Reporting on cyber threats: ransomware, phishing, breaches, malware and the actors behind them, curated from security news, research and vendor blogs.
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
Tom Uren and Amberleigh Jack talk about the weird bugging incident at OpenAI. It doesn’t look at all like it was normal state-backed espionage, but there are still good reasons the frontier labs should ensure that their crown jewels are safe. They also...
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on... what could possibly be hiding inside? We break out a Geiger counter and a cat to find out. Meanwhile, malicious ads are targeting journalists with...
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts...
Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset.
Cloudflare's web application firewall can now correlate an HTTP request with its response. Full transaction detection helps every customer find successful exploits, data exposure, and risky misconfigurations that request-only inspection can miss.
An investigation into a threat actor bypassing AI safety controls to coordinate credential theft, VoIP fraud planning, and database exfiltration. The post “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of...
Adversaries are turning the tools businesses trust into delivery mechanisms for malicious activity. Cisco Talos observed abuse of more than 25 legitimate platforms over the past year, exploiting the built-in trust of collaboration, file-sharing, payment...
A hacker hijacks more than 10% of Tor’s exit nodes, a second ransomware negotiator has been linked to ShinyHunters, a Chinese crime ring hacked Staples, and a hacker leaks emails from German far-right party AfD. Show notes Risky Bulletin: Hacker hijacks...
ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
Exasol Database 7.1.30 - command execution
Edimax BR-6478AC firmware v2.20 - authenticated command injection
Automotive Shop Management System 1.0 - SQLi
Open eClass 3.15 - RCE
Keycloak 26.7.2 - Unauthenticated Account Takeover
Synametrics Syncrify 6.2 - command execution
South River Technologies Titan MFT Server 26.0.0 - code execution
pizzafy-1.0 - SQLi
Categories: Threat Research Tags: advisory, vulnerability, php
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) appeared first on Unit 42 .
The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does...
Key Findings Introduction Antidetect browsers conceal their users’ digital identities, enabling a single operator or small team to simultaneously run thousands of isolated accounts across multiple platforms such as Facebook, Instagram, TikTok, YouTube,...
A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang. Detectives have linked the man to the attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in...
You can trust a social media platform and still get scammed by an ad running on it
The China-based threat group uses DLL sideloading in these attacks Categories: Threat Research Tags: BRONZE SANDCASTLE, Meterpreter, Sandboxie
In this edition of Between Two Nerds Tom Uren and The Grugq discuss whether the rise of AI coding will result in more or less bugs and whether it will ultimately make software more secure. This episode is also available on YouTube . Show notes