Unvetted AI agents are accessing U.S. bank accounts https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
AxiosScoop: Unvetted AI agents are accessing U.S. bank accountsBanks including Morgan Stanley, Bank of America, JPMorgan, Wells Fargo and others are racing to contain agent risks.
Exclusive: FoxIO researcher says Bun never answered its May report of a server-crashing HTTP/3 flaw https://runtimewire.com/article/researcher-says-bun-did-not-answer-may-report-on-http3-flaw-7e4927?rwr=xmu4qsbu&rws=llpxf5e1
RuntimeWireExclusive: FoxIO researcher says Bun never answered its May report of a server-crashing HTTP/3 flawSébastien Féry told RuntimeWire that FoxIO reported the flaw through the channel in Bun's security policy and "never heard back." Bun shipped HTTP/3 security fixes Thursday in a release that doesn't mention FoxIO or the report.
CVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory https://kb.isc.org/docs/cve-2026-94300
kb.isc.orgCVE-2026-94300: Concurrent GSS-TSIG messages corrupt memory
Operation IXIM: Preventing a botnet of millions of Popcorn Time users https://labs.eye.security/operation-ixim-preventing-a-botnet-of-millions-of-popcorn-time-users/
Eye ResearchOperation IXIM: Preventing a botnet of millions of Popcorn Time usersOver the past X months, Eye Research has been actively disabling the vulnerable update mechanism used by the popular download client PopCorn Time. This involved executing code on systems running the vulnerable software. This is the story on how we got here and why we took the unprecedented decision of taking matters into our own hands.
Custom Extensions for SmartScreen Evasion https://ipurple.team/2026/10/22/custom-extensions/
Purple TeamCustom ExtensionsThreat actors may create a custom extension or modify an existing file extension to masquerade a malicious implant as a legitimate file. A custom file extension may be used to support phishing scen…
Reversing a DPRK-linked toolkit that backdoors VS Code, Cursor, Discord and npm, with an Ethereum dead-drop C2 and a DEV#POPPER variant https://medium.com/@tarunrd77/north-korea-backdoored-their-vs-code-npm-kept-bringing-it-back-6371da5e74c4?sharedUserId=tarunrd77
MediumNorth Korea Backdoored Their VS Code. npm Kept Bringing It Back.No scheduled tasks. No registry keys. Just a RAT hidden behind 200 spaces in the tools developers use every day, with a Python stager…
PHP Just Patched Two Critical Remote Code Execution Flaws. Update Now. https://kylesinvestigation.com/2026/10/21/php-just-patched-two-critical-remote-code-execution-flaws-update-now/
KYLES INVESTIGATIONPHP Just Patched Two Critical Remote Code Execution Flaws. Update Now. - Nationwide Private Investigator & Skip Tracing | Knoxville TN Background Checks & OSINT | Kyle's InvestigatOctober 21, 2026 If your website runs on PHP, check your version today. The PHP security team released emergency fixes this morning for two critical vulnerabilities, and attack tools are already circulating online. The fix: update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Any earlier release of those branches is exposed. What happened Details of […]
CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window https://nefariousplan.com/posts/php-cve-2026-109618-109619-two-directions-one-window
Gallery of PHP maintenance pages from today https://r74n.com/php
r74n.comThe Day the Internet went Dark (PHP2Shell)Gallery of websites shut down by the October 2026 PHP vulnerabilities.
uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/
[0x0v1]uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging appsIntroduction
uCreater (the vendor's own name for the product is YingGai) is a commercial Android surveillance platform built around 群控 (“mass control”). Branded through packages in the com.ucreator.* namespace, it is not a single malware family but a productized framework: a VirtualApp/LSPatch engine, a library of per-
PHP patches for critical PHP2Shell vulnerabilities https://www.php.net/archive/2026.php#2026-10-21-5
www.php.netPHP: News Archive - 2026PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
PHP rce CVE-2026-109618 https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
watchTowrPHP Remote Code Execution FAQ: CVE-2026-109618 | watchTowrCVE-2026-109618 FAQ: affected PHP versions, fixes and more - updated as details emerge.
France had more Internet-exposed Danfoss refrigeration dashboards than the rest of the world combined before the supermarket attacks (weekly IPv4 scan data) https://ipinfo.io/blog/france-fridges-hack
ipinfo.ioFrance's Supermarket Fridges Were Vulnerable Online for MonthsIPinfo scans reveal that 85% of exposed French refrigeration controllers had known security flaws before the October 2026 cyberattack.
Warning claims two 10.0 RCEs affect PHP 5 and later https://runtimewire.com/article/two-massive-php-rces-to-be-announced-thursday-pete-cooper
RuntimeWireWarning claims two 10.0 RCEs affect PHP 5 and laterA post attributed to watchTowr names two PHP RCE vulnerabilities, but their existence, affected versions and patch status could not be independently confirmed.
The OffiDocs Browser Extension Campaign https://amibeingpwned.com/blog/offidocs-campaign
amibeingpwned.comThe OffiDocs CampaignOffiDocs runs 60 Chrome extensions with 2.3M installs across 4 publisher accounts, mostly everyday office tools. 37 of them hex-encode and exfiltrate every full URL you visit, with no explicit consent, under privacy policies that allow sharing with business partners and other third parties.
Free real-time Certificate Transparency stream, no API key https://certstream.dev/free-certstream-api.html
All vulnerabilities are now race conditions https://blog.himanshuanand.com/2026/09/all-vulnerabilities-are-now-race-conditions/
Himanshu Anand :: Security & Other Notesall vulnerabilities are now race conditionsTLDR AI made finding bugs cheap. It did nothing to make getting paid for them any easier. The same bug now gets found by ten different people inside a fortnight. One of them collects the money. The other nine collect a polite duplicate notice and a dent in their platform reputation. The programmes are drowning too. That is why curl shut down its entire bounty operation in January 2026, after fewer
How I got over 300 Tor exit nodes removed https://kaba.cx/posts/20261020_Tor/
kaba.cxHow I got over 300 Tor exit nodes removed
Prompt injection, XSS and SIEM-exfil payloads living in reverse DNS, plus 28 fake Googlebots that passed FCrDNS https://ellio.tech/en/blog/ignoreallpreviousinstructions-a-peek-into-340-billion-daily-reverse-dns-ptr-records/
How practical is 100k requests per second? Introducing h3fuzz https://www.slcyber.io/research/how-practical-is-100k-requests-per-second-introducing-h3fuzz
www.slcyber.ioHow practical is 100k requests per second? Introducing h3fuzzCan HTTP/3 really give you 100k requests per second for content discovery? We tested it in a fork of ffuf and are releasing h3fuzz, a web UI for fuzzing.
Unauthenticated SQL injection in GLPI (≤ 11.0.8) https://mobeta.fr/blog/glpi-unauth-sqli/
MobetaUnauthenticated SQL injection in GLPI (≤ 11.0.8) | MobetaAn unauthenticated attacker can read the whole GLPI database via the planning endpoint (GLPI ≤ 11.0.8). Analysis, proof of concept and the 11.0.9 fix.
