Code Defender

Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it’s unclear how the keys were compromised.

A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet.

The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company

Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting  PAN-OS and Prisma Access by ransomware actors.

The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was

Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.

The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially

The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google’s Chrome Root Program confirms on October 20.

An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept.

A researcher reported the

The CDE released multiple statements over the last week warning the state’s students that assessment contractor Educational Testing Service (ETS) suffered a months-long data breach.

The FBI and cyber agencies in the UK and Germany said SafePay is targeting businesses and critical infrastructure by guessing passwords, exploiting vulnerabilities and using phishing attacks.

The company has restored many websites and apps in Europe and expects e-commerce brands in the US to be restored in days.

The post Ahold Delhaize Restoring Services Disrupted by Cyberattack appeared first on SecurityWeek.

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.

The post The Key to AI Software Security Isn’t Speed, It’s Maturity appeared first on SecurityWeek.

Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework.

The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek.