Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

October 22, 2026 at 12:27AM GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed serve…

LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

October 21, 2026 at 11:31PM The popular LiteLLM Python package has been compromised as part of a software supply chain attack tha…

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

October 21, 2026 at 11:35AM A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare …

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

October 21, 2026 at 10:27AM PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulne…

Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

October 20, 2026 at 10:39PM The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromise…

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

October 20, 2026 at 12:41PM Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said …

Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge

October 20, 2026 at 11:23AM A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer a…

Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

October 20, 2026 at 09:35AM Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that&…

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

October 19, 2026 at 11:02PM Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptoc…

From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software

October 19, 2026 at 05:20PM In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record …

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

October 19, 2026 at 03:36PM A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and m…

OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys

October 19, 2026 at 11:37AM An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the t…