Threat Wire
BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys BleepingComputer [Critical] FBI links $6.3 billion Binance crypto heist to North Korean hackers BleepingComputer [Critical] Alpine Linux rebuilds GitLab after attempted RCE attack CVE-2026-118539 [Critical] Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION CVE-2026-58882 [Critical] SMS of Death: Android under attack, an invisible SMS can block calls and emergency services The Hacker News [Critical] CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key The Hacker News [Critical] FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist CVE-2026-111357 [Critical] U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog BleepingComputer [Critical] Northflank security breach leads to abuse of customers' AI API keys

CyberWatch Newsroom Live Intel

Continuous enterprise threat intelligence tracking active in-the-wild zero-days (CISA KEV), Microsoft Windows KB cumulative updates, MSRC security advisories, and CVE remediation.

Last Checked: Nov 2, 2026 - 02:28:59 UTC (Hourly Auto-Sync Active)
Newsfeed (/feed) RSS Feed JSON API
All Security Bulletins 5,807 Active Zero-Days (KEV) 608 Microsoft Patch KBs 849 MSRC Live Wire 1,922 CISA Advisories 157 Threat Intel 2,629
Showing 24 of 411 advisories
Page 4 of 18
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors Important The Hacker News
2026-10-21 The Hacker News

China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors

Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. "The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading," Sophos security researcher Gab…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports Moderate The Hacker News
2026-10-21 The Hacker News

Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports

Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and the behavioral signals email filters have relied on for years are fading as a result. Proofpoint shared several examples of the s…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't Critical The Hacker News
2026-10-21 The Hacker News

PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't

You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP will release the fix at 14:00 UTC on October 21 for two flaws it rates 9.2 out of 10, and has given no workaround of its own. Until you can i…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
The Harness Is the Hard Part of Agentic Pentesting Moderate The Hacker News
2026-10-21 The Hacker News

The Harness Is the Hard Part of Agentic Pentesting

An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on afterward lives in the harness around the model. The harness is where the engineering in AI pentesting sits. The Hugging F…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections Critical The Hacker News
2026-10-21 The Hacker News

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, afte…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Critical The Hacker News
2026-10-21 The Hacker News

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites Important The Hacker News
2026-10-21 The Hacker News

Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor als…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases Moderate The Hacker News
2026-10-21 The Hacker News

U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases

U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Security order. They may also no longer buy information technology products or services from the Chinese AI developer or its affiliat…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Moderate The Hacker News
2026-10-21 The Hacker News

State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web

State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain dat…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws Important CVE-2026-96652 The Hacker News
2026-10-21 The Hacker News

CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side R…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion Important The Hacker News
2026-10-21 The Hacker News

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster dubbed Partisan Zmiy, which is also known as the Cyber Partisans. Known to be active since at least 2020, the group has a t…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software Moderate The Hacker News
2026-10-20 The Hacker News

Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher report…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Critical CVE-2026-106173 The Hacker News
2026-10-20 The Hacker News

Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthoriz…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA Critical CVE-2026-0257 The Hacker News
2026-10-20 The Hacker News

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto N…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites Critical The Hacker News
2026-10-20 The Hacker News

Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites

A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet. The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment mak…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election Critical The Hacker News
2026-10-20 The Hacker News

Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election

The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators Moderate The Hacker News
2026-10-20 The Hacker News

WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators

WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one. The text sat in the pages' code, never shown on screen, until it was rem…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
What Security Teams Can Do To Tame Wild Code Moderate The Hacker News
2026-10-20 The Hacker News

What Security Teams Can Do To Tame Wild Code

A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster th…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns Moderate The Hacker News
2026-10-20 The Hacker News

Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns

Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certifi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader Critical The Hacker News
2026-10-20 The Hacker News

Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader

The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail, involved the use of a backdoor call…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident Moderate The Hacker News
2026-10-20 The Hacker News

ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident

ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the fo…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Important The Hacker News
2026-10-20 The Hacker News

Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan Important CVE-2026-110936 The Hacker News
2026-10-20 The Hacker News

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious cod…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge Moderate The Hacker News
2026-10-20 The Hacker News

Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge

A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in fr…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.
Threat Intelligence
Advisory
1 2 3 4 5 6 ... 18
Notification