Node2Shell, Explained: Your Questions About the Node.js Compression Bug That Researchers Just Turned Into Code Execution
When Node.js shipped security updates on Wednesday, October 21, the most serious fix was for a bug in the code...
Month: October 2026
Railway Breach Timeline: How a Cloud Hosting Platform Went From Strange Activity to Telling Every Customer to Change Their Keys
Developers have been passing one instruction around since Wednesday: if you have anything on Railway, rotate your secrets. Railway, a...
Quest Diagnostics Says an Intruder Reached Patient Records Through the Portal Doctors Use to Order Lab Tests
Lab testing company Quest Diagnostics has disclosed a breach in a system that medical practices use to order tests and...
Third Exploited VeloCloud Orchestrator Zero-Day Since July: Even a Read-Only Login Can Become a Superuser
If your branch offices connect through VeloCloud SD-WAN, the management console behind that network has a new problem. Arista Networks...
Under Three Hours From First Probe to Privileged Access: Microsoft Ties the ConnectWise Backup Breach to an AI-Driven Chinese Campaign
Here Is How Layered Defenses Help When the Attacker Arrives as an App You Already TrustedMost security advice assumes the...
Wi-Fi, Phones, Cameras and Attendance, All at Once: An Inventory of What a Cyberattack Shut Off Across Richmond’s Public Schools
On Wednesday morning, staff at Richmond Public Schools in Virginia opened their district-issued laptops and found a message claiming the...
Signed, Protected and Still Poisoned: How Attackers Slipped a Credential Stealer Into the LiteLLM AI Gateway’s Official Release
LiteLLM is the kind of software most business owners have never heard of but may already depend on. It gives...
Chrome Will Now Speak Up Before You Paste That ‘Fix’: A Walkthrough of Google’s New Defenses Against ClickFix and Web Scams
ClickFix attacks succeed because the victim does the risky part. A fake CAPTCHA or error page tells them to copy...
1,462 Arrests, 10,909 Networks Taken Down, $105 Million Recovered: Interpol’s Serengeti III Crackdown, at a Glance
Online fraud rarely respects borders: the scam that reaches a business inbox may be planned, staffed and laundered thousands of...
PHP2Shell, Day Two: The Fix Is Out, Attackers Were Probing Days Earlier, and What to Do Depending on Where Your Site Lives
Yesterday’s question was when the fix would arrive. Today’s is whether it reached your servers in time. PHP released the...
