European Union
Global standards
US
UK
Australia
Netherlands
Ticker feed
Sony Network Communications confirmed that hackers breached So-net, its Japanese internet service provider, stealing personal data from roughly 2.6 million current and former subscribers. The attackers accessed the member database on October 19, with the company detecting the intrusion four days later. How they got in hasn’t been disclosed.
Stolen data includes names, birthdates, gender, phone numbers, email addresses, user IDs, and internet connection IDs: 2.14 million records from So-net subscribers and 443,000 from Plala (S Course), a plan sold with NTT Docomo’s fiber service and run by So-net. About 293,000 belong to people who left in March 2026 or later.
Around 54,000 passwords for four add-on email services were also taken, which So-net says put attackers in a position to read and send mail. Sixteen bank account records were exposed, though no credit card or PIN data was stored. NURO and other services weren’t affected.
So-net has reset the affected email passwords and notified Japan’s Personal Information Protection Commission.
Source: SecurityWeek
Sony Network Communications confirmed that hackers breached So-net, its Japanese internet service provider, stealing personal data from roughly 2.6 million current and former subscribers. The attackers accessed the member database on October 19, with the company detecting the intrusion four days later. How they got in hasn’t been disclosed.
Stolen data includes names, birthdates, gender, phone numbers, email addresses, user IDs, and internet connection IDs: 2.14 million records from So-net subscribers and 443,000 from Plala (S Course), a plan sold with NTT Docomo’s fiber service and run by So-net. About 293,000 belong to people who left in March 2026 or later.
Around 54,000 passwords for four add-on email services were also taken, which So-net says put attackers in a position to read and send mail. Sixteen bank account records were exposed, though no credit card or PIN data was stored. NURO and other services weren’t affected.
So-net has reset the affected email passwords and notified Japan’s Personal Information Protection Commission.
Source: SecurityWeek
WordPress dropped version 7.1.4 on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated remote code execution flaw in the update process itself.
The RCE stems from a race condition during updates, where predictable temp folder names and a missing index.php file could let an attacker hijack the installer using their own database. Exploitation requires zero credentials but is difficult: the attacker must hit a seconds-long update window, and the wp-content/upgrade/ folder must be reachable from the web.
The fix adds 16 random characters to folder names, restores file protections, and stops wp-config.php from being copied. Almost all the other fixes, covering stored XSS, data exposure, and permission gaps, need an account to exploit, usually at Contributor level. WordPress hasn’t reported any active exploitation.
Fixes reach every branch back to 4.7; versions 4.6 and earlier get none. Admins should update now — don’t wait for WordPress 7.2 in December.
Source: Cybersecurity News
WordPress dropped version 7.1.4 on October 28, 2026, fixing 22 security vulnerabilities. The most serious is an unauthenticated remote code execution flaw in the update process itself.
The RCE stems from a race condition during updates, where predictable temp folder names and a missing index.php file could let an attacker hijack the installer using their own database. Exploitation requires zero credentials but is difficult: the attacker must hit a seconds-long update window, and the wp-content/upgrade/ folder must be reachable from the web.
The fix adds 16 random characters to folder names, restores file protections, and stops wp-config.php from being copied. Almost all the other fixes, covering stored XSS, data exposure, and permission gaps, need an account to exploit, usually at Contributor level. WordPress hasn’t reported any active exploitation.
Fixes reach every branch back to 4.7; versions 4.6 and earlier get none. Admins should update now — don’t wait for WordPress 7.2 in December.
Source: Cybersecurity News
Tech leaders are warning of a coming “vulnerability tsunami” after researchers used AI to help find two critical flaws in PHP, the coding language behind millions of websites. Wiz researchers say the underlying flaws had been present for decades.
The scramble began with the October 21 disclosure. The NSA issued an urgent alert, and government and private websites in the US and UK temporarily went offline to apply fixes. Cloudflare CEO Matthew Prince said exploit attempts climbed from thousands in the 10 hours before the announcement to millions afterward, and CISA has since confirmed the flaws are being exploited.
“I no longer think we’re going to be able to patch all bugs,” said OpenAI CEO Sam Altman. Anthropic deputy chief information security officer Jason Clinton warned there “won’t be enough time to patch critical infrastructure,” and Salesforce CEO Marc Benioff called it a “code red.” The next two years, Prince said, will be “incredibly fraught.”
Source: The Guardian
Tech leaders are warning of a coming “vulnerability tsunami” after researchers used AI to help find two critical flaws in PHP, the coding language behind millions of websites. Wiz researchers say the underlying flaws had been present for decades.
The scramble began with the October 21 disclosure. The NSA issued an urgent alert, and government and private websites in the US and UK temporarily went offline to apply fixes. Cloudflare CEO Matthew Prince said exploit attempts climbed from thousands in the 10 hours before the announcement to millions afterward, and CISA has since confirmed the flaws are being exploited.
“I no longer think we’re going to be able to patch all bugs,” said OpenAI CEO Sam Altman. Anthropic deputy chief information security officer Jason Clinton warned there “won’t be enough time to patch critical infrastructure,” and Salesforce CEO Marc Benioff called it a “code red.” The next two years, Prince said, will be “incredibly fraught.”
Source: The Guardian
Denver Health Medical Plan (DHMP) is notifying 238 083 current and former members that their personal and health data may have been exposed after an access key belonging to its analytics vendor, SquareML, was accidentally leaked on a public website.
The key went online on June 27, 2025, and stayed live until it was revoked on August 18, 2026 — a 14-month exposure window. SquareML told DHMP about the leak on August 14.
The key gave read-only access to a SquareML database holding names, birth dates, ZIP codes, plan eligibility, hospital admission and discharge data, and health metrics such as BMI, HbA1c, and eGFR values. It couldn’t be used to download, export, or change records, and no Social Security numbers or financial data were stored there.
DHMP says it has no evidence the information was viewed or misused, only that it may have been, and has reset passwords on all accounts with database access.
Source: SecurityWeek
Denver Health Medical Plan (DHMP) is notifying 238 083 current and former members that their personal and health data may have been exposed after an access key belonging to its analytics vendor, SquareML, was accidentally leaked on a public website.
The key went online on June 27, 2025, and stayed live until it was revoked on August 18, 2026 — a 14-month exposure window. SquareML told DHMP about the leak on August 14.
The key gave read-only access to a SquareML database holding names, birth dates, ZIP codes, plan eligibility, hospital admission and discharge data, and health metrics such as BMI, HbA1c, and eGFR values. It couldn’t be used to download, export, or change records, and no Social Security numbers or financial data were stored there.
DHMP says it has no evidence the information was viewed or misused, only that it may have been, and has reset passwords on all accounts with database access.
Source: SecurityWeek
CISA has added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Both flaws score 9.2 on CVSS v4.0 and can allow unauthenticated remote code execution. The listing followed successful code execution against honeypots on October 24, reported by Perplexity detection and response lead Adel Karimi.
Karimi noted the chain ran on a deliberately favorable single-worker Apache mod_php setup, so it doesn’t show how reliably the exploit works elsewhere. Censys estimates more than 32.5 million PHP services still run an affected version.
Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, and US federal agencies must apply them by October 29. PHP 8.1 and earlier no longer receive official fixes.
Source: The Hacker News
CISA has added two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Both flaws score 9.2 on CVSS v4.0 and can allow unauthenticated remote code execution. The listing followed successful code execution against honeypots on October 24, reported by Perplexity detection and response lead Adel Karimi.
Karimi noted the chain ran on a deliberately favorable single-worker Apache mod_php setup, so it doesn’t show how reliably the exploit works elsewhere. Censys estimates more than 32.5 million PHP services still run an affected version.
Fixes landed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, and US federal agencies must apply them by October 29. PHP 8.1 and earlier no longer receive official fixes.
Source: The Hacker News
Dutch police arrested two men on October 6 over a bank helpdesk fraud scheme that stole more than €380,000 (~$425,600) from 170 victims in about three weeks. Victims received calls with AI-generated audio impersonating their bank, then a fake bank employee told them to download an app and scan their debit card against their phone.
That app extracted the card’s NFC chip data and relayed it to an accomplice waiting at an ATM, who then withdrew cash in real time. A 23-year-old from Vaassen allegedly built the infrastructure and directed the attacks, while a 25-year-old from Ede coordinated operations. Both remain in custody, and authorities seized their servers, phones, and laptops.
Source: SecurityWeek
Dutch police arrested two men on October 6 over a bank helpdesk fraud scheme that stole more than €380,000 (~$425,600) from 170 victims in about three weeks. Victims received calls with AI-generated audio impersonating their bank, then a fake bank employee told them to download an app and scan their debit card against their phone.
That app extracted the card’s NFC chip data and relayed it to an accomplice waiting at an ATM, who then withdrew cash in real time. A 23-year-old from Vaassen allegedly built the infrastructure and directed the attacks, while a 25-year-old from Ede coordinated operations. Both remain in custody, and authorities seized their servers, phones, and laptops.
Source: SecurityWeek
A vulnerability originally flagged in Node.js turns out to be much broader. CVE-2026-111497 lives inside Google’s Brotli decoder, and JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan have shown it can crash or corrupt .NET apps, FFmpeg, ClickHouse servers, and Apache Arrow workloads.
The flaw affects Brotli 1.0.3 through 1.2.0 and is fixed in 1.0.10, 1.1.1, and 1.2.1. An invalid block switch tricks the decoder into continuing with broken state, enabling out-of-bounds memory writes. ClickHouse crashed on a single crafted HTTP request. Apache Arrow entered an infinite CPU loop. FFmpeg corrupted memory via a malicious JPEG XL file, though the researchers stopped short of a full remote code execution exploit.
Node.js patches shipped October 21, and Microsoft began rolling out .NET updates on October 25. When the research was published, ClickHouse had merged a fix without shipping a release, and Arrow’s issue was still open. Teams should audit any code path that decompresses untrusted Brotli data — version numbers alone won’t tell the full story, because projects can patch Brotli without changing versions.
Source: Cybersecurity News
A vulnerability originally flagged in Node.js turns out to be much broader. CVE-2026-111497 lives inside Google’s Brotli decoder, and JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan have shown it can crash or corrupt .NET apps, FFmpeg, ClickHouse servers, and Apache Arrow workloads.
The flaw affects Brotli 1.0.3 through 1.2.0 and is fixed in 1.0.10, 1.1.1, and 1.2.1. An invalid block switch tricks the decoder into continuing with broken state, enabling out-of-bounds memory writes. ClickHouse crashed on a single crafted HTTP request. Apache Arrow entered an infinite CPU loop. FFmpeg corrupted memory via a malicious JPEG XL file, though the researchers stopped short of a full remote code execution exploit.
Node.js patches shipped October 21, and Microsoft began rolling out .NET updates on October 25. When the research was published, ClickHouse had merged a fix without shipping a release, and Arrow’s issue was still open. Teams should audit any code path that decompresses untrusted Brotli data — version numbers alone won’t tell the full story, because projects can patch Brotli without changing versions.
Source: Cybersecurity News
Palo Alto Networks has confirmed that the two critical PHP2Shell flaws in PHP, CVE-2026-109618 and CVE-2026-109619, affect every release of PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls, plus all Panorama systems. No special configuration is needed to be vulnerable. Two cloud services, Cortex XCORE and WildFire Cloud, were also affected but have since been fixed.
PHP scores both flaws 9.2 on CVSS v4.0, but Palo Alto rates the impact on its products at 8.7, High, and lists availability as the affected property rather than data theft or takeover. Exposure is limited to the management web interface and XML API, plus any dataplane interface with a management profile attached. GlobalProtect portals and gateways aren’t affected.
Palo Alto says it isn’t aware of malicious exploitation of its products, though Unit 42 has seen proof-of-concept exploits for PHP2Shell. The first PAN-OS hotfixes are estimated for October 26, with the rest due by October 30. Until then, admins should restrict management interface access to trusted internal IPs and avoid internet-facing exposure.
Source: Cybersecurity News
Palo Alto Networks has confirmed that the two critical PHP2Shell flaws in PHP, CVE-2026-109618 and CVE-2026-109619, affect every release of PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls, plus all Panorama systems. No special configuration is needed to be vulnerable. Two cloud services, Cortex XCORE and WildFire Cloud, were also affected but have since been fixed.
PHP scores both flaws 9.2 on CVSS v4.0, but Palo Alto rates the impact on its products at 8.7, High, and lists availability as the affected property rather than data theft or takeover. Exposure is limited to the management web interface and XML API, plus any dataplane interface with a management profile attached. GlobalProtect portals and gateways aren’t affected.
Palo Alto says it isn’t aware of malicious exploitation of its products, though Unit 42 has seen proof-of-concept exploits for PHP2Shell. The first PAN-OS hotfixes are estimated for October 26, with the rest due by October 30. Until then, admins should restrict management interface access to trusted internal IPs and avoid internet-facing exposure.
Source: Cybersecurity News
LiteLLM, a popular open source proxy for AI model routing, was compromised on October 21 when attackers hijacked its release pipeline and published a poisoned version 1.107.0. The packages were live for about three hours across PyPI and Docker Hub, long enough for an estimated 49 000 downloads. The GitHub source tag was clean — the artifacts came from a lookalike repository.
Attackers held GitHub CLI OAuth tokens for three developer accounts. LiteLLM says one set likely leaked through Claude Code, which in specific circumstances embeds tokens into a response body that may be logged — and the internal deployment holding those logs was exposed to the public internet. How the attackers reached that deployment, or moved laterally once inside, remains unclear. They used the tokens to disable branch protections, redirect the release pipeline, and publish signed packages.
The payload drops three files into the site-packages root and runs whenever a Python interpreter starts, with no import of litellm needed. It harvests browser credentials, AWS, GCP, and Azure secrets, SSH keys, and AI API keys from Anthropic, OpenAI, and GitHub Copilot, encrypting them to litellm[.]dev — a lookalike domain registered eight days earlier. A second component fetches fresh code hourly.
Wiz saw attackers querying Amazon Bedrock with stolen AWS credentials about 4.5 hours after exfiltration, which it reads as LLMjacking. Enterprise customers on LiteLLM’s private repository were unaffected. Anyone who installed 1.107.0, including through the Docker latest, main-latest, or main-stable tags, should remove it, rotate every credential on the machine, and scan for malware. The latest clean version is 1.106.2.
Source: SecurityWeek
LiteLLM, a popular open source proxy for AI model routing, was compromised on October 21 when attackers hijacked its release pipeline and published a poisoned version 1.107.0. The packages were live for about three hours across PyPI and Docker Hub, long enough for an estimated 49 000 downloads. The GitHub source tag was clean — the artifacts came from a lookalike repository.
Attackers held GitHub CLI OAuth tokens for three developer accounts. LiteLLM says one set likely leaked through Claude Code, which in specific circumstances embeds tokens into a response body that may be logged — and the internal deployment holding those logs was exposed to the public internet. How the attackers reached that deployment, or moved laterally once inside, remains unclear. They used the tokens to disable branch protections, redirect the release pipeline, and publish signed packages.
The payload drops three files into the site-packages root and runs whenever a Python interpreter starts, with no import of litellm needed. It harvests browser credentials, AWS, GCP, and Azure secrets, SSH keys, and AI API keys from Anthropic, OpenAI, and GitHub Copilot, encrypting them to litellm[.]dev — a lookalike domain registered eight days earlier. A second component fetches fresh code hourly.
Wiz saw attackers querying Amazon Bedrock with stolen AWS credentials about 4.5 hours after exfiltration, which it reads as LLMjacking. Enterprise customers on LiteLLM’s private repository were unaffected. Anyone who installed 1.107.0, including through the Docker latest, main-latest, or main-stable tags, should remove it, rotate every credential on the machine, and scan for malware. The latest clean version is 1.106.2.
Source: SecurityWeek
Oracle has pushed an emergency Java security update to fix CVE-2026-91403, a critical vulnerability scoring 9.1 on CVSS 3.1, published October 21. The flaw sits in JSSE, the Java SE component that handles HTTPS trust decisions, and also affects GraalVM. Oracle rates it easy to exploit, with no login or user interaction needed.
The root cause lies outside Java’s code: certificate authority eMudhra issued intermediate certificates with weak private keys, after a scripting error left them one byte long. An attacker in a man-in-the-middle position could use those keys to forge certificates for any hostname, making malicious sites appear legitimate to Java clients. Browsers already reject the eight revoked certificates; Oracle’s update makes Java distrust them too.
Affected supported releases are Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1, plus GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Older, unsupported versions weren’t tested and may also be vulnerable. No confirmed attacks have been reported.
Oracle recommends updating immediately. As a stopgap, admins can replace Java’s blocked.certs file with Oracle’s supplied version (blacklisted.certs on Java 8) or turn on TLS revocation checks.
Source: Cybersecurity News
Oracle has pushed an emergency Java security update to fix CVE-2026-91403, a critical vulnerability scoring 9.1 on CVSS 3.1, published October 21. The flaw sits in JSSE, the Java SE component that handles HTTPS trust decisions, and also affects GraalVM. Oracle rates it easy to exploit, with no login or user interaction needed.
The root cause lies outside Java’s code: certificate authority eMudhra issued intermediate certificates with weak private keys, after a scripting error left them one byte long. An attacker in a man-in-the-middle position could use those keys to forge certificates for any hostname, making malicious sites appear legitimate to Java clients. Browsers already reject the eight revoked certificates; Oracle’s update makes Java distrust them too.
Affected supported releases are Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1, plus GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Older, unsupported versions weren’t tested and may also be vulnerable. No confirmed attacks have been reported.
Oracle recommends updating immediately. As a stopgap, admins can replace Java’s blocked.certs file with Oracle’s supplied version (blacklisted.certs on Java 8) or turn on TLS revocation checks.
Source: Cybersecurity News
