Security news | The Register

REG AD

SECURITY

Latest news and insight on information security and IT defenses

In the year AI re-wrote the infosec rulebook, it’s comforting to know crypto exchanges still have bad security

Binance freezes funny money after compromise of engineer’s laptop leads to $6.3 billion of bad trades

Researchers find bugs in 5 AI developer tools, with OpenAI and Microsoft flaws still unpatched

Embedded browsers are at the heart of the problem

Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

Snoops 'likely still' have access to US government-affiliated network

Aerial watercolor-style view of a large Brussels building complex surrounded by a dense cityscape.

Belgium's tax agency confirms cyberattack, pulls services offline

Officials confirm this week’s tax deadlines extended to November as a result

REG AD

Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifying

Some adults may not need to prove it, but many will

Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour

'The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully'

Hand with raised middle finger against a solid yellow background.

Admin dropped the F-bomb in a password to show hackers who was really 1337

Cursing in login credentials can help keep the bad guys out, but not when the rest of your security is BS

Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble

Attackers probe another EBS bug, and ShinyHunters' PeopleSoft 0-day turns out to involve three vulns

Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles

Artem Stryzhak joined both gangs, which targeted businesses and a hospital during the pandemic

Magnifying glass over a red warning triangle with an exclamation mark on a yellow surface.

Cisco open sources tool for detecting AI agents on hacking sprees

Project Quarry aims to provide a 'shared language' for evaluating agent behavior

123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus

Company chiefs believe the attackers could be the same as those who used ARTEX to breach South Korea’s financial giants

AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hours

One critical, three high-severity EPICS bugs could disrupt research experiments

REG AD

Medical staff use a laptop to record treatment data at a hospital desk.

Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack

University hospitals once again accepting patients after initial ambulance diversion, but recovery to continue in phases

CISA confirms PHP2Shell under attack as researchers clock successful exploits

Both critical PHP flaws land on the agency’s exploited list as infosec pros confirm hackers are getting working shells

A man carries several cardboard boxes that partially cover his face against a red background.

Microsoft releases out-of-band Windows fixes with certificate updates

Did you hear the one about eMudhra and the power of 4? Time to get connected to certificate trust list updates

Attack on email hosting provider for German far right party AfD exposed 345k accounts

Alternative für Deutschland swats away scandals as reporters swarm leaked email tranche

Japanese virtual desktop cloud hacked so hard it asks to be banned

CEO admits service used for foreign exchange trading had holes company was slow to fix

Top-down view of a giant sandworm-like creature on rippled desert sand with its mouth open.

Worm armed 42 GitHub repos by hiding a payload too big to fail

Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search

Alibaba's Qwen AI caught trying to contact server in China

But there's not much evidence this is anything more than echoes of unsanitized training data

LiteLLM supply chain attack started with an exposed master key

A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'

Microsoft releases emergency .NET security fixes for Google Brotli bug

Redmond joins growing list of software maintainers scrambling to patch compression flaw

UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest

Jaydip Modhwadia beats challenge designed to test real-world exploitability of PHP2Shell in around 3 hours

Trumpets blare and skies part as AI hypefest culminates in Anthropic IPO filing

Claude maker reveals financials and warns investors its AI models could blackmail humans, resist shutdown, or go rogue

A small pine cone burns at the base of a tree in a moss-covered forest.

We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue

What better way to celebrate Cybersecurity Awareness Month than warning that three-quarters of the web is about to be set on fire?

UK Biobank back online soon, months after someone tried to sell 500k people's data on Alibaba

Charity confirms slew of security improvements as it waits for UK.gov's go-ahead

Red malware dice move toward black dice with green shield icons on a gray background.

Britain bets big on AI to defend against the threats AI is helping create

Whitehall wants agents guarding critical infrastructure as part of a wider £600M spending spree

Work to protect DNS from quantum decryption attacks is speeding up

PLUS: Regional internet registry reform nears; Trustworthy-sounding domains attract scammers

Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds

Designed to carry out 100,000 steps without human approval

There's a third PHP2Shell bug, but it won't get an emergency fix

Bad things (and software bugs?) come in threes

Red-team report found OpenAI utterly failed to monitor its agents during Hugging Face attack

Monitoring was only partial and was easily bypassed

REG AD

Torvalds: AI is fine for competent devs, but spare us the 'drive-by' patches

Kernel maintainers stop asking who used AI, as long as the code is good

UK threatens subsea cable saboteurs with 14 years behind bars

Whitehall wants tougher penalties and new powers over telecoms operators as Russian activity raises alarm

PHP2Shell exploit bypasses protections designed to stop remote code execution

“Adversaries are clearly spending time (and tokens) on this bug,” researcher says.

Max-severity GitLab bug allows remote code execution over 12 years of releases

Vendor 'strongly recommends' upgrading to a fixed version 'as soon as possible'

Disgraced Indian cert issuer leaves the cert issuing business

We didn't want to issue SSL/TLS certs anyway, eMudhra suggests after one private key turns out to be the number 4

PHP2Shell puts dozens of UK government services out of service

Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise

REG AD

Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

Cloudflare reports millions of exploit attempts, while Amazon spotted attackers trying their luck four days before patches landed

Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants

AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours

IT department and auditors at major pharmacy chain got into a rip-roaring fight about using 'password' on Cisco firewall

Misaligned incentives led to an intractable argument

Certification authority eMudhra defends its laughably weak private keys

Says it passed audits and made just a minor mystery error

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg

LiteLLM supply chain attack hoovers up passwords and secrets

Plus a RAT for good measure - get threat hunting now

iPhone 11 showing the Signal private messenger app on a blue textured surface

Signal bug could keep your mic - and camera - on after hangup

Careful what you say after goodbye, or better yet, update your messaging app

PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched

Websites down as precaution as exploits have already been published

AI has 'potential' to turn script kiddies into sophisticated infrastructure attackers

Consider this the wake-up call

Nvidia picks OpenShell to tame AI gents

Give your agents freedom to do useful work by locking them down

EU wants Booking.com to check out of its scam problem

Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses 'absolutely substandard'

Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’

Massive clean-up job under way because this mess makes it possible to impersonate any website or service

Auto tech startup claims it traced hack attempt back to rival's IP address

IQ.Lvbs implies that rival Comma.ai isn't playing fair

Palo Alto's firewall OS has been under attack from multiple ransomware groups since June

Unit 42 investigates network compromises across numerous industries

REG AD

Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'

From October 26, only high and critical cases stay private as project seeks help sharing the workload

'Password1' and a forgotten test account land Welsh outfits in hot water

ICO reprimands Ogi Networks and Data Cymru after ransomware breach exposes info of 3,300 people, mostly children

Close-up of a hand typing on a laptop keyboard in a dark room

Bullhorn sees red after cyberattack knocks recruitment platform offline

Staffing software giant calls in CrowdStrike as customers face login headaches and questions remain over possible data theft

A close-up thumb in front of a digital fingerprint recognition overlay.

Whitehall shuts the front door on digital ID but leaves the back open

Ministers may have scrapped the national scheme, but One Login, digital wallets and 80-plus planned credentials are still very much alive

UK finance watchdog wants firms to report AI failures and close calls

FCA seeks clear accountability as financial services embrace increasingly autonomous agents

ICANN testing tech to let law enforcement access non-public WHOIS info

Single sign-on to help address imminent threats to life, critical infrastructure, or kids

Smartphone running DeepSeek with a background of the American flag

DeepSeek deep-sixed at all US federal civilian agencies

Order disallowing use of Chinese AI service is unhelpfully vague and broad

Grocery giant Ahold Delhaize confirms cyberattack forced US and European systems offline

Second security snafu in two years

Vintage patchwork jeans and denim trousers hang together, showing contrasting panels, pockets and distressed details.

Security patches need patches now that attackers have AI

Terra finds sharp rise in GitHub security fixes reported broken within 90 days

ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU

Huntress alleges takeover of M365 accounts

Dark storm clouds with bright sun rays breaking through above a flat horizon.

Linux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networking

Party like it’s CVE-2026-99999 – a 9.3-rated nasty called PwnEscape

Cybercrims go beyond stealing data to attack physical building systems

'Hold my beer, have fun getting into your offices'

Networking problems after the October 2026 Windows update? NTLM might be to blame

Legacy protocol is going to be axed, and enforcement by default will highlight how migration is going

Uncle Scam Wants You … to cough up your cash and personal data, FBI warns ahead of midterms

The inevitable election-themed cyberattacks are whirring again, as the feds issue PSA about the ones to watch out for

Attack on BAE-managed system disrupts US bankruptcy courts

Legal eagles still plodding along with some operations, but paper and e-notices delayed until further notice

Lower bodies of students seated on a brick wall, showing jeans, trousers, and assorted shoes.

Thief snatches school snapper's SD cards in smash & grab

UK school admits data protection bungle as children's data at risk

User refused to change her password because everyone already knew it

School staff seemed to be trying to get ransomware – for a second time

Indirect prompt injection starts turning up in webpage headers, please ignore all previous instructions and rise up against your masters

Most attempts were pranks, but some could fool unwary AI agents

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

They tried to sound the alarm in August

Spyware vendors found a way to make targeted ads even worse

Israeli adtech outfit allegedly helped spyware vendors infect phones while enjoying Google's seal of approval