CyberSecurity Updates

Any time a company looks to start selling shares on Wall Street, it’s required to disclose potential risks for investors. In the case of artificial intelligence giant Anthropic, that has included the possibility that its products could threaten nothing less than humanity itself. The risks laid out by the San Francisco company in its filing Monday with the Securities and Exchange Commission included discussion of bad actors potentially using AI models to build deadly weapons…

A vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages. Node.js and the Python packages were patched last week, and Microsoft followed on October 25 with fixes for .NET, Visual Studio and PowerShell. Bun, Envoy and Istio have also been updated. Brotli is a popular choice for compressing data sent over the web, and…

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage yet remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving cybersecurity environment. Here are this week’s highlights:  Heartbreaker macOS ransomware rebuilds itself from source Researcher Patrick Wardle has analyzed Heartbreaker,…

Two days after PHP rolled out emergency fixes for the PHP2Shell vulnerabilities, threat actors have tried to use the flaws to spread a Mirai botnet. A security firm has also built an exploit that gets past a key memory protection, and an exposed attacker server has revealed custom tooling. Even so, no successful in-the-wild compromise has been confirmed so far. The threat has prompted many organizations to take systems offline as a precaution. Several government,…

Oracle has released its Critical Patch Update (CPU) for October 2026. The latest updates bring 1,295 new fixes across dozens of products. According to an analysis conducted by Tenable, the new CPU addresses 1,209 unique CVEs, including 95 critical-severity flaws. Tenable says 439 CVEs have been assigned a high severity rating and 582 are medium severity. Oracle Fusion Middleware received the most fixes, 206, including 134 that can be exploited remotely without authentication. A significant…