// security
$ tail -f ./security
Headlines from early disclosure channels, research labs and curated news, each with a short summary.
# Today
-
Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack
A red-team report found OpenAI's monitoring of its agents during a Hugging Face attack was partial and easily bypassed.
-
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft plans to add AI-powered, context-aware phishing detection to Teams messages beginning in early November 2026.
-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Researchers reported a UEFI bootkit named BlackX bypassing Secure Boot on patched Windows systems during targeted attacks on Central Asian diplomatic organizations.
-
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby released updates fixing three regex engine bugs linked to four GitLab remote code execution flaws caused by memory corruption during pattern compilation.
-
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Researchers reported ransomware affiliates used AI agents and an automated intrusion framework to carry out attacks and data extortion.
-
FCC bans two devices with surveillance chips linked to Huawei
The FCC banned two surveillance devices containing chips manufactured by Huawei subsidiary HiSilicon.
-
Microsoft: Windows Server 2016 reaches end of support in January
Windows Server 2016 will reach end of support in January 2027 and will no longer receive security updates.
-
Knicks sent employees fake offer of championship rings in phishing test: Report
The Knicks reportedly sent employees a fake offer of championship rings as part of a corporate phishing test.
-
Quest Diagnostics confirms data breach exposed patient records
Quest Diagnostics confirmed a data breach exposed patient records after unauthorized access to its Quanum LSM system.
-
Senators say targeted ads are a security risk. Ad groups say the critics are off base.
Some senators and Citizen Lab researchers linked targeted ads to security risks, while IAB Europe and Google defended industry vetting practices.
-
PHP shares mitigation for new RCE vulnerability with no patch
PHP security team shared mitigation measures for an unpatched remote code execution vulnerability affecting non-default configurations.
-
You gave your AI agent access, but who is giving it orders?
AI agents can be manipulated via malicious emails, websites, or plugins to misuse legitimate permissions for commands, data access, or file deletion, prompting discussion of runtime controls.
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Researchers reported a campaign compromising exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, exposing more than 70,000 credentials.
-
UK proposes 14-year prison terms for undersea cable sabotage
The UK proposes increasing maximum prison sentences to 14 years for deliberate undersea cable sabotage under updated legislation.
-
Quest Diagnostics warns of potential data theft after attack on lab service system
Quest Diagnostics reported a possible breach of patient data involving one of its key systems.
-
HPE patches eight max severity RCE and auth bypass AOS flaws
HPE released security updates for ArubaOS addressing 72 vulnerabilities, including eight critical remote code execution and authentication bypass flaws.
-
Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches
Linux kernel maintainer Linus Torvalds says AI-generated patches are acceptable if competent developers produce good code, but drive-by submissions should be avoided.
-
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP has warned of CVE-2026-115560, an unpatched remote code execution issue affecting only web applications with unusual configurations.
-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Russian-linked hackers used a new mesh network backdoor in a destructive attack against a Ukrainian logistics company after initial access via a spear-phishing email.
-
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
A critical vulnerability in Python's Pillow library allows code execution when processing EPS images because filenames are passed to Ghostscript without validation.
-
UK threatens subsea cable saboteurs with 14 years behind bars
The UK government proposed tougher penalties for damaging subsea cables and new powers over telecoms operators amid concerns about sabotage.
-
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Researchers demonstrated a Node.js remote code execution proof of concept using crafted Brotli data processed by the bundled decoder, affecting an official Linux arm64 Node.js 24.22.0 image.
-
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
A flaw in the x402 SDK default client could let malicious APIs request AI agents’ full token balances before spending limits were added.
-
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware
Attackers made millions of unsuccessful attempts to exploit new PHP2Shell vulnerabilities to deploy a Mirai botnet variant, according to reported activity.
-
Reports of PHP bug exploitation attempts grow as experts downplay viability of exploits
Reports of exploitation attempts involving PHP bugs known as PHP2Shell increased, while experts said the exploits are less viable than headlines suggest.
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies
A security bulletin reports a ransomware supply chain attack affecting shipping firms, ongoing exploitation of PHP2Shell, and GoDaddy certificate revocations.
-
Railway warns devs to rotate secrets after potential breach
Railway reported suspicious activity involving customer environment variables and recommended rotating stored secrets.
# Yesterday
-
Toronto crime tips org freezes operations after details of data breach come to light
A Toronto Crime Stoppers chapter paused operations after disclosing details of a data breach and its timeline.
-
PHP2Shell exploit bypasses protections designed to stop remote code execution
A PHP2Shell exploit reportedly bypasses protections designed to prevent remote code execution, according to researchers.
-
Capcom confirms data breach affecting 11.7 million accounts
Capcom has confirmed a breach of its CAPCOM ID membership service exposed email addresses and related data for 11.7 million accounts.