This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 23, 2026 – Read the Full Story in The Times of Israel Imagine a country without borders, universities, facto
The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys : The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the eng
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
A Crime Stoppers chapter has stopped accepting tips after a breach exposed information about anonymous tipsters.
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became availab
As AI accelerates cybercrime and reshapes enterprise security priorities, Flashpoint experts examine what threat intelligence teams need to prepare for in 2027. The post Preparing for 2027: Five Trend
One of the bill’s sponsors told CyberScoop it’s “incredibly expensive” for U.S. AI companies to stay ahead and distillation attacks incentivize stealing over innovation. The post Exclusive: bipartisan
Users were misled about who could access their personal information on Facebook. Now Meta has been ordered to pay $25 billion.
The private keys were so weak they could be guessed in under a second — and one of them was just the number 4. The post eMudhra kills its certificate business after researchers cracked its private key
PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users a
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 22, 2026 – Watch the YouTube Video Where and how do chief information security officers (CISOs) find new cyb
Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers. The post Encryption i
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP. The post Why It’s Urgent to Upda
On October 21, 2026, the PHP project released emergency fixes for two critical remote code execution (RCE) vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and c
Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The expl
Discover how connecting external attack surface visibility with threat-informed vulnerability intelligence helps security teams identify exposures, assess risk, and prioritize remediation. The post Th
Hidden instructions told WhatsApp’s chatbot not to suggest privacy regulators to users struggling to delete their accounts.
Hidden instructions told WhatsApp’s chatbot not to suggest privacy regulators to users struggling to delete their accounts.
