# Latest **URL:** https://forums.thehomestack.io/latest.md?page=3 [Latest](https://forums.thehomestack.io/latest.md) · [Categories](https://forums.thehomestack.io/categories.md) · [Tags](https://forums.thehomestack.io/tags.md) **Page:** 4 --- ## [Lazarus hackers use post-quantum cryptography for malware delivery](https://forums.thehomestack.io/t/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/26547)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 8:49pm UTC](https://forums.thehomestack.io/t/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/26547 "2026-10-21T20:49:56Z")
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. \[…\] This is a companion discussion topic for the original e… --- ## [Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases](https://forums.thehomestack.io/t/critical-gitlab-flaw-cvss-10-0-could-allow-unauthenticated-rce-across-12-years-of-releases/26546)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 8:19pm UTC](https://forums.thehomestack.io/t/critical-gitlab-flaw-cvss-10-0-could-allow-unauthenticated-rce-across-12-years-of-releases/26546 "2026-10-21T20:19:53Z")
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matter… --- ## [CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers](https://forums.thehomestack.io/t/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/26545)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 6:49pm UTC](https://forums.thehomestack.io/t/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers/26545 "2026-10-21T18:49:19Z")
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. \[…\] This is a companion discussion topic for the original en… --- ## [LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor](https://forums.thehomestack.io/t/litellm-compromised-in-supply-chain-attack-delivering-credential-stealer-and-backdoor/26544)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 6:19pm UTC](https://forums.thehomestack.io/t/litellm-compromised-in-supply-chain-attack-delivering-credential-stealer-and-backdoor/26544 "2026-10-21T18:19:15Z")
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. T… --- ## [OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So](https://forums.thehomestack.io/t/openais-gpt-6-agent-removed-safety-monitoring-then-falsely-denied-doing-so/26543)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 5:44pm UTC](https://forums.thehomestack.io/t/openais-gpt-6-agent-removed-safety-monitoring-then-falsely-denied-doing-so/26543 "2026-10-21T17:44:29Z")
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI c… --- ## [Mapping Cyber Attack Paths⚠️](https://forums.thehomestack.io/t/mapping-cyber-attack-paths/26542)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 4:39pm UTC](https://forums.thehomestack.io/t/mapping-cyber-attack-paths/26542 "2026-10-21T16:39:53Z")
This is a companion discussion topic for the original entry at https://www.youtube.com/shorts/2-KIcgIpCgw --- ## [OpenAI agents disabled safety monitoring, one lied about it](https://forums.thehomestack.io/t/openai-agents-disabled-safety-monitoring-one-lied-about-it/26541)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 4:39pm UTC](https://forums.thehomestack.io/t/openai-agents-disabled-safety-monitoring-one-lied-about-it/26541 "2026-10-21T16:39:52Z")
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. \[…\] This is a companion discussion… --- ## [Widespread PHP Flaw May Cause Many Site Outages Today](https://forums.thehomestack.io/t/widespread-php-flaw-may-cause-many-site-outages-today/26540)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 4:04pm UTC](https://forums.thehomestack.io/t/widespread-php-flaw-may-cause-many-site-outages-today/26540 "2026-10-21T16:04:59Z")
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected s… --- ## [PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge](https://forums.thehomestack.io/t/php-issues-emergency-patches-for-two-critical-php2shell-rce-flaws-as-exploit-attempts-emerge/26539)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 3:30pm UTC](https://forums.thehomestack.io/t/php-issues-emergency-patches-for-two-critical-php2shell-rce-flaws-as-exploit-attempts-emerge/26539 "2026-10-21T15:30:07Z")
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the PHP … --- ## [ClickFix has never been bigger, and AI tools are its most convincing lure yet](https://forums.thehomestack.io/t/clickfix-has-never-been-bigger-and-ai-tools-are-its-most-convincing-lure-yet/26538)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 2:29pm UTC](https://forums.thehomestack.io/t/clickfix-has-never-been-bigger-and-ai-tools-are-its-most-convincing-lure-yet/26538 "2026-10-21T14:29:35Z")
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditi… --- ## [PHP ships emergency patches for critical PHP2Shell flaws](https://forums.thehomestack.io/t/php-ships-emergency-patches-for-critical-php2shell-flaws/26537)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 2:29pm UTC](https://forums.thehomestack.io/t/php-ships-emergency-patches-for-critical-php2shell-flaws/26537 "2026-10-21T14:29:35Z")
The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell. \[…\] This is a companion di… --- ## [Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands](https://forums.thehomestack.io/t/google-chrome-adds-clickfix-warnings-to-stop-users-from-running-malicious-commands/26536)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 1:29pm UTC](https://forums.thehomestack.io/t/google-chrome-adds-clickfix-warnings-to-stop-users-from-running-malicious-commands/26536 "2026-10-21T13:29:32Z")
Google on Tuesday said it’s rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which… --- ## [Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports](https://forums.thehomestack.io/t/generative-ai-is-erasing-behavioral-tells-weakening-behavior-only-detection-proofpoint-reports/26535)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 12:54pm UTC](https://forums.thehomestack.io/t/generative-ai-is-erasing-behavioral-tells-weakening-behavior-only-detection-proofpoint-reports/26535 "2026-10-21T12:54:56Z")
Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each reci… --- ## [China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors](https://forums.thehomestack.io/t/china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to-deploy-backdoors/26534)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 12:54pm UTC](https://forums.thehomestack.io/t/china-aligned-bronze-sandcastle-abuses-sandboxie-dll-sideloading-to-deploy-backdoors/26534 "2026-10-21T12:54:56Z")
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. “Th… --- ## [Microsoft PowerToys adds CursorHide, Button Lock mouse tools](https://forums.thehomestack.io/t/microsoft-powertoys-adds-cursorhide-button-lock-mouse-tools/26533)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 12:24pm UTC](https://forums.thehomestack.io/t/microsoft-powertoys-adds-cursorhide-button-lock-mouse-tools/26533 "2026-10-21T12:24:33Z")
Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. \[…\] This is a companion discussion topic for the original entry at https://www.bleepingcom… --- ## [Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections](https://forums.thehomestack.io/t/attackers-hijacked-over-300-tor-exit-relays-to-intercept-ssh-connections/26532)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 11:24am UTC](https://forums.thehomestack.io/t/attackers-hijacked-over-300-tor-exit-relays-to-intercept-ssh-connections/26532 "2026-10-21T11:24:11Z")
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit… --- ## [The Harness Is the Hard Part of Agentic Pentesting](https://forums.thehomestack.io/t/the-harness-is-the-hard-part-of-agentic-pentesting/26531)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 11:24am UTC](https://forums.thehomestack.io/t/the-harness-is-the-hard-part-of-agentic-pentesting/26531 "2026-10-21T11:24:10Z")
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production an… --- ## [PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't](https://forums.thehomestack.io/t/php2shell-what-actually-protects-you-before-the-14-00-utc-php-rce-patch-and-what-doesnt/26530)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 11:24am UTC](https://forums.thehomestack.io/t/php2shell-what-actually-protects-you-before-the-14-00-utc-php-rce-patch-and-what-doesnt/26530 "2026-10-21T11:24:10Z")
You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says. PHP … --- ## [The patching gap: Hacked fridges, AI ransomware and Mythos finds](https://forums.thehomestack.io/t/the-patching-gap-hacked-fridges-ai-ransomware-and-mythos-finds/26529)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 10:23am UTC](https://forums.thehomestack.io/t/the-patching-gap-hacked-fridges-ai-ransomware-and-mythos-finds/26529 "2026-10-21T10:23:55Z")
This is a companion discussion topic for the original entry at https://www.youtube.com/watch?v=qV36V-WOsDo --- ## [Microsoft says October updates didn’t actually fix VPN issues](https://forums.thehomestack.io/t/microsoft-says-october-updates-didn-t-actually-fix-vpn-issues/26528)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 10:23am UTC](https://forums.thehomestack.io/t/microsoft-says-october-updates-didn-t-actually-fix-vpn-issues/26528 "2026-10-21T10:23:53Z")
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. \[…\] This is a companion discussion topic for the original entry at https://… --- ## [U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases](https://forums.thehomestack.io/t/u-s-orders-deepseek-removed-from-federal-civilian-systems-bans-new-purchases/26527)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 9:53am UTC](https://forums.thehomestack.io/t/u-s-orders-deepseek-removed-from-federal-civilian-systems-bans-new-purchases/26527 "2026-10-21T09:53:52Z")
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services “developed using DeepSeek implementations,” under a Department of Ho… --- ## [Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites](https://forums.thehomestack.io/t/attackers-abuse-updraftcentral-keys-to-plant-backdoors-on-wordpress-sites/26526)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 9:53am UTC](https://forums.thehomestack.io/t/attackers-abuse-updraftcentral-keys-to-plant-backdoors-on-wordpress-sites/26526 "2026-10-21T09:53:51Z")
Unknown threat actors breached TeamUpdraft’s website and potentially gained unauthorized access to customers’ connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. T… --- ## [CISA: SafePay ransomware hit over 600 critical infrastructure orgs](https://forums.thehomestack.io/t/cisa-safepay-ransomware-hit-over-600-critical-infrastructure-orgs/26525)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 8:48am UTC](https://forums.thehomestack.io/t/cisa-safepay-ransomware-hit-over-600-critical-infrastructure-orgs/26525 "2026-10-21T08:48:17Z")
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024. \[…\] This is a companion discussion topic fo… --- ## [Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion](https://forums.thehomestack.io/t/hackers-hid-vasilek-backdoor-in-vmware-tools-during-2-year-russian-healthcare-intrusion/26524)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 7:47am UTC](https://forums.thehomestack.io/t/hackers-hid-vasilek-backdoor-in-vmware-tools-during-2-year-russian-healthcare-intrusion/26524 "2026-10-21T07:47:55Z")
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to… --- ## [CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws](https://forums.thehomestack.io/t/cisa-orders-federal-agencies-to-patch-exploited-plex2shell-siemens-and-siteguard-flaws/26523)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 7:47am UTC](https://forums.thehomestack.io/t/cisa-orders-federal-agencies-to-patch-exploited-plex2shell-siemens-and-siteguard-flaws/26523 "2026-10-21T07:47:54Z")
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that… --- ## [State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web](https://forums.thehomestack.io/t/state-bank-of-india-confirms-data-leak-after-3-897-customer-records-found-on-dark-web/26522)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 7:47am UTC](https://forums.thehomestack.io/t/state-bank-of-india-confirms-data-leak-after-3-897-customer-records-found-on-dark-web/26522 "2026-10-21T07:47:50Z")
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned b… --- ## [PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert](https://forums.thehomestack.io/t/php2shell-two-unpatched-critical-php-rce-flaws-cvss-9-2-trigger-emergency-security-alert/26521)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 5:46am UTC](https://forums.thehomestack.io/t/php2shell-two-unpatched-critical-php-rce-flaws-cvss-9-2-trigger-emergency-security-alert/26521 "2026-10-21T05:46:52Z")
This story is developing and was written before PHP’s scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory. PHP will ship an ou… --- ## [Stolen UpdraftCentral keys used to backdoor WordPress sites](https://forums.thehomestack.io/t/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/26520)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 1:35am UTC](https://forums.thehomestack.io/t/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites/26520 "2026-10-21T01:35:36Z")
A threat actor breached TeamUpdraft’s website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. \[…\] Thi… --- ## [Mozilla, Google, Apple block compromised eMudhra CA certificates](https://forums.thehomestack.io/t/mozilla-google-apple-block-compromised-emudhra-ca-certificates/26519)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 1:00am UTC](https://forums.thehomestack.io/t/mozilla-google-apple-block-compromised-emudhra-ca-certificates/26519 "2026-10-21T01:00:43Z")
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted cert… --- ## [PHP warns admins of two critical flaws, emergency patches coming tomorrow](https://forums.thehomestack.io/t/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/26518)
**Author:** [@robinhood1995](https://forums.thehomestack.io/u/robinhood1995)\ **Replies:** 0\ **Last updated:** [October 20, 2026, 9:11pm UTC](https://forums.thehomestack.io/t/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/26518 "2026-10-20T21:11:24Z")
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled di… [Previous page](https://forums.thehomestack.io/latest.md?page=2) [Next page](https://forums.thehomestack.io/latest.md?page=4)