THE REGISTER SECURITY
Attack on email hosting provider for German far right party AfD exposed 345k accounts
Alternative für Deutschland swats away scandals as reporters swarm leaked email tranche
By The Register Security
THE HACKER NEWS
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory
By The Hacker News
DARK READING
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
By Dark Reading
THE REGISTER SECURITY
LiteLLM supply chain attack started with an exposed master key
A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'
By The Register Security
THE HACKER NEWS
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the store's pages that, when visited by unsuspecting users, serves malicious JavaScript loader code through Magento CMS blocks. "When you
By The Hacker News
THE REGISTER SECURITY
PHP2Shell: No login, no app code, no warning. What next?
PARTNER CONTENT: Learn what the flaws are, how far exploitation has gone, and how to get to full coverage fast with Tanium
By The Register Security
THE HACKER NEWS
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but
By The Hacker News
THE HACKER NEWS
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT
By The Hacker News
Latest from the newsroom
CLOUD IAM
CVE-2026-83938: Unauthenticated Network Attack Path Found in Azure Kubernetes Config Service
A missing authentication flaw in Azure Kubernetes Configuration Service lets a network attacker escalate privileges without any credentials.
Remote Code Execution (RCE)
After PHP2Shell, Here Comes Its Cousin: Node2Shell
Meet Node2Shell (CVE-2026-111497): how a native Brotli memory flaw in Node.js turns untrusted compressed data into RCE, and why your workload IAM is the real prize.
245 views
Remote Code Execution (RCE)
CVE-2026-87337: Unauthenticated HTTP Attack Puts Oracle Access Manager at Critical Risk
A CVSS 10.0 flaw in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets unauthenticated attackers read and modify all OAM data over plain HTTP.
Remote Code Execution (RCE)
PHP2Shell - CVE-2026-109618 and 109619: What We Actually Know So Far
Two CVE records and a scary name hit the feeds on Halloween. Here is what is confirmed, what is rumor, and what identity teams should do today.
130 views
PAM
CVE-2026-76268: Splunk's Unauthenticated Patroni API Lets Attackers Run OS Commands
A critical Splunk Enterprise flaw lets unauthenticated users run OS-level commands via an exposed Patroni REST API on search head cluster members.
199 views
NEWS
CVE-2026-105115: OpenAM Before 16.1.3 Lets Attackers Load Classes Without Auth
An unauthenticated class instantiation flaw in OpenAM's legacy SOAP interface lets remote attackers crash servers or probe toward code execution.
183 views
CLOUD IAM
CVE-2023-54405: Unauthenticated File Upload in H3C CAS Gives Attackers RCE
H3C CAS cloud platform's CVM component has an unauthenticated file upload flaw that lets attackers achieve remote code execution with no credentials required.
161 views
MFA
CVE-2026-85984: miniOrange OTP Plugin Lets Attackers Bypass Admin Login Entirely
A logic flaw in the miniOrange OTP Login plugin for WordPress allows unauthenticated attackers to log in as any administrator using only a known username.
190 views
MFA and Passwordless
The passkey era: how to prepare, adapt and win over users and executives
Passkeys fix the control that keeps failing: the shared secret. Here is how to roll them out and sell them to users and the board.
200 views
PAM
CVE-2026-84078: IBM Guardium 12.2 Exposes Load-Balancer Ops to Unauthenticated Access
IBM Guardium Data Protection 12.2 has a missing authentication flaw in LoadBalancerServlet, letting unauthenticated users trigger privileged operations.
244 views2 comments
Support independent IAM journalism
Keep Identity at the Core free and unbought
No paywall, no vendor money behind the reporting. Every story, tracker and translation here is paid for by readers like you. Pick an amount or name your own.
IAM in the United Kingdom
Regulation and compliance that decide how identity is run where you areOur coverage of the United Kingdom
RegulationNCSC publishes post-quantum TLS configuration guidance and says migrate now
The UK's NCSC has released recommendations for configuring post-quantum cryptography in TLS and says the time to start migrating is now.
Regulation
Two plead guilty to FCA fraud charges after four Nexus clients lose £2m
Nexus director Kerry Nelson and operations manager Jacqueline Stephens admit fraud and false documents after four clients lost £2m, the FCA says.
Regulation
NCSC publishes Cyber Adversary Simulation (CyAS) scheme documents
NCSC has released the scheme documents for Cyber Adversary Simulation, setting out its view of good practice and how assured providers should deliver it.
118 views
All regulatory trackers →UK Regulatory & Compliance Tracker
Last reviewed: Oct 25, 2026
🚨 Oops... Another One
Live breach and vulnerability intelligence - updated as it happens
Breach Intelligence
● LIVEVulnerability Tracker
● LIVENever Miss a Breach, CVE, or Industry Shift
Join thousands of IAM professionals getting the weekly Intelligence Brief every Monday morning.