WHATS
THE HAX?
WHATS Security signals, without the noise.
Article feed
60 sources ↓Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
Multiple Cisco Products Snort 3 Security Hardening Release: October 2026
Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities
Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Cisco Advance Notification for Publication of October 21, 2026, Security Advisories
Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability
Cisco Unified Communications Manager Improper Access Control Vulnerability
Cisco Expressway Series Information Disclosure Vulnerability
Cisco Expressway Series Security Hardening Release: October 2026
Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability
Cisco Secure Client Secure Firewall Posture Module Privilege Escalation Vulnerability
Cisco Expressway Series Remote Code Execution Vulnerability
Cisco Unified Communications Products Security Hardening Release: October 2026
Railway warns devs to rotate secrets after potential breach
Capcom confirms data breach affecting 11.7 million accounts
LiteLLM release pipeline hacked to distribute info-stealer malware
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Microsoft shares how to fix broken Exchange Online EWS apps
Machine speed attacks require machine speed detection and response
Amazon says PHP2Shell exploitation began 4 days before patches
GitLab warns of new max severity code execution vulnerability
Authorities disrupt nearly 11,000 cybercrime networks in Africa
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
Lazarus hackers use post-quantum cryptography for malware delivery
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
OpenAI agents disabled safety monitoring, one lied about it
PHP ships emergency patches for critical PHP2Shell flaws
Toronto crime tips org freezes operations after details of data breach come to light
Indian tech company eMudhra announces withdrawal from certificate business after security incident
Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents
Cybercrime crackdown across Africa leads to 1,462 arrests, $105 million seized
South Carolina officials offer assistance after state capital hit with cyberattack
Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX
Signal Vulnerability Could Keep Calls Alive After Users Hang Up
PHP2Shell Attacks Started Four Days Before Public Disclosure, AWS Reports
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
Russian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by Ukraine
OpenAI Reports Two Incidents of AI Agents Disabling Their Own Oversight
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack
What We Missed: Feds Lasso Texas Laptop Farms
Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour
UAE Transitions 50% of Gov't Services to Agentic AI
TiDB Breach Exposes Flawed Cloud Security Assumptions
Marvell, Microsoft & Oracle Work to Standardize Data Center Hardware Security
Cloud Security Alliance Survey Finds Data Loss Prevention Often Detects Data Loss Only After It Happens
'PHP2Shell' Bugs Signal Red Alert for Security Industry
OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
Optiv Launches CyberBOT Cybersecurity Awareness Training Program
Survey Finds High-Profile Executives Feel Untouchable as Digital Exposure Turns Into Physical Risk
GitLab critical patches include one for a bug that allows code execution by unauthenticated users
Security teams urged to center defense on the flaw profile attackers target most
LiteLLM release pipeline hacked to distribute credential-stealing malware
China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants
OpenAI’s models are deliberately breaking their misalignment monitoring systems
Two critical PHP flaws put the web on alert as emergency patches arrive
Microsoft: Treat AI agents as insider threats
Disgraced eMudhra drops out of TLS business after using cert private key of 4
Hackers got a four-day head start on epic PHP2Shell vulnerability
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
A stranger disassembled my mouse’s official app, fixed my checksum, and by accident gave me the idea for USB cable support
Hello everyone,It's Aditya from India. I am working on a project where I use machine code to make my own ultra photorealistic graphics game engine while using math.So if anyone is interested to talk about this, I would like to discuss with you
I reverse engineered Black & White with Astra and added LLM + voice support on top of the game's original AI. The environment is exposed to the LLM's context and the creature can select tools to inspect and interact with the world or answer questions about it.
Vidar Stealer — Chrome Injection & Malicious JS Targeting Google & Reddit Sessions
Ghidra 12.2 has been released!
There isn't an easy exploit for this PHP vulnerability
GitHub - gsl0001/windows-airdrop: Research harness: OWL's AWDL core built and tested on Windows with a mock radio (no Wi-Fi hardware)
SuperGhidra: an improvised agent-first RE tool on top of Ghidra
gore: a CLI that turns a Godot game (PCK or EXE) into a project you can open, with automatic AES-256 key recovery
How Cryo's Atlantis: The Lost Tales (1997) engine works: formats, panoramic projection, scripts and 3D heads
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
Patch or Pass #1: Plex Media Server exploit chain now in CISA KEV, PAN-OS GlobalProtect (CVE-2026-0257) used by Qilin and Inc ransomware, plus 2 EOL boxes with no patch
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
PHP2Shell detection: attempt signatures and IOCs from live open-dir tracking
Prince of Persia: A Threat Group Hiding in Plain Sight | Semperis Research
PHP2Shell Exposure Hunting - Do you have it across your estate and where?? An Advanced Hunting pack for Defender XDR
KeyStealth: A $10,000 PhaaS Kit caught in the wild
PHP2Shell exploitation prior to public disclosure in MadPot
eMudhra intermediate CA keys exposed (weak P-384 generation). Browsers blocked the chains, but check your non-browser trust stores
Header Accordions: QPACK amplification attacks against HTTP/3 servers
Security Disclosure: Wednesday October 21st
eMudhra Statement on Recent Certificate Security Incident
PHP2Shell disclosure-day telemetry: scanners that double as droppers, a second stage not in public malware feeds, and IOCs (user agents, boundary strings, hashes)
Recent AI-Assisted Cyber Attacks in Japan: Investigating Attack Infrastructure and Techniques - JPCERT/CC Eyes
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Dissecting Operation FlashHole, a complex attack by Lazarus
Inside CARLIY0S: How CyberCartel Used Multiple AI Models to Attack 400+ Latin American Banks and Financial Institutions
[SECURITY] litellm 1.107.0 compromised (PyPI removed; Docker latest/main-stable STILL infected): cook.pth credential stealer + sitecustomize RCE loader, built from lookalike repo Berri-AI/litellm
PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web
Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
eMudhra kills its certificate business after researchers cracked its private keys in under a second
Encryption isn’t enough to protect data wherever it goes
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
PHP releases emergency fixes for 2 critical vulnerabilities
CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory
Markdown Is the New Executable: Attackers Are Dropping Agent Instructions Into Your Downloads Folder From the Web
Operation IXIM: Preventing a botnet of millions of Popcorn Time users
Custom Extensions for SmartScreen Evasion
The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security
Gallery of PHP maintenance pages from today
PHP2Shell (CVE-2026-109618/109619): first exploit requests arrived 5.5 hours before PHP shipped the fix, and the "scanners" carry Mirai-style loaders
PHP patches for critical PHP2Shell vulnerabilities
In Singapore for a few days hanging out with hackers and having a good time.
The Economics of AI
PHP Issues Patches for Two Critical Flaws, Security Leaders Discuss
11M Impacted by Capcom Breach, Some Facing Unauthorized Changes
US Defense Department Faces Class Action Lawsuit for Data Breach
CISO Burnout Isn’t a Personal Problem — It’s Organizational
Hacker Conversations: Corey Thuen and the Evil Bit
Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Splunk, SolarWinds Release Fresh Security Updates
Cisco Patches 34 Vulnerabilities Across Multiple Products
PHP2Shell Exploitation Started Days Before Patches
Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU
Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security
News alert: Gcore extends free web protection to government agencies after widespread PHP exploits
CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability
CVE-2026-108456 Azure AI Foundry Elevation of Privilege Vulnerability
CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability
CVE-2026-96251 Microsoft PowerShell Remote Code Execution Vulnerability
CVE-2026-96303 Microsoft PowerShell Security Feature Bypass Vulnerability
CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability
CVE-2026-61359 Windows Storage Elevation of Privilege Vulnerability
CVE-2026-69902 Windows NTFS Remote Code Execution Vulnerability
CVE-2026-83709 Windows NTLM Elevation of Privilege Vulnerability
CVE-2026-85868 Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2026-97783 Microsoft Office SharePoint Spoofing Vulnerability
EU Regulators to Investigate Booking.com Over Scam Risks
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Cloud Security Maturity Lags Despite Widespread Adoption, SANS Warns
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
New Serious PHP Vulnerabilities Released and Patched
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
OpenAI’s coding agents talked themselves out of being monitored
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Fingerprint uses AI coding tools to automate fraud detection setup
XTIUM expands XTAI with centralized AI governance and cost management
SentinelOne brings runtime threat detection and response to AI agents
Broadcom adds real-time scam detection to 3-D Secure authentication
Claude Security can now spot vulnerabilities that reappear in code
Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks
What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Anthropic finds 94 cases where open-source projects drop security controls without warning
Signal flaw could expose audio and video even after users hang up
Africa cybercrime crackdown nets 1,462 arrests and over $105 million
AI-found bugs are expected to rise, and OpenAI has a five-stage response plan
Delinea gives AI assistants read-only access to governance data
Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question
AI agent permissions are outrunning security
Say a few words, and a rigged AI asks for $5,000
AI coding boom exposes cracks in cloud development
AI agent observability is struggling to keep up with hallucinations
Kiloview E3 NDI Encoder
Siemens Industrial Edge App Publisher
Siemens Software Center
Siemens Capital Embedded AR Classic
Siemens SENTRON 3NA COM Fuse
Siemens PSS(R)SINCAL
Siemens SIMATIC IPCs
Siemens APOGEE, TALON and Desigo PXC/PXM Products
Siemens Industrial Edge Device Kit
Siemens SIMATIC S7 Webserver API
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
Siemens RUGGEDCOM CROSSBOW
Siemens WinCC
Siemens SIMATIC S7 PLCs Web Server
Siemens RUGGEDCOM CROSSBOW Station Access Controller
Siemens SIMATIC S7-1500 TM MFP
Siemens Industrial Edge Devices
Siemens RUGGEDCOM APE1808 Devices
InterSystems Corporation InterSystems IRIS for Health
Managing AI Token Consumption for Operational Resilience
What Fraud Data Says About Where Payment Security Is Headed
Booking.com Probe Exposes Travel Fraud Beyond Checkout
Booking.com Anti-Fraud Practices Face Scrutiny in Europe
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
AI Guardrails Aren’t Stopping Criminal Hackers
ISC Stormcast For Thursday, October 22nd, 2026 https://isc.sans.edu/podcastdetail/10146, (Thu, Oct 22nd)
Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
The race to the first exploit // php2shell
Behind Japan’s Warnings of a Cyber Crisis
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
WhatsApp’s chatbot was given hidden instructions to not mention privacy regulators
PHP2Shell: Why websites are going offline for emergency security updates
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
🍍📟 Don't dox yourself: Censor Mode - WiFi Pineapple Pager #pentesting #hacking #cybersecurity
I went through the confirmed AI coding agent security incidents since July 2025. The agent was rarely the way in. The things installed next to it were.
Over a decade in PHP's codebase. AI made it exploitable in a week.
Is it possible to intercept/read an Email?
php patch is available now
AI-assisted php2shell exploit chain hits PHP runtime, forces coordinated defense across 70% of web
Critical PHP2Shell Vulnerabilities (CVSS 9.2): CVE-2026-109618 & CVE-2026-109619 — Patch & Hunt Immediately
Graysentinel
What are you guys doing for IR team training?
What made you guys like or even love cybersecurity?
PHP: Critical remote code execution vulnerabilities, update now
PHP - As an IT person, what should I be doing?
I built a full-chain Chrome exploit in 6 days using only gpt-5.6-sol…Ask Me Anything!
LiteLLM 1.107.0 compromised on PyPI and installs a credential stealer and backdoor
PHP2Shell - AI uncovers critical vulnerabilities in the backbone of the web
The Biggest Opportunity in Gaming & Betting Is Knowing When to Say Yes
Widespread PHP Flaw May Cause Many Site Outages Today
Does your fraud risk assessment measure up when a financial crime occurs?
Black Hat Stories | Island.io
Try another search or clear the filters.
Security signals, without the noise. — page 1
Current feed archive. Entries come from the loaded publisher feeds and change as those feeds update.