Longtime ECI leader returns as CEO; Trevor Gruenewald to remain a board member after 18 years with the company

Read more →

VeroID launches to support customer identity checks for businesses and the software platforms that serve them.

Read more →

Helping protect astronauts from radiation risks while promoting the use of satellite data and the creation of future lunar industries.

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

If spreadsheets are your thing, but Microsoft Office isn’t, you might want to give the open-source clone, GridCraft, a try.

Read more →

If you’re tired of Google Maps failing to get you where you need to go, set Waze as the default on your Pixel. I’ve finally figured out how.

Read more →

For decades, Elon Musk has mixed resources and ambitions at his two largest companies.

Read more →

October is Cyber Security Awareness Month, an opportunity for all Australians to strengthen their cyber security knowledge and take practical steps to protect their devices,…

Read more →

On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively named PHP2Shell. Both are rated 9.2 (Critical) under CVSS v4.0, and both allow an unauthenticated attacker to run code on a vulnerable server. The fixed…

Read more →

New Tenable OPEN for AI program enables customers to use preferred AI models, agents and tools to improve visibility, insight and action

Read more →

CVE-2026-103111, CVE-2026-109618, CVE-2026-109619

Read more →

Attacker adoption of agentic AI is lagging the technology, but adversaries are already exploiting high-severity vulnerabilities in an average of just three days, leaving…

Read more →

Planned for the first half of CY27, Extreme Exchange zones will bring AI skills to branch and edge sites, designed for data sovereignty, localization, survivability, and better…

Read more →

New Agent Sandbox Foundation Stack combines the VAST AI Operating System with NVIDIA NemoClaw and NVIDIA OpenShell to give every sandboxed agent a fast, isolated workspace, the…

Read more →

As banks and insurers deploy AI agents against customer data, Meiro’s Local AI CDP delivers sovereign AI inference: AI models run inside the institution-controlled environment…

Read more →

Ukraine is using a basic Starshield service, which uses Starlink’s standard equipment with different features

Read more →

AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed. On Tuesday, it reported two incidents, both involving the agent disabling or interfering with its alignment monitoring, and in one case directly lying about having done so.  “In two internal coding tasks, agents weakened misalignment monitoring…

Read more →

New capability delivers fine-grained, cross-application access insights to AI assistants

Read more →

EPIC allows customers to test and validate liquid-cooled infrastructure in real-world environments alongside leading technology partners

Read more →

EVENT NEWS: Marking its 70th anniversary milestone, Phase One of the 140th China Import and Export Fair Canton Fair underlines a structural transformation in regional…

Read more →

Imagine buying a brand new hardware wallet for your cryptocurrency with the shrink-wrap still on… what could possibly be hiding inside? We break out a Geiger counter and a cat to find out. Meanwhile, malicious ads are targeting journalists with zero-click attacks. Plus, Origin’s Spencer Thompson reveals what AI agents are really getting up to…

Read more →

New Teradata Factory and Teradata Sovereign Cloud on Google Distributed Cloud capabilities give enterprises greater control over where their most sensitive data and AI operate

Read more →

Azul’s Security-only, Stability-first™ updates can be deployed immediately to counter the speed of agentic AI threats

Read more →

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address…

Read more →

Qing Liu appointed General Manager, Asia Pacific, as the company expands investment and customer support across the region.

Read more →

Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode. The vast majority of connections made by Chrome use HTTPS, according to…

Read more →

Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. […]

Read more →

Losing original hospital bills can make a health insurance claim more difficult, especially when you are filing a reimbursement claim. These bills help show what treatment you…

Read more →

Microsoft researchers attributed the recent supply-chain attack targeting ConnectWise customers’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940. “As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries,” Microsoft Security Research wrote…

Read more →

Hackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers’ servers. […]

Read more →

Plus, the Starlink slowdown hurt Ukraine’s ability to stop Russian attacks, and U.S. special envoy Steve Witkoff praised Vladimir Putin as a ‘humanitarian.’

Read more →

A Russian satellite made a close approach to a commercial radar satellite linked to Ukraine, raising concerns about surveillance and security in space. A Russian-made satellite called Kosmos 2612 got very close to ICEYE-X36 last week, a commercial Earth-observation satellite that may support countries like Ukraine. CNN reports it may have come within less than…

Read more →

Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE). On Wednesday morning, the PHP Foundation released patches for affected versions, and said it…

Read more →

Fleet Device Management is expanding its endpoint management platform to support NVIDIA DGX Station and RTX PRO workstations, enabling enterprise IT teams to manage AI computing systems alongside existing macOS, Windows, and Linux devices. The expansion is designed to bring AI workstations into established device security, vulnerability management, and compliance workflows as organizations deploy more…

Read more →

Deeper Network Promo

Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.

Read more →

EVP of Microsoft Security Hayete Gallot writes in a blog post that AI agents operating independently within companies could be a serious security threat. According to Microsoft, today’s most advanced AI models cannot be fully trusted. Not because they are malicious, but because they are trained to achieve goals and can take unexpected shortcuts to achieve them.…

Read more →

Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra. Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromised intermediate CAs to impersonate any website or service.…

Read more →

Oracle’s October 2026 update fixes 1,209 vulnerabilities, including six CVSS 10.0 flaws. See the affected products and what security teams should patch first.

Read more →

Ahold Delhaize took IT systems offline after a cyberattack disrupted grocery services in the US and Europe, highlighting business continuity challenges.

Read more →

Hackers used open-banking services to test stolen bank logins for free. Group-IB uncovered related phishing activity and verification costs for platforms.

Read more →

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. […]

Read more →

The effort is aimed at standardizing a NIST FIPS 140-3 Level 3 integrated HSM for cloud and hyperscale data center infrastructure.

Read more →

The company, which reported record revenue of $64.2 billion for the third quarter, said the new stock won’t affect Mark Zuckerberg’s voting control.

Read more →

Research finds that, among respondents experiencing data loss, only 16% said DLP blocked their most significant incidents before data left the organization.

Read more →

OpenAI reveals two cases of AI agents disabling safety monitoring during coding tasks, with one falsely denying it had removed the safeguards. OpenAI published an internal incident report this week documenting two separate cases in which GPT-6 class agents weakened the system designed to detect misaligned behavior, in both cases while carrying out routine coding…

Read more →

Elon Musk is considering putting electric cars, rockets, satellites and artificial intelligence under one corporate roof. Tesla and SpaceX have established committees of independent directors to examine a potential merger, marking a significant step toward combining two of Musk’s largest businesses. However, neither company has agreed to transaction terms, and the deal remains uncertain. For…

Read more →

Major enterprise AI contracts involve more than selecting a cloud platform. Buyers also have to consider the engineering resources and consulting expertise available to support their investments. Cognizant said it committed more than 18,000 engineers to a new Gemini Frontier Capability Group under its expanded partnership with Google Cloud, announced Oct. 19. Its specialists will…

Read more →

Security teams are scrambling to remediate two critical PHP vulnerabilities following leaked details and reports of exploitation attempts.

Read more →

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions…

Read more →

WhatsApp instructed its AI support chatbot not to recommend contacting privacy regulators when users couldn’t delete their accounts, researchers found. Privacy software company Redact discovered the hidden text on October 8. Its researchers then examined and saved copies of all 545 pages linked from WhatsApp’s help center, finding 102 instruction blocks across 80 pages. The…

Read more →

Every IT and security team knows the feeling of opening a vulnerability report and seeing a number that only goes up. Thousands of findings. Hundreds marked critical. A backlog that grows faster than any team can close it. For years, the default response has been to work harder: more scans, more tickets, more overtime. But…

Read more →

An upcoming update will bring new features to existing HomePods. Here’s what to know.

Read more →

For most IT teams, Patch Tuesday used to set the rhythm of the month. Updates arrived, teams tested them, change boards approved them, and deployments rolled out over the following weeks. It wasn’t painless, but it was predictable. That predictability is gone. Nearly 48,000 CVEs were published in 2025, and the average time to exploit…

Read more →

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. […]

Read more →

In this article What’s happening What is ARTEX? Mitigation and protection guidance References Learn more As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of these Storm-0940 ARTEX-driven attacks have resulted…

Read more →

For the past few years, most enterprise AI has been advisory. It summarized tickets, drafted knowledge articles, and suggested next steps. A person still decided what to do. That’s changing. Agentic AI systems can plan multistep tasks and carry them out: querying systems, triggering workflows, changing configurations, and closing tickets with little or no human…

Read more →

Director Ron Deibert spoke to a crowd in his keynote address at SecTor 2026, warning that the threats that the Citizen Lab investigates are being “super-charged” thanks to AI. In particular, he criticized the United States’ “descent into authoritarianism” and use of AI to spread propaganda. Read Dark Reading’s coverage of the talk here The…

Read more →

“Hallucination” has become the catch-all term for AI getting things wrong. It describes a real phenomenon: Large language models can generate confident, fluent answers that are simply untrue. But in IT operations, many errors labeled as hallucinations have a more ordinary explanation. The AI isn’t inventing facts. It’s faithfully reporting information that happens to be…

Read more →

The models Astra and Sol misinterpreted instructions during internal use, which has serious implications for alignment monitoring.

Read more →

The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package…

Read more →

A state jury found the social-media giant liable for misleading the state’s consumers.

Read more →

New York, NY, USA, October 21st, 2026, CyberNewswire According to the 2026 Autonomous Agents Threat Report, published by Arrakis Security, 76% of active agents have not run in 60 days, but their credentials still work and their triggers still fire. 44% have not run in 180 days. 24% of dormant agents can be started by…

Read more →

Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and Access Management (IAM). IAM Roles Anywhere relies on public…

Read more →

A developer’s GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.

Read more →

New York, NY, USA, 21st October 2026, CyberNewswire

Read more →

Google’s browser will flash two types of warnings based on whether the site is deemed dangerous or just suspicious.

Read more →

OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company said the incident took place on October 3 and 6, 2026, for Sol and Astra, respectively, as part of an internal deployment.…

Read more →

Sens. Richard Blumenthal and Josh Hawley wrote to CEO Sundar Pichai following a Wall Street Journal investigation.

Read more →

OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. […]

Read more →

Deeper Network Promo

Sofia Liguori, a research engineer working at DeepMind, resigned in protest this week from Google’s pioneering artificial intelligence laboratory. Unlike a wave of other AI researchers who have quit over fears AI might someday turn against humanity, Liguori stepped down over concern about her employer’s current practices. Disenchanted and disturbed by Google’s military contracts with…

Read more →

Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow for remote code execution. PHP is a widely-used, open-source server-side scripting language designed primarily for web development. All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are considered at risk. Successful exploitation of the most…

Read more →

If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched. The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a…

Read more →

Critical PHP flaws forced European government websites offline. Here’s what happened, why services were suspended, and what comes next.

Read more →

FBI and CISA warn SafePay ransomware has hit at least 600 organizations. Learn how the group attacks networks and what security teams can do to prevent breaches.

Read more →

Hands-on sessions provide educators, nonprofits, and community leaders with an accessible resource to foster year-round cyber awareness and build more resilient communities.

Read more →

360 Privacy finds more than 8 in 10 security and wealth professionals say cybersecurity and physical security can no longer be separated.

Read more →

Expect to see quite a few websites serving “404” or “Page Not Found” errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these…

Read more →

Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any application code runs, affecting every PHP build since 5.4. Based on the entities involved in the disclosure, artificial intelligence and associated technologies played a key role…

Read more →

Overview Immediately after the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, a large number of repositories named “php2shell” were created in a short period of time on GitHub, a code repository platform. Of the top 100 repositories (excluding forks) found by searching for “php2shell,” 99 addressed these vulnerabilities, and nearly all…

Read more →

Researchers have uncovered Athena StealthRoute, a phishing-as-a-service platform featuring an AI Studio that generates phishing lures and decoy content designed to conceal attacks

Read more →

PHP releases emergency PHP2Shell fixes for two critical flaws allowing unauthenticated code execution. Website owners and hosting providers…

Read more →

Researchers found more than 6,800 Meta Muse chat-sharing links through passive DNS records, exposing sensitive conversations and prompting Meta to suspend sharing.

Read more →

Oracle heeft 33 kwetsbaarheden verholpen in diverse Oracle Analytics-producten, waaronder Oracle Business Intelligence Enterprise Edition en Oracle BI Publisher. In de patchnote staan 33 kwetsbaarheden, waarvan 14 kwetsbaarheden op afstand kunnen worden misbruikt zonder dat authenticatie vereist is. Afhankelijk van de kwetsbaarheid, de getroffen productversie en de configuratie kan misbruik leiden tot ongeautoriseerde toegang tot…

Read more →

Oracle heeft 110 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Communications-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit…

Read more →

Researchers found hidden instructions in WhatsApp Help Center pages that told its AI chatbot not to recommend certain privacy complaints to regulators.

Read more →

Amazon is committing more than €16 billion ($18 billion) to Germany in 2027, including €4.8 billion to expand AWS infrastructure as demand for AI and cloud computing grows. The investment plan, announced Tuesday at the German government’s Invest in Germany Summit in Berlin, will expand AWS’s Frankfurt region while supporting additional projects in robotics, logistics,…

Read more →

OpenAI wants to name its price before Anthropic’s stock market debut tells everyone what a rival is worth. The ChatGPT maker is seeking about $30 billion in fresh funding at a valuation exceeding $1.4 trillion, Reuters reported, citing people familiar with the matter. The company is reportedly accelerating the fundraising ahead of Anthropic’s expected mid-November…

Read more →

Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates. A security researcher known as Wayne discovered the flaw on…

Read more →

Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules. Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation. It helps answer both “Does this request look malicious?” and “What happened when the application handled it?” Response rules can…

Read more →

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. […]

Read more →

PHP heeft twee kritieke kwetsbaarheden verholpen. De kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt voor het uitvoeren van willekeurige code. Alle PHP-installaties die webverzoeken verwerken zijn getroffen. De kwetsbaarheid met kenmerk CVE-2026-109618 betreft geheugenbeschadiging bij de afhandeling van een Out-of-Memory-situatie. Hierdoor kunnen interne requestgegevens slechts gedeeltelijk worden geïnitialiseerd en tijdens de verwerking als geldige…

Read more →

Five new Blink cameras are coming to the market, and the extended-range model has all my attention.

Read more →

ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defenses and why AI tools have become increasingly effective lures. […]

Read more →

Updated an acknowledgement. This is an informational change only.

Read more →

The vulnerability associated with this CVE was fixed in July, however was inadvertently not included with that release. Microsoft recommends updating to the most current release of the SharePoint server.

Read more →

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP team says only updating fully protects a server. The flaws, together called PHP2Shell, sit in the…

Read more →

Researchers at Symantec have uncovered an AI agent designed to operate a full cyber-attack without human intervention

Read more →

Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers running PHP 5.4 or later and they may allow an attacker to cause denial of service, remote code execution, and data exposure when an application processes specially crafted HTTP traffic. Cloudflare has…

Read more →

NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. It builds on NVIDIA’s existing OpenShell security software, combining it with hardware for running AI models, managing agent operations and enforcing security rules. The aim is to let agents carry out useful work within defined…

Read more →