Cybersecurity News
Stay informed about the latest cybersecurity incidents, vulnerabilities, and threat landscape changes. We cover data breaches, ransomware campaigns, critical CVEs, and regulatory updates – with context on what it means for you and how to protect yourself.
16-year-old vulnerability in EDK II PXE UEFI firmware allows code execution before Secure Boot during network boot
The critical buffer overflow vulnerability CVE-2026-97631 in the EDK II PXE driver — the open-source codebase underlying the UEFI firmware ...
Virtualine domain seizure operation: what is known about shutting down bulletproof hosting infrastructure
On October 27, 2026, the U.S. Department of Justice announced the seizure of the virtualine.net domain, which belonged to a ...
Magento online store infection campaign: 953 victims, scanner evasion and persistence via localStorage
The Dutch company Sansec reports a large-scale campaign in which attackers have infected 953 online stores, mainly running on the ...
Anthropic claims an unreleased Claude model chained Chrome, Safari, Windows and Linux vulnerabilities into working exploits
Anthropic has published a study claiming that an unreleased internal Claude model discovered vulnerabilities in Google Chrome, Safari, Android, Windows ...
Adobe patched 8 critical vulnerabilities in Campaign Classic and a flaw in Connect
On October 27, 2026, Adobe published security update APSB26-162, which addresses eight critical vulnerabilities in Adobe Campaign Classic — a ...
Oracle PeopleSoft vulnerability exploited by ShinyHunters turned out to be a chain of three separate flaws
The critical CVE-2026-35273 vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, which the ShinyHunters group had been exploiting ...
CVE-2026-86950 in CoreGraphics: Apple extends the fix to the iPhone XS and XR lineup
On October 26, 2026, Apple released iOS 18.7.11 and iPadOS 18.7.11 — a security update for legacy iPhone and iPad ...
Critical vulnerability CVE-2026-101767 in Oracle E-Business Suite — chain from SQL injection to OS command execution
Oracle has fixed the critical vulnerability CVE-2026-101767 (CVSS 9.8) in the Oracle Application Object Library component of Oracle E-Business Suite ...
Token Spraying campaign compromised dozens of organizations via replay of stolen Microsoft 365 sessions
Researchers at Huntress uncovered a large-scale campaign to compromise Microsoft 365 accounts in which attackers replayed stolen authentication tokens instead ...
Google privacy policy update: how Personal Intelligence links personal data to targeted advertising
As of 16 October 2026, an updated Google privacy policy comes into force which, according to The Hacker News and ...
