Tag Archive

A convincing phone call can be enough to open a path into a company network. Scattered Spider has repeatedly used social engineering to persuade help desk workers to reset passwords or move multi-factor authentication (MFA) to a device controlled by …

Rust 1.100 will introduce optional security cooldowns in Cargo, giving developers a way to delay newly published dependencies before they enter projects. Scheduled for November 12, 2026, the release aims to give security teams and package maintainers time to spot …

Ransomware operators used commercial AI tools to help plan intrusions, manage victim information and prepare extortion, according to a new investigation. But the systems they relied on also kept detailed records of their work. A publicly accessible server exposed AI …

Oracle has released its October 2026 Critical Patch Update, delivering 1,295 new security patches across its software portfolio. Published on October 20. The update includes a maximum-severity Oracle E-Business Suite vulnerability that allows attackers without login credentials to take over …

A public proof-of-concept exploit has been released for CVE-2026-106173, a critical vulnerability in Fortinet FortiSIEM that can let a remote attacker write files and run code without logging in. The flaw affects FortiSIEM 7.5.0. Fortinet released a fix in version …

A public proof-of-concept repository shares verification tools and a lab setup to test two critical PHP vulnerabilities known as php2shell. The flaws, tracked by researchers as CVE-2026-109618 and CVE-2026-109619, are reported to affect PHP’s session.upload_progress feature and could lead to …

Microsoft has introduced a new report-assessment system across its bug bounty programs, making the evidence security researchers submit a key factor in their rewards. Under the Azure bounty program, eligible critical remote code execution and privilege escalation reports can earn …

Microsoft has introduced a new command-line tool that gives IT admins a faster way to check and manage OneDrive sync across company devices. Microsoft introduced the OneDrive Sync Client Command Line Interface (CLI) at the OneDrive + Copilot event held …

Apache Tomcat has fixed eight security flaws that could let attackers bypass password checks, expose data between users, and disrupt connections under specific conditions. Apache disclosed the vulnerabilities on October 20, 2026, after releasing fixes in Tomcat 11.0.27, 10.1.61, and …