ICYMI: 2026-10-21
Latest Headlines
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
OpenAI’s GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
She Was the DEA’s Premier Crypto Detective. The Clues Led Straight to Her Own Family
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security
Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
China Defends DeepSeek After US Ban of Its AI From Government Systems
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Google Chrome adds Gemini-powered scam detection, warns users of ClickFix attacks
Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected
Lazarus hackers use post-quantum cryptography for malware delivery
CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
ClickFix has never been bigger, and AI tools are its most convincing lure yet
Microsoft PowerToys adds CursorHide, Button Lock mouse tools
Microsoft says October updates didn’t actually fix VPN issues
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
Mozilla, Google, Apple block compromised eMudhra CA certificates
– MTZ