October 2026

A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities.

The post Syrian Hacker Gets Prison Time in US After Over a Decade on the Run appeared first on SecurityWeek.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.

The vulnerabilities are listed below –

CVE-2026-111357 (CVSS score: 8.8) – A missing authentication for a critical function vulnerability that could allow a

A malicious ChatGPT share link could run an attacker’s code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.

The researchers reported the flaw through OpenAI’s bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.

The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.

I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.

A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.

The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware.

The post In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak appeared first on SecurityWeek.