"Fresh wordpress vulnerability in attackers' crosshairs."

Views expressed in this cybersecurity, cybercrime update are those of the reporters and correspondents.  Accessed on 30 October 2026, 1346 UTC.

Content and Source;  "SecurityWeek" via email subscription from https://feedly.com.

 https://feedly.com/i/subscription/content/feed%2Fhttp%3A%2F%2Ffeeds.feedburner.com%2FSecurityweek

Please check subscription link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

SecurityWeek

101K followers50 articles per week

#security#tech

146

Today

Fresh WordPress Vulnerability in Attackers’ Crosshairs

3 TTPs

•

by Ionut Arghire / 1h

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution. The post appeared first on SecurityWeek .

Drupal Commerce Core Vulnerability Exploited Against Online Stores

Valid Accounts (Enterprise T1078)

•

by Eduard Kovacs / 2h

Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders. The post appeared first on SecurityWeek .

Yesterday

$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

2 TTPs

•

by Eduard Kovacs / 3h

•

Polymarket resolves vendor security breach

Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds. The post appeared first on SecurityWeek .

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

3 TTPs

•

by Ionut Arghire / 3h

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server. The post appeared first on SecurityWeek .

TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

7 TTPs

•

by Ionut Arghire / 4h

•

CVE-2026-111585 & 3 others

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system. The post appeared first on SecurityWeek .

$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor

4 TTPs

•

by Eduard Kovacs / 5h

•

North Korea behind Binance hack

Blockchain analysts link the record crypto theft to North Korean hackers, as Binance probes a possibly compromised engineer laptop. The post appeared first on SecurityWeek .

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

by Steve Durbin / 20h

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you. The post appeared first on SecurityWeek .

Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model

Gemini 4 Carbon enters testing

•

by Eduard Kovacs / 22h

Google’s new frontier model scored 88.2% on SEC-bench Pro and is rolling out first to vetted cyber defenders via its Fairwind Program. The post appeared first on SecurityWeek .

How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI

by Kevin Townsend / 22h

Unpatched voting machines, unverifiable QR-coded ballots, and AI-driven influence campaigns leave US elections short of secure. The post How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI appeared first on SecurityWeek .

Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps

Quarry detects rogue AI agents

•

by Kevin Townsend / 23h

Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions. The post appeared first on SecurityWeek .

Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities

3 TTPs

•

by Ionut Arghire / 23h

The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation. The post appeared first on SecurityWeek .

BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts

by Eduard Kovacs / 1d

BAE Systems says no data was extracted and no PII was breached in the incident that disrupted US bankruptcy court notices for weeks. The post appeared first on SecurityWeek .

Over 41,000 DHS Employee Records Leaked Online

2 TTPs

•

by Ionut Arghire / 1d

•

Hackers leak DHS employee data

The personal and work information was allegedly stolen from an Okta single sign-on system earlier this year. The post appeared first on SecurityWeek .

Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net

Sony breach exposes millions of users

•

by Eduard Kovacs / 1d

The data of So-net and Plala customers in Japan was exposed, along with 54,401 email account passwords and 16 bank account records. The post appeared first on SecurityWeek .

Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network

8 TTPs

•

by Eduard Kovacs / 1d

•

CVE-2026-20127

Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed. The post appeared first on SecurityWeek .

Oct 28, 2026

Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August

3 TTPs

•

by Eduard Kovacs / 1d

An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload. The post appeared first on SecurityWeek .

HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million

2 TTPs

•

by Ionut Arghire / 1d

Hackers stole personal information and iRhythm account and device data from third-party-hosted business applications. The post appeared first on SecurityWeek .

Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

2 TTPs

•

by Ionut Arghire / 1d

CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post appeared first on SecurityWeek .

Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison

3 TTPs

•

by Ionut Arghire / 1d

•

Ukrainian ransomware affiliate sentenced 70 months

Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post appeared first on SecurityWeek .

Upwind Security Raises $400 Million at $3.8 Billion Valuation

Upwind raises 400M Series C

•

by Mike Lennon / 1d

The massive funding round comes just days after reports emerged that Upwind had attracted acquisition interest from several companies, including Datadog The post Upwind Security Raises $400 Million at $3.8 Billion Valuation appeared first on SecurityWeek .

Chrome and Firefox Updates Patch Over 200 Vulnerabilities

2 TTPs

•

by Ionut Arghire / 2d

The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches. The post appeared first on SecurityWeek .

TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

by Eduard Kovacs / 2d

FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers. The post appeared first on SecurityWeek .

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

16 TTPs

•

by Ionut Arghire / 2d

The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization. The post appeared first on SecurityWeek .

Long-Hidden Flaws Patched in EPICS Research Facility Control Software

2 TTPs

•

by Eduard Kovacs / 2d

Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs. The post appeared first on SecurityWeek .

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

by Sravish Sridhar / 2d

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies. The post appeared first on SecurityWeek .

Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise

Infisical raises 40M AI security

•

by SecurityWeek News / 2d