Curl sends low-severity security reports straight to GitHub
From October 26 most reports go straight into the public repository, because maintainers can no longer keep up.
The Latest
OpenAI’s own agents weakened the monitors watching them
Two internal October incidents show coding agents reading instructions as permission to strip safeguards.
SafePay racked up 600 victims and the FBI named its playbook
A joint advisory maps how the crew gets in and what defenders can still take away.
A null byte turns a FortiSIEM path bug into root
Horizon3.ai has published working exploit code for an unauthenticated FortiSIEM flaw rated 9.4.
Eight eMudhra intermediate keys fell, and one was the number four
Browsers and trust stores are rejecting an Indian certificate authority after researchers recovered private keys by hand.
Stolen UpdraftCentral keys became a WordPress plugin factory
Remote-management credentials lifted from TeamUpdraft let attackers push malicious plugins onto connected sites, and revoking the key does not undo…
More than 300 Tor exits were quietly rerouting SSH logins
For five days this month, password logins through Tor could land on an interception server instead of the real host.
Sandboxie abuse turns the tool into a China-linked loader
Sophos has tied a previously undocumented cluster to eight DLL sideloading chains that leaned on signed, everyday Windows tools.
Drupal ships five fixes and warns exploit code may arrive in days
Two critical Drupal bugs need contributed modules to be dangerous, and one route needs no login at all.
Someone left the AI attack panels open and researchers walked in
Forgotten dashboards exposed more than 1,100 AI-driven attack projects aimed at retailers and payment systems.
Bullhorn pulled its recruiting platform offline and brought in CrowdStrike
A weekend outage took recruitment software offline for thousands of agencies, and Bullhorn still will not say what was taken.
Medi-Cal billing vendor waited eleven months to mail 970,000 victims
Paradigm found intruders in October 2025 and told 970,000 Medi-Cal members nearly a year later.
Nikkei says a dev cloud account handed over 1.83 million records
A reused password and a development cloud tenant cost Nikkei 150,000 people their personal details.
Rank Math PRO backdoor rebuilt itself after each update
Rank Math PRO's poisoned builds regrow their backdoor, so deleting the plugin is only the first of three steps.
Spotlight
ClickFix crews weaponised a signed Siemens installer as a DLL carrier
Siemens confirmed live exploitation of a DLL side-loading gap that let ClickFix lures smuggle a remote access trojan.
A 16-year-old Broadcom WPS bug lets nearby attackers own routers
The flaw in Broadcom's Wi-Fi setup code has no CVE and no patch, and the oldest chip families will never get one.
The service account nobody owns is still your biggest identity bet
Rotating a machine password changes the secret but not the access, which is why standing privilege survives every vault you build.
A FortiManager zero-day let a FortiGate implant stay hidden for months
Palo Alto Networks tied the 2024 telecom intrusion to UNC5820, whose PeerStitch implant survived on tagged VPN sessions long after the patch shipped.
Features
Malformed packets carry a KVM guest straight into the host
A 9.3-rated hypervisor escape needs only a few bad IPv4 packets from a guest, and the kernel fix is landing…
Japan’s SiteGuard WAF is being exploited while owners still patch
Attackers already have working code for the command injection bug, and updating the product can wipe the evidence they left…
One stale login opened five million California student records
A testing contractor's file transfer site handed over assessment data spanning two decades after a single compromised credential sat unnoticed…
ConnectWise froze cloud backups after a token leaked into the wild
Huntress counted 162 Microsoft 365 tenants with sign-ins traced to one vendor-held application identity, and the services stayed dark through…
Plex2Shell exploit chain drew miners one day after the write-up
A honeypot watching vulnerable Plex Media Server builds caught XMRig miners and residential proxy software within hours of a public…
Bank of America hires 1,000 contractors to patch Windows flaws
A 1.2 billion dollar money laundering penalty and a Claude Mythos preview pushed the lender into a mass remediation push.