October 2026

Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams 2026-10-15 at 18:26 By A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active […]

1M Impacted by CenterPoint Energy Data Breach 2026-10-15 at 17:42 By A data breach against CenterPoint Energy has impacted approximately 1 million Texans.  This article is an excerpt from Subscribe to Security Magazine’s RSS Feed View Original Source

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks 2026-10-15 at 17:17 By NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash […]

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing 2026-10-15 at 17:17 By Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the […]

Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early 2026-10-15 at 15:16 By Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026.  The campaigns also increase operational pressure […]

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation 2026-10-15 at 15:16 By Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. […]

Why AI Confidence Is Not Validation 2026-10-15 at 15:16 By AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. […]

Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules 2026-10-15 at 15:07 By Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site’s server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach […]