THE REGISTER SECURITY
Attack on email hosting provider for German far right party AfD exposed 345k accounts
Alternative für Deutschland swats away scandals as reporters swarm leaked email tranche
By The Register Security
THE HACKER NEWS
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory
By The Hacker News
DARK READING
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
By Dark Reading
THE REGISTER SECURITY
LiteLLM supply chain attack started with an exposed master key
A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'
By The Register Security
THE HACKER NEWS
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. "When you
By The Hacker News
THE REGISTER SECURITY
PHP2Shell: No login, no app code, no warning. What next?
PARTNER CONTENT: Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium
By The Register Security
THE HACKER NEWS
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but
By The Hacker News
THE HACKER NEWS
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT
By The Hacker News
Latest from the newsroom
CLOUD IAM
CVE-2026-83938: Unauthenticated Network Attack Path Found in Azure Kubernetes Config Service
A missing authentication flaw in Azure Kubernetes Configuration Service lets a network attacker escalate privileges without any credentials.
Remote Code Execution (RCE)
After PHP2Shell, Here Comes Its Cousin: Node2Shell
Meet Node2Shell (CVE-2026-111497): how a native Brotli memory flaw in Node.js turns untrusted compressed data into RCE, and why your workload IAM is the real prize.
245 views
Remote Code Execution (RCE)
CVE-2026-87337: Unauthenticated HTTP Attack Puts Oracle Access Manager at Critical Risk
A CVSS 10.0 flaw in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets unauthenticated attackers read and modify all OAM data over plain HTTP.
Remote Code Execution (RCE)
PHP2Shell - CVE-2026-109618 and 109619: What We Actually Know So Far
Two CVE records and a scary name hit the feeds on Halloween. Here is what is confirmed, what is rumor, and what identity teams should do today.
130 views
PAM
CVE-2026-76268: Splunk's Unauthenticated Patroni API Lets Attackers Run OS Commands
A critical Splunk Enterprise flaw lets unauthenticated users run OS-level commands via an exposed Patroni REST API on search head cluster members.
199 views
NEWS
CVE-2026-105115: OpenAM Before 16.1.3 Lets Attackers Load Classes Without Auth
An unauthenticated class instantiation flaw in OpenAM's legacy SOAP interface lets remote attackers crash servers or probe toward code execution.
183 views
CLOUD IAM
CVE-2023-54405: Unauthenticated File Upload in H3C CAS Gives Attackers RCE
H3C CAS cloud platform's CVM component has an unauthenticated file upload flaw that lets attackers achieve remote code execution with no credentials required.
161 views
MFA
CVE-2026-85984: miniOrange OTP Plugin Lets Attackers Bypass Admin Login Entirely
A logic flaw in the miniOrange OTP Login plugin for WordPress allows unauthenticated attackers to log in as any administrator using only a known username.
190 views
MFA and Passwordless
The passkey era: how to prepare, adapt and win over users and executives
Passkeys fix the control that keeps failing: the shared secret. Here is how to roll them out and sell them to users and the board.
200 views
PAM
CVE-2026-84078: IBM Guardium 12.2 Exposes Load-Balancer Ops to Unauthenticated Access
IBM Guardium Data Protection 12.2 has a missing authentication flaw in LoadBalancerServlet, letting unauthenticated users trigger privileged operations.
244 views2 comments
Support independent IAM journalism
Keep Identity at the Core free and unbought
No paywall, no vendor money behind the reporting. Every story, tracker and translation here is paid for by readers like you. Pick an amount or name your own.
IAM in Canada
Regulation and compliance that decide how identity is run where you areOur coverage of Canada
RegulationCyber Centre warns of critical PHP vulnerabilities, urges prompt patching
Canada's Cyber Centre says critical PHP flaws could allow unauthenticated command execution and asks organizations to patch internet-facing systems first.
Regulation
Cyber Centre publishes threat assessment on Canada's aviation sector
Canada's Cyber Centre has released a TLP:CLEAR cyber threat assessment on the aviation sector, part of its series on critical infrastructure.
Regulation
Cyber Centre publishes ITSAP.00.080 on secure online banking, flags AI driven scams
The Canadian Centre for Cyber Security's October 2026 awareness bulletin ITSAP.00.080 covers online banking risks, phishing and what to do when fraud happens.
123 views
RegulationCanadian Centre for Cyber Security details frontier AI use in malware reverse engineering
CSE's Frontier AI Lab describes a pilot where AI helped analysts triage, document and attribute malware samples, with humans validating every finding.
Regulation
Cyber Centre publishes ITSP.20.001 guidance on submarine cable security
Canada's Cyber Centre has released ITSP.20.001, a practitioner guide to threats and mitigations for submarine telecommunications cables.
155 views
RegulationCyber Centre warns AI is helping attackers find and disrupt internet-exposed PLCs
Canada's Cyber Centre says threat actors are using AI to locate and attack programmable logic controllers reachable from the internet, hitting water systems.
231 views
All regulatory trackers →CA Regulatory & Compliance Tracker
Last reviewed: Oct 25, 2026
🚨 Oops... Another One
Live breach and vulnerability intelligence - updated as it happens
Breach Intelligence
● LIVEVulnerability Tracker
● LIVENever Miss a Breach, CVE, or Industry Shift
Join thousands of IAM professionals getting the weekly Intelligence Brief every Monday morning.