WHATS Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding
CSO Online ·
WHATS
THE HAX?
Top story
Also in coverage
Witness: Open-source framework for verifying how your software was built
Help Net Security ·
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
The Hacker News ·
ISC Stormcast For Monday, October 26th, 2026 https://isc.sans.edu/podcastdetail/10150, (Mon, Oct 26th)
SANS Internet Storm Center, InfoCON: green ·
Article feed
60 sources ↓Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding
Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0
Dual BIOS: The laptop security feature SMBs don’t know they need
Meta hit with $25 billion fine for illegally sharing user data
Witness: Open-source framework for verifying how your software was built
AI slop is piling up highest on the biggest open-source projects
Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture
Forgotten AI agents may still access sensitive company data
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
ISC Stormcast For Monday, October 26th, 2026 https://isc.sans.edu/podcastdetail/10150, (Mon, Oct 26th)
YARA-X 1.22.0 Release, (Sun, Oct 25th)
(Reliable)? php2shell exploitability, (Fri, Oct 23rd)
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd)
GCIH studying. Advice needed.
Pivoting away from working at an MSSP, advice?
Open alternative to Glass wire (for network monitoring)?
wake-and-break: Wake and Break: a PSP exploit for AMD navi31 (RX 7900) that makes the card accept unsigned IP firmware. Not persistent: a cold power cycle restores stock.
CVE-2026-111497, node2shell Detection Opportunities
Someone is already building a target list of Brotli-capable hosts for node2shell / HTTP2Shell / Broccoli2Shell (CVE-2026-111497)
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 5
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120
Security Affairs newsletter Round 601 by Pierluigi Paganini – INTERNATIONAL EDITION
The AI Threat Landscape
The Economics of AI
AI Changes Security Research
AI coding agents hijacked using AGENTS.md file in Downloads folder
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
Reversing a Ren’Py installer: hidden payloads, Amatera Stealer and a changing C2
Windows msi Malware file - Downloaded from fake cloudflare Clickfix page
CVE-2026-102870 ASP.NET Core Remote Code Execution Vulnerability
CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
CVE-2026-114148 ASP.NET Core Elevation of Privilege Vulnerability
Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
57% of Large Firms Report Bot or Agent Incidents or Losses
FTC Data Shows Investment Scams Fuel Fivefold Surge in Seniors’ Fraud Losses
What Fraud Data Says About Where Payment Security Is Headed
Breaking the AWS MCP Python Sandbox
How LLM-Based Penetration Testing Harnesses Work
We used RCE on 3 million PCs to prevent a botnet
Looking for a mentor
BlackX UEFI Bootkit Leverages “Baton Drop” Flaw to Bypass Secure Boot
Today, we hacked what we'd set out to hack: the iPhone
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Vulnerabilities in PHP Affecting Cisco Products: October 2026
Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
HackTheBox - Checkpoint
HackTheBox - Eloquia
HackTheBox - DevHub
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
Friday Squid Blogging: Increasing Squid Populations
Compromised TLS Certificates
New Serious PHP Vulnerabilities Released and Patched
Trust Is Not What It Seems — And Fraudsters Are Counting on It
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
AI Tools Are Generating Massive Attacks for Little Cost
BOTS WIPED OUT? | Threat Wire
🍍📟 Don't dox yourself: Censor Mode - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
🍍📟 "App Store" Anyone?: Pager Portal - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Agents are your newest insiders. Security must move at their speed.
FCC bans two devices with surveillance chips linked to Huawei
UK proposes 14-year prison terms for undersea cable sabotage
Quest Diagnostics warns of potential data theft after attack on lab service system
Knicks sent employees fake offer of championship rings in phishing test: Report
Disgraced eMudhra drops out of TLS business after using cert private key of 4
Hackers got a four-day head start on epic PHP2Shell vulnerability
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Exclusive: Bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
eMudhra kills its certificate business after researchers cracked its private keys in under a second
U.S. Banks Detect Unauthorized AI Agents Accessing Accounts
Cyber Breach Hits Quest Diagnostics, Patient Records May Be Affected
PHP Issues Patches for Two Critical Flaws, Security Leaders Discuss
The #1 Danger Isn't Roblox
0day Hacks NetworkChuck (OSINT)
Flushing the toilet kills our network!
AI Agent Order Data: Agentic Commerce on Forter’s Network
The Biggest Opportunity in Gaming & Betting Is Knowing When to Say Yes
US Shoppers Are Ready to Give AI More of Their Holiday To-Do List
How Police Can Track Your Phone
Learn More About AI With Me at GTC
What Is Machine Data?
Resident Evil maker Capcom warns of phishing after 11.7 million records exposed
Crime Stoppers chapter freezes tips after breach breaks anonymity promise
Facebook’s misleading privacy claims land Meta a $25 billion penalty
Hacker leaks 281 GB of data from Germany’s far-right AfD party
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Adds One Known Exploited Vulnerability to Catalog
Critical Vulnerabilities in PHP Require Immediate Patching
Siemens Industrial Edge App Publisher
Gaming Giant Capcom Confirms Data Breach Exposed Users’ Personal Information
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
php situation 24h later
The race to the first exploit // php2shell
Self-efficacy in the age of AI
A stranger disassembled my mouse’s official app, fixed my checksum, and by accident gave me the idea for USB cable support
Hello everyone,It's Aditya from India. I am working on a project where I use machine code to make my own ultra photorealistic graphics game engine while using math.So if anyone is interested to talk about this, I would like to discuss with you
I reverse engineered Black & White with Astra and added LLM + voice support on top of the game's original AI. The environment is exposed to the LLM's context and the creature can select tools to inspect and interact with the world or answer questions about it.
In Singapore for a few days hanging out with hackers and having a good time.
Your AI hackbot has found another 100+ vulnerabilities. Who fixes them? And how? ft Erlend
wood will keep you warm, once when chop, carry, staple and sort it, and once when you burn it.
News alert: Gcore extends free web protection to government agencies after widespread PHP exploits
Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal
News alert: Bright Security launches AI-powered tool to uncover hidden software vulnerabilities
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
Is the ad a scam? How to tell before you click
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Operation FlashHole: Lazarus breaks security, defies control
Behind Japan’s Warnings of a Cyber Crisis
PHP2Shell Exploitation: Two Critical PHP Flaws Explained
TAG-217 Targets South Korean Financial Services with ARTEX
Widespread PHP Flaw May Cause Many Site Outages Today
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.K. Sanctions Cryptomus for RU Money Laundering
Does your fraud risk assessment measure up when a financial crime occurs?
Fraud Risk Assessment: A New Model and New Approach
Assessing the Strength of Your Fraud Controls
Black Hat Stories | Island.io
Black Hat Europe 2026 | Hear From Our Sponsors
Black Hat Stories | First Time Exhibitor
Why people don’t report scams, and it’s not embarrassment
6 alternatives to Blackpoint for your shortlist
Cybercrime Detective Explains Cybersecurity Jargon in 60-Second Videos for Cybersecurity Awareness Month
ZDI-CAN-34171: Adobe
What Does a GRC Cybersecurity Professional Do?
CTF Walkthrough: The Cuckoo's Log
Purple Team Incident Adventure | TCM Community Live | Cybersecurity
#StopRansomware: SafePay Ransomware
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
HackerOne Limited Me to 3 Reports After 12 Years
Google just paid a $90,000 bounty for this vulnerability
I Built a Hackbot for Less Than $250
Anthropic’s AI Reversal Is A Warning Shot For Agentic Defense
Agentic AI Is Changing Security Decisions: Why Accountability Must Be Designed, Not Assumed
A New OT Security Playbook for Connected Robots
Proofpoint CEO Sumit Dhawan On ‘Market-Changing’ $6.3B Varonis Deal, IPO Goal
Proofpoint CEO on acquiring Varonis for $6.3B: ‘Opportunities like this don’t come every day’
Thoma Bravo's Proofpoint to buy Varonis Systems in $6.3 billion all-cash deal
eIDAS 2.0 and AMLR Updated Standards: What Should Regulated Businesses Do Next?
Business Fraud at Network Scale: What the $3.5B Medicare Hospice Crisis Reveals About Know Your Business
DCSG1 - Pwn2Own Level Break of a Printer - SungJun Park, WonBeen Im
DCSG1 - Augmenting Apple's Source Code and OS Logs with AI Agents -Olivia Gallucci
DCSG1 - Actual OT Cyber Security - Dillon Lee
Introducing the new Copilot with Home, Code and Autopilot
Building the system for AI at work
Introducing Microsoft 365 G7: Intelligence + Trust for the mission ahead
AI Agents Can Be Secured. We Can Do It.
Why the Open Secure AI Alliance Matters: Open Frontier Models, Open Deployment Flexibility
Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave
Ransomware: A Continuing Threat for Small Businesses
AI in Tax Season: Risks, Scams, and How to Protect Your Data
Tax Season Scams to Watch For This Year
Why every payments team should be watching for ACH fraud
From the Edge to the Core: 9 Ways PKI Secures Your Network
How to Secure Your Email Server on an SMB Budget
Microsoft Build 2026: Building agentic apps with Microsoft Fabric and Microsoft Databases
Azure IaaS: Defense in depth built on secure-by-design principles
Enforcing trust and transparency: Open-sourcing the Azure Integrated HSM
How FIN6 Exfiltrates Files Over FTP
Emulating FIN6 - Active Directory Enumeration Made EASY
The SECRET to Embedding Metasploit Payloads in VBA Macros
Try another search or clear the filters.
Showing 180 of 1004 loaded entries. Search and all-headlines view include all available entries in this section. Browse the feed archive.