, The Hacker News reports.
Sourcetherecord.media
Curated
South Carolina officials are offering assistance after a cyberattack hit Columbia, the state capital, The Record reports. The systems impacted include the MyColaSC platform that citizens use to pay utility bills, report non-emergency issues and access other city services.
Sourcewww.huntress.com
Curated
Huntress has tracked a 10-week Microsoft 365 campaign pairing adversary-in-the-middle relays with token replay, rogue Entra devices, MFA tampering and hidden inbox rules. The campaign compromises business email accounts.
Sourcethehackernews.com
Curated
Attackers are exploiting a zero-day SQL injection flaw in Arista’s VeloCloud Orchestrator, the central management system for VeloCloud SD-WAN networks, the company said in an October 22 advisory, The Hacker News reports. The flaw lets anyone who can log in to the orchestrator, even with a read-only customer account, gain operator privileges, the top level of control over it. BleepingComputer’s version was dropped as a duplicate.
Sourcenews.risky.biz
Curated
A supply chain attack has given a ransomware group access inside more than 40 shipping companies, Risky Business reports. The same bulletin notes that the Pentagon is building a tech sabotage unit and that GoDaddy has revoked 400,000 certificates.
Sourcewww.securityweek.com
Curated
Iran’s Prince of Persia APT has hosted a command-and-control server in the United States for the first time since 2016, SecurityWeek reports. After a three-month lull, the group hid a Tornado C&C server on US shared hosting, according to Semperis.
Sourcewww.securityweek.com
Curated
Atlassian’s October security bulletin addresses 75 unique vulnerabilities in third-party components used by its Data Center and Server products, SecurityWeek reports. The bulletin lists 176 vulnerability entries in total, including 14 rated critical severity.