advisoryvia UK NCSC
Introducing a new AI chapter in the NCSC research problem book
A revolution is underway at the intersection of AI and cyber security.
Oct 20, 2026 UTC
Security news
Stories are collected automatically from public feeds, attributed to their original publishers and linked. Editors can remove anything. Always read the original source.
ransomwarevia Krebs on Security
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware neg...
Oct 19, 2026 UTC
advisoryvia UK NCSC
Post-quantum updates to our TLS guidance
The NCSC publishes its recommendations for configuring post-quantum cryptography in TLS. Now is time to migrate.
Oct 15, 2026 UTC
advisoryvia UK NCSC
Using TLS to protect data
Recommended profiles to securely configure TLS for the most common versions and scenarios, with additional guidance for managing older versions.
Oct 15, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic
Overview Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 conce...
Oct 14, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#948176: Multiple TLS libraries can bypass delegation enforcement
Overview This note covers thirteen library-specific records (VU#948176.6, .8–.19) of how widely used TLS libraries apply X.509 Name Constraints. The records describe cases where a...
Oct 14, 2026 UTC
policyvia Krebs on Security
U.K. Sanctions Cryptomus for RU Money Laundering
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomw...
Oct 14, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#166125: Bisheng has authentication bypass vulnerabilities
Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (I...
Oct 14, 2026 UTC
vulnerabilityvia Krebs on Security
Microsoft Patches More Than 1,400 Security Flaws
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's reco...
Oct 13, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#456950: Komodo Periphery Agent Contains an OS Command Injection Vulnerability
Overview Versions <= 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names,...
Oct 13, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access priv...
Oct 13, 2026 UTC
advisoryvia CERT/CC Vulnerability Notes
VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation
Overview This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those diffe...
Oct 13, 2026 UTC