Attackers need three days from disclosure to a working exploit
Rapid7 counted 43 newly exploited vulnerabilities in Q3 and found nearly 80% were remote, unauthenticated and zero-click.
The Latest
Interpol’s Africa sweep ends in 1,462 arrests and $105M recovered
Operation Serengeti III disrupted more than 10,000 malicious networks across 21 countries between late June and the end of August.
Cyber claims shrink in number while the big ones double in size
NAIC data shows large-company cyber claims averaging $4.4M in 2025, double the prior year, even as claim frequency fell.
Britain wants 14 years for anyone who cuts a cable at sea
A White Paper would replace an 1885 statute whose maximum penalty for severing a cable was a £100 fine.
Mave collects $34M to put agents on the alert queue
Two Unit 8200 veterans raised a $34M round for agents that investigate security alerts across a customer's existing tool stack.
A rented model ran one crew’s attack loop for 100,000 unattended steps
Symantec trapped a criminal AI agent in a honeypot and recovered the full prompt that turns somebody else's model into…
Token spraying turned stolen logins into 79 corporate mailbox takeovers
Huntress watched one operator replay stolen Microsoft 365 sessions against hundreds of tenants and walk into 79 of them without…
Chinese bootkit defeats Secure Boot via skipped revocation
Diplomatic targets in Central Asia were infected by a firmware implant that exploits an unblocklisted certificate most admins never revoked.
Ransomware brokers ran their intrusions through an AI kill chain framework
An exposed server laid bare 133 sessions of AI-assisted break-ins with a human approving each step.
Ransomware crews keep walking through an old Palo Alto MFA bypass
Months after the PAN-OS fix shipped, Qilin and Inc affiliates still log in with stolen sessions and then encrypt the…
Oracle’s October update carries 1,295 fixes and six top-severity holes
Unauthenticated attackers can take over E-Business Suite, SOA Suite, Access Manager and JD Edwards across a single quarter's patch batch.
Dead updater disabled on millions of PCs nobody owned
An abandoned Popcorn Time updater ran as SYSTEM and fetched code over plain HTTP, making it a ready-made botnet for…
Ruby patched three regex bugs behind GitLab’s four critical CVEs
Any application that compiles a regular expression from untrusted input is exposed, not just GitLab.
Linux SMB patch lagged two 9.0 flaws already public
KSMBD remote code execution bugs were posted to open mailing lists with no patches, and one needs no login at…
Spotlight
A Russian crew hid its command server inside a peer-to-peer mesh network
ESET caught a previously undocumented backdoor tunnelling through Yggdrasil before Sandworm wiped a Ukrainian logistics firm.
Atlassian’s October cleanup patches 75 flaws drawn from third-party components
October's bulletin addresses 75 unique CVEs inherited from bundled components across Data Center and Server products, pushing admins through another heavy patch cycle.
Quest Diagnostics joins the growing list of breached labs
The laboratory giant said it found an intrusion in one of its systems this week and that patient records were likely caught up in it.
An Iranian crew parked its servers on US hosting again
Semperis traced Prince of Persia's first US-based command server since 2016 after a three month silence that was the longest in two decades.
Features
A read-only tenant login is enough to own VeloCloud
Arista patched an exploited SQL injection in VeloCloud Orchestrator that lets the lowest-privilege account become a superuser operator.
Britain drafts 14-year terms for cutting cables at sea
A 12-week consultation proposes prison time, unlimited fines and new security duties for operators of the cables carrying 99 percent…
Capcom resets 196 accounts after 11.7 million ID records spill
Attackers took email addresses and login metadata for 11,774,247 CAPCOM ID records, then quietly changed passwords on 196 accounts.
A filename, not an image, trips Pillow into running commands
Pillow 13.0.0 closes a Ghostscript path where the name of an uploaded EPS file decides whether a server runs someone…
A regex overflow puts every GitLab version back in scope
CVE-2026-110264 scores 10.0, reaches back to 2014 and lands one patch above the update admins applied nine days ago.
Small header batches blow up HTTP/3 servers in memory
Seven of ten HTTP/3 stacks cap compressed headers but not the unpacked result, so a slim request can eat gigabytes…