The Hacker News (3 hours ago)
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services “developed using DeepSeek implementations,” under a Department of Homeland Security order.
Read the full story on The Hacker News.
The web is a bit of a hot mess today following the discovery of two severe vulnerabilities.
There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.
You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model.
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination.
Organisations that cannot quickly patch two critical flaws in PHP should consider taking their websites offline, the EU’s cybersecurity response team has warned. PHP powers a large share of the web. The PHP project will release fixes at 14:00 UTC on Wednesday, October 21.
Unknown threat actors breached TeamUpdraft’s website and potentially gained unauthorized access to customers’ connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites.
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that’s collectively called Plex2Shell.
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization.
72 active sources
27 Turkish · 45 English
All sources
