The important things.
In fewer words.
54 stories · Most recent event first
Security · Developing
Microsoft removed seven certificates from Windows trust on 26 October after discovering recoverable eMudhra intermediate certificate-authority private keys. Edge received the same distrust change on 27 October.
Security
Ubuntu’s 26 October NGINX updates address flaws that can crash server workers or, under additional conditions, allow remote code execution. The affected configurations and fixed package versions vary by release.
Security
Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October, including a fix for CoreGraphics vulnerability CVE-2026-86950. Apple says it is aware of a report that the flaw may have been exploited against specific individuals on versions before iOS 27.
Security · Developing
UNM Health said on 28 October that clinical operations were fully functional and classes and research had resumed after a 26 October cybersecurity incident disrupted patient care.
Security
CISA added the Brotli vulnerability CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October. Node.js fixes and rebuilt PHP Windows packages are available; exposure depends on whether software processes untrusted Brotli-compressed input.
Security
FoxIO's 26 October technical analysis describes three TLS weaknesses in the GoAhead embedded web server. Depending on the TLS library and configuration, they can undermine certificate checks or expose some encrypted traffic. Vendor advisories list GoAhead 6.1.1 as patched; device owners still need an appropriate firmware update from their manufacturer.
Security
Arista disclosed an actively exploited SQL-injection vulnerability in VeloCloud Orchestrator on 22 October. CVE-2026-114625 can let an authenticated tenant user become a local superuser operator; it is not an unauthenticated attack.
Security
HPE has issued fixes for critical AOS-8 and AOS-10 networking vulnerabilities that can allow unauthenticated code or command execution.
Security
LiteLLM says attackers distributed malicious 1.107.0 packages and container images on 21 October. The affected artifacts included credential-stealing malware; the vendor removed or replaced them and advises affected users to rebuild from trusted artifacts and rotate exposed credentials.
Security
CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on 26 October. PHP released fixes for both unauthenticated remote-code-execution flaws on 21 October.
Security · Developing
Moldova’s prime minister said on 3 November that preliminary data show attackers extracted at least one information item in about 750,000 cases during cyberattacks on public digital services from 19 to 23 October. He cautioned this does not mean 750,000 full accounts were hacked. AGE said extraction was stopped on 23 October and later attempts were blocked; as of 30 October it reported 21 of 82 assessed services remained temporarily unavailable. Authorities are investigating possible foreign-state involvement but have not publicly named an actor.
Security · Developing
Florida's Department of Education says criminals gained unauthorized access to its student financial-aid website, potentially affecting about 4.9 million people. Information that may have been involved includes Social Security numbers and other identity details, but officials say not everyone was necessarily affected and the investigation continues. Staff became aware of the incident on 19 October; the department disclosed it on 29 October.
Security · Developing
A federal filing lists 8,179,772 people affected by iRhythm Technologies’ data breach. The company’s updated notice is dated 2 October; the intrusion occurred in June. This is a catch-up report on that disclosure.
Security
Denver Health Medical Plan disclosed on 1 October that a SquareML vendor access key had been publicly exposed, potentially allowing access to a database containing information on 238,083 members.