The important things.
In fewer words.
98 stories · Most recent event first
Security
CISA disclosed four EPICS Base vulnerabilities on 27 October affecting version 7.0.10 and earlier. Operators should update to 7.0.11 and test compatibility before production deployment.
Security · Developing
SecurityWeek reports that Defused’s Oracle E-Business Suite decoys observed exploratory attacks on 27 October against CVE-2026-101767. Oracle patched the critical Application Object Library flaw in its 20 October update.
Security · Developing
CISA added CVE-2026-48356, affecting Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog on 27 October. Adobe’s July security releases address the flaw.
Security · Developing
Microsoft removed seven certificates from Windows trust on 26 October after discovering recoverable eMudhra intermediate certificate-authority private keys. Edge received the same distrust change on 27 October.
Security
Ubuntu’s 26 October NGINX updates address flaws that can crash server workers or, under additional conditions, allow remote code execution. The affected configurations and fixed package versions vary by release.
Security
Apple released iOS 18.7.11 and iPadOS 18.7.11 on 26 October, including a fix for CoreGraphics vulnerability CVE-2026-86950. Apple says it is aware of a report that the flaw may have been exploited against specific individuals on versions before iOS 27.
Security · Developing
UNM Health said on 28 October that clinical operations were fully functional and classes and research had resumed after a 26 October cybersecurity incident disrupted patient care.
Security
CISA added the Brotli vulnerability CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October. Node.js fixes and rebuilt PHP Windows packages are available; exposure depends on whether software processes untrusted Brotli-compressed input.
Security
FoxIO's 26 October technical analysis describes three TLS weaknesses in the GoAhead embedded web server. Depending on the TLS library and configuration, they can undermine certificate checks or expose some encrypted traffic. Vendor advisories list GoAhead 6.1.1 as patched; device owners still need an appropriate firmware update from their manufacturer.
Security · Developing
DreamHost said it discovered unauthorized access on 23 October to a server running its web-based File Manager. The company said the intruder accessed FTP/SFTP credentials of users who had used the tool from about August through 23 October, and credentials for a limited number of webmail users; contents of a small number of mailboxes may have been viewed. DreamHost said the incident affected a fraction of email and FTP/SFTP accounts, well under about 10%, but gave no count. It reset credentials and said it found no evidence of control-panel or billing access; the investigation continues.
Security
Arista disclosed an actively exploited SQL-injection vulnerability in VeloCloud Orchestrator on 22 October. CVE-2026-114625 can let an authenticated tenant user become a local superuser operator; it is not an unauthenticated attack.
Security
HPE has issued fixes for critical AOS-8 and AOS-10 networking vulnerabilities that can allow unauthenticated code or command execution.
Security
CISA added PHP2Shell CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on 26 October. On 3 November, Singapore’s Cyber Security Agency said Palo Alto Networks had reported active exploitation against internet-exposed management interfaces on firewalls running affected PAN-OS versions. The alert also lists selected Cisco, Citrix, F5, Siemens and Fortinet products as affected. The flaws can permit unauthenticated remote code execution. Reported chains with Linux flaw CVE-2026-46300 remain attributed to vendor and security-researcher reporting; victims and compromise count remain unknown.
Security
LiteLLM says attackers distributed malicious 1.107.0 packages and container images on 21 October. The affected artifacts included credential-stealing malware; the vendor removed or replaced them and advises affected users to rebuild from trusted artifacts and rotate exposed credentials.
Security · Developing
Moldova’s prime minister said on 3 November that preliminary data show attackers extracted at least one information item in about 750,000 cases during cyberattacks on public digital services from 19 to 23 October. He cautioned this does not mean 750,000 full accounts were hacked. AGE said extraction was stopped on 23 October and later attempts were blocked; as of 30 October it reported 21 of 82 assessed services remained temporarily unavailable. Authorities are investigating possible foreign-state involvement but have not publicly named an actor.
Security · Developing
Florida's Department of Education says criminals gained unauthorized access to its student financial-aid website, potentially affecting about 4.9 million people. Information that may have been involved includes Social Security numbers and other identity details, but officials say not everyone was necessarily affected and the investigation continues. Staff became aware of the incident on 19 October; the department disclosed it on 29 October.
Security · Developing
A federal filing lists 8,179,772 people affected by iRhythm Technologies’ data breach. The company’s updated notice is dated 2 October; the intrusion occurred in June. This is a catch-up report on that disclosure.
Security
Denver Health Medical Plan disclosed on 1 October that a SquareML vendor access key had been publicly exposed, potentially allowing access to a database containing information on 238,083 members.