Vulnerabilities & remediation
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA reports: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose…
AI & Security
Former pentester used ARTEX AI to steal 8.2 million data records
BleepingComputer reports: South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks.
Ransomware & Extortion
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
The Hacker News reports: Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware.
Cloud, Identity & SaaS
When an AI Agent Is the Incident, the Identity Record Is the Evidence
BleepingComputer reports: A new NIST, CISA, and NSA guide treats runaway agents as incidents to be rehearsed. The hard part of the response is answering whose authority the agent used, and that answer has to exist before the incident does.
Cybercrime & Fraud
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
The Hacker News reports: Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations.
Cybercrime & Fraud
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
The Hacker News reports: An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz.
Vulnerabilities & remediation
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
BleepingComputer reports: A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
AI & Security
Texas sues OpenAI for deceiving consumers about safety, seeks sweeping reforms and fines
The Record reports: In an unusual move, the suit — brought under the state’s deceptive trade practices laws — seeks to hold founder and CEO Sam Altman personally liable for the alleged deception.