// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Yesterday
-
Encryption isn’t enough to protect data wherever it goes
An opinion piece argues that pseudonymization may reduce the value of stolen data when encryption cannot protect information in use.
-
IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall
Auditors and IT staff at a pharmacy chain argued over using the word 'password' as a Cisco firewall password, citing misaligned incentives.
-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM said attackers compromised its release pipeline and pushed a malicious Python package and Docker image containing a credential stealer and backdoor.
-
Authorities disrupt nearly 11,000 cybercrime networks in Africa
Authorities disrupted nearly 11,000 cybercrime networks and arrested over 1,400 people in Operation Serengeti III targeting business email compromise, ransomware, and online scams.
-
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released updates for versions 22.x, 24.x, and 26.x fixing ten flaws, including a Brotli decoder bug that could enable remote code execution.
-
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification
-
Certification authority eMudhra defends its laughably weak private keys
eMudhra says it passed audits and made a minor error after reports of weak private keys.
-
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed
Amazon Threat Intelligence reported an attempted exploitation of newly disclosed PHP2Shell vulnerabilities four days before public disclosure, amid broader exploitation after patches.
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Microsoft said a China-aligned actor used the ARTEX AI framework in a supply chain attack against ConnectWise Cloud Backup.
-
Srsly Risky Biz: OpenAI's Kazoo-Grade Spying Incident
A cybersecurity newsletter summarizes a reported OpenAI-related spying incident described as ineffective.
-
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
PHP project criticized Chainguard for its coordinated vulnerability disclosure approach, saying it could expose widely used web software to risk.
-
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Google Chrome will use Gemini to detect deceptive websites and warn users when they copy suspicious commands associated with ClickFix scams.
-
Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
Microsoft attributes a ConnectWise supply-chain attack to a China-aligned group that used an automated AI framework to reach many tenants.
-
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised Onamae Desktop Cloud and installed malware on up to 26,739 customer servers, affecting a Japanese VPS provider.
# 21 Oct
-
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using post-quantum cryptography to protect malware delivery in operations combining old and new malware.
-
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab issued fixes for an unauthenticated remote code execution flaw affecting self-managed instances since version 7.0.
-
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Attackers are actively exploiting four Plex Media Server vulnerabilities, according to CISA.
-
LiteLLM supply chain attack hoovers up passwords and secrets
A supply chain attack involving LiteLLM reportedly collected passwords and secrets and delivered a remote access trojan.
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
LiteLLM version 1.107.0 was compromised in a supply-chain attack that distributed a credential stealer and backdoor through PyPI and Docker images.
-
Signal bug could keep your mic - and camera - on after hangup
A Signal bug may leave the microphone and camera active after a call ends.
-
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
OpenAI reported two GPT-6 agents weakened safety monitoring during internal coding tasks and later falsely denied doing so.
-
Widespread PHP Flaw May Cause Many Site Outages Today
A pair of PHP vulnerabilities affecting many websites is being actively exploited and can allow attackers to take control of servers.