Cloud Security

Today’s signal The Hacker News recently reported China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility. Published context: October 29, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized by a China-nexus threat actor known as Warp Panda in attacks targeting the U.S. legal sector. The vulnerability in questi ...

Today’s signal The Hacker News recently reported Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges. Published context: October 28, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google’s Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked re ...

Today’s signal The Hacker News recently reported Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware. Published context: October 26, 2026. Cybersecurity researchers are calling attention to what they say is a “recurring social engineering pattern” across hundreds of cases in which threat actors use Microsoft Teams’ external chat creation feature to conduct impersonation scams or to deliver malware. “A consistent pattern of attacker behavior has emerged across these incidents: the use of the sam ...

Today’s signal The Hacker News recently reported Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations. Published context: October 26, 2026. Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress, which observed the activity between July 14 and September 22, 2026, said it detected 497 successfu ...

Today’s signal The Hacker News recently reported CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud. Published context: October 24, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 ( ...

Today’s signal The Hacker News recently reported Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions. Published context: October 23, 2026. Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an “Autonomous Red Team Kill Chain Framework” referred to as Phantom. The threat actor is assessed to be Russian-speaking and functions both as an intrusion and data ...

Today’s signal The Hacker News recently reported ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More. Published context: October 22, 2026. This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That’s a lot to deal with in just a few days. And the week isn’t even over yet. But those big headlines are only half the story ...

Today’s signal The Hacker News recently reported LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release. Published context: October 22, 2026. LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM’s release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The ...

Today’s signal The Hacker News recently reported Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution. Published context: October 20, 2026. Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthoriz ...

Today’s signal The Hacker News recently reported ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident. Published context: October 20, 2026. ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the fo ...

Today’s signal The Hacker News recently reported OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys. Published context: October 19, 2026. An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode’s optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team mem ...

Today’s signal The Hacker News recently reported UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing. Published context: October 16, 2026. Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The reason this matters is simple: buyers are paying attention to speed, operational resilience, and credible technical execution. A trending story can create awareness, but the business question is what a team should do with that attention. ...