Blog – Page 2 – Learn and Explore

October 26, 2026
Uncategorized

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it...

October 26, 2026
Uncategorized

Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A malicious instruction file sitting in a developer’s Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer’s machine and stopped the agent before any code ran....

October 25, 2026
Uncategorized

PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking

Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. “In one case, the attackers targeted a government entity in Europe and within two hours of the initial exploitation they had successfully accessed...

October 25, 2026
Uncategorized

Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers

A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who...

October 25, 2026
Uncategorized

OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication

OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. “Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the...

October 24, 2026
Uncategorized

Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads

Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. “You may choose to allow certain Google services, including services...

October 24, 2026
Uncategorized

Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline

LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. “On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness...

October 24, 2026
Uncategorized

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

A memory-corruption flaw in Google’s Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program’s memory,...

October 24, 2026
Uncategorized

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet

Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belongs to Time4Popcorn, an...

October 24, 2026
Uncategorized

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below – CVE-2026-110447 (CVSS score: 9.2)...