The PHP security team recently issued an urgent alert across the web ecosystem. Specifically, maintainers scheduled an expedited update on Wednesday, 21 October 2026 at 14:00 UTC to remediate two …

TL;DR On October 20, 2026, Apache disclosed six Apache CouchDB vulnerabilities, led by a CVSS 9.3 command execution flaw. CouchDB 3.5.3 fixes all of them. Apache also published four flaws in the r…

Broken Object Level Authorization — IDOR, to most of us — is the single most common serious bug in modern APIs. It sits at #1 on the OWASP…

Agentic AI is changing cybersecurity. But what happens when the system you built to find vulnerabilities becomes the biggest threat to your…

How can AI-powered pentesting be operationalized without sacrificing evidence quality, operator control, or governance?

Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.

TL;DR Threat actors stole a vendor API secret belonging to ConnectWise Cloud Backup (formerly SkyKick) to access customer Microsoft 365 environments. During this ConnectWise Cloud Backup breach, a…

Most of the GraphQL bugs that pay well involve actually exploiting something — batching past a rate limiter, breaking object-level…

How a URL input nobody thinks twice about becomes the keys to your entire cloud account.

Introduction

If you have spent any time learning cybersecurity, software engineering, databases, blockchain, digital forensics, or cryptography, you…

Let’s start with the line “When Your Family, Friends, and Relatives Think You’re a Hacker”. This is very bad and even worse for us as…

Valid credentials do not guarantee that a request is safe.

Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution.

A Large Tor Exit Node Attack An unknown attacker took over 333 Tor exit nodes. That gave the intruder a way to intercept SSH connections and unencrypted correspondence. The hijacked relays made up…