Tech nieuws

IT

SlashDot.org

https://slashdot.org

CDC Warns of Rising Threat of Drug-Resistant Germs

  Pagina openen
The CDC estimates that 19 drug-resistant pathogens cause 9.7 million infections and more than 50,000 deaths annually in the U.S., with resistance continuing to outpace development of new treatments. "The agency considers this problem to be one of our most urgent public health threats," reports NBC News. From the report: The report is the CDC's first comprehensive assessment of these drug-resistant pathogens in seven years. [...] The new report offers a detailed picture of these threats in the U.S., including a ranking of which are the most urgent concerns, based on the number and severity of infections they cause and how easily preventable or transmissible they are. The ranking also factors in how many treatment options exist and their costs. [...] The report estimates that 19 drug-resistant germs cause 9.7 million infections annually in the U.S. Of these, four pathogens are ranked as most worrisome, including the fungus Candida auris and the bacteria that causes gonorrhea, which has become resistant to all but one class of antibiotics used to treat it. The other two urgent threats, according to the CDC, are the bacteria Acinetobacter and Enterobacterales, both of which are resistant to a class of antibiotics widely considered a "last resort" for patients. In addition, the report adds a new bacteria to the list of "concerning" threats, which are considered less worrisome but still warrant monitoring: neisseria meningitidis, which causes meningococcal disease. The rare but life-threatening illness can be prevented through childhood vaccinations, but the bacteria that causes it is slowly developing a resistance to penicillin and another antibiotic called ciprofloxacin. The report also offers some good news: The CDC determined that the bacteria Clostridioides difficile, or "C. diff," which causes diarrhea and inflammation of the colon and can be deadly, is causing fewer cases year over year. The agency downgraded it to a serious threat, whereas it was categorized as urgent in the prior version of the report, which came out in 2019.

Read more of this story at Slashdot.

https://science.slashdot.org/story/26/10/28/0256204/cdc-warns-of-rising-threat-of-drug-resistant-germs?utm_source=rss1.0mainlinkanon&utm_medium=feed


Greenhouse Gas Levels Set Records In 2025, UN Says

  Pagina openen
An anonymous reader quotes a report from CBS News: Greenhouse gas concentrations in the atmosphere rose to record highs in 2025, locking in climate impacts that will persist for centuries, the United Nations said on Tuesday. Levels of the three main greenhouse gases -- the climate-warming carbon dioxide, methane and nitrous oxide -- all rose to unprecedented figures in 2025, the U.N.'s weather and climate agency said. The World Meteorological Organization said the rise would lead to more long-term temperature increases for the planet. The bulletin looks at greenhouse gas concentrations -- the amount of those gases in the atmosphere -- rather than new annual emissions amounts as the world burns more coal, oil and gas. In 2025, carbon dioxide concentrations were at 426.8 parts per million (ppm); methane at 1,948 parts per billion, and nitrous oxide at 339.1 parts per billion. That takes them, respectively, to 153%, 267% and 126% of the pre-industrial levels witnessed before 1750. Of the three major greenhouse gases, CO2 accounts for about 66% of the warming effect on the climate. Around half of the total CO2 emitted each year remains in the atmosphere; the rest is absorbed by the land and oceans. From 2024 to 2025, the global average concentration of CO2 rose by 2.8 ppm -- smaller than the record surge from 2023 to 2024 of 3.6 ppm. WMO senior scientific officer Oksana Tarasova said this reflected the "recovery of the land carbon sinks and reduced fire carbon emissions in 2025 after the strong 2023/2024 El Nino," the naturally occurring, climate-warming weather phenomenon. "However, a 2.8 ppm annual increase is still a substantial addition of carbon to the atmosphere from fossil fuel burning." It is also above the average growth rate for the past decade of 2.6 ppm -- a figure that stood at 0.8 ppm in the 1960s. "Another year, another new record," said WMO Deputy Secretary-General Ko Barrett. "Greenhouse gases are trapping an unprecedented amount of heat in the atmosphere, providing energy for more extreme weather and associated risks to our economies and societies. Further reading: UN Says Breaching 1.5C Warming Limit Is 'Imminent and Unavoidable'

Read more of this story at Slashdot.

https://news.slashdot.org/story/26/10/27/2325218/greenhouse-gas-levels-set-records-in-2025-un-says?utm_source=rss1.0mainlinkanon&utm_medium=feed


Ford's Most Affordable EV Will Offer Built-In Bidirectional Home Charging

  Pagina openen
Ford's upcoming $28,350 Fathom electric truck will include a built-in inverter capable of supplying up to 10 kW of AC power to a home, bringing bidirectional charging to a significantly cheaper EV. Owners will still need additional Ford home hardware for features like outage backup and peak-rate energy management, but the company expects the necessary equipment to cost substantially less than its previous-generation system. CNET reports: The upcoming Fathom will be based on what Ford calls its Universal EV Platform, designed with the aid of its 2023 acquisition, startup Auto Motive Power, with bidirectional power on the plate from the start. The hardware required to invert the battery's DC energy to an estimated 10 kW of AC home power will be built into the truck, so it won't require a separate wall-mounted inverter box. Ford says the Fathom's system will meet all applicable UL 1741 requirements and IEEE 1547 standards to ensure the vehicle is safely connected to the grid. As for the actual hardware you plug into your car, all signs point to the Fathom using the NACS plug type pioneered by Tesla and now widely adopted by new EVs in North America. In terms of the communication standard -- the one that governs how AC power is routed from the slim wall box to the car's onboard charger -- that'll be via SAE J3068, a software protocol developed for high-power, heavy-duty AC charging. [...] However, while Fathom's Universal EV Platform eliminates the need for a wall inverter box, it doesn't completely bypass the need for additional hardware to make your home ready to accept bidirectional power. Say you wanted to take advantage of the Home Power Management feature to draw energy into the Fathom's battery when power is cheapest, and then use that energy to offset peak-hour usage when power is most expensive. You'll have to install at least the Ford Home Power Station in your home, at an additional cost. The automaker hasn't specified pricing, but says that it's working to reduce costs and expects this component alone to cost half as much as the first-generation Ford Home Energy system, which debuted at around $1,300. That could put the new system at roughly $650.

Read more of this story at Slashdot.

https://hardware.slashdot.org/story/26/10/27/2151204/fords-most-affordable-ev-will-offer-built-in-bidirectional-home-charging?utm_source=rss1.0mainlinkanon&utm_medium=feed


Growing List of Firms Object to OKX-ICE Tokenized Stock Plans

  Pagina openen
Intel, Oracle, IBM and IonQ have joined a growing list of companies objecting to having tokenized versions of their shares traded through OKX and Intercontinental Exchange's blockchain venture, bringing the total number of objections to 26. About 37% of the companies on OKXICE's original list have now opted out, according to CoinDesk. From the report: The four companies were named in an updated public notice (PDF) dated Monday, Oct. 26, from OKXICE, the two firms' joint venture. They join earlier objectors including Microsoft, Alphabet, Goldman Sachs, Cisco and Wells Fargo. The growing list underscores a hurdle for OKXICE and the SEC's new framework for tokenized stock trading: building a market that issuers are willing to join. The agency's five-year "Innovation Exemption" gives qualifying venues room to test round-the-clock blockchain-based trading of stocks, and it also gives public companies an option to block their shares from being offered. OKXICE issued its initial public notice on Oct. 4, outlining plans to use Uniswap v4 liquidity pools on OKX's XLayer blockchain, with transactions settled in stablecoins. The venue would use automated market makers -- software that executes trades through pools of assets rather than matching buyers and sellers through a conventional order book. Under the framework, venues must notify issuers and give them 30 days to object before offering tokenized versions of their shares.

Read more of this story at Slashdot.

https://news.slashdot.org/story/26/10/27/2130245/growing-list-of-firms-object-to-okx-ice-tokenized-stock-plans?utm_source=rss1.0mainlinkanon&utm_medium=feed


Code-Execution Flaw In UEFI Firmware Threatens Most Servers On Planet Earth

  Pagina openen
Ars Technica's Dan Goodin reports: Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world's server vendors and data centers. The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called (PDF) EDK2 the "preeminent solution / implementation of the UEFI specifications." Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively. Project Mu, Microsoft's hardened EDK2 fork, used the code containing the vulnerable component as well. The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot, which establishes a chain of trust for all code, including the Trusted Platform Module (TPM), loaded during boot. While final payloads delivered by CVE-2026-97631 have no persistence -- meaning they run only once -- they can give attackers a wide opening to install other payloads that also run each time early in the boot process. The parties that discovered CVE-2026-97631 -- Alex Matrosov of Anthropic and Dan Holmes of Google -- had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week. With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming.

Read more of this story at Slashdot.

https://it.slashdot.org/story/26/10/27/2121232/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth?utm_source=rss1.0mainlinkanon&utm_medium=feed


Techcrunch.com

https://techcrunch.com/






TheRegister.com

https://www.theregister.com/






Arstechnica.com

https://arstechnica.com






Wired.com

https://www.wired.com






ZDNet.com

https://www.zdnet.com






TechRepublic.com

https://www.techrepublic.com






mashable.com

https://mashable.com/tech

Apple M6 MacBook Pro vs M5 MacBook Pro: Top 5 Differences You Should Know

  Pagina openen
The M6 MacBook Pro brings more CPU and GPU cores and better wireless connectivity over the M5 model, but most of the other key specs remain the same. Apple's M6 MacBook Pro brings processor and connectivity upgrades over the M5 model while retaining its design, starting memory, storage and claimed battery life.

https://in.mashable.com/tech/115435/apple-m6-macbook-pro-vs-m5-macbook-pro-top-5-differences-you-should-know


Moto G47 Power Specifications Revealed: 7,000mAh Battery, 108-Megapixel Camera And More

  Pagina openen
The Moto G47 Power supports dual nano-SIM cards and runs Hello UI based on Android 16. It features a 6.67-inch HD+ LCD display with a resolution of 720 x 1,604 pixels and a 120Hz refresh rate. Motorola's Moto G47 Power ships with Android 16-based Hello UI and offers dual nano-SIM connectivity. The smartphone sports a 6.67-inch HD+ LCD screen with a 720 x 1,604-pixel resolution and support for a 120Hz refresh rate.

https://in.mashable.com/tech/115438/moto-g47-power-specifications-revealed-7000mah-battery-108-megapixel-camera-and-more


Apple Launches New M6-Powered iMac in India at Rs 1,74,900, Promises up to 2x Faster Graphics Performance

  Pagina openen
The 2026 iMac starts at Rs. 1,74,900 for the base model, which features a 10-core CPU, a 10-core GPU, 16GB of memory and 256GB of storage. Apple is also offering a higher-end variant priced at Rs. 1,99,900. Apple has priced the base model of the 2026 iMac at Rs. 1,74,900, with a 10-core CPU, 10-core GPU, 16GB of RAM and 256GB of storage. A higher-spec variant is also available for Rs. 1,99,900.

https://in.mashable.com/tech/115428/apple-launches-new-m6-powered-imac-in-india-at-rs-174900-promises-up-to-2x-faster-graphics-performan


Redmi K100 With 50-Megapixel Rear Camera, 10,000mAh Battery Launched: Details Inside

  Pagina openen
The Redmi K100 supports dual SIM connectivity and runs HyperOS 4, based on Android 17. It features a 6.83-inch AMOLED display with a 1.5K resolution of 1,280 x 2,772 pixels and a refresh rate of up to 165Hz. On the software front, the Redmi K100 ships with HyperOS 4, which is built on Android 17, along with support for two SIM cards. The smartphone sports a 6.83-inch 1.5K AMOLED display with a resolution of 1,280 x 2,772 pixels and a peak refresh rate of 165Hz.

https://in.mashable.com/tech/115434/redmi-k100-with-50-megapixel-rear-camera-10000mah-battery-launched-details-inside



Geekwire.com

https://www.geekwire.com


Etzioni on AI: Is Anthropic worth $2 trillion? Do the napkin math with this handy calculator

  Pagina openen

Anthropic filed to go public Monday, with its bankers reportedly valuing the company at $1.5 trillion to $2 trillion. Oren Etzioni’s interactive calculator estimates what Anthropic is worth from three inputs: its revenue in 2028, its profit margin and the multiple investors pay for each dollar of profit. Read More

https://www.geekwire.com/2026/etzioni-on-ai-is-anthropic-worth-2-trillion-do-the-napkin-math/



Microsoft earnings preview: Employee buyouts, AI spending and a new financial scorecard

  Pagina openen

Microsoft reports fiscal first-quarter results Wednesday, its first under a new structure that splits the company into two segments, two days after offering buyouts to about 60,000 employees. Analysts expect revenue of $90.75 billion, and Microsoft will start disclosing Azure revenue every quarter. Read More

https://www.geekwire.com/2026/microsoft-earnings-preview-employee-buyouts-ai-spending-and-a-new-financial-scorecard/



Latest from TechRadar

https://www.techradar.com






Cybersecurity

Security.nl

https://www.security.nl






Slashdot

https://slashdot.org/

CDC Warns of Rising Threat of Drug-Resistant Germs

  Pagina openen
The CDC estimates that 19 drug-resistant pathogens cause 9.7 million infections and more than 50,000 deaths annually in the U.S., with resistance continuing to outpace development of new treatments. "The agency considers this problem to be one of our most urgent public health threats," reports NBC News. From the report: The report is the CDC's first comprehensive assessment of these drug-resistant pathogens in seven years. [...] The new report offers a detailed picture of these threats in the U.S., including a ranking of which are the most urgent concerns, based on the number and severity of infections they cause and how easily preventable or transmissible they are. The ranking also factors in how many treatment options exist and their costs. [...] The report estimates that 19 drug-resistant germs cause 9.7 million infections annually in the U.S. Of these, four pathogens are ranked as most worrisome, including the fungus Candida auris and the bacteria that causes gonorrhea, which has become resistant to all but one class of antibiotics used to treat it. The other two urgent threats, according to the CDC, are the bacteria Acinetobacter and Enterobacterales, both of which are resistant to a class of antibiotics widely considered a "last resort" for patients. In addition, the report adds a new bacteria to the list of "concerning" threats, which are considered less worrisome but still warrant monitoring: neisseria meningitidis, which causes meningococcal disease. The rare but life-threatening illness can be prevented through childhood vaccinations, but the bacteria that causes it is slowly developing a resistance to penicillin and another antibiotic called ciprofloxacin. The report also offers some good news: The CDC determined that the bacteria Clostridioides difficile, or "C. diff," which causes diarrhea and inflammation of the colon and can be deadly, is causing fewer cases year over year. The agency downgraded it to a serious threat, whereas it was categorized as urgent in the prior version of the report, which came out in 2019.

Read more of this story at Slashdot.

https://science.slashdot.org/story/26/10/28/0256204/cdc-warns-of-rising-threat-of-drug-resistant-germs?utm_source=rss1.0mainlinkanon&utm_medium=feed


Greenhouse Gas Levels Set Records In 2025, UN Says

  Pagina openen
An anonymous reader quotes a report from CBS News: Greenhouse gas concentrations in the atmosphere rose to record highs in 2025, locking in climate impacts that will persist for centuries, the United Nations said on Tuesday. Levels of the three main greenhouse gases -- the climate-warming carbon dioxide, methane and nitrous oxide -- all rose to unprecedented figures in 2025, the U.N.'s weather and climate agency said. The World Meteorological Organization said the rise would lead to more long-term temperature increases for the planet. The bulletin looks at greenhouse gas concentrations -- the amount of those gases in the atmosphere -- rather than new annual emissions amounts as the world burns more coal, oil and gas. In 2025, carbon dioxide concentrations were at 426.8 parts per million (ppm); methane at 1,948 parts per billion, and nitrous oxide at 339.1 parts per billion. That takes them, respectively, to 153%, 267% and 126% of the pre-industrial levels witnessed before 1750. Of the three major greenhouse gases, CO2 accounts for about 66% of the warming effect on the climate. Around half of the total CO2 emitted each year remains in the atmosphere; the rest is absorbed by the land and oceans. From 2024 to 2025, the global average concentration of CO2 rose by 2.8 ppm -- smaller than the record surge from 2023 to 2024 of 3.6 ppm. WMO senior scientific officer Oksana Tarasova said this reflected the "recovery of the land carbon sinks and reduced fire carbon emissions in 2025 after the strong 2023/2024 El Nino," the naturally occurring, climate-warming weather phenomenon. "However, a 2.8 ppm annual increase is still a substantial addition of carbon to the atmosphere from fossil fuel burning." It is also above the average growth rate for the past decade of 2.6 ppm -- a figure that stood at 0.8 ppm in the 1960s. "Another year, another new record," said WMO Deputy Secretary-General Ko Barrett. "Greenhouse gases are trapping an unprecedented amount of heat in the atmosphere, providing energy for more extreme weather and associated risks to our economies and societies. Further reading: UN Says Breaching 1.5C Warming Limit Is 'Imminent and Unavoidable'

Read more of this story at Slashdot.

https://news.slashdot.org/story/26/10/27/2325218/greenhouse-gas-levels-set-records-in-2025-un-says?utm_source=rss1.0mainlinkanon&utm_medium=feed


Ford's Most Affordable EV Will Offer Built-In Bidirectional Home Charging

  Pagina openen
Ford's upcoming $28,350 Fathom electric truck will include a built-in inverter capable of supplying up to 10 kW of AC power to a home, bringing bidirectional charging to a significantly cheaper EV. Owners will still need additional Ford home hardware for features like outage backup and peak-rate energy management, but the company expects the necessary equipment to cost substantially less than its previous-generation system. CNET reports: The upcoming Fathom will be based on what Ford calls its Universal EV Platform, designed with the aid of its 2023 acquisition, startup Auto Motive Power, with bidirectional power on the plate from the start. The hardware required to invert the battery's DC energy to an estimated 10 kW of AC home power will be built into the truck, so it won't require a separate wall-mounted inverter box. Ford says the Fathom's system will meet all applicable UL 1741 requirements and IEEE 1547 standards to ensure the vehicle is safely connected to the grid. As for the actual hardware you plug into your car, all signs point to the Fathom using the NACS plug type pioneered by Tesla and now widely adopted by new EVs in North America. In terms of the communication standard -- the one that governs how AC power is routed from the slim wall box to the car's onboard charger -- that'll be via SAE J3068, a software protocol developed for high-power, heavy-duty AC charging. [...] However, while Fathom's Universal EV Platform eliminates the need for a wall inverter box, it doesn't completely bypass the need for additional hardware to make your home ready to accept bidirectional power. Say you wanted to take advantage of the Home Power Management feature to draw energy into the Fathom's battery when power is cheapest, and then use that energy to offset peak-hour usage when power is most expensive. You'll have to install at least the Ford Home Power Station in your home, at an additional cost. The automaker hasn't specified pricing, but says that it's working to reduce costs and expects this component alone to cost half as much as the first-generation Ford Home Energy system, which debuted at around $1,300. That could put the new system at roughly $650.

Read more of this story at Slashdot.

https://hardware.slashdot.org/story/26/10/27/2151204/fords-most-affordable-ev-will-offer-built-in-bidirectional-home-charging?utm_source=rss1.0mainlinkanon&utm_medium=feed


Growing List of Firms Object to OKX-ICE Tokenized Stock Plans

  Pagina openen
Intel, Oracle, IBM and IonQ have joined a growing list of companies objecting to having tokenized versions of their shares traded through OKX and Intercontinental Exchange's blockchain venture, bringing the total number of objections to 26. About 37% of the companies on OKXICE's original list have now opted out, according to CoinDesk. From the report: The four companies were named in an updated public notice (PDF) dated Monday, Oct. 26, from OKXICE, the two firms' joint venture. They join earlier objectors including Microsoft, Alphabet, Goldman Sachs, Cisco and Wells Fargo. The growing list underscores a hurdle for OKXICE and the SEC's new framework for tokenized stock trading: building a market that issuers are willing to join. The agency's five-year "Innovation Exemption" gives qualifying venues room to test round-the-clock blockchain-based trading of stocks, and it also gives public companies an option to block their shares from being offered. OKXICE issued its initial public notice on Oct. 4, outlining plans to use Uniswap v4 liquidity pools on OKX's XLayer blockchain, with transactions settled in stablecoins. The venue would use automated market makers -- software that executes trades through pools of assets rather than matching buyers and sellers through a conventional order book. Under the framework, venues must notify issuers and give them 30 days to object before offering tokenized versions of their shares.

Read more of this story at Slashdot.

https://news.slashdot.org/story/26/10/27/2130245/growing-list-of-firms-object-to-okx-ice-tokenized-stock-plans?utm_source=rss1.0mainlinkanon&utm_medium=feed


Code-Execution Flaw In UEFI Firmware Threatens Most Servers On Planet Earth

  Pagina openen
Ars Technica's Dan Goodin reports: Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world's server vendors and data centers. The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called (PDF) EDK2 the "preeminent solution / implementation of the UEFI specifications." Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively. Project Mu, Microsoft's hardened EDK2 fork, used the code containing the vulnerable component as well. The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot, which establishes a chain of trust for all code, including the Trusted Platform Module (TPM), loaded during boot. While final payloads delivered by CVE-2026-97631 have no persistence -- meaning they run only once -- they can give attackers a wide opening to install other payloads that also run each time early in the boot process. The parties that discovered CVE-2026-97631 -- Alex Matrosov of Anthropic and Dan Holmes of Google -- had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week. With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming.

Read more of this story at Slashdot.

https://it.slashdot.org/story/26/10/27/2121232/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth?utm_source=rss1.0mainlinkanon&utm_medium=feed


theregister.com/security

https://www.theregister.com/security






CISO2CISO.com

https://ciso2ciso.com

Hackread.com

https://www.hackread.com






Vuldb

https://vuldb.com

CVE-2026-63286 | Axis Communications AB AXIS Camera Station Pro/AXIS Camera Station 5 private personal information

  Pagina openen
A vulnerability was found in Axis Communications AB AXIS Camera Station Pro and AXIS Camera Station 5. It has been rated as problematic. This impacts an unknown function. This manipulation causes exposure of private personal information to an unauthorized actor. This vulnerability is tracked as CVE-2026-63286. The attack is restricted to local execution. No exploit exists.

https://vuldb.com/vuln/427778


CVE-2026-103370 | Awesome Support Plugin up to 6.4.1 on WordPress wpas_files cross site scripting

  Pagina openen
A vulnerability was found in Awesome Support Plugin up to 6.4.1 on WordPress. It has been declared as problematic. This affects an unknown function. The manipulation of the argument wpas_files results in cross site scripting. This vulnerability is identified as CVE-2026-103370. The attack can be executed remotely. There is not any exploit available.

https://vuldb.com/vuln/427777


CVE-2026-77871 | Post Snippets Plugin up to 4.2.4 on WordPress Shortcode cross site scripting

  Pagina openen
A vulnerability was found in Post Snippets Plugin up to 4.2.4 on WordPress. It has been classified as problematic. The impacted element is an unknown function of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-77871. Remote exploitation of the attack is possible. No exploit is available.

https://vuldb.com/vuln/427776


CVE-2026-92098 | Webheadllc Webheadcoder Multi-Step Forms for Contact Form 7 Plugin cross site scripting

  Pagina openen
A vulnerability was found in Webheadllc Webheadcoder Multi-Step Forms for Contact Form 7 Plugin up to 4.7 on WordPress and classified as problematic. The affected element is an unknown function. Executing a manipulation of the argument l10n_print_after can lead to cross site scripting. The identification of this vulnerability is CVE-2026-92098. The attack may be launched remotely. There is no exploit available.

https://vuldb.com/vuln/427775


CVE-2026-100175 | Postie Plugin up to 1.9.87 on WordPress Email Body URL Autolink cross site scripting

  Pagina openen
A vulnerability has been found in Postie Plugin up to 1.9.87 on WordPress and classified as problematic. Impacted is an unknown function of the component Email Body URL Autolink. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-100175. The attack may be initiated remotely. There is no available exploit.

https://vuldb.com/vuln/427774


advisories.ncsc.nl

https://advisories.ncsc.nl/

NCSC-2026-0456 [1.00] [M/H] Kwetsbaarheden verholpen in Apple iOS en iPadOS

  Pagina openen
Apple heeft kwetsbaarheden verholpen in iOS en iPadOS. De kwetsbaarheden betreffen diverse beveiligingsproblemen zoals onvoldoende validatie van symbolische links, onjuiste permissiecontroles, out-of-bounds lees- en schrijffouten, use-after-free fouten, integer overflows, race conditions, type confusion, en logische fouten in state management. Deze kunnen leiden tot ongeautoriseerde toegang tot gevoelige gebruikersdata, geheugenbeschadiging, onverwachte systeem- of applicatiecrashes, privilege escalatie, sandbox escapes, en denial-of-service condities. Aanvallers kunnen deze kwetsbaarheden misbruiken door speciaal vervaardigde bestanden, netwerkverkeer, of webcontent aan te bieden, of door lokale toegang te hebben tot het apparaat. De kwetsbaarheden zijn aanwezig in verschillende versies van de genoemde Apple besturingssystemen en beïnvloeden onder andere de verwerking van afbeeldingen, video’s, audio, fonts, PDF-bestanden, webcontent, en systeemcomponenten zoals de Keychain, Bluetooth, en Thread-netwerk. Er zijn geen specifieke proof-of-concept details vermeld, maar de beschrijvingen geven aan dat misbruik mogelijk is via diverse aanvalsvectoren.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0456


NCSC-2026-0455 [1.00] [M/H] Kwetsbaarheden verholpen in Apple MacOS

  Pagina openen
Apple heeft meerdere kwetsbaarheden verholpen in macOS, met name in de versies Golden Gate 27.2, Sequoia 15.8.2, Tahoe 26.7.2 en Monterey 12.4. De kwetsbaarheden betroffen diverse beveiligingsaspecten binnen macOS, waaronder onvoldoende validatie van symbolische links (symlinks), onjuiste permissiecontroles, onvolledige autorisatiemechanismen, en fouten in geheugenbeheer zoals out-of-bounds reads en writes, use-after-free, buffer overflows, en race conditions. Deze fouten konden door lokale of remote aanvallers worden misbruikt om privileges te escaleren, sandbox-beperkingen te omzeilen, gevoelige gebruikersdata of kernelgeheugen te benaderen, of om denial-of-service condities te veroorzaken door onverwachte systeem- of applicatiecrashes. Daarnaast werden problemen opgelost in Gatekeeper, de beveiligingscomponent die code-integriteit en app-verificatie afdwingt, waarbij bypasses werden voorkomen. Ook werden kwetsbaarheden in de verwerking van diverse bestandstypen zoals afbeeldingen, video’s, audio, fonts, PDF’s en ZIP-archieven aangepakt om geheugenbeschadiging en ongeautoriseerde code-uitvoering te voorkomen. De fixes omvatten verbeterde validatie van invoer, strengere toegangscontroles, verbeterde geheugenbeheer en state management, en het versterken van sandbox- en privacymechanismen. De updates zijn ook doorgevoerd in andere Apple-platforms zoals tvOS, visionOS en watchOS, waarbij consistentie in beveiligingsverbeteringen werd nagestreefd.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0455


NCSC-2026-0454 [1.00] [M/H] Kwetsbaarheden verholpen in HPE Networking AOS

  Pagina openen
HPE heeft 72 kwetsbaarheden verholpen in HPE Networking AOS-8 en AOS-10, waaronder Mobility Conductors, Mobility Controllers, Mobility Gateways en Access Points. De kwetsbaarheden betreffen verschillende beveiligingsproblemen, waaronder authenticatieomzeiling, command- en SQL-injectie, buffer-overflows en onvoldoende toegangscontrole. Van de in totaal 72 kwetsbaarheden zijn 33 als kritiek aangemerkt. Hiervan kunnen 19 volgens HPE Networking zonder authenticatie op afstand via het netwerk worden misbruikt. Voor de overige 14 kritieke kwetsbaarheden is volgens HPE Networking eveneens geen authenticatie vereist, maar moet de aanvaller toegang hebben tot een aangrenzend netwerk. Succesvol misbruik kan onder meer leiden tot het uitvoeren van willekeurige code, het verkrijgen van administratieve toegang, het wijzigen van configuraties, het uitlezen van gevoelige informatie en Denial-of-Service. Van de 33 kritieke kwetsbaarheden hebben acht een CVSS-score van 10.0. De kwetsbaarheden met kenmerk CVE-2026-79844, CVE-2026-79845, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850 en CVE-2026-79851 kunnen zonder authenticatie en gebruikersinteractie op afstand worden misbruikt. Zeven hiervan kunnen leiden tot het uitvoeren van willekeurige code. CVE-2026-79845 kan leiden tot het verkrijgen van administratieve toegang en het wijzigen of uitlezen van gevoelige gegevens. Voor sommige kwetsbaarheden gelden aanvullende voorwaarden. Hoewel CVE-2026-79844 en CVE-2026-79846 een CVSS-score van 10.0 hebben, vermeldt HPE dat misbruik afhankelijk kan zijn van voorwaarden buiten de controle van de aanvaller. De kwetsbaarheden met kenmerk CVE-2026-79857 en CVE-2026-79860 in het PAPI-protocol van AOS-8, kunnen zonder authenticatie op afstand worden misbruikt door speciaal vervaardigde UDP-pakketten te versturen. Succesvol misbruik kan leiden tot het uitvoeren van willekeurige code met verhoogde rechten en mogelijk volledige compromittering van het systeem. HPE Networking meldt niet op de hoogte te zijn van publieke exploitcode en zijn geen bevestigde gevallen van actief misbruik bekend. Het NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0454


NCSC-2026-0453 [1.00] [M/H] Kwetsbaarheid in Google Brotli-decoder

  Pagina openen
Google heeft een kwetsbaarheid verholpen in de Brotli-decompressiebibliotheek. Deze bibliotheek wordt onder meer gebruikt in Node.js. Een ongeauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken door speciaal vervaardigde Brotli-gecomprimeerde gegevens te laten verwerken. Succesvol misbruik kan leiden tot een denial-of-service, toegang tot gevoelige gegevens uit het procesgeheugen of het uitvoeren van willekeurige code met de rechten van het getroffen proces.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0453


NCSC-2026-0452 [1.00] [M/H] Kwetsbaarheden verholpen in FreeBSD bhyve hypervisor

  Pagina openen
De FreeBSD community heeft meerdere kwetsbaarheden verholpen in bhyve Hypervisor De kwetsbaarheden betreffen race conditions, onjuiste validatie en synchronisatieproblemen in verschillende device modellen binnen de bhyve hypervisor. Een kwaadwillende gast-virtuele machine kan deze fouten misbruiken om een denial of service te veroorzaken door het bhyve proces te laten crashen of om arbitraire code uit te voeren in de host userspace. Dit kan plaatsvinden via manipulatie van event ring size en Transfer Request Block (TRB) velden in de USB 3 device model, het triggeren van out-of-bounds geheugen toegang door onjuiste controle van zero-length Buffer Descriptor List entries in de HDA audio device model, en door het misbruiken van duplicaten, unsynchronized constanten en ontbrekende validatie van resolutieparameters in de framebuffer device model. Deze kwetsbaarheden zijn specifiek voor systemen die de bhyve hypervisor gebruiken.

https://advisories.ncsc.nl/advisory?id=NCSC-2026-0452


NCSC Nieuws

https://www.ncsc.nl/actueel

Kwetsbaarheden in Apple MacOS: update nu

  Pagina openen
Apple heeft meerdere kwetsbaarheden ontdekt in MacOS, in de versies vóór Golden Gate 27.2, Sequoia 15.8.2, Tahoe 26.7.2 en Monterey 12.4. De ernst van deze kwetsbaarheden is gemiddeld tot hoog, met een kans op misbruik die als middelmatig wordt beoordeeld en mogelijke schade die groot kan zijn. Het Nationaal Cyber Security Centrum (NCSC) adviseert om de beschikbare updates zo snel mogelijk te installeren om risico's te beperken.

https://www.ncsc.nl/alerts/kwetsbaarheden-in-apple-macos-update-nu


Kwetsbaarheden in Apple iOS en iPadOS: update nu

  Pagina openen
Er zijn meerdere kwetsbaarheden gevonden in Apple iOS en iPadOS, waaronder CVE-2019-5598 en CVE-2026-64759, met een hoogste risicoscore van 8,8. Deze kwetsbaarheden kunnen leiden tot ernstige problemen zoals ongeautoriseerde toegang en systeemstoringen. De kans op misbruik is gemiddeld, maar de mogelijke schade is groot. Het Nationaal Cyber Security Centrum (NCSC) adviseert om de beschikbare updates van Apple zo snel mogelijk te installeren.

https://www.ncsc.nl/alerts/kwetsbaarheden-in-apple-ios-en-ipados-update-nu


Kwetsbaarheden in Oracle Fusion Middleware-producten: update nu

  Pagina openen
Er zijn meerdere kwetsbaarheden gevonden in Oracle Fusion Middleware-producten. Diverse kwetsbaarheden hebben een kritieke score tot CVSS 10.0. Het Nationaal Cyber Security Centrum (NCSC) beoordeelt de kans op misbruik en de mogelijke schade als ‘hoog’. Het advies is om de nieuwste beveiligingsupdates zo snel mogelijk te installeren.

https://www.ncsc.nl/alerts/kwetsbaarheden-in-oracle-fusion-middleware-producten-update-nu


Update: PHP-kwetsbaarheden nog steeds reden om direct te patchen

  Pagina openen
Er zijn twee kritieke kwetsbaarheden ontdekt in PHP, een veelgebruikte programmeertaal voor websites en webapplicaties. Misbruik van deze kwetsbaarheden kan ertoe leiden dat aanvallers op afstand systemen overnemen. Uit voorzorg had het NCSC zijn website tijdelijk offline gehaald. Ook meerdere andere organisaties, waaronder overheidsinstanties, hadden hun websites preventief uitgeschakeld. Inmiddels zijn beveiligingsupdates (patches) beschikbaar om de kwetsbaarheden te verhelpen.

https://www.ncsc.nl/alerts/update-php-kwetsbaarheden-nog-steeds-reden-om-direct-te-patchen


Kwetsbaarheid in Google Brotli-decoder in Node.js: update nu

  Pagina openen
Er is een kwetsbaarheid (CVE-2026-111497) gevonden in de Brotli-decompressiebibliotheek van Google, die o.a. wordt gebruikt in Node.js. Het Nationaal Cyber Security Centrum (NCSC) beoordeelt de kans op misbruik als ‘gemiddeld’, maar de mogelijke schade als ‘groot’. Het advies is om de nieuwste beveiligingsupdates zo snel mogelijk te installeren.

https://www.ncsc.nl/alerts/kwetsbaarheid-in-google-brotli-decoder-in-nodejs-update-nu


NIST Cybersecurity

https://www.nist.gov

wid.cert-bund.de

https://wid.cert-bund.de




[UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere Schwachstellen

  Pagina openen
Ein Angreifer kann mehrere Schwachstellen in Google Chrome / Microsoft Edge ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4067



cert.ssi.gouv.fr

https://www.cert.ssi.gouv.fr






theHackerNews

https://thehackernews.com

Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach

  Pagina openen
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice. The service hosts Windows desktops used for FX trading,

https://thehackernews.com/2026/10/japans-gmo-offers-1-million-bounty-to.html


Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers

  Pagina openen
Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how Tailscale SSH forwards network connections, a job the Tailscale background process carries out with root privileges. To use them, an attacker must

https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html


ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws

  Pagina openen
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side request forgery (SSRF) that reaches an internal management interface because PeopleSoft trusts its own loopback address

https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html


Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

  Pagina openen
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in

https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html


CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets

  Pagina openen
Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat actors to conduct the malicious cyber operations, described them as distinct from previously published

https://thehackernews.com/2026/10/cyberstrikeai-uses-44-ai-agents-to.html


Techrepublic

https://techrepublic.com/topic/security






BleepingComputer.com

https://www.bleepingcomputer.com/






securityboulevard.com

https://securityboulevard.com

CXSecurity.com

https://cxsecurity.com/






Brian Krebs

https://krebsonsecurity.com

Widespread PHP Flaw May Cause Many Site Outages Today

  Pagina openen
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild.

https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/


Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

  Pagina openen
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.

https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/





Troy Hunt

https://www.troyhunt.com

Weekly Update 527: Cybergeddon News v. Reality

  Pagina openen

Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite

As the news from last week has settled down, it would seem this headline was pretty spot on. The foretold apocalypse didn't eventuate, and there were no internet-destroying outages. In fact, it took days before I could find a single story of PHP2Shell being reliably attributed back

https://www.troyhunt.com/weekly-update-527/


Weekly Update 526: Building HIBP AI/SI First

  Pagina openen

Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite

I have this sense that we've passed the point where "vibe coding" is a derogatory term. I have no empirical evidence for this; it's more a feeling that those weaponising the term have now accepted the inevitability and are just getting with the program.

https://www.troyhunt.com/weekly-update-526/


Weekly Update 525: AI Data Breach Hyperbole

  Pagina openen

Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite

I remember the name of that AI doco now - The AI Doc: Or How I Became an Apocaloptimist. I was watching it on the long-haul flight home the other day, and what I found particularly engrossing was the polar-opposite opinions from a bunch of people: "it'

https://www.troyhunt.com/weekly-update-525/


Weekly Update 524: Live From Copenhagen

  Pagina openen

Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite

I'm in Denmark! Well, just, I'm now at Copenhagen airport ready to begin the long trek home, with the final event at GOTO now done and going just perfectly. This week, there are two ShinyHunters arrests in the news: Pepijn in the Netherlands and then Saif

https://www.troyhunt.com/weekly-update-524/


Weekly Update 523: Live From a Norwegian Fjord

  Pagina openen

Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite

How's that view?! With NDC Oslo now done, it's a little bit of sightseeing before heading to Denmark for GOTO in Copenhagen for Scott's and my "Cyber-broken" talk. In the meantime, this week is mostly about the ShinyHunters trajectory targeting both

https://www.troyhunt.com/weekly-update-523/


Bruce Schneier

https://www.schneier.com

Hiding Capabilities in AI Models

  Pagina openen

Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”

Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses...

https://www.schneier.com/blog/archives/2026/10/hiding-capabilities-in-ai-models.html


Bias in Qwen3-Coder Model

  Pagina openen

Interesting research:

TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.

  • One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked. ...

https://www.schneier.com/blog/archives/2026/10/bias-in-qwen3-coder-model.html



Compromised TLS Certificates

  Pagina openen

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys:

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237...

https://www.schneier.com/blog/archives/2026/10/compromised-tls-certificates.html


New Serious PHP Vulnerabilities Released and Patched

  Pagina openen

PHP maintainers have released fixes for two critical vulnerabilities:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs...

https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html


Security Affairs

https://securityaffairs.co

Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters

  Pagina openen
Italy ’s Parliament cyberattack highlights hybrid warfare risks and the need for transparency, stronger defenses and accountability. The cyberattack targeting email accounts at Italy’s Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, raises questions that go well beyond the security of individual inboxes. At a time when European institutions face [...]

https://securityaffairs.com/201867/hacking/italys-parliament-under-cyber-pressure-why-the-attack-on-the-chamber-matters.html


Australia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking

  Pagina openen
Australia’s cyber agency warns AI will drive more disruptive attacks, helping hackers find vulnerabilities faster and exploit them at greater scale. Australia’s top cyber spy has a blunt message: expect more disruption to everyday services. Abigail Bradshaw, director-general of the Australian Signals Directorate (ASD), says that with each jump in AI capability, more disruption is [...]

https://securityaffairs.com/201859/ai/australias-cyber-spy-chief-expect-more-disruption-as-ai-accelerates-hacking.html


U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog

  Pagina openen
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the PHP PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS score of 9.2). The flaws [...]

https://securityaffairs.com/201840/security/u-s-cisa-adds-php-flaws-php2shell-to-its-known-exploited-vulnerabilities-catalog.html


Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP

  Pagina openen
Ukraine warns that attackers can remotely access Dahua cameras and recorders via Easy4IP, viewing video and changing settings. Ukraine’s cyber incident response team CERT-UA has warned about attackers taking over video surveillance systems made by Dahua. In its alert dated October 23, 2026, it reports unauthorized remote access to IP cameras and video recorders. The [...]

https://securityaffairs.com/201827/hacking/attackers-take-control-of-dahua-cameras-and-video-recorders-via-easy4ip.html


Cohere Finds Qwen AI Model Contacting a Server in China

  Pagina openen
Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems. A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task. “Asked to write a defensive detection rule, Qwen3.8-Flash-Next [...]

https://securityaffairs.com/201810/ai/cohere-finds-qwen-ai-model-contacting-a-server-in-china.html


news.sophos.com

https://news.sophos.com