IT news
Microsoft: Chinese spies used AI to breach ConnectWise
Microsoft disclosed that a China-aligned actor used an AI framework to compromise ConnectWise and target hundreds of organizations.
Oct 25, 10:15 AM UTC · 3 sources
Latest in IT
eMudhra exits global SSL/TLS business after key compromise
Indian certification authority eMudhra is abandoning its global SSL/TLS operations following the discovery of weak private keys in its intermediate certificates.
Railway breach exposes customer secrets, urges rotation
Railway disclosed a security incident where an unauthorized party accessed encrypted environment variables, prompting urgent credential rotation for users.
UK government services offline over PHP2Shell vulnerability
UK government services were taken offline as a precaution against critical PHP vulnerabilities, with no confirmed breaches reported.
NASA panel flags lunar fueling risks and LEO access concerns
A NASA safety panel identified fueling requirements as a major risk for the Artemis IV mission while raising concerns about future low Earth orbit access.
INTERPOL disrupts 10,909 cybercrime networks in Africa
INTERPOL announced that Operation Serengeti III disrupted over 10,000 malicious networks and recovered more than $105 million in illicit funds across 21 countries.
The Browser Company to sunset Arc browser in December 2026
The Browser Company announced it will discontinue the Arc browser on December 22, 2026, citing rising security costs in the age of AI.
Quest Diagnostics confirms patient data breach in Quanum system
Quest Diagnostics confirmed a cyberattack compromised patient personal and health data in its Quanum system.
GitLab patches critical regex flaw affecting versions since 2014
GitLab released security fixes for a critical remote code execution vulnerability in its regular expression engine.
PHP warns of new unpatched RCE risk after emergency fixes
PHP issued a warning for a new remote code execution vulnerability two days after releasing emergency patches for critical flaws.
Pentagon bans staff from betting on military outcomes
US Defense Secretary Pete Hegseth issued a directive prohibiting Department of War personnel from using nonpublic information for financial wagers.
Arista patches actively exploited VeloCloud zero-day
Arista Networks released security updates to fix a critical SQL injection flaw in VeloCloud Orchestrator that is being actively exploited.
Researchers disable vulnerable Popcorn Time updater on millions of devices
Eye Security researchers remotely disabled a vulnerable updater for the abandoned Time4Popcorn app on millions of devices to prevent potential code execution attacks.
LiteLLM supply chain attack delivers credential stealer
A compromised LiteLLM release distributed malware that steals cloud credentials and private keys.
Node.js patches Brotli decoder flaw enabling remote code execution
Node.js released security updates on October 21 to fix an out-of-bounds write in the Brotli decoder that allows remote code execution.
BlackX UEFI bootkit targets Central Asian diplomatic groups
Kaspersky attributes the BlackX UEFI bootkit campaign to APT41, noting it exploits a vulnerability to bypass Secure Boot on patched systems.
Google updates privacy policy to allow Gmail data for targeted ads
Google revised its privacy policy to permit the use of Gmail and Google Photos data for targeted advertising when users opt into Personal Intelligence features.
OpenAI-led coalition fixes PHP2Shell bug after early leak
OpenAI led a two-month effort to fix critical PHP vulnerabilities that allowed unauthenticated code execution, prompting governments to take websites offline.
PHP patches critical RCE flaws as exploit attempts surge
PHP released an emergency update to fix two critical vulnerabilities allowing unauthenticated remote code execution, following widespread exploitation attempts.