// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft plans to add AI-powered, context-aware phishing detection to Teams messages beginning in early November 2026.
-
Microsoft: Windows Server 2016 reaches end of support in January
Windows Server 2016 will reach end of support in January 2027 and will no longer receive security updates.
-
Quest Diagnostics confirms data breach exposed patient records
Quest Diagnostics confirmed a data breach exposed patient records after unauthorized access to its Quanum LSM system.
-
PHP shares mitigation for new RCE vulnerability with no patch
PHP security team shared mitigation measures for an unpatched remote code execution vulnerability affecting non-default configurations.
-
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated via malicious emails, websites, or plugins to misuse legitimate permissions for commands, data access, or file deletion, prompting discussion of runtime controls.
-
HPE patches eight max severity RCE and auth bypass AOS flaws
HPE released security updates for ArubaOS addressing 72 vulnerabilities, including eight critical remote code execution and authentication bypass flaws.
-
Railway warns devs to rotate secrets after potential breach
Railway reported suspicious activity involving customer environment variables and recommended rotating stored secrets.
# Yesterday
-
Capcom confirms data breach affecting 11.7 million accounts
Capcom has confirmed a breach of its CAPCOM ID membership service exposed email addresses and related data for 11.7 million accounts.
-
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised LiteLLM’s PyPI package and published malicious Docker images that steal credentials, secrets, and environment variables.
-
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks issued security updates for an actively exploited zero-day vulnerability in VeloCloud Orchestrator on-premises deployments.
-
Microsoft shares how to fix broken Exchange Online EWS apps
Microsoft has outlined a temporary option to re-enable retired Exchange Web Services in Exchange Online so affected applications can continue working.
-
Machine speed attacks require machine speed detection and response
A security report says stolen GitHub tokens, malicious AI installers, and MFA phishing can enable rapid data theft before defenders respond.
-
Amazon says PHP2Shell exploitation began 4 days before patches
Amazon reports that attackers began exploiting PHP2Shell vulnerabilities four days before security patches were released.
-
GitLab warns of new max severity code execution vulnerability
GitLab has released patches for a maximum-severity regular expression compiler flaw that could allow remote attackers to execute arbitrary code on vulnerable servers.
-
Authorities disrupt nearly 11,000 cybercrime networks in Africa
Authorities disrupted nearly 11,000 cybercrime networks and arrested over 1,400 people in Operation Serengeti III targeting business email compromise, ransomware, and online scams.
-
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Google Chrome will use Gemini to detect deceptive websites and warn users when they copy suspicious commands associated with ClickFix scams.
-
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
Hackers compromised Onamae Desktop Cloud and installed malware on up to 26,739 customer servers, affecting a Japanese VPS provider.
# 21 Oct
-
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using post-quantum cryptography to protect malware delivery in operations combining old and new malware.
-
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
Attackers are actively exploiting four Plex Media Server vulnerabilities, according to CISA.