Author
News Vulnerabilities & Zero-Days
The PHP security team will release fixes for two critical vulnerabilities rated CVSS 9.2 on 21 October 2026 at 14:00 UTC. CERT-EU says they could allow remote code execution. PHP powers 69.3% of websites whose server-side language is known, so teams should prepare to patch now.
Jaydeep Bhatt
News Cyber Attacks
Attackers used a compromised credential for the ConnectWise Cloud Backup app, formerly SkyKick, to sign in to customers' Microsoft 365 tenants. Huntress confirmed unauthorized sign-ins in 162 tenants, and ConnectWise has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
BeyondTrust has patched CVE-2026-102764, a critical flaw in Remote Support that Google's Mandiant says a suspected China-nexus espionage group it calls ARMORY CASTLE exploited as a zero-day from late August 2026. Self-hosted appliances need to be patched manually.
Jaydeep Bhatt
News Cyber Attacks
OpenAI has published three reports describing how internal AI models, while being trained or tested, bypassed authentication on a government statistics website, pulled non-public data from a research organization's systems and spent test cryptocurrency from a wallet they were not allowed to use.
Jaydeep Bhatt
News Cyber Attacks
Anthropic says Claude models took unintended actions on real websites during evaluations and internal use, including exploiting an injection flaw, using leaked access tokens and submitting an invented tip to a police form. It is cutting live internet access from all internal evaluations.
Jaydeep Bhatt
News Cyber Attacks
India's national cyber agency CERT-In has issued a critical advisory saying AI agents under evaluation reached live systems of Indian organizations and read business records, while criminals are using public agentic AI tools to cut attack timelines from days to hours.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Security firm XBOW says AI agents running OpenAI's publicly available GPT-5.6 Sol model helped its researchers build a three-bug Chrome exploit chain in six days, earning a $250,000 Google bounty. All three bugs are now fixed.
Jaydeep Bhatt
News Cyber Attacks
Anthropic researchers found that small open-weight AI models can already complete many steps needed to spread across cheap internet-connected devices, and one model completed full replication in a test network. They estimate a small model could reach that level by the end of 2026.
Jaydeep Bhatt
News industry-news
CyberSN's latest jobs report shows US cybersecurity job postings fell 26.4% in the first nine months of 2026, a four-year low, while postings for AI security engineers rose 268.3% year over year.
Jaydeep Bhatt
News Cyber Attacks
A cybersecurity incident that forced Ahold Delhaize to take systems offline on 11 October 2026 is still disrupting online shopping at Albert Heijn in the Netherlands and at US brands including Food Lion, Stop & Shop and Hannaford. Albert Heijn says store deliveries have fully resumed.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management interface flaw that lets an authenticated attacker run code as root, after observing very limited exploitation. CISA gave US federal agencies until 17 October 2026 to fix it.
Jaydeep Bhatt
News Vulnerabilities & Zero-Days
Next.js 16.4.1 and 15.5.28 fix two critical unauthenticated remote code execution flaws, one in use cache functions and one in SVG image optimization, plus a high-severity denial of service in Server Actions. There is no workaround for two of the three.
Jaydeep Bhatt