What is Cybersecurity?

Topic · Security

Cybersecurity

Threats, defences and the industry protecting digital infrastructure.

Cybersecurity

Why now?

AI is accelerating both offence and defence
Critical infrastructure is a primary target
Security operations are being rebuilt around automation

Latest

Security

CISA Confirms PHP2Shell Is Being Exploited in the Wild

The agency added both PHP flaws to its Known Exploited Vulnerabilities catalogue on 26 October 2026, a week after saying it had seen no successful exploitation, and gave federal civilian agencies until 29 October to act.

28 October 20263 min read

Security

Stolen GitHub Tokens Put Malware in a LiteLLM Release

A compromised release pipeline put a poisoned LiteLLM build on PyPI and Docker for under three hours on 21 October 2026. It harvested cloud secrets, AI provider API keys and SSH keys, and Wiz says the attackers were spending stolen AWS credentials about four and a half hours later.

26 October 20263 min read

Security

Mirai Operators Join PHP2Shell Attacks, No Breach Confirmed

The two critical PHP engine flaws known as PHP2Shell have drawn botnet traffic, a working ASLR bypass and an attacker toolkit left publicly browsable, yet no vendor has reported a successful in-the-wild compromise as of 23 October 2026.

24 October 20263 min read

DHS Order Pulling DeepSeek From Agency Systems Dates to July

A Federal Register notice on 20 October 2026 published a Homeland Security order excluding DeepSeek from federal civilian procurement and requiring agencies to remove DeepSeek products, and third-party software built on DeepSeek implementations, from their systems.

21 October 20263 min read

Security

Attackers Are Escalating to Root Through a Japanese Web Firewall

A command injection flaw in the SiteGuard Server Edition web application firewall, CVE-2026-106931, is being exploited to run commands as root or SYSTEM. JPCERT/CC alerted users on 14 October 2026 and the vendor told support customers on 29 September.

19 October 20263 min read

Security

China-Linked Actor Had Root on BeyondTrust Since August

A critical flaw in BeyondTrust Remote Support appliances, CVE-2026-102764, was exploited as a zero-day in late August 2026 by a suspected PRC-nexus espionage actor that Google tracks as ARMORY CASTLE. BeyondTrust patched its SaaS tenants on 9 October and disclosed the vulnerability on 15 October. Self-hosted customers have to apply the patch themselves.

17 October 20263 min read

Security

Attackers Chained Three Ivanti Zero-Days and One Is Still Unfixed

Ivanti disclosed CVE-2026-104935 on 13 October 2026 and CISA added it to the Known Exploited Vulnerabilities catalogue the same day. Volexity found an attacker running commands as root on a fully patched VPN gateway from 3 October.

14 October 20263 min read

Security

China-Linked Scanner Holds 1,300 Exploit Scripts, FBI Says

A joint advisory led by the FBI describes MicroScan, a Python web application holding more than 1,300 penetration-testing scripts that China-linked actors have used since at least 2017. CISA added five of the eight named flaws to its exploited-vulnerability catalogue with a federal deadline that expired on 11 October.

12 October 20263 min read

Security

FBI Removes Contractor Over an Unapplied PeopleSoft Patch

The FBI says the breach of its job applicant portal followed a third party's failure to install a security patch, and has removed the contractor responsible. Reuters, citing two unnamed sources, identified the contractor as working for Accenture and the platform as Oracle PeopleSoft.

7 October 20263 min read

5 things worth knowing today.

A five-item daily brief: what happened, why it matters and what to watch. Written by the desk, verified by editors.

Cybersecurity

Why now?

Latest

CISA Confirms PHP2Shell Is Being Exploited in the Wild

Stolen GitHub Tokens Put Malware in a LiteLLM Release

Mirai Operators Join PHP2Shell Attacks, No Breach Confirmed

DHS Order Pulling DeepSeek From Agency Systems Dates to July

Attackers Are Escalating to Root Through a Japanese Web Firewall

China-Linked Actor Had Root on BeyondTrust Since August

Attackers Chained Three Ivanti Zero-Days and One Is Still Unfixed

China-Linked Scanner Holds 1,300 Exploit Scripts, FBI Says

FBI Removes Contractor Over an Unapplied PeopleSoft Patch

Related topics

AI Governance

AI Security

5 things worth knowing today.