Cybersecurity News: Breaches, Ransomware & Zero-Days

10,134 stories · Updated every 5 minutes

1. CISA Confirms PHP2Shell Exploitation, Orders Federal Agencies to Patch

   HackRead · 27 Oct 2026, 23:56 IST · Medium severity

   The US Cybersecurity and Infrastructure Security Agency (CISA) added two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, to its…

2. Microsoft releases Windows OOB updates to distrust eMudhra certificates

   BleepingComputer · 27 Oct 2026, 23:50 IST · Medium severity

   Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.

3. Anthropic says it will be burning lots of natural gas to feed the AI boom

   TechRadar · 27 Oct 2026, 23:35 IST · Medium severity

   Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security. Benedict provides detailed analysis on state-sponsored threat actors, APT...

4. Brotli bug reaches far beyond Node.js (CVE-2026-111497)

   Help Net Security · 27 Oct 2026, 23:08 IST · Medium severity

   A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. About CVE-2026-111497 Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”,...

5. Cybersecurity CEO Indicted For Allegedly Scamming Millions From Ransomware Victims

   Slashdot · 27 Oct 2026, 22:30 IST · High severity

   An anonymous reader quotes a report from ProPublica: A Florida man who was the subject of a 2019 investigation by ProPublica was indicted last month on federal charges that he defrauded clients of his ransomware data recovery firm....

6. OTX Threat: PHP2Shell (CVE-2026-109618/9) Havoc: UNC actors leveraging Public Exploit Code Against Public, Business And Educational Infrastructure

   AlienVault OTX · 27 Oct 2026, 17:45 IST · Critical severity

   Two critical use-after-free vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2, affect the session.upload_progress feature. These flaws trigger during multipart request parsing before application code...

7. OTX Threat: PHP2Shell: Exploitation Attempts and Remediation Trends

   AlienVault OTX · 27 Oct 2026, 19:42 IST · Medium severity

   Wiz Research has been monitoring exploitation attempts targeting two critical PHP vulnerabilities since their public disclosure on October 21, 2026. While no successful attacks have been observed in their telemetry, some private...

8. OTX Threat: Inside ICMacOS: From an Infostealer to a Persistent RAT

   AlienVault OTX · 27 Oct 2026, 17:45 IST · Medium severity

   ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums. The malware targets macOS systems running Sierra...

9. OTX Threat: Camera Management Software Compromise Leads to Malware Deployment

   AlienVault OTX · 27 Oct 2026, 21:37 IST · Medium severity

   Attackers compromised camera management software (CMS.exe) to gain initial access to multiple organizational environments. Following compromise, adversaries deployed rs.win32.exe into user AppData directories and leveraged DLL...

10. OTX Threat: Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics

    AlienVault OTX · 27 Oct 2026, 21:37 IST · Critical severity

    A Brazilian Magecart group, active since 2024, conducted a supply chain attack by injecting a card skimmer into the Plausible analytics script of Brazilian ecommerce platform Convertr. Starting October 24, 2026, all Convertr checkouts...

11. USN-8957-1: authd vulnerability

    Ubuntu security notices · 27 Oct 2026, 21:53 IST · Medium severity

    Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to gain access to another user's local account and files, resulting...

12. 'Aokigahara' Stealer Targets 'Developer Keyrings' & AI Assistants

    darkreading · 27 Oct 2026, 22:17 IST · Medium severity

    The malware's focus on AI tools expands the traditional infostealer playbook to expose a forest of AI sessions, sensitive business data, and developer infrastructure from a single compromised endpoint.

13. Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances

    Infosecurity Magazine · 27 Oct 2026, 22:15 IST · High severity

    The University of New Mexico is working to restore systems following the incident, which has been claimed by the BYOD ransomware group

14. Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads

    The Hacker News · 27 Oct 2026, 19:29 IST · Medium severity

    Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting...

15. Warp discloses breach exposing AI agent logs, user telemetry data

    BleepingComputer · 27 Oct 2026, 21:45 IST · Medium severity

    Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure.

16. Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack

    The Register · 27 Oct 2026, 21:45 IST · Medium severity

    The University of New Mexico is canceling classes across the medicine, nursing, and pharmacy faculties for a second day amid continued efforts to recover from a "cybersecurity event." The attack targeted the Health Sciences Center on...

17. EPICS Base

    CISA Alerts · 27 Oct 2026, 17:30 IST · Medium severity

    View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following...

18. Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

    CISA Alerts · 27 Oct 2026, 17:30 IST · Medium severity

    View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations...

19. OTX Threat: How VBScript Malware Evades Detection Using Trusted Tools Copy

    AlienVault OTX · 27 Oct 2026, 17:45 IST · Medium severity

    Three malware campaigns using VBScript have been identified targeting victims primarily in Brazil and Portugal through phishing attacks. The campaigns deliver Overlord RAT, Lampion trojan, and an unknown RAT using fake legal notices,...

20. Microsoft Teams is getting a suite new AI features to crack down on phishing attacks

    IT Pro · 27 Oct 2026, 20:38 IST · Medium severity

    Nicole Kobie first started writing for ITPro in 2007. As a freelance journalist covering technology and business, Nicole's work includes bylines in New Scientist, Wired, PC Pro and many more. Nicole the author of a book about the...

21. OTX Threat: DarkCore: A Data-Theft RAT With a Session-Hijacking Browser

    AlienVault OTX · 27 Oct 2026, 17:45 IST · Medium severity

    Security researchers uncovered DarkCore, a remote access trojan distributed through cybercrime networks with advanced credential theft and session hijacking capabilities. The threat features a dedicated browser that reuses stolen...

22. University of New Mexico hospital diverts ambulances after cyberattack

    The Record by Recorded Future · 27 Oct 2026, 20:27 IST · Medium severity

    For about two hours on Monday, the organization diverted ambulances to health systems in Albuquerque and Santa Fe. They were forced to suspend outpatient surgeries and appointments for the remainder of the day.

23. Hackers Abuse Microsoft Teams External Chats to Access Corporate PCs

    HackRead · 27 Oct 2026, 20:13 IST · Medium severity

    Hackers impersonate IT support in Microsoft Teams external chats, tricking employees into granting remote access and installing malware on corporate computers.

24. CISA confirms PHP2Shell under attack as researchers clock successful exploits

    The Register · 27 Oct 2026, 20:15 IST · Medium severity

    The US government's cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week....

25. US government says hackers are now exploiting critical PHP web bugs

    TechCrunch Security · 27 Oct 2026, 20:10 IST · Medium severity

    government cyber agency warns that hackers have figured out a way to exploit the popular PHP software, used in 70% of the web's software.

26. Podatność w oprogramowaniu KGS Software tia Viewer

    CERT Polska · 27 Oct 2026, 17:25 IST · Medium severity

    W oprogramowaniu KGS Software tia Viewer wykryto podatność typu Stored Cross-Site Scripting (CVE-2026-105987).

27. Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support

    Help Net Security · 27 Oct 2026, 19:46 IST · Medium severity

    Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents...

28. The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest

    BleepingComputer · 27 Oct 2026, 19:31 IST · Medium severity

    Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest,...

29. NSE chief asks brokers’ body to set up a task force against AI cyberattacks

    Medianama · 27 Oct 2026, 19:12 IST · Medium severity

    Ashish Kumar Chauhan, the National Stock Exchange (NSE) chief, has asked a stockbrokers’ body, the Association of National Exchanges Members of India (ANMI), to set up a special task force to battle against AI-driven cyberattacks....

30. Malicious apps prey on Russians’ anxiety about fuel prices, drone strikes

    The Record by Recorded Future · 27 Oct 2026, 19:06 IST · Medium severity

    Cybercriminals are stuffing infostealer malware into bogus apps aimed at tracking gas prices, police activity, drone strikes and other information of concern to average Russians, researchers said.

31. UK Politician Jess Asato Got Deepfaked. Now She’s Taking xAI to Court

    Wired Security · 27 Oct 2026, 18:59 IST · Medium severity

    Jess Asato’s public campaigning for victims of online abuse put her in the crosshairs of Grok’s deepfake scandal. Then the UK member of parliament became a victim of the abuse herself.

32. Ransomware in the Age of AI: How Defenders Can Break the Attack Chain

    Flashpoint · 27 Oct 2026, 18:40 IST · Critical severity

    Table Of Contents Table of Contents Introducing Ransomware in the Age of AI: A Survival Guide for Defenders Understanding the Modern Ransomware Attack Lifecycle Build a More Proactive Defense Against Ransomware More subscribe to our...

33. Bitdefender’s new tool maps how attackers could reach critical systems

    TNW · 27 Oct 2026, 18:51 IST · Medium severity

    Bitdefender has launched GravityZone Exposure Management, which combines vulnerability discovery, internet-facing asset scanning, attack-path mapping and per-user hardening. It is available now on Windows, as an add-on or standalone....

34. Your Samsung TV Could Allegedly Use Other Bluetooth Devices To Listen To You - Here's How

    BGR · 27 Oct 2026, 18:47 IST · Medium severity

    As per a new report, Samsung TVs could allegedly use other Bluetooth devices around you to listen to you all the time. Here's how it's a privacy breach.

35. Over 525,000 hit in massive University of Copenhagen data breach

    TechRadar · 27 Oct 2026, 18:45 IST · High severity

    Over 525,000 hit in massive University of Copenhagen data breach

36. Australia’s spies are sharing intelligence with hacking targets — and want them to share back

    The Record by Recorded Future · 27 Oct 2026, 18:43 IST · Medium severity

    More than half of the individual warnings from the Australian Signals Directorate (ASD) drew on previously secret material that had been cleared for disclosure, underscoring the growing role of intelligence sharing to prevent attacks.

37. CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch

    The Record by Recorded Future · 27 Oct 2026, 18:46 IST · Medium severity

    CISA added the widely publicized PHP vulnerabilities to the KEV, but didn't specify what kind of exploitation it was observing.

38. HPE Patches Dozens of Critical Flaws in Networking Products

    SecurityWeek · 27 Oct 2026, 18:43 IST · Critical severity

    Eight max-severity security defects could lead to remote code execution and authentication bypass. The post HPE Patches Dozens of Critical Flaws in Networking Products appeared first on SecurityWeek .

39. Tricks from the Past deployed via signed ChatGPT and Claude binaries

    Checkpoint Research · 27 Oct 2026, 18:33 IST · Medium severity

    Key Points Check Point Research discovered a campaign we track as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol ,...

40. The web’s having a rough week. Here’s how to browse safely

    Malwarebytes Labs · 27 Oct 2026, 17:52 IST · Medium severity

    You may even have it bookmarked. Then it asks you to do something unusual: install an update, allow notifications, or run a command to prove you’re human. A website you trust can still display instructions you shouldn’t follow.