CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities collectively tracked as PHP2Shell to its catalog of actively exploited security flaws. Threat actors without privileges can exploit the two security issues (CVE-2026-109618 and CVE-2026-109619) in high-complexity attacks to gain remote code execution (RCE) on unpatched systems. The PHP security team patched the two flaws on Wednesday, October 21. READ MORE...
Genesys Hack Exposes Customer Data From Internal Systems
Customer experience company Genesys says it has contained a cyberattack that involved unauthorized access to data. Headquartered in Menlo Park, California, Genesys is a provider of customer experience and call center technology for mid-sized and large organizations. On October 19, the company announced that hackers had accessed internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) environment. READ MORE...
Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
Denver Health Medical Plan (DHMP) is notifying 238,000 people that their personal and health information may have been compromised in a data breach. Based in Denver, Colorado, DHMP is a non-profit managed care organization within the Denver Health and Hospital Authority system. Through its Denver Health Medicaid Choice plan, it administers Health First Colorado (Medicaid) benefits for members in Denver and three surrounding counties. READ MORE...
Former pentester used ARTEX AI to steal 8.2 million data records
South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks. According to local media citing the Seoul Metropolitan Police, the gang leader has a background in penetration testing and worked at a cybersecurity company between 2019 and 2022. In 38 of the incidents, the threat actor demanded ransom payments of 360 million won ($270,000). READ MORE...
Highway thieves are spoofing GPS to steal millions in data center-bound cargo
Highway thieves are using sophisticated digital tactics that investigators worry make it easy to rob trucks carrying millions in expensive data center equipment. NBC News spoke to "several industry leaders, consultants, and investigators advising law enforcement" offices probing the biggest thefts yet and reported that since June, thieves have "made away with more than $100 million in data center freight." READ MORE...
AI Halloween videos: Who's getting your photos?
This Halloween, AI is doing the costumes. Upload a photo and you can become a vampire, surround your dog with pumpkins, or star in a viral "zombie love story:" Your partner has turned, you lower the gun, and the zombie's leap ends in a hug. But before you upload, do you know who will receive your photos? In September, we wrote about more than 100 subscription sites built from the same cheap website kit. With Halloween approaching, we've found the same approach being used to sell AI videos. READ MORE...
In-the-Wild Attack Abuses AI Agents' Trust in Markdown
A new indirect prompt injection attack relies on using markdown files in an end user's downloads folder to install malware and steal credentials. That's according to Forever Security, which recently detailed a novel AI agent attack they captured in the wild. According to a research blog post, when an attacker plants a malicious file in a user's download folder, the user's agent may treat the file as trusted instructions and execute actions based on it. READ MORE...
PHP2Shell: What to know about two critical PHP flaws
Last week, details emerged about a pair of critical vulnerabilities in PHP, a server-side scripting language commonly used in web development. The news prompted security advisories from government agencies and sent website owners scrambling to apply the patches, with some sites even going offline as a precaution. This is because on an unpatched server, an attacker can exploit the vulnerabilities to run their own code without logging in. READ MORE...
Microsoft Authenticator vulnerability let rogue Android apps steal work account access
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn't need permissions, and you didn't need to tap anything. Authenticator does more than show six-digit codes. On Android it also acts as a "broker." When Teams, Outlook or another Microsoft app needs to sign you in, it asks Authenticator, and Authenticator hands back a token: a digital pass that proves you're logged in. READ MORE...
Private repos still leak secrets to Gheist, a stolen GitHub token campaign
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token, finds every repository that token can open, and plants a workflow in each one. The workflow prints the repository's secrets into a log, and the attacker downloads it. READ MORE...
- ...in 1809, President James Madison orders the annexation of the western part of West Florida. Settlers there had rebelled against Spanish authority.
- ...in 1904, The New York subway officially opens running from the Brooklyn Bridge uptown to Broadway at 145th Street.
- ...in 1950, author and public speaker Fran Lebowitz ("Metropolitan Life", "Social Studies") is born in Morristown, NJ.
- ...in 1988, US President Ronald Reagan decides to tear down a new US Embassy in Moscow because Soviet listening devices were built into the structure.
