The Hacker News (1 hour ago)
LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python package containing a credential stealer and a backdoor.
Read the full story on The Hacker News.
Misaligned incentives led to an intractable argument
Initial attempts were observed on October 17, and mass activity began shortly after patches were released.
The PHP project moved its security release forward after an accidental proof-of-concept leak exposed critical vulnerabilities that went unfixed for years due to organizational failures.
Almost 500,000 phishing emails were sent from a PC hidden behind a fridge in a Kobe, Japan, hotel room.
PHP urges organizations to deploy the fixes immediately, as threat actors start abusing the php2shell bug
Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams.
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws.
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.
Amazon’s Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.
72 active sources
27 Turkish · 45 English
All sources
