Security Brief Daily

Security Brief Daily
  • 0.0 (0)
  • Tech News
  • Daily

A daily AI-generated cybersecurity briefing. Fresh threat intelligence, vulnerability roundups, and infosec news — concise, clear, and delivered every day.

  1. 2d ago

    Oct 28, 2026 · #112

    Episode 112 — 28 Oct 2026 1. ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws Source: The Hacker News The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a server-side... 2. Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The... 3. Apple backports CoreGraphics zero-day patches to older iPhones Source: Bleeping Computer ​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...] 4. CISA confirms PHP2Shell vulnerabilities now exploited in attacks Source: Bleeping Computer The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...] 5. Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Source: The Hacker News Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in... 6. Hackers hijack Convertr analytics script to steal payment card data Source: Bleeping Computer A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...] 7. DreamHost forces password resets in ongoing "incident" Source: Bleeping Computer DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...] 8. Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach Source: The Hacker News Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip helps lead to...

  2. 3d ago

    Oct 27, 2026 · #111

    Episode 111 — 27 Oct 2026 1. CISA confirms PHP2Shell vulnerabilities now exploited in attacks Source: Bleeping Computer The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...] 2. CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring... 3. PHP2Shell security flaws now sucessfully exploited in the wild Source: Bleeping Computer Two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild. [...] 4. Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento Source: The Hacker News An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages... 5. DreamHost forces password resets in ongoing "incident" Source: Bleeping Computer DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface. [...] 6. University of Copenhagen data breach exposes data of 525,000 people Source: Bleeping Computer The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...] 7. Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Source: The Hacker News Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed... 8. Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses Source: The Hacker News The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device...

  3. 4d ago

    Oct 26, 2026 · #110

    Episode 110 — 26 Oct 2026 1. PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Source: The Hacker News *CnwVfT7֡齧3'Ɠ ~O!c:]2:2z*.[jt\9 jc[ǹ7Pj|'o1aê1J8&]Fiv=755! l; j1eI5,iŽo!YHG-$x: ;Vr*G& 5bdcP}(rq/Fd~M... 2. Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Source: The Hacker News A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw... 3. Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Source: The Hacker News Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern... 4. HPE patches eight max severity RCE and auth bypass AOS flaws Source: Bleeping Computer Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. [...] 5. PHP shares mitigation for new RCE vulnerability with no patch Source: Bleeping Computer The PHP security team has shared mitigation measures for a new remote code execution vulnerability that affects systems with non-default configurations and has no patch. [...] 6. Arista patches new VeloCloud Orchestrator zero-day exploited in attacks Source: Bleeping Computer Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...] 7. Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Source: The Hacker News LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was... 8. LiteLLM release pipeline hacked to distribute info-stealer malware Source: Bleeping Computer Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...]

  4. 6d ago

    Oct 24, 2026 · #108

    Episode 108 — 24 Oct 2026 1. PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware Source: The Hacker News Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The... 2. Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Source: The Hacker News Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. The flaw, CVE-2026-112900, is in the way Pillow handles EPS images, which it opens by passing the file's name... 3. Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials Source: The Hacker News Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators in this... 4. BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations Source: The Hacker News Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected... 5. Quest Diagnostics confirms data breach exposed patient records Source: Bleeping Computer American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...] 6. LiteLLM release pipeline hacked to distribute info-stealer malware Source: Bleeping Computer Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...] 7. Amazon says PHP2Shell exploitation began 4 days before patches Source: Bleeping Computer Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...] 8. GitLab warns of new max severity code execution vulnerability Source: Bleeping Computer GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...]

  5. Oct 23

    Oct 23, 2026 · #107

    Episode 107 — 23 Oct 2026 1. PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware Source: The Hacker News Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The... 2. Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Source: The Hacker News Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or... 3. PHP ships emergency patches for critical PHP2Shell flaws Source: Bleeping Computer The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...] 4. Arista patches new VeloCloud Orchestrator zero-day exploited in attacks Source: Bleeping Computer Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...] 5. INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown Source: The Hacker News INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies from 21 countries arrest 1,462 suspects. Codenamed... 6. LiteLLM release pipeline hacked to distribute info-stealer malware Source: Bleeping Computer Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...] 7. Railway warns devs to rotate secrets after potential breach Source: Bleeping Computer Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...] 8. Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation Source: The Hacker News Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted...

  6. Oct 22

    Oct 22, 2026 · #106

    Episode 106 — 22 Oct 2026 1. China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack Source: The Hacker News Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that... 2. PHP ships emergency patches for critical PHP2Shell flaws Source: Bleeping Computer The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. [...] 3. Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions Source: The Hacker News Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an... 4. Authorities disrupt nearly 11,000 cybercrime networks in Africa Source: Bleeping Computer Law enforcement agencies have disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people in Operation Serengeti III, which targeted business email compromise, ransomware, and online scams. [...] 5. LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release Source: The Hacker News LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push... 6. Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed Source: The Hacker News .u-7= NB9h )C OjlA }]. }B9't툇qmejQDjwӺiڞܖ7= C6$}ʹ3 = Dz npyS]2U|ɲ!%՟."ث? 7\|EWJBCzj}YW|]7֡_9ݻ~gYΓw1HaB]... 7. CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers Source: Bleeping Computer The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...] 8. Lazarus hackers use post-quantum cryptography for malware delivery Source: Bleeping Computer North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]

  7. Oct 21

    Oct 21, 2026 · #105

    Episode 105 — 21 Oct 2026 1. PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Source: The Hacker News This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an out-of-cycle security release at 14:00 UTC today, October... 2. Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Source: The Hacker News Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical... 3. CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities... 4. Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA Source: The Hacker News Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited... 5. CISA: SafePay ransomware hit over 600 critical infrastructure orgs Source: Bleeping Computer The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. [...] 6. OVHcloud CLI releases backdoored on GitHub to steal developer secrets Source: Bleeping Computer French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...] 7. Stolen UpdraftCentral keys used to backdoor WordPress sites Source: Bleeping Computer A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...] 8. Zeabur shutting down after second security breach in two months Source: Bleeping Computer Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810...

  8. Oct 20

    Oct 20, 2026 · #104

    Episode 104 — 20 Oct 2026 1. GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories Source: The Hacker News The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution,... 2. OpenCode hack exposes API keys amid AI distillation attacks Source: Bleeping Computer The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...] 3. Drupal patches critical RCE flaws, warns exploits may emerge soon Source: Bleeping Computer Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. [...] 4. Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge Source: The Hacker News A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday,... 5. Critical BlockStrap flaw lets hackers run code on Magento servers Source: Bleeping Computer Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...] 6. WordPress SEO plugin Rank Math compromised to backdoor websites Source: Bleeping Computer Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...] 7. ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan Source: The Hacker News Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted... 8. Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic Source: The Hacker News A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and...

See All (107)

About

A daily AI-generated cybersecurity briefing. Fresh threat intelligence, vulnerability roundups, and infosec news — concise, clear, and delivered every day.

Information

  • Creator
    Security Brief Daily
  • Years Active
    2026
  • Episodes
    107
  • Rating
    Clean
  • Copyright
    © 2026 Security Brief Daily
  • Show Website
    Security Brief Daily