Corey Thuen hires hackers for what he calls ‘the evil bit’ — an adversarial streak he believes is either there or it isn’t.

The post Hacker Conversations: Corey Thuen and the Evil Bit appeared first on SecurityWeek.

The Amsterdam-based company plans to use the funding for research and development and commercial expansion in Europe and the Middle East.

The post Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform appeared first on SecurityWeek.

Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.

The post Signal Vulnerability Lets Malicious Callers Block Hang-Ups appeared first on SecurityWeek.

Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching.

The post Tech and Security Companies Respond to PHP2Shell Vulnerabilities appeared first on SecurityWeek.

Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.

The post Splunk, SolarWinds Release Fresh Security Updates appeared first on SecurityWeek.

Critical-severity security defects could lead to command execution, authentication bypass, and XSS attacks.

The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek.

Initial attempts were observed on October 17, and mass activity began shortly after patches were released.

The post PHP2Shell Exploitation Started Days Before Patches appeared first on SecurityWeek.

Nearly 100 vulnerabilities have been assigned a critical severity rating and Fusion Middleware received the most patches.

The post Oracle Patches Over 1,200 Vulnerabilities With October 2026 CPU appeared first on SecurityWeek.

The $25 billion award far exceeds a $5 billion fine the Federal Trade Commission levied against Facebook in 2019.

The post Meta Ordered to Pay New Mexico $25 Billion for Deceiving Users About Privacy on Facebook appeared first on SecurityWeek.

Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis.

The post Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections appeared first on SecurityWeek.

Doppelgänger (German for “double”) describes the campaign’s hallmark: fake
copies of well-known news sites, with a design, logo and layout meant to make
readers think they are reading an article from a legitimate media outlet.

In recent weeks, ClearSky identified renewed activity by the Russian influence
campaign in Israel. The campaign, known as “The Double” – Doppelgänger,
spreads false and misleading messages built on parts of real publications, while
impersonating well-known media outlets. The messages are spread on social
networks, mainly on X, through a network of fake accounts. The goal is not only to
spread one-off false information. The campaign aims to push, over time, messages
that serve Russian interests, weaken trust in the government and its institutions,
deepen divisions in Israeli society and pollute AI engines. Between May and October
2026, ClearSky’s analyst team documented at least 76 fake articles published on
walla[.]ist, a site impersonating the Walla news site. The campaign’s resurgence
since August 2026 may stem from a Russian intent to influence Israeli public opinion
ahead of the elections scheduled for October 27, as Russia has done in election
campaigns in other countries. This report sums up the infrastructure, scale,
messages and accounts we identified.

Read the full report:

ClearSky-Russian-Influence-Campaign-Exposure-20.10.26.pdf

OffSec's new framework hub shows security leaders what their teams can do and how to prove it.

The post OffSec Aligns Its Cyber Workforce Development Programs to Global Workforce Frameworks appeared first on OffSec.

Learn all about scoring updates to the OSCP exam that are starting on December 1, 2026.

The post OSCP+ Scoring Update: What You Need to Know appeared first on OffSec.

Learn what to expect from OSCP, including format, requirements, scoring, practical study tips, and answers to common preparation questions.

The post OSCP Exam Guide: What to Expect and How to Prepare appeared first on OffSec.

A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and

The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees. That's according to a report from Reuters, citing two sources familiar with the matter. "To date, our review has determined that the incident occurred as the result of a security failure ​

Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in Denmark's national population register, the country's digitalization ministry said on October 5. They used a private Danish company's lawful right to look up records in the Central Person Register (CPR). The ministry has told people never to

A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X.

Atlassian has told its users to patch its datacenter products, pronto, to prevent attackers accessing their files. The Australian collaborationware company on Monday sent users an email that opens with the words “Action required” and points to a security bulletin that explains CVE-2026-21589. The 9.3-rated arbitrary file access vulnerability is present in the datacenter versions of its Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye products. Atlassian says the vulnerability “allows an unauthenticated attacker to access specific files within the web application root directory in affected versions.” That’s scary because Atlassian warns “In some configurations, there may be sensitive files present that increase your risk.” There’s also some good news in that attackers must know the exact filename and path to exploit the vulnerability, and the mess doesn’t allow anyone to see the contents of a directory. Another piece of good news is that Atlassian has updated its products – so users only need to find a change window in which to upgrade to a safe version of their software. Atlassian advised those who can’t patch ASAP to remove their instances from the internet, if possible. “Instances accessible to the public internet, including those with user authentication, should be restricted from external network access until you can take action,” the company warned. Its advisory also includes mitigations and advice on how to determine if your instances need the fix. Users who made the move from datacenter products to the Atlassian cloud have nothing to do, as Atlassian fixed the flaws in its own SaaS. That state of affairs rather vindicates Atlassian’s 2020 decision to stop developing its low-end server products and require users to shift into its cloud, and last year’s sequel in which it decided to discontinue its datacenter software, too. Atlassian admitted it hasn’t made that migration easy, because it somehow released a lift and shift tool that was worse than an earlier version. In March 2026, Atlassian axed ten percent of staff. The company’s share price was on a year-long slide at the time, as pundits suggested it might fall victim to the SaaSPocalypse, a theory that AI would replace business software. The price of Atlassian scrip has tripled since then, suggesting investors are more confident the company’s plan to use AI to power workflows represents a moat LLMs cannot cross. ®

Linux KVM, the hypervisor favoured by hyperscale clouds, apparently has a full VM escape bug. That nasty news came from security researcher Paulos Yibelo, who on X shared a screenshot of a bug bounty award he won for discovering what he described as “Full VM escape zeroday (guest>host root in industry standard hypervisors)!” The bug bounty Yibelo participated in is run by Vercel, a company that provides MicroVMs as sandboxes for AI agents to work inside. The company’s Sandbox uses Firecracker MicroVMs, a technology created by AWS, which relies on Linux KVM – the kernel level hypervisor in Linux. Vercel CEO Guillermo Rauch named KVM as the hypervisor identified by Yibelo. “We’ve confirmed a KVM 0day through our Vercel Sandbox bounty program. Affecting the industry’s gold standard solution for Linux virtualization,” he wrote. And that’s all the info that has made it into the public view at this time. The Register can find no chat on relevant mailing lists. We have asked Rauch and Yibelo for additional details. Hopefully, we don’t hear from either of them for days or weeks, for two reasons. One is that guest-host escapes are the nightmare virtualization scenario because they mean whoever runs a guest VM could take over an entire server, and perhaps gain the ability to control other guests. The other is that KVM is astoundingly prevalent: AWS and Google both use it to power their public clouds. Enterprise virtualization players Nutanix, HPE, and Proxmox also rely on KVM. And of course KVM is also in Firecracker, which is open source and could therefore be running in all sorts of places. Whatever Yibelo discovered therefore very much needs a responsible disclosure process, because if hints about the flaw emerge it could allow attackers to do a lot of damage. Once a fix is found, the next question is whether implementing it will require disruption or downtime. It’s possible to hot-patch KVM, and to migrate live VMs from vulnerable hosts to machines running a patched version of Linux. Hopefully those techniques will work. This might be the second nasty bug discovered in KVM this year, after the so-called Januscape flaw. Beyond the potential risks this bug created, observers have suggested the potential seriousness of the flaw means Yibelo’s reward should exceed the $50,000 available under Vercel’s bug bounty program. ®