Security — Page 3
Cybersecurity, vulnerabilities, breaches, and defensive research.
- Straiker says CyberCartel used AI agents against 400+ financial targets
CEO Ankur Shah's security startup says the group coordinated Grok, Claude and Kimi models; the reported 4,493 records do not establish how many people or institutions were affected.
- Quad9 will leave France after court orders DNS blocks in beIN case
A Paris court ordered DNS blocking through November 14th and set a €1,000 daily penalty; Quad9 says it will withdraw on November 24th.
- eMudhra exits global TLS after eight certificates exposed guessable private keys
Founder and chairman V. Srinivasan says SSL/TLS generated about 1% of eMudhra's revenue. eMudhra plans to move affected customers to replacement certificates through partners.
- Quest Diagnostics confirms patient records accessed through Quanum system
Quest says it discovered unauthorized access on October 21st; the number of affected patients and the specific information accessed remain unknown.
- Mistral AI faces a $1 million claim over alleged theft of training data
A post dated October 22nd alleges access to employee computers and computing infrastructure; Mistral denied a similar September claim after an internal investigation.
- LiteLLM's compromised release workflow sent credential-stealing malware to PyPI and Docker
The October 21st attack used a lookalike source repository and credentials from three developer accounts to publish version 1.107.0. LiteLLM suspects OAuth tokens leaked through logs in an internet-exposed deployment, but has not confirmed how that deployment was accessed.
- Meta restores Muse artifact sharing after replacing links exposed through DNS
David Singleton says the flaw affected shared artifacts, not chat sharing. Meta has replaced old links, which now tell visitors to request a new one from the sender.
- Exclusive: FoxIO researcher says Bun never answered its May report of a server-crashing HTTP/3 flaw
Sébastien Féry told RuntimeWire that FoxIO reported the flaw through the channel in Bun's security policy and "never heard back." Bun shipped HTTP/3 security fixes Thursday in a release that doesn't mention FoxIO or the report.
- RemoteThreat adds product and marketing chiefs to sell its offensive cyber platform
Joe Castellanos and Taylor Pettis join three weeks after RemoteThreat's $7 million pre-seed, as founder Chris Thompson builds out the team behind its operator-led platform.
- Semperis traces Prince of Persia command server to U.S. shared hosting
Semperis researcher Tomer Bar says Prince of Persia returned to U.S.-hosted infrastructure in August, using shared hosting before moving behind Cloudflare.
- Microsoft links ARTEX attacks to more than 2,250 ConnectWise tenants
Storm-0940 used compromised ConnectWise application identities for cloud access; Microsoft says some targets reached privileged access in under three hours.
- Laravel patched every running Laravel Cloud app after PHP's critical security release
Taylor Otwell said Laravel's team worked overnight. PHP warned that the flaws could allow unauthenticated remote code execution, while Laravel Forge users still had to update servers themselves.
- Railway pauses deployments after possible exposure of customer environment variables
Railway urged all customers to rotate stored credentials after saying an unauthorized party may have accessed encrypted variables and the decrypted contents of some.
- PHP 8.5.12 patch may be incomplete, researchers say
A post on X says the security fix may be incomplete but needs further validation. PHP says 8.5.12 fixes two critical vulnerabilities; no public confirmation establishes that the alleged remaining paths are exploitable.
- GitHub reports degraded services as PHP ships critical security fixes
On October 21st, GitHub flagged issues with Actions, pull requests and webhooks while PHP released fixes for two vulnerabilities that can enable remote code execution.
- OpenAI models helped find two critical PHP flaws affecting web servers
PHP released fixes on October 21st for two unauthenticated remote-code-execution flaws, after a two-month coordinated remediation effort.
- PingCAP confirms TiDB Cloud data exposure after stolen credentials accessed internal systems
The September-October intrusion exposed account, SQL-editor and billing records; a separate attacker claim of 10.6 TB stolen and plaintext API keys remains unverified.
- EXCLUSIVE: Anthropic's Claude Desktop bundles a dormant security scan for local skills
The off-by-default control would hold skills handled through the app for review by the organization's configured Claude model; passing skills are released, warnings leave them usable with a caution, and failures are blocked.
- GitHub previews an npm firewall that cannot stop packages routed around it
GitHub's October 20th-dated changelog entry, published October 21st, details a free public preview for GitHub Enterprise Cloud customers. The firewall applies policy checks to npm traffic routed through it; general availability will use metered-usage billing.
- TeamUpdraft's stolen UpdraftCentral keys let attackers install WordPress backdoors
TeamUpdraft says attackers accessed its website during October 17th-18th; Patchstack and Nethemba traced attacks to valid remote-management keys and identified no flaw in victims' site setups.
- GMO links ARTEX hacking tool to attacks targeting about 20 Japanese companies
The security firm says eight targeted companies disclosed data leaks in September and October, while warning its view is limited to infrastructure it observed.
- eMudhra's eight weak CA keys triggered a wider software trust-store cleanup
Founder-chairman Venkatraman Srinivasan leads eMudhra, which says a key-generation script sent weak keys into certificates trusted by major platforms.
- WSJ says Musk authorized Starshield slowdown that disrupted Ukrainian drones
Ukraine says a 160 kph speed cap disrupted military drone operations; Musk says the U.S. government controls Starshield, while Trump denies ordering the limit.
- PHP schedules critical security release for October 21st
The release addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. PHP is asking users to prepare to upgrade.