Good morning! PHP puts two critical flaws on notice as browsers and Apple block eight certificates with compromised keys. One asks you to wait for the fix; the other shows what happens after the keys are gone. Here are the 7 things you don't want to miss: 1. ⚠️ PHP schedules an out-of-cycle release for two flaws rated 9.2 PHP's security team gave advance notice Tuesday for an out-of-cycle release Wednesday at 14:00 UTC, fixing two vulnerabilities it rates 9.2 without describing them. A leaked...
14 days ago • 2 min read
Good morning! The FBI suspects a ransom negotiator helped run ShinyHunters' extortion portal as California's attorney general secures a $6 million settlement from 23andMe's successor. One is a settlement; the other is suspicion without a charge. Here are the 7 things you don't want to miss: 1. ⚖️ The FBI suspects a ransom negotiator of running ShinyHunters' extortion site In a follow-up to October's arrest of a ransomware-negotiation firm executive, U.S. investigators suspect executives at...
15 days ago • 2 min read
Good morning! ConnectWise suspends its cloud backup service after attackers reach its application identities, as OpenCode warns some users' AI provider keys may be exposed. Neither is a password, and neither company will name a suspect. Here are the 4 things you don't want to miss: 1. 🔒 ConnectWise suspends cloud backup after attackers reach Microsoft 365 tenants ConnectWise suspended its Cloud Backup service, formerly SkyKick, and two connected services after attackers gained unauthorized...
15 days ago • 1 min read
Good morning! An exploited Cisco email-gateway flaw leads CISA's Wednesday additions as Microsoft takes down the marketplace behind three phishing kits. Both live at the inbox — one guards it, one floods it. Here are the 7 things you don't want to miss: 1. 🔒 Four new KEV entries, led by an exploited Cisco email flaw CISA added four vulnerabilities to its Known Exploited Vulnerabilities list on October 14, led by CVE-2026-76519 in Cisco's Secure Email Gateway, rated 9.8 by Cisco. Two others...
20 days ago • 2 min read
Good morning! A DOJ complaint charges an OpenAI engineer with planting a covert recorder as Meta traces a GitHub breach to one employee's stolen credentials. It takes a conference room or a login to reach company secrets. Here are the 7 things you don't want to miss: 1. 🔒 CISA flags an exploited zero-day in Ivanti Connect Secure CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities list on October 13: an authentication bypass in Ivanti Connect Secure that allows unauthenticated...
21 days ago • 2 min read
Good morning! GitLab ships a CVSS 10.0 in the compiler behind its CI/CD pipelines, and LG televisions fall to an unauthenticated root chain. Unauthenticated and unattended: the two hardest words in a patch note. Here are the 6 things you don't want to miss: 1. 🔒 GitLab scores a 10.0 in the CI/CD compiler GitLab shipped a critical patch release for CVE-2026-97229, a CVSS 10.0 integer overflow in the CI/CD regular-expression compiler that, under certain conditions, could have let an...
22 days ago • 2 min read
Good morning! French fridges defrost themselves overnight as Ahold Delhaize pulls some systems offline as a precaution. No link reported between them — just one lousy Monday for grocery IT. Here are the 7 things you don't want to miss: 1. ❄️ French supermarket fridges defrost themselves overnight Attackers triggered defrost cycles at major French supermarket chains overnight Sunday, sending refrigerator temperatures up and forcing stores to discard fresh and frozen stock. Intermarché,...
23 days ago • 2 min read
Good morning! The DOJ seized the infrastructure behind two hacking tools a Chinese company allegedly ran as the FBI raided a scam compound in Ghana. Two U.S. strikes, same Thursday, two continents — credit is already contested. Here are the 7 things you don't want to miss: 1. 🚔 DOJ seizes China-linked hacking tools as advisory lands The Justice Department and FBI seized the domains behind Microscan and FishHub, two tools a Chinese company allegedly ran for hacking and scanning...
26 days ago • 2 min read
Good morning! A ransomware recovery CEO is charged with wire fraud over secretly paying the ransoms he claimed to beat as Boeing faces extortion claims at a unit it sold last year. One is an indictment; the other is only claims. Here are the 7 things you don't want to miss: 1. 🔒 Cisco's October advisories cover switches, controllers and licensing Cisco's PSIRT published its scheduled batch on Wednesday, October 7, led by an unauthenticated remote code execution flaw in NX-API (CVE-2026-76471,...
27 days ago • 2 min read