News Advisories, exploited vulnerabilities and the stories behind them
The RecordMoldova investigates possible foreign involvement in major government cyberattack
r/cybersecurityTransferring existing certs and WGU degree
r/cybersecurityResearchers uncover Volt Typhoon’s covert, ephemeral network
r/cybersecurityTailscale Releases Emergency Fix for “Tailworm” SSH Flaws
-
BleepingComputer
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]
-
Cisco Security Advisories
Cisco Advance Notification for Publication of November 4, 2026, Security Advisories
On November 4, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Identity Services Engine (ISE) UCS Central Software Unified Communications Manager To remediate vulnerabilities to be disclosed on November 4, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories. Important: The Cisco PSIRT does not plan to publish any more security hardening advisories to disclose security vulnerability infor…
-
The Register · Security
Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles
Ukrainian ransomware crook Artem Stryzhak has been sentenced to 70 months in the slammer by a New York federal court for his role as an affiliate of the Nefilim and Hive ransomware gangs. Prosecutors believe the cybercriminal began working with Nefilim in or around June 2021, while living in Barcelona, Spain. The Nefilim ransomware-as-a-service (RaaS) operation was known for targeting wealthy companies, with its operators encouraging affiliates to pursue businesses capable of paying substantial ransom demands. One of Nefilim's most high-profile attacks was on Australian logistics giant Toll G…
-
r/cybersecurity
Discord Is Making Public Messages Searchable on Google, and Your Old Posts Could Reach Strangers
r/cybersecurity · techtimes.co.uk
-
r/cybersecurity
AI Workshop Training Question
Hello, I’m sort of diving into the AI Cyber Security side of things and I’m a bit struggling and looking for some guidance. I’m very interested in the security side of this but I’m having a very hard time wrapping my head around agents / RAGs / LLM and prompts etc and how they all work together and so on. I’m an extreme hands on learner and I want to build my own from scratch just some simple “AI…
-
r/cybersecurity
Architecture Review: Full-System Design for a Hybrid ML/GNN Network Intrusion Detection System MVP
Context: I am developing a Python-based Network Intrusion Detection System (NIDS) designed to move beyond traditional signature-based constraints. The application is a hybrid system: it uses an ensemble layer (Random Forest + XGBoost) for fast statistical flow classification, paired with a Graph Neural Network layer (GraphSAGE) to analyze structural anomalies and lateral movement patterns. The pr…
-
The Record
UK to look at making software companies liable for cyber breaches
The new U.K. budget says the government will "consider where liability for cyber breaches should sit," potentially a landmark shift for a country that has relied on voluntary codes to encourage software vendors to improve security.
-
r/netsec
Scanning 7.25 Million Public Repositories on China's Largest Git Platform for Secrets
r/netsec · mongodb.com
-
The Record
Belarusian hackers increasingly acting as proxies for Russia amid war in Ukraine
Belarus-linked hackers are increasingly aligning their cyber operations with Russia's interests in Ukraine, researchers said Wednesday.
-
r/blueteamsec
SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks
r/blueteamsec · hybrid-analysis.blogspot.com
-
SecurityWeek
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.
-
r/cybersecurity
Global Vulnerability Scanning of Backport Fixes
Working in a large org, I am curious how other teams are validating backported patches when large security vendors are not able to successfully delineate the differences between patched and unpatched versions? (Specifically recent events) I say this as I have already verified that backport patches are in place on machines that are still showing as vulnerable in some vulnerability scanners. Does a…
-
BleepingComputer
Microsoft urges Entra ID admins to migrate users to passkeys
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. [...]
-
r/ReverseEngineering
Inside our inline hooking engine: relocating prologues with iced-x86 (x86-64 + AArch64, deps closed to two crates)
r/ReverseEngineering · rutken.com
-
Dark Reading
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.
-
r/cybersecurity
Question
Alright, question for other seasoned cyber professionals. I've been in offsec for about a decade, I currently have something like 12 certs and 2 masters. My question, my current job paid for all of those except i think 3 certs. I have zero desire to get another certification. my question, if work was paying, and you knew you could finish another degree from WGU in 6 months of less, and you're all…
-
r/cybersecurity
Interplains - zero breach
Has anyone seen this tool called zero breach by some people called interplains or something? Publicity seemed very suspicious, and their delivery seemed even more... Given my limited if even existing expertise in this matter, I wanted some opinions before trying it. They have a repository on github "interplains" "zero breach". Thank you
-
r/cybersecurity
Saw a 10+ year Big 4 IT Auditor say AI is automating core testing and shrinking contracts. How accurate is this from the Cyber/GRC side?
Saw a post over on r/ITAudit recently from a Big 4 vet with 10+ years in the field, and it raised some interesting points about where the domain is heading. His main argument wasn't just the usual complaint about burnout or long hours. He claimed IT Audit is going through a real structural shift because of AI and client budget cuts: Contract prices are getting squeezed: Clients are renegotiating…
-
NVD CVE API 2.0
CVE-2026-115968 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-115968 -
NVD CVE API 2.0
CVE-2026-104286 · fortinet, fortimail · CVSS 9.8
CVSS 9.8 (v3.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) → 9.8 (v3.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); Modified; +1 -35 CPE criteria (now 1); +1 references (now 2); added to CISA KEV, due 2026-10-04. An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMail 7.4.0 through 7.4.7, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests
Fix: 5 public exploits · CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-10-04) · 1 patch or advisory reference on NVD Fix panel
-
r/ReverseEngineering
A new obliterated version of curser that works with your local models
r/ReverseEngineering · github.com
-
BleepingComputer
InfraTrust report warns of exploited flaws in critical network infrastructure
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]
-
r/cybersecurity
AMA: I spent eight months investigating the cybersecurity bootcamp IronCircle (formerly ThriveDX)
I'm an investigative reporter with The Hechinger Report, a national education news site. I've spent much of this year looking into the for-profit cybersecurity bootcamp IronCircle (formerly ThriveDX and HackerUSA.) You can read my story here: https://hechingerreport.org/a-university-branded-boot-camp-promised-tech-jobs-it-delivered-only-debt/ Over the course of my reporting, IronCircle was first…
-
r/cybersecurity
😲 An operator stole 68 GB from a Philippine government agency, then left the evidence open on the internet
r/cybersecurity · hunt.io
-
SecurityWeek
Upwind Security Raises $400 Million at $3.8 Billion Valuation
The massive funding round comes just days after reports emerged that Upwind had attracted acquisition interest from several companies, including Datadog The post Upwind Security Raises $400 Million at $3.8 Billion Valuation appeared first on SecurityWeek.
-
BleepingComputer
Even after PHP2Shell, blast radius matters more than a CVSS score
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. [...]
-
r/cybersecurity
The largest cyber attack on the Republic of Moldova: over 750,000 ID numbers compromised, public services paralyzed and major fraud risks
r/cybersecurity · rfi.fr
-
r/blueteamsec
I recreated a Node2Shell (CVE-2026-111497) RCE attack in the form of an interactive exercise
On 21 October 2026, Google released patched versions of its Brotli compression library for CVE-2026-111497, a vulnerability nicknamed Node2Shell. It is an out-of-bounds write in the Brotli decoder (fixed builds 1.0.10, 1.1.1 and 1.2.1), reachable through Content-Encoding: br on both incoming requests and fetched responses. I made an interactive, hands-on lab exercise on this vulnerability. The go…
CVE-2026-111497 -
r/cybersecurity
Getting harder to distinguish bots. Are there useful application-side techniques?
Midsize company, we are struggling to block Muse and I assume it will only get harder from here. Trying to lean on CloudFlare tools but they don't seem to be effective. Wondering if it's worth trying hidden honeypot fields or similar techniques? Something like a reverse captcha that only AI could quickly solve, like obscure trivia or similar? What else can we do?
-
SecurityWeek
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches. The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.
-
NVD CVE API 2.0
CVE-2026-48356 · adobe, commerce, commerce_b2b · CVSS 9.3
Analyzed. Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Fix: 2 public exploits · CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-11-10) · 1 patch or advisory reference on NVD Fix panel
-
r/blueteamsec
Unveiling Sirius Backdoor: A Multistage Fileless Campaign Disguised as FedEx Invoices
r/blueteamsec · trellix.com
-
r/cybersecurity
CISA Confirms Active Exploitation of Node2Shell / HTTP2Shell
r/cybersecurity · bleepingcomputer.com
CVE-2026-111497 -
r/netsec
Where a million-request-a-second HTTP/2 flood goes: XDP drop counters from two real attacks
r/netsec · shieldify.ee
-
r/cybersecurity
"Hypothetical" issues with a government payment system
Hypothetically if I discovered that a government near mes large scale system that handles 1m+ card transactions per year. Terminals was built but putting a RPI NFC reader USB barcode scanner and a 4g modem in a box and shipping it with Ubuntu 16. This was installed in 2025 and the last build date of the os was 2023 And hypothetically it was setup with default pi username "pi" and unknown if any p…
-
SecurityWeek
TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers. The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek.
