Security
Railway urges users to rotate secrets after attack
Railway says an attacker seeking AI provider keys may have decrypted environment variables in up to about 100,000 workspaces, and it urges key rotation.
Advertisement
Section
Security
Breaches, vulnerabilities, scams and how to stay safe online.
Cloudflare says Workers AI bug exposed data in 155 GLM-5.3 replies
A setup error and an SGLang engine bug let very long prompts to Cloudflare's GLM-5.3 model return pieces of other customers' requests, the company said.
Straiker: hackers used Claude and Grok to target Latin American banks
Security firm Straiker says the CyberCartel group ran a multi-agent AI system built on Claude, Grok and Kimi models against over 400 Latin American financial targets.
Text file in Downloads can hijack Codex and Claude Code, Forever says
Forever says a planted instructions file in a customer's Downloads folder steered an AI coding agent toward malware, and it showed the trick on Codex and Claude Code.
Brotli decoder bug puts Node.js, Bun, Python and Envoy apps at risk
CVE-2026-111497, a memory flaw in Google's Brotli decoder code, reaches every program that bundles it, so Node.js, Bun, Envoy and Python users must update each copy.
- Security
Capcom says 11.7 million Capcom ID records hit by unauthorized access
Email addresses and login history records were affected, 196 passwords were changed without permission, and Capcom says no credit card data was involved.
- Security
Knicks' parent calls ring-bait phishing test an 'unfortunate mistake'
The Knicks organization used a fake offer of free championship rings to test staff for phishing, and Madison Square Garden Sports now calls it a mistake.
- Security
Ukraine says Starlink and Starshield speeds are restored
Ukraine says military-grade Starlink service is back to full speed after restrictions that began October 13 disrupted drone and front-line operations.
- Advertisement
- Security
Quest says unauthorized party accessed patient records via Quanum
In an SEC filing, Quest Diagnostics disclosed unauthorized access to its Quanum lab ordering system and said the full scope is still under investigation.
- Security
CISA urges immediate patching of critical php2shell PHP flaws
The php2shell flaws let attackers run code on any PHP install serving web requests, and CISA says to update now or take systems offline.
- Security
Ransomware Gangs Deployed AI Agents to Automate Network Intrusions
Exposed server logs show INC and The Gentlemen ransomware affiliates used an AI agent framework called Phantom to run breaches with minimal human input.
- Security
CISA Adds Collabora and Arista VeloCloud Flaws to Known Exploited List
Federal agencies have until Oct. 26 to patch two critical, actively exploited bugs in widely used document and network management software.
- Security
LiteLLM PyPI Supply Chain Attack Steals AI Dev Credentials
Attackers hijacked LiteLLM's release pipeline to push credential-stealing malware to PyPI, putting AI developers' cloud keys and API secrets at immediate risk.