Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks 2026-10-22 at 13:59 By Zeljka Zorz A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC checks, uses Dell’s real template, and confirms a $736.09 purchase of Microsoft Project Standard […]
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers 2026-10-22 at 13:22 By Mirko Zorz Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has […]
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers Read More »
Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question 2026-10-22 at 10:02 By Mirko Zorz In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why organizations underestimate speed, the time it takes to detect and stop […]
AI agent permissions are outrunning security 2026-10-22 at 09:02 By Mirko Zorz Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make decisions and take actions that would have required human approval a year ago. […]
AI agent permissions are outrunning security Read More »
Say a few words, and a rigged AI asks for $5,000 2026-10-22 at 08:00 By Mirko Zorz Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person spoke, the models produced output the attacker had picked in advance. In one test, […]
Say a few words, and a rigged AI asks for $5,000 Read More »
PHP2Shell: Critical PHP vulnerabilities patched, update now! 2026-10-21 at 16:51 By Mirko Zorz The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and […]
PHP2Shell: Critical PHP vulnerabilities patched, update now! Read More »
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June 2026-10-21 at 14:13 By Sinisa Markovic Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy. CVE-2026-0257 stems from the […]
Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June Read More »
Info-stealing malware slipped into OVHcloud CLI releases on GitHub 2026-10-21 at 11:59 By Sinisa Markovic OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed the incident on X, warning users who downloaded the […]
Info-stealing malware slipped into OVHcloud CLI releases on GitHub Read More »
Privacy-preserving AI can protect your heart data, the bill is the problem 2026-10-21 at 10:02 By Mirko Zorz A heart monitor used to be a box beside a hospital bed. Electrodes fed a cable, the cable fed a screen, and a nurse watched the screen. The threat model fit on a sticky note. Cardiac care […]
Privacy-preserving AI can protect your heart data, the bill is the problem Read More »
Why security tools lose sight of the credential 2026-10-21 at 10:02 By Help Net Security Security teams have tools for code, endpoints, cloud infrastructure, identity, and secrets management. Credentials cut across all of them. A developer finds an AWS key in a repository. The first step is obvious: remove it. But that does not answer […]
Why security tools lose sight of the credential Read More »
DevGuard: Open-source vulnerability management for the software supply chain 2026-10-21 at 10:02 By Anamarija Pogorelec DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it. One command line, six […]
DevGuard: Open-source vulnerability management for the software supply chain Read More »
Bringing AI into the SOC means watching for shadow AI and loose permissions 2026-10-21 at 07:30 By Help Net Security In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools. He explains how LLMs help […]
Bringing AI into the SOC means watching for shadow AI and loose permissions Read More »
AOMEI Backupper servers hijacked for minutes at a time to push backdoor 2026-10-20 at 18:14 By Zeljka Zorz An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own […]
AOMEI Backupper servers hijacked for minutes at a time to push backdoor Read More »
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign 2026-10-20 at 15:23 By Sinisa Markovic Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the […]
Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign Read More »
Quarantined, but still on your calendar: The explosion of invite-based attacks 2026-10-20 at 15:18 By Zeljka Zorz There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned. Sublime recorded a 1,216% month-over-month increase in August 2026, and the first […]
Quarantined, but still on your calendar: The explosion of invite-based attacks Read More »
US Army is developing AI agents that could strike enemy networks and vanish without a trace 2026-10-20 at 13:03 By Sinisa Markovic The US Army is looking for AI agents that can slip into an adversary’s network, find their target, copy themselves onto nearby tablets and computers, and then erase themselves before anyone notices. Over […]
ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access 2026-10-19 at 16:58 By Zeljka Zorz American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft 365 accounts. The intruders used a compromised credential belonging to the ConnectWise […]
ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access Read More »
With open-weight AI, more of the security burden falls on enterprises 2026-10-19 at 14:04 By Sinisa Markovic Organizations that run open-weight AI models on their own infrastructure may have to supply safety and security controls that an AI provider would otherwise handle for them, Microsoft and NVIDIA warn in a joint paper on managing the […]
With open-weight AI, more of the security burden falls on enterprises Read More »
Bearer CLI: Free, source-available code security scanning tool (SAST) 2026-10-19 at 08:30 By Anamarija Pogorelec Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, […]
Bearer CLI: Free, source-available code security scanning tool (SAST) Read More »
Fake Arch Linux AUR packages exploit typos to run malware with root privileges 2026-10-16 at 12:58 By Sinisa Markovic Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source […]
Fake Arch Linux AUR packages exploit typos to run malware with root privileges Read More »