Android gets AI defenses against messaging scams, fake calls
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
BleepingComputer 30m ago
critical
Vulnerabilities
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server…
Zero-click spyware infecting devices through online ads, researchers say
Powerful zero-click spyware is infected devices worldwide through targeted ads, new research shows — an alarming development in the spread of surveillance technology.
The Record 1h agoThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories…
The Hacker News 1h agoHackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth
A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. [...]
BleepingComputer 1h agoContext Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate. The post Context Is King in the Fight Against Modern Cyberattacks appeared first on…
SecurityWeek 2h agoFake Arch Linux packages push malware with root privileges
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]
BleepingComputer 3h agoWatch Now: Zero Trust Strategies Summit – All Sessions Available on Demand
This summit is laser-focused on the next generation of Zero Trust and Identity security, moving beyond theory to deliver actionable strategies. The post Watch Now: Zero Trust Strategies Summit – All Sessions…
SecurityWeek 3h agoMeasuring Human Cryptanalysis Effort
Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption…
Schneier on Security 3h agoCitizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the…
The Hacker News 4h agoSilent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025…
The Hacker News 4h agoVulnerability Management Isn't About the Score — It's About How It Applies to You
Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.
Dark Reading 5h agoUK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978
A cyberattack on Britain’s Legal Aid Agency (LAA) stole far older and broader records than the government previously disclosed.
The Record 5h agoPatch first
- Broadcom VMware vCenter — CVE-2026-59310, used in ransomware
- JetBrains TeamCity — CVE-2026-63077, used in ransomware
- Cisco Secure Firewall Management Center (FMC) — CVE-2026-20316, used in ransomware
- SonicWall SMA1000 Appliances — CVE-2026-15409, used in ransomware
Check your exposure
- Mail and firewall management interfaces reachable from the internet
- Appliances still on end-of-support branches
- Anything on the KEV catalogue with no owner assigned
In numbers
- 1746 known exploited vulnerabilities tracked
- 361 of them linked to ransomware campaigns
- 210 wire items in the last 90 days