-
The Navigate360 data breach has exposed approximately 8.3 million tip records from reporting systems that serve schools and public safety agencies. Some records contained sensitive student information, prompting criticism from Nevada officials over delayed disclosures. Navigate360 confirmed the incident on October 23. According to the company, an unauthorised party accessed its systems between November 21,…
-
A Popcorn Time vulnerability in the abandoned Time4Popcorn fork left millions of computers potentially open to remote code execution. Security researchers intervened by taking control of its expired update domain and disabling vulnerable updaters. The flaw, tracked as CVE-2026-30612, affected the application’s Windows and macOS update mechanisms. Those components downloaded executables over unencrypted HTTP without…
-
Microsoft plans to introduce AI-powered Teams phishing detection in early November 2026. The feature will examine conversation context to identify potential scams, including messages without dangerous links or attachments. Initially, Microsoft will focus on higher-risk conversations, particularly first-time chats from external contacts. The targeted release should finish by mid-November. Meanwhile, the company expects worldwide general…
-
A Quest Diagnostics breach has affected patient information held in the company’s Quanum Lab Services Manager system. The medical testing provider confirmed unauthorised access but has not established how many patients the incident involves. Quest detected the intrusion on October 21 and immediately suspended access to the affected platform. Its investigation involves both patient health…
-
A Railway potential breach has prompted the cloud hosting provider to urge all users to rotate credentials stored on its platform. The warning follows suspicious activity involving systems that hold customer environment variables. Railway said an unauthorised third party may have accessed encrypted variables and obtained decrypted contents for some of them. However, investigators have…
-
A Capcom data breach has exposed email addresses and account information belonging to more than 11.7 million CAPCOM ID accounts. The Japanese gaming company confirmed that attackers accessed its membership service and changed login passwords on 196 accounts. Most exposed records contained email addresses and account activity details. However, a small group also had personal…
-
A LiteLLM supply-chain attack compromised the project’s release pipeline and distributed credential-stealing malware through PyPI and container registries. The malicious release, version 1.107.0, targeted Windows, Linux and macOS environments. Maintainers said attackers breached the pipeline on October 21 and published packages containing compiled malware and tools for remote code execution. However, the incident did not…
-
Arista Networks has released security updates for a VeloCloud Orchestrator zero-day that attackers are actively exploiting. The critical vulnerability affects on-premises deployments and allows authenticated users with basic privileges to gain powerful administrative access. Tracked as CVE-2026-114625, the flaw involves SQL injection through the VeloCloud Orchestrator web interface. Exploitation requires a valid authenticated session but…
-
Amazon Threat Intelligence detected PHP2Shell exploitation attempts on October 17, four days before developers released security patches. However, researchers have not established whether those early attempts could successfully compromise real-world systems. The two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow remote code execution on vulnerable PHP installations. The PHP security team released fixes on October…
-
GitLab has released emergency security updates to address a maximum-severity vulnerability that could let remote attackers execute arbitrary code. The GitLab code execution flaw affects its Community Edition (CE) and Enterprise Edition (EE). Tracked as CVE-2026-110264, the vulnerability involves an integer overflow in the platform’s Regular Expression Compiler. Under certain conditions, an attacker could exploit…