https://patchnoteslab.com/ Free hands-on cyber security and IT practice for beginners: labs on realistic logs, scans and emails, SOC shifts you can shadow then work, Network+, Security+ and PenTest+ exam prep, and the day's security news explained. en Fri, 23 Oct 2026 07:26:53 +0000 https://www.securityweek.com/irans-prince-of-persia-apt-hosts-cc-in-us-for-first-time-since-2016/ https://www.securityweek.com/irans-prince-of-persia-apt-hosts-cc-in-us-for-first-time-since-2016/ Fri, 23 Oct 2026 06:39:00 +0000 SecurityWeek After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. Via SecurityWeek. https://www.darkreading.com/cyberattacks-data-breaches/state-bank-india-customer-pii-data-leak https://www.darkreading.com/cyberattacks-data-breaches/state-bank-india-customer-pii-data-leak Fri, 23 Oct 2026 03:30:00 +0000 Dark Reading Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII. Via Dark Reading. https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/ https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/ Thu, 22 Oct 2026 21:25:00 +0000 BleepingComputer Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. [...] Via BleepingComputer. https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach https://therecord.media/toronto-crime-tips-org-freezes-ops-after-breach Thu, 22 Oct 2026 20:52:00 +0000 The Record Late Wednesday night the Toronto chapter of Crime Stoppers broke ranks with the national association, revealing a timeline showing what it knew and when along with an announcement that it will pause… Via The Record. https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack Thu, 22 Oct 2026 20:42:00 +0000 Dark Reading The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants. Via Dark Reading. https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883 https://www.theregister.com/security/2026/10/22/php2shell-exploit-bypasses-protections-designed-to-stop-remote-code-execution/5304883 Thu, 22 Oct 2026 20:37:00 +0000 The Register “Adversaries are clearly spending time (and tokens) on this bug,” researcher says. Via The Register. https://www.darkreading.com/insider-threats/texas-laptop-farms-north-korean-it-workers https://www.darkreading.com/insider-threats/texas-laptop-farms-north-korean-it-workers Thu, 22 Oct 2026 20:33:00 +0000 Dark Reading In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, from busting up North Korea's stateside infrastructure in "Operation Lonestar Justice" to Staples' gift… Via Dark Reading. https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/ https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/ Thu, 22 Oct 2026 20:22:00 +0000 BleepingComputer Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. [...] Via BleepingComputer. https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware-french https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware-french Thu, 22 Oct 2026 19:30:00 +0000 Dark Reading Des centaines de magasins ont subi des pertes se chiffrant en millions d'euros parce qu'ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de… Via Dark Reading. https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/ https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/ Thu, 22 Oct 2026 19:12:00 +0000 BleepingComputer Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...] Via BleepingComputer. https://thehackernews.com/2026/10/the-ai-agent-nobody-owns-watch-expert.html https://thehackernews.com/2026/10/the-ai-agent-nobody-owns-watch-expert.html Thu, 22 Oct 2026 19:05:00 +0000 The Hacker News Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone… Via The Hacker News. https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html Thu, 22 Oct 2026 19:05:00 +0000 The Hacker News Attackers are exploiting a zero-day SQL injection flaw in Arista's VeloCloud Orchestrator (VCO), the central management system for VeloCloud SD-WAN networks, the company said in an advisory on October 22. The flaw… Via The Hacker News. https://therecord.media/indian-tech-company-announces-withdrawal-certificate-business-incident https://therecord.media/indian-tech-company-announces-withdrawal-certificate-business-incident Thu, 22 Oct 2026 18:46:00 +0000 The Record The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four. Via The Record. https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html Thu, 22 Oct 2026 18:12:00 +0000 The Hacker News eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys… Via The Hacker News. https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html https://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html Thu, 22 Oct 2026 17:45:00 +0000 The Hacker News This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of… Via The Hacker News. https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854 https://www.theregister.com/security/2026/10/22/max-severity-gitlab-bug-allows-remote-code-execution-over-12-years-of-releases/5304854 Thu, 22 Oct 2026 17:36:00 +0000 The Register Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible' Via The Register. https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/ https://www.bleepingcomputer.com/news/security/arista-patches-new-velocloud-orchestrator-zero-day-exploited-in-attacks/ Thu, 22 Oct 2026 17:18:00 +0000 BleepingComputer Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. [...] Via BleepingComputer. https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html Thu, 22 Oct 2026 17:01:00 +0000 The Hacker News Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in… Via The Hacker News. https://www.theregister.com/security/2026/10/22/disgraced-indian-cert-issuer-leaves-the-cert-issuing-business/5304848 https://www.theregister.com/security/2026/10/22/disgraced-indian-cert-issuer-leaves-the-cert-issuing-business/5304848 Thu, 22 Oct 2026 16:58:00 +0000 The Register We didn't want to issue SSL/TLS certs anyway, Indian firm suggests after one private key turns out to be the number 4 Via The Register. https://therecord.media/china-cyber-connectwise-ai https://therecord.media/china-cyber-connectwise-ai Thu, 22 Oct 2026 16:30:00 +0000 The Record A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise… Via The Record. https://thehackernews.com/2026/10/meta-ordered-to-pay-25-billion-after.html https://thehackernews.com/2026/10/meta-ordered-to-pay-25-billion-after.html Thu, 22 Oct 2026 16:12:00 +0000 The Hacker News Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company's Cambridge… Via The Hacker News. https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840 https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840 Thu, 22 Oct 2026 16:05:00 +0000 The Register Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise Via The Register. https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-how-to-fix-broken-exchange-online-ews-apps/ https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-how-to-fix-broken-exchange-online-ews-apps/ Thu, 22 Oct 2026 15:49:00 +0000 BleepingComputer Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. [...] Via BleepingComputer. https://www.theregister.com/security/2026/10/22/sponsored-when-the-attacker-becomes-the-user-rethinking-account-takeover/5303913 https://www.theregister.com/security/2026/10/22/sponsored-when-the-attacker-becomes-the-user-rethinking-account-takeover/5303913 Thu, 22 Oct 2026 15:00:00 +0000 The Register SPONSORED FEATURE: AI makes phishing easier than ever Via The Register. https://www.securityweek.com/hacker-conversations-corey-thuen-and-the-evil-bit/ https://www.securityweek.com/hacker-conversations-corey-thuen-and-the-evil-bit/ Thu, 22 Oct 2026 14:31:00 +0000 SecurityWeek Corey Thuen hires hackers for what he calls ‘the evil bit’ — an adversarial streak he believes is either there or it isn’t. Via SecurityWeek. https://www.bleepingcomputer.com/news/security/machine-speed-attacks-require-machine-speed-detection-and-response/ https://www.bleepingcomputer.com/news/security/machine-speed-attacks-require-machine-speed-detection-and-response/ Thu, 22 Oct 2026 14:02:00 +0000 BleepingComputer Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why… Via BleepingComputer. https://thehackernews.com/2026/10/interpol-arrests-1462-suspects-disrupts.html https://thehackernews.com/2026/10/interpol-arrests-1462-suspects-disrupts.html Thu, 22 Oct 2026 13:38:00 +0000 The Hacker News INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law enforcement agencies… Via The Hacker News. https://therecord.media/africa-cybercrime-interpol-arrests https://therecord.media/africa-cybercrime-interpol-arrests Thu, 22 Oct 2026 13:30:00 +0000 The Record More than 1,400 suspected cybercriminals were arrested across Africa this summer as part of a crackdown on the gangs perpetrating online fraud, ransomware and business email compromise attacks, Interpol said. Via The Record. https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html Thu, 22 Oct 2026 13:26:00 +0000 Schneier on Security PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged… Via Schneier on Security. https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/ https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/ Thu, 22 Oct 2026 13:09:00 +0000 BleepingComputer Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...] Via BleepingComputer. https://www.securityweek.com/indurex-raises-8-million-to-expand-industrial-cybersecurity-platform/ https://www.securityweek.com/indurex-raises-8-million-to-expand-industrial-cybersecurity-platform/ Thu, 22 Oct 2026 13:00:00 +0000 SecurityWeek The Amsterdam-based company plans to use the funding for research and development and commercial expansion in Europe and the Middle East. Via SecurityWeek. https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/ https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/ Thu, 22 Oct 2026 12:34:00 +0000 SecurityWeek Affecting the open source calling library RingRTC, the bug prevented calls from ending properly. Via SecurityWeek. https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/ https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/ Thu, 22 Oct 2026 12:20:00 +0000 SecurityWeek Vendors are checking their products for PHP2Shell, security firms are shipping detections, and governments are urging immediate patching. Via SecurityWeek. https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749 https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749 Thu, 22 Oct 2026 12:15:00 +0000 The Register Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed Via The Register. https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident Thu, 22 Oct 2026 12:14:00 +0000 The Record The systems impacted by the attack include the MyColaSC platform that citizens use to pay utility bills, report non-emergency issues and access other city services. Via The Record. https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/ Thu, 22 Oct 2026 11:41:00 +0000 BleepingComputer GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. [...] Via BleepingComputer. https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687 https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687 Thu, 22 Oct 2026 11:28:00 +0000 The Register AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours Via The Register. https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html Thu, 22 Oct 2026 11:15:00 +0000 The Hacker News Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found that an unauthorized third party may have gained access… Via The Hacker News. https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/ https://www.securityweek.com/splunk-solarwinds-release-fresh-security-updates/ Thu, 22 Oct 2026 10:45:00 +0000 SecurityWeek Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information. Via SecurityWeek. https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html Thu, 22 Oct 2026 10:44:00 +0000 The Hacker News A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects… Via The Hacker News.