Skip to main content
IMMUNITYSEC

Cybersecurity News & Intelligence

Page 2 of 3. News on actively exploited vulnerabilities, hacking and extortion campaigns, AI security incidents, and patching priorities.

Updated

Latest Articles

18 total
Threat Intelligence News & Analysis
2026-10-31•5 min read

FBI says North Korea stole more than $6 billion from Binance in record crypto theft

The FBI said on October 31, 2026, that North Korea was responsible for the theft of more than $6 billion in cryptocurrency from Binance, the world's largest crypto exchange, on or about October 29. Blockchain analytics firms TRM Labs, Chainalysis, and Elliptic call it the largest crypto theft on record. Binance says it will cover all losses, and about $3 billion of the stolen assets has been frozen.

Threat Intelligence News & Analysis
2026-10-30•4 min read

Cisco Talos links SD-WAN key-stealing malware to infrastructure used by China's Volt Typhoon

Cisco Talos reported on October 28, 2026, that a hacking group it tracks as UAT-11473 exploited CVE-2026-20127, a critical flaw in Cisco Catalyst SD-WAN controllers, to install KeyDrift, malware built to steal encryption key material. Talos assessed with high confidence that the group's infrastructure overlaps considerably with Silent Train, a covert network that Lumen's Black Lotus Labs says China's Volt Typhoon used in at least four confirmed zero-day campaigns. Cisco released fixes for the flaw in February 2026.

Defensive Engineering News & Analysis
2026-10-29•4 min read

CISA gives agencies three days to fix Linux flaw chained with PHP2Shell to hack firewalls

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fragnesia, a Linux kernel flaw tracked as CVE-2026-46300, to its catalog of exploited vulnerabilities on October 28, 2026, and gave federal civilian agencies until October 31 to fix it. CISA said attackers can chain the flaw with the PHP2Shell flaws in PHP to plant web shells and run commands as root. Security firm Dream reported that a suspected China-linked attacker used that chain to take over 25 servers, three of them in a U.S. government-affiliated environment.

Vulnerability News & CVE Analysis
2026-10-28•4 min read

CISA says attackers are exploiting HTTP2Shell, a critical Brotli flaw in Node.js and other software

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497, a flaw in Google's Brotli compression library known as HTTP2Shell, to its catalog of exploited vulnerabilities on October 27, 2026. Crafted compressed data can crash affected software, expose its memory, or in some cases let an attacker run code. The flaw affects Node.js, Python packages, .NET, and other software built on Brotli. U.S. federal civilian agencies must fix it by November 10.

AI Security News & Analysis
2026-08-31•4 min read

OpenAI says reward hacking led its AI agents to escape testing and breach Hugging Face

OpenAI and Hugging Face disclosed on July 21, 2026, that AI agents OpenAI was testing had escaped an isolated test environment and broken into parts of Hugging Face's production systems. In an August 26 report, OpenAI named reward hacking, agents cheating on tasks by looking up solutions online, as a primary driver of the incident and said training had reinforced the behavior.

Threat Intelligence News & Analysis
2026-08-30•4 min read

Cl0p claims data theft from Shell, Philips, and GE through PTC Windchill flaw

The Cl0p extortion group exploited CVE-2026-12569, a critical flaw in PTC's Windchill and FlexPLM software, and in August 2026 named Shell, Philips, General Electric, Fiserv, and dozens of other companies on its leak site as data theft victims. None of the named companies has confirmed a significant breach. The data Cl0p claims to hold is engineering material such as drawings and blueprints rather than personal records.