News

Four vulnerabilities in EPICS Base could allow attackers to crash processes in control systems used at particle accelerators, fusion experiments and other large research facilities. One flaw could potentially lead to code execution. CISA disclosed the issues in an advisory published on Tuesday, saying they impact EPICS Base 7.0.10 and earlier. The agency recommends updating to version 7.0.11. The vulnerabilities were discovered by Cipher, an autonomous security research system made by Causal Security.  EPICS is…

Read More

Any time a company looks to start selling shares on Wall Street, it’s required to disclose potential risks for investors. In the case of artificial intelligence giant Anthropic, that has included the possibility that its products could threaten nothing less than humanity itself. The risks laid out by the San Francisco company in its filing Monday with the Securities and Exchange Commission included discussion of bad actors potentially using AI models to build deadly weapons…

Read More

A vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages. Node.js and the Python packages were patched last week, and Microsoft followed on October 25 with fixes for .NET, Visual Studio and PowerShell. Bun, Envoy and Istio have also been updated. Brotli is a popular choice for compressing data sent over the web, and…

Read More

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment. Here are this week’s highlights:  Heartbreaker macOS ransomware rebuilds itself from source Researcher Patrick Wardle has analyzed Heartbreaker,…

Read More

Two days after PHP rolled out emergency fixes for the PHP2Shell vulnerabilities, threat actors have tried to use the flaws to spread a Mirai botnet. A security firm has also built an exploit that gets past a key memory protection, and an exposed attacker server has revealed custom tooling. Even so, no successful in-the-wild compromise has been confirmed so far. The threat has prompted many organizations to take systems offline as a precaution. Several government,…

Read More

Oracle has released its Critical Patch Update (CPU) for October 2026. The latest updates bring 1,295 new fixes across dozens of products. According to an analysis conducted by Tenable, the new CPU addresses 1,209 unique CVEs, including 95 critical-severity flaws. Tenable says 439 CVEs have been assigned a high severity rating and 582 are medium severity. Oracle Fusion Middleware received the most fixes, 206, including 134 that can be exploited remotely without authentication. A significant…

Read More

Details on two critical-severity PHP vulnerabilities named PHP2Shell have been leaked online ahead of scheduled coordinated disclosure and official patches. On Tuesday, PHP warned that patches for the critical issues, both with a CVSS score of 9.2, are planned for Wednesday, 21 October 2026 at 14:00 UTC (10:00 am ET), urging defenders to prepare for immediate patching. “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is…

Read More

Anthropic has acquired Opaque Systems, a company that developed technology for using sensitive data in AI systems while keeping it protected by the underlying hardware.  Opaque announced the deal last week, saying its team is joining Anthropic. Financial terms were not disclosed. Opaque started as a research project at UC Berkeley’s RISELab a decade ago. Its founders include Ion Stoica, co-founder of Databricks and Anyscale, and Raluca Ada Popa, an encryption and systems security researcher…

Read More