Category: Newsbeat

The web’s certificate trust system just had one of its scariest weeks in years. On October 17, 2026, an independent researcher proved that the private keys of eight eMudhra intermediate certificate authorities could be recovered straight from their public certificates, meaning anyone could have forged trusted HTTPS certificates for any website against clients that still […]

GitLab has shipped an emergency critical patch release for CVE-2026-110264, an integer overflow in its regular-expression compiler that carries the maximum CVSS score of 10.0 and could let an unauthenticated attacker execute arbitrary code on a self-managed GitLab server. Released on October 21, 2026 as versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, the […]

In the early hours of October 21, 2026, attackers hijacked the release pipeline of LiteLLM, the hugely popular open-source Python SDK and AI gateway that sits in front of OpenAI, Anthropic, Azure and dozens of other model providers, and pushed a poisoned version 1.107.0 to PyPI, Docker Hub and GitHub Container Registry. The malicious wheels […]

On October 21, 2026, the PHP project shipped emergency releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws in the PHP engine itself: CVE-2026-109618 and CVE-2026-109619, together dubbed PHP2Shell. Both are rated CVSS v4.0 9.2 by the PHP security team and can allow unauthenticated remote code execution, independent of the application running […]

Five days after attackers turned a stolen ConnectWise Cloud Backup credential against Microsoft 365 tenants, the incident has moved from discovery into cleanup. ConnectWise says it completed a full reset of all accounts and credentials in the affected Cloud Backup environment on October 19 and, as of its October 21 update, has begun restoring services […]

Five months after it was patched, a PAN-OS GlobalProtect authentication bypass has become one of ransomware’s favorite front doors. In an update published October 19, 2026, Palo Alto Networks’ Unit 42 said the Qilin (tracked as Spikey Scorpius) and INC (Tarnished Scorpius) ransomware operations are actively exploiting CVE-2026-0257, a CVSS 7.8 flaw in the GlobalProtect […]

On Monday, October 19, 2026, Microsoft announced a new set of controls in Microsoft 365 E7 and its Project Perception security system that treat AI agents as insiders rather than trusted software. The package includes Dynamic Permissions, which start an agent with no access and grant it only what a single task needs; Dynamic Agent […]

Since Friday, October 16, 2026, managed service providers have been scrambling after attackers got hold of a credential belonging to ConnectWise Cloud Backup, the Microsoft 365 backup service formerly sold as SkyKick, and used it to sign in to customer tenants as the trusted backup app itself. Huntress first confirmed unauthorized sign-ins in 162 tenants, […]

On Thursday, October 15, 2026, Microsoft announced that months of under-the-hood work on Windows 11 are now rolling out broadly, delivering what the company calls a Windows experience that is up to 20% more responsive across Start, File Explorer, Search, Settings, Snipping Tool, Microsoft 365 and Edge. The update leans heavily on smarter memory management, […]

If your organization runs Ivanti Connect Secure (ICS), this is the week to drop everything: on Tuesday, October 13, Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass by spoofing with a CVSS score of 8.6 that lets a remote, unauthenticated attacker execute arbitrary commands on the VPN appliance, and it had already been exploited as a […]