Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,449 articles

Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge

Researchers tie PHP2Shell attempts to a Mirai botnet and show an ASLR bypass, but no successful compromise has been confirmed yet.…

NEWSHackread2 days ago

426 Android and iOS Apps Linked to PHP2Shell Backend Risks

Research found 426 mobile apps connecting to servers advertising PHP versions potentially affected by PHP2Shell vulnerabilities, r…

NEWScriticalInfosecurity Magazine2 days ago

Gaming Giant Capcom Confirms Data Breach Exposed Users’ Personal Information

Japanese video games giant Capcom confirmed unauthorized access to its online account system

NEWSThe Register2 days ago

Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches

Kernel maintainers stop asking who used AI, as long as the code is good

NEWScriticalCVE-2026-115560The Hacker News2 days ago

URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critic…

NEWShighThe Hacker News2 days ago

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack ta…

NEWSSecurityWeek2 days ago

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments. The post China A…

NEWSInfosecurity Magazine2 days ago

Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise

Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC…

NEWScriticalInfosecurity Magazine2 days ago

Attacks on Tech Firms Behind Most Third-Party Data Breach Victims

Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies…

NEWScriticalSecurityWeek2 days ago

Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months

The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges…

NEWScriticalCVE-2026-112900The Hacker News2 days ago

Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the…

NEWSThe Register2 days ago

UK threatens subsea cable saboteurs with 14 years behind bars

Whitehall wants tougher penalties and new powers over telecoms operators as Russian activity raises alarm

NEWScriticalThe Hacker News2 days ago

Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious…

NEWScriticalSecurityWeek2 days ago

11 Million Impacted by Capcom Data Breach

The hackers stole 11 million email addresses from CAPCOM ID and changed the login passwords for 196 accounts. The post 11 Million…

NEWSSecurityWeek2 days ago

Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’

Medical laboratory operator Quest Diagnostics said it learned of a cyber breach of one of its systems this week, likely compromisi…

NEWSSecurityWeek2 days ago

LiteLLM Compromised in Fresh Supply Chain Attack

Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compr…

NEWSSecurityWeek2 days ago

Atlassian Patches 75 Flaws in Data Center and Server Products

Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components…

NEWShighCVE-2026-111497The Hacker News2 days ago

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at…

NEWShighCVE-2026-109618The Hacker News2 days ago

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infect…

NEWSSecurityWeek2 days ago

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. Th…

NEWSBleeping Computer3 days ago

Railway warns devs to rotate secrets after potential breach

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer…

NEWShighThe Register3 days ago

PHP2Shell exploit bypasses protections designed to stop remote code execution

“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.

NEWScriticalBleeping Computer3 days ago

Capcom confirms data breach affecting 11.7 million accounts

Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 millio…

NEWShighBleeping Computer3 days ago

LiteLLM release pipeline hacked to distribute info-stealer malware

Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credential…

NEWScriticalThe Hacker News3 days ago

Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for…

NEWSThe Hacker News3 days ago

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Th…

NEWSHackread3 days ago

Paying in ADA: Cardano’s vision for the future of payroll

Cardano payroll could support ADA salaries and automated payments, but employers must address price volatility, tax obligations, w…

NEWSThe Hacker News3 days ago

ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More

This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eM…

NEWSCyberScoop3 days ago

Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber

One of the bill’s sponsors told CyberScoop it’s “incredibly expensive” for U.S. AI companies to stay ahead and distillation attack…

NEWSThe Register3 days ago

Max-severity GitLab bug allows remote code execution over 12 years of releases

Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'