A single bug in one of the web’s most widely embedded compression libraries has turned into a cross-platform patching scramble. CVE-2026-111497, nicknamed Node2Shell, is an out-of-bounds write in Google’s Brotli decoder that affects Brotli 1.0.3 through 1.2.0 and carries a CVSS v4 score of 9.2. Node.js and two Python packages shipped fixes last week, and […]
Continue Reading
The web’s certificate trust system just had one of its scariest weeks in years. On October 17, 2026, an independent researcher proved that the private keys of eight eMudhra intermediate certificate authorities could be recovered straight from their public certificates, meaning anyone could have forged trusted HTTPS certificates for any website against clients that still […]
Continue Reading
GitLab has shipped an emergency critical patch release for CVE-2026-110264, an integer overflow in its regular-expression compiler that carries the maximum CVSS score of 10.0 and could let an unauthenticated attacker execute arbitrary code on a self-managed GitLab server. Released on October 21, 2026 as versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, the […]
Continue Reading
In the early hours of October 21, 2026, attackers hijacked the release pipeline of LiteLLM, the hugely popular open-source Python SDK and AI gateway that sits in front of OpenAI, Anthropic, Azure and dozens of other model providers, and pushed a poisoned version 1.107.0 to PyPI, Docker Hub and GitHub Container Registry. The malicious wheels […]
Continue Reading
A team led by Northwestern University’s Pedram Khalili reported in Nature on October 21, 2026 that it has electrically written and read data in a magnetic memory cell built entirely from antiferromagnets, materials long thought to be nearly impossible to control with current. The researchers built nanoscale all-antiferromagnetic tunnel junctions (AATJs) from two layers of […]
Continue Reading
On October 21, 2026, the PHP project shipped emergency releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws in the PHP engine itself: CVE-2026-109618 and CVE-2026-109619, together dubbed PHP2Shell. Both are rated CVSS v4.0 9.2 by the PHP security team and can allow unauthenticated remote code execution, independent of the application running […]
Continue Reading
Five days after attackers turned a stolen ConnectWise Cloud Backup credential against Microsoft 365 tenants, the incident has moved from discovery into cleanup. ConnectWise says it completed a full reset of all accounts and credentials in the affected Cloud Backup environment on October 19 and, as of its October 21 update, has begun restoring services […]
Continue Reading
Five months after it was patched, a PAN-OS GlobalProtect authentication bypass has become one of ransomware’s favorite front doors. In an update published October 19, 2026, Palo Alto Networks’ Unit 42 said the Qilin (tracked as Spikey Scorpius) and INC (Tarnished Scorpius) ransomware operations are actively exploiting CVE-2026-0257, a CVSS 7.8 flaw in the GlobalProtect […]
Continue Reading
On Monday, October 19, 2026, Microsoft announced a new set of controls in Microsoft 365 E7 and its Project Perception security system that treat AI agents as insiders rather than trusted software. The package includes Dynamic Permissions, which start an agent with no access and grant it only what a single task needs; Dynamic Agent […]
Continue Reading
Since Friday, October 16, 2026, managed service providers have been scrambling after attackers got hold of a credential belonging to ConnectWise Cloud Backup, the Microsoft 365 backup service formerly sold as SkyKick, and used it to sign in to customer tenants as the trusted backup app itself. Huntress first confirmed unauthorized sign-ins in 162 tenants, […]
Continue Reading