Attackers probe critical Oracle EBS flaw days after patch release
Threat actors are actively scanning for CVE-2026-101767, a critical remote code execution vulnerability in Oracle E-Business Suite patched last week.
Security & privacy
TLS and certificates, encryption, safe file transfer, breaches and how to avoid them.
macOS certificate revocation gaps in command-line tools
Apple blocked compromised certificates in October 2026, but macOS command-line tools using flat files may still trust them.
Orphaned AI agent keys remain active long after projects end
AI agents often leave behind valid IAM access keys that persist for months. New guidance offers SQL queries and policies to identify and retire these unused credentials.
Apple macOS developer tools still trust compromised eMudhra certificates
As of late October 2026, Apple's bundled git and curl on macOS still trust compromised eMudhra certificates, exposing developers to supply chain attacks.
CISA orders federal agencies to patch active PHP2Shell exploits within three days
The U.S. cybersecurity agency confirms hackers are exploiting critical PHP vulnerabilities and mandates immediate patches for civilian federal systems.
Why containers alone fail to secure autonomous AI agents
New analysis shows that standard container isolation is insufficient for AI agents, requiring deeper network and hardware-level sandboxing strategies.
Most PHP servers remain exposed to critical PHP2Shell exploits despite warnings
Security researchers report that 93.6% of systems remain vulnerable to PHP2Shell attacks five days after disclosure, with active exploitation rising rapidly across the internet.
Diagnosing and fixing ERR_SSL_PROTOCOL_ERROR for self-hosted services
A technical guide explains the causes of Chrome's SSL protocol error, offering troubleshooting steps for visitors and server administrators dealing with TLS handshake failures.
Microsoft Teams scams use IT impersonation to deploy ransomware
Attackers exploit external chat features in Microsoft Teams with fake IT support identities, leading to remote access and Chaos ransomware deployment.
Critical RCEs in PHP and GitLab plus eMudhra CA compromise
PHP and GitLab patched critical remote code execution flaws while eMudhra exited the certificate market after weak keys were exposed.
Odudu release candidate brings self-hosted identity and agent support
Wisdom Praise released a release candidate of Odudu, a self-hosted multi-tenant OIDC provider with AI agent support. It runs in one container with PostgreSQL but lacks an independent security review.
Apple blocks compromised eMudhra certificates and guides admins on CLI remediation
Apple has blocked twelve compromised TLS certificates from eMudhra intermediate CAs. Mac administrators using command-line tools must manually update trust stores to ensure full protection.
VoidAccess brings self-hosted threat intelligence and local AI to security researchers
VoidAccess is a new MIT-licensed tool that aggregates threat data from Tor and public feeds into relationship graphs, keeping sensitive investigations on your own infrastructure.
CISA warns of active exploits in Collabora Online and Arista VeloCloud
CISA added two critical vulnerabilities to its KEV catalog due to active exploitation. Nextcloud users and Arista VCO admins must patch immediately.
PHP2Shell vulnerabilities force global scramble to patch critical web infrastructure
Two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, allowed unauthenticated remote code execution, prompting widespread emergency patching across the internet.
