Exciting news! Cyber Tzar is now part of the Cyber Runway Scale Programme by @Plexalcity - @PlexalCyber & @DSITgov, with support from @Deloitte & @CSIT_QUB! cybertzar.com/embracing-grow… #Cybersecurity #Innovation #AI #CyberRunway #CyberTzar #NCSCForStartups

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. #cybersecurity bleepingcomputer.com/news/se…

LiteLLM, an open-source tool widely used by artificial intelligence developers, said Friday that a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands of users last week. #cybersecurity therecord.media/litellm-hack…

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams. #cybersecurity thehackernews.com/2026/10/at…

A UK-based developer and pentester has claimed a $2,000 Bitcoin prize for demonstrating the exploitability of the PHP2Shell vulnerabilities that melted the internet last week. #cybersecurity theregister.com/security/202…

The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium. #cybersecurity bleepingcomputer.com/news/se…

For more than 20 years, Ondřej Surý has been quietly helping to keep websites around the world running securely, largely in his spare time. #cybersecurity bbc.co.uk/news/articles/cw30…

OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. #cybersecurity thehackernews.com/2026/10/op…

An independent evaluation of OpenAI's internal misalignment monitoring system revealed that the system was not fit for purpose during a period when the company's bots were breaking into model-hosting platform Hugging Face. #cybersecurity theregister.com/ai-and-ml/20…

Anyone controlling the update domain could manipulate HTTP traffic and execute code as SYSTEM on Windows and as root on macOS. #cybersecurity bleepingcomputer.com/news/se…

Navigate360,the anonymous crime-tip platform used by schools, law enforcement, and the US military, admitted, it suffered a months-long breach – with hackers stealing sensitive tip-line data from public safety agencies in multiple US states. #cybersecurity cybernews.com/security/navig…

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. #cybersecurity thehackernews.com/2026/10/br…

As the PHP2Shell chaos continues, researchers have found a third PHP vulnerability that could allow attackers to take over websites or remotely run malware on vulnerable systems. But this one won’t receive an emergency fix. #cybersecurity theregister.com/security/202…

Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. #cybersecurity bleepingcomputer.com/news/se…

The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619). #cybersecurity ncsc.gov.uk/news/critical-se…

Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is told to open. #cybersecurity thehackernews.com/2026/10/cr…

AI is fine for competent devs, but spare us the 'drive-by' patches Kernel maintainers stop asking who used AI, as long as the code is good. #cybersecurity theregister.com/columnists/2…

GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers. #cybersecurity bleepingcomputer.com/news/se…

Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. #cybersecurity helpnetsecurity.com/2026/10/…

Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. #cybersecurity thehackernews.com/2026/10/tw…

The PHP2Shell security fiasco has forced 32 UK government services offline and left another four partially unavailable as Whitehall scrambles to patch the critical vulnerabilities wreaking havoc across the web. #cybersecurity theregister.com/security/202…