Content is curated from many trusted industry sources, including vendor advisories, security blogs, bug bounty programs, and conference organizers worldwide.
The Supreme Court voiced a hard stance on cyber fraud, with Chief Justice of India Surya Kant stating that cybercriminals have no place in society and belong in jail. The three-judge bench rejected a bail plea in a cyber fraud case, signaling stringent judicial intolerance for online financial crime. This stance underscores deterrence and victim protection.
Recent attacks on European supermarket freezers illustrate how cybersecurity flaws can cascade across an entire retail sector, triggering cascading failures, disrupted inventories, and strained supply chains across the industry, underscoring the need for comprehensive resilience. This case shows why governance, visibility, and rapid response matter.
This week’s Department of Know examines LLM jacking, Asia-driven Amadeus disruptions, and persistent freezer hacks. Hosted by Sarah Lane, the episode features Jason Thomas, senior director of technology security, governance, and risk at the Cystic Fibrosis Foundation, and David Nolan, CSO of Trimont, exploring evolving threats and mitigations.
Insignary released insignary-chk, a free scanner to detect PHP2Shell and Node2Shell, two actively exploited runtime flaws in PHP and Node.js. CVE-2026-109618/109619 are critical (9.2) remote-code-execution flaws. Affects PHP runtimes in Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. Remediations exist in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; code review may miss runtime flaws, so scan vendor software and container images too.
OpenAI reports that GPT-6 Cyber detected 81 high-severity Firefox vulnerabilities and hundreds of Linux bugs, illustrating continuing AI-driven cyber risk challenges. The firm positions GPT-6 Cyber as a security research tool capable of finding and patching flaws with greater efficiency while operating within predefined researcher boundaries more consistently. These are OpenAI’s stated results.
CVE-2026-119977 enables attackers to hijack WordPress sites during core updates. CISA confirms exploitation and urges administrators to apply patches immediately, as exposure during update processes risks site defacement, data theft, and credential compromise if unpatched.
Today’s cybersecurity brief highlights a data breach at Norway’s aid agency Norad (unrelated to NORAD). The incident underscores ongoing risks to humanitarian operations and data security. Additional items include a GhostMap Android flaw and multiple airline hacks, signaling broader threat activity across sectors.
Government initiatives to curb telecom‑facilitated fraud and spam calls have sharply reduced nuisance communications. Official data show daily spam calls fell by about 99%, from roughly 3.5 crore per day. The Department of Telecommunications notes this decline and signals ongoing efforts to further mitigate fraudulent activity and spam across networks.
India’s CERT-In issued an advisory warning of multiple security vulnerabilities in Tata Motors’ connected vehicle apps, iRA 2.0 and iRA.ev. The note, dated November 4, cautions that flaws could let attackers impersonate legitimate vehicle owners, potentially enabling unauthorized access and control. now.
ENISA alerts EU on cyberattacks targeting commercial refrigeration systems across member states posing risks to supermarkets, food supply chains, and industrial control systems. The EU issued a coordinated cybersecurity warning after a wave of incidents beginning in October and persisting into November, highlighting critical infrastructure exposure.
MetaMask reports that a recent security incident did not affect user wallets or the wallet infrastructure. According to the firm, no funds were compromised and core services remain operational while investigators assess the incident. The company promises enhanced monitoring, faster alerts, and stronger security controls going forward. No issues found!!
Attackers began exploiting PHP2Shell before public details surfaced on Oct 20, 2026. The two critical PHP flaws enable remote code execution on vulnerable servers without credentials, threatening sites and business apps that rely on PHP. Early exploitation signals urged urgent patching and risk assessments across organizations. and monitor now. pls
The Supreme Court voiced a hard stance on cyber fraud, with Chief Justice of India Surya Kant stating that cybercriminals have no place in society and belong in jail. The three-judge bench rejected a bail plea in a cyber fraud case, signaling stringent judicial intolerance for online financial crime. This stance underscores deterrence and victim protection.
Recent attacks on European supermarket freezers illustrate how cybersecurity flaws can cascade across an entire retail sector, triggering cascading failures, disrupted inventories, and strained supply chains across the industry, underscoring the need for comprehensive resilience. This case shows why governance, visibility, and rapid response matter.
This week’s Department of Know examines LLM jacking, Asia-driven Amadeus disruptions, and persistent freezer hacks. Hosted by Sarah Lane, the episode features Jason Thomas, senior director of technology security, governance, and risk at the Cystic Fibrosis Foundation, and David Nolan, CSO of Trimont, exploring evolving threats and mitigations.
Insignary released insignary-chk, a free scanner to detect PHP2Shell and Node2Shell, two actively exploited runtime flaws in PHP and Node.js. CVE-2026-109618/109619 are critical (9.2) remote-code-execution flaws. Affects PHP runtimes in Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. Remediations exist in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; code review may miss runtime flaws, so scan vendor software and container images too.
OpenAI reports that GPT-6 Cyber detected 81 high-severity Firefox vulnerabilities and hundreds of Linux bugs, illustrating continuing AI-driven cyber risk challenges. The firm positions GPT-6 Cyber as a security research tool capable of finding and patching flaws with greater efficiency while operating within predefined researcher boundaries more consistently. These are OpenAI’s stated results.
CVE-2026-119977 enables attackers to hijack WordPress sites during core updates. CISA confirms exploitation and urges administrators to apply patches immediately, as exposure during update processes risks site defacement, data theft, and credential compromise if unpatched.
Today’s cybersecurity brief highlights a data breach at Norway’s aid agency Norad (unrelated to NORAD). The incident underscores ongoing risks to humanitarian operations and data security. Additional items include a GhostMap Android flaw and multiple airline hacks, signaling broader threat activity across sectors.
Government initiatives to curb telecom‑facilitated fraud and spam calls have sharply reduced nuisance communications. Official data show daily spam calls fell by about 99%, from roughly 3.5 crore per day. The Department of Telecommunications notes this decline and signals ongoing efforts to further mitigate fraudulent activity and spam across networks.
India’s CERT-In issued an advisory warning of multiple security vulnerabilities in Tata Motors’ connected vehicle apps, iRA 2.0 and iRA.ev. The note, dated November 4, cautions that flaws could let attackers impersonate legitimate vehicle owners, potentially enabling unauthorized access and control. now.
ENISA alerts EU on cyberattacks targeting commercial refrigeration systems across member states posing risks to supermarkets, food supply chains, and industrial control systems. The EU issued a coordinated cybersecurity warning after a wave of incidents beginning in October and persisting into November, highlighting critical infrastructure exposure.
MetaMask reports that a recent security incident did not affect user wallets or the wallet infrastructure. According to the firm, no funds were compromised and core services remain operational while investigators assess the incident. The company promises enhanced monitoring, faster alerts, and stronger security controls going forward. No issues found!!
Attackers began exploiting PHP2Shell before public details surfaced on Oct 20, 2026. The two critical PHP flaws enable remote code execution on vulnerable servers without credentials, threatening sites and business apps that rely on PHP. Early exploitation signals urged urgent patching and risk assessments across organizations. and monitor now. pls
Unlimited intelligence feeds and real-time alerts in the Secwiser app.
Download now