Attack & News

Latest cybersecurity news, threat reports, and attack campaigns

All Feeds Attack & News Gov Alerts / ISAC Vulnerability Alerts Privacy & Governance Fraud & Scams

5,450 articles

EU wants Booking.com to check out of its scam problem

Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses 'absolutely substandard'

NEWScriticalInfosecurity Magazine4 days ago

SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns

A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take ac…

NEWSSecurityWeek4 days ago

China Defends DeepSeek After US Ban of Its AI From Government Systems

The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from t…

NEWSThe Hacker News4 days ago

PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as…

NEWSThe Hacker News4 days ago

The Harness Is the Hard Part of Agentic Pentesting

An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model wri…

NEWSThe Hacker News4 days ago

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that…

NEWScriticalInfosecurity Magazine4 days ago

Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches

Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches

NEWSBleeping Computer4 days ago

Microsoft says October updates didn’t actually fix VPN issues

Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulat…

NEWShighHackread4 days ago

China-Based BRONZE SANDCASTLE Hackers Abuse Sandboxie to Load Backdoors

Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal A…

NEWShighSecurityWeek4 days ago

Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor

Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable. The post C…

NEWSWired Security4 days ago

She Was the DEA’s Premier Crypto Detective. The Clues Led Straight to Her Own Family

To escape the chaos of her Russian childhood, Lili Infante became an American law enforcement prodigy. She pioneered the DEA’s inv…

NEWScriticalInfosecurity Magazine4 days ago

Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account

The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident

NEWShighThe Hacker News4 days ago

Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for…

NEWScriticalBleeping Computer4 days ago

CISA: SafePay ransomware hit over 600 critical infrastructure orgs

The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infras…

NEWSThe Hacker News4 days ago

U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases

U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party…

NEWSThe Hacker News4 days ago

State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web

State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records availa…

NEWShighCVE-2026-966524.3 MEDIUMThe Hacker News4 days ago

CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vuln…

NEWScriticalCVE-2026-109618SecurityWeek4 days ago

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution. The post…

NEWShighThe Hacker News4 days ago

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a…

NEWSSecurityWeek4 days ago

Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI

Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader. The post Hijacked Developer Accou…

NEWScriticalThe Hacker News4 days ago

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security…

NEWSSecurityWeek4 days ago

Accenture, Dragos, SANS Launch $10M Initiative to Defend Small US Utilities

The first phase will cover up to 500 utilities, which will get free security tools, equipment, deployment help and training. The p…

NEWSSecurity Magazine4 days ago

35% of Organizations Run Over 1000 AI Agents

A recently released report by ServiceNow analyzed the effect of agentic AI exposure.

NEWSHackread5 days ago

Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal

Orlando, Florida, United States, 21st October 2026, CyberNewswire

NEWShighBleeping Computer5 days ago

Stolen UpdraftCentral keys used to backdoor WordPress sites

A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromis…

NEWSBleeping Computer5 days ago

Mozilla, Google, Apple block compromised eMudhra CA certificates

Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were…

NEWSCyberScoop5 days ago

Philippines-based American pleads guilty to running expansive fraud scheme targeting US servicemembers

Robert Wayne Boling Jr. was the mastermind of an identity theft conspiracy that victimized thousands of military members and veter…

NEWSThe Register5 days ago

Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’

Massive clean-up job under way because this mess makes it possible to impersonate any website or service

NEWShighThe Register5 days ago

Auto tech startup claims it traced hack attempt back to rival's IP address

IQ.Lvbs implies that rival Comma.ai isn't playing fair

NEWSHackread5 days ago

Multi-Cloud Blind Spots Are Leaving Security Teams Exposed

Discover how multi-cloud environments create security blind spots, inconsistent access controls, risks and how CCSP strategies hel…