The Hacker News (4 hours ago)
Amazon’s Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the flaws come under broad exploitation in the wild following the release of the patches.
Read the full story on The Hacker News.
It has been a dramatic, public and global response, but the cyber event hasn’t happened yet.
‘500 new vulnerabilities’ found in government, says AI minister
Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.
ESET linked hackers to Russia, using a decentralised network to hide their malware during an attack on a Ukrainian grain company. The security company says it is the first documented case of a state-linked hacking group using the Yggdrasil network in this way.
Misaligned incentives led to an intractable argument
Initial attempts were observed on October 17, and mass activity began shortly after patches were released.
LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python package containing a credential stealer and a backdoor.
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws.
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code.
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.
72 active sources
27 Turkish · 45 English
All sources
