WHATS Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
SecurityWeek ·
WHATS
THE HAX?
Top story
Also in coverage
Cyber Vulnerabilities Besiege Italy, Absent Clear Cause
darkreading ·
Qualys CISO on what security teams can do as exploit campaigns grow
Help Net Security ·
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The Hacker News ·
Article feed
60 sources ↓Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Upwind Security Raises $400 Million at $3.8 Billion Valuation
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Cyber Vulnerabilities Besiege Italy, Absent Clear Cause
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
Third Serengeti Sweep Tops 1,400 Arrests as Investigations Mature
WhatPatchguardProtects: Reference of all kernel structures, routines, and MSRs monitored by PatchGuard (KPP) on Windows.
Agentic artificialintelligence is accelerating cyber attacks
The Gentlemen: A closer look at a not-so-gentle ransomware-as-a-service operation
Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access
Qualys CISO on what security teams can do as exploit campaigns grow
IT bosses are confident they’ve found the certificates they don’t know about
Shame and sleepless nights haunt scam victims long after the money is gone
Stolen staff logins are spreading attacks between K-12 school districts
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
ISC Stormcast For Thursday, October 29th, 2026 https://isc.sans.edu/podcastdetail/10156, (Thu, Oct 29th)
Yet Another ClickFix Campaign, (Wed, Oct 28th)
Real Folks of Cyber | Thomas Rogers | DITL
Is AI Security a Real Career?
What Does a GRC Cybersecurity Professional Do?
Bluesky Is Blocking Links to a Major Leak of DHS Employee Records
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw
Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents
Today I spotted, investigated, and remediated my first legitimate attack
Hochul signs AI chatbot and baby monitor regulations
If-statement that caused HTTP2Shell was itself undisclosed patch of vulnerability
XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet library, fixed in 10.0.4 (CVE requested, CAN-2026-2041077)
Turning the Valve - Exploiting RCE and LPE in the Steam Platform
An attacker can crash a Godot game server using DTLS with an unauthenticated UDP datagram
Officials seize domain of top bulletproof hosting provider Virtualine
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists
Lawsuit against Ex-Overstock CEO tied to 2020 election film falls apart over question of ‘actual malice’
Smashing Security podcast #490: How Jared Kushner’s iPhone was allegedly hacked twice
Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems
Hacker leaks 281 GB of data from Germany’s far-right AfD party
CVE-2026-19175 Use after free in Payments
CVE-2026-57083 Windows Media Photo Codec Information Disclosure Vulnerability
CVE-2026-57084 Windows File Explorer Information Disclosure Vulnerability
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Vulnerabilities in Node.js Affecting Cisco Products: October 2026
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Court strikes down West Virginia law barring disclosure of public officials’ personal data
Japan Airlines warns of data breach as country grapples with multiple cyber incidents
European digital rights nonprofit noyb sues Scale AI for ‘invasive’ worker surveillance
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
Discord to let search engines index public server messages
Sony ISP subsidiary data breach exposes 2.5 million customer records
Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail
Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users
CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers
Cloudflare is offering a $3,000 bounty for any unique PHO2SHELL bypass.
My $250 AI Hackbot Ran 24/7 on a VPS and Missed This
HackerOne Limited Me to 3 Reports After 12 Years
AI Meets Minecraft
New AI Threats in 2026 #sponsored by @Snyksec
Follow The Money
I collected 79 cybersecurity books in one place
Controlling electronic shelf labels with Evil-Cardputer
AI Smartcard hacking
The CISO’s evolving role: Protecting and defending in the agentic era
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Japan’s GMO Internet Urges Customers to Disconnect PCs
Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries
AI Is Turning CISOs Into Business-Risk Translators, Says Nvidia’s Head of Cyber
Hackers Target US Federal Election Commission
Microsoft Releases Emergency .NET Patches
New Research Reveals Gaps in AI Safeguards, Cyber Experts Discuss
Fake ChatGPT, Claude apps spread malware via signed AI binaries
Gheist turns GitHub Actions into a secret extraction service
Trusting Unsloth’s trust setting could mean executing malicious code
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA Adds Two Known Exploited Vulnerabilities to Catalog
EPICS Base
Studying Fraudulent North Korean IT Workers
Hiding Capabilities in AI Models
Bias in Qwen3-Coder Model
Lessons from Cybersecurity Black Week
ESET APT Activity Report Q2 2026–Q3 2026
PHP2Shell: What to know about two critical PHP flaws
SHARED INTEL Q&A: PHP2Shell is no Log4Shell — open-source flaw is more warning than wildfire
MY TAKE: OktoberTech reveals a hardening AI foundation — but no one yet governing the agents
News alert: Gcore extends free web protection to government agencies after widespread PHP exploits
Millions of security cameras at risk: DoS vulnerability in Intelbras devices
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
Deploying AI agents securely: how Kaspersky products mitigate AI threats
Proofpoint Introduces Flex to Help Customers Invest with Confidence as Security Needs Evolve
Proofpoint Joins Microsoft Integrated Cloud Email Security (ICES) Ecosystem
Proofpoint CEO Sumit Dhawan On ‘Market-Changing’ $6.3B Varonis Deal, IPO Goal
Holiday Shopping Gets an Agentic AI Twist
The 5 Pillars of Agentic Readiness
AI Agent Order Data: Agentic Commerce on Forter’s Network
JNISleuth-MCP: Automated Android JNI RegisterNatives recovery, ARM64 OLLVM (CSEL + BR X8) deobfuscator, and Ghidra / IDA Pro 9.0 bridge
Does any one Reverse Engineered IDM ( Internet Download Manager) ??
iCloudKit Extractor: seven months from an ADP dead end to a public toolkit
ZDI-CAN-36579: Meta
Raise Cuts Chargebacks 45% and Nearly Ends Manual Fraud Reviews
Fraudsters Leave Patterns, and AWS Wants AI to Follow Them
Scams Gain 10 Percentage Points in Share of Fraud Dollars
Code-execution flaw in UEFI firmware affects most servers on planet Earth
Knicks sent employees fake offer of championship rings in phishing test: Report
Disgraced eMudhra drops out of TLS business after using cert private key of 4
why EVERYONE is copying this
The #1 Danger Isn't Roblox
0day Hacks NetworkChuck (OSINT)
The AI advantage your company can keep
Bringing CRM into the flow of work and agents into business process for sales and service teams
Introducing the new Copilot with Home, Code and Autopilot
Five election scams to watch out for
Artificial Intimacy: Love and lies in the age of AI
The web’s having a rough week. Here’s how to browse safely
Heimdal named Advanced Persistent Threat Solution of the Year at the Computing Security Awards
Data Breach Statistics That Matter in 2026
6 alternatives to TrendAI Vision One
The $2,000 php2shell Challenge Was Unexploitable
php situation 24h later
The race to the first exploit // php2shell
🍍📟 Theme Hacking Tip - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
BOTS WIPED OUT? | Threat Wire
🍍📟 Don't dox yourself: Censor Mode - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
Can You Train AI on a Laptop?
How Police Can Track Your Phone
Learn More About AI With Me at GTC
Indirect Syscall Rust Loader Analysis (Stream)
Malicious AGENTS.md file in Downloads folder hijacks AI coding agents
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
HackTheBox - Checkpoint
HackTheBox - Eloquia
HackTheBox - DevHub
In Singapore for a few days hanging out with hackers and having a good time.
Your AI hackbot has found another 100+ vulnerabilities. Who fixes them? And how? ft Erlend
wood will keep you warm, once when chop, carry, staple and sort it, and once when you burn it.
Behind Japan’s Warnings of a Cyber Crisis
PHP2Shell Exploitation: Two Critical PHP Flaws Explained
TAG-217 Targets South Korean Financial Services with ARTEX
Widespread PHP Flaw May Cause Many Site Outages Today
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.K. Sanctions Cryptomus for RU Money Laundering
Does your fraud risk assessment measure up when a financial crime occurs?
Fraud Risk Assessment: A New Model and New Approach
Assessing the Strength of Your Fraud Controls
Black Hat Stories | Island.io
Black Hat Europe 2026 | Hear From Our Sponsors
Black Hat Stories | First Time Exhibitor
#StopRansomware: SafePay Ransomware
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
Anthropic’s AI Reversal Is A Warning Shot For Agentic Defense
Agentic AI Is Changing Security Decisions: Why Accountability Must Be Designed, Not Assumed
A New OT Security Playbook for Connected Robots
eIDAS 2.0 and AMLR Updated Standards: What Should Regulated Businesses Do Next?
Business Fraud at Network Scale: What the $3.5B Medicare Hospice Crisis Reveals About Know Your Business
DCSG1 - Pwn2Own Level Break of a Printer - SungJun Park, WonBeen Im
DCSG1 - Augmenting Apple's Source Code and OS Logs with AI Agents -Olivia Gallucci
DCSG1 - Actual OT Cyber Security - Dillon Lee
AI Agents Can Be Secured. We Can Do It.
Why the Open Secure AI Alliance Matters: Open Frontier Models, Open Deployment Flexibility
Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave
Ransomware: A Continuing Threat for Small Businesses
AI in Tax Season: Risks, Scams, and How to Protect Your Data
Tax Season Scams to Watch For This Year
Why every payments team should be watching for ACH fraud
From the Edge to the Core: 9 Ways PKI Secures Your Network
How to Secure Your Email Server on an SMB Budget
Microsoft Build 2026: Building agentic apps with Microsoft Fabric and Microsoft Databases
Azure IaaS: Defense in depth built on secure-by-design principles
Enforcing trust and transparency: Open-sourcing the Azure Integrated HSM
How FIN6 Exfiltrates Files Over FTP
Emulating FIN6 - Active Directory Enumeration Made EASY
The SECRET to Embedding Metasploit Payloads in VBA Macros
Try another search or clear the filters.
Showing 180 of 983 loaded entries. Search and all-headlines view include all available entries in this section. Browse the feed archive.