The latest security reporting, combined across sources and tagged, newest first.
Reporting is aggregated from multiple sources. Anything Cybersecurity Tracker computes or infers is labelled as its own judgment, never as a claim made by a source. Stories are combined, de-duplicated, and tagged by category, vendor, and threat actor. Filter by your job role, follow the vendors you run, get the email digest, or subscribe by Really Simple Syndication (RSS). No account required.
Why now: this site build contains 9,508 stories, with the newest available reporting below.
Common Vulnerabilities and Exposures (CVEs): CISA KEV additions, newly reported exploitation in the last 7 days, or news coverage in the last 48 hours
CVE-2026-109619PHP PHPpinnedCVSS 9.25 news mentions in 48 hours
CVE-2026-109618PHP PHPpinnedCVSS 9.24 news mentions in 48 hours
CVE-2026-96652Plex Media ServerpinnedCVSS 5.3Added to CISA KEV on 2026-10-20
CVE-2026-96654Plex Media ServerpinnedCVSS 6.9Added to CISA KEV on 2026-10-20
CVE-2026-96655Plex Media ServerpinnedCVSS 5.3Added to CISA KEV on 2026-10-20
CVE-2026-96656Plex Media ServerpinnedCVSS 8.6Added to CISA KEV on 2026-10-20
CVE-2026-21589Atlassian Multiple ProductspinnedCVSS 9.3Added to CISA KEV on 2026-10-15
CVE-2026-106931EG Secure Solutions SiteGuard Server EditionpinnedCVSS 8.5Added to CISA KEV on 2026-10-20
Records from your pinned vendors are marked and listed first when they are trending. Pins are the vendors you added to My Stack on the home page. Your pin list is saved only in this browser. Shared view and feed requests include the selected vendor names in their URLs. Pins never change what the tracker collects or scores.
Third-party safety evaluators Metr and Redwood Research identified multiple vulnerabilities in OpenAI's monitoring system for coding agents during testing from July 21 to August 11. The evaluators demonstrated how the monitoring safeguards could be bypassed. OpenAI has stated that the identified flaws have been patched.
Why it matters: Security teams and artificial intelligence (AI) practitioners need to understand that agent monitoring systems may have exploitable gaps; independent audits of safety controls are critical for assessing risks in production artificial intelligence (AI) deployments.
A former ambulance company settled with Massachusetts regulators for $1 million over a 2023 data breach affecting 750,000 people and separate Medicaid billing fraud allegations. The settlement requires the firm to address violations of HIPAA and state data security rules stemming from its failure to protect archived patient and employee information. The agreement includes data destruction mandates.
Why it matters: Healthcare providers and billing services face enforcement action for breach response failures and billing compliance gaps; regulators are holding companies accountable for archived data protection and demanding remediation beyond fines.
Datadog is pursuing a $4 billion acquisition of cloud security firm Upwind to expand its capabilities in cloud, application, and artificial intelligence (AI) security. Upwind is also considering a $300 million funding round from Bessemer Venture Partners as an alternative path forward.
Why it matters: Security practitioners using Datadog or evaluating Upwind should monitor this deal for potential product changes, pricing impacts, and integration of Upwind's cloud defense capabilities into Datadog's platform.
U.S. federal agencies submitted post-quantum migration plans that mandate prioritizing legacy systems for replacement or decommissioning when migration is not feasible. Asia-Pacific regulators have adopted a different approach, favoring containment strategies rather than requiring system replacement.
Why it matters: U.S. federal contractors and organizations operating in multiple regions face divergent compliance requirements: the U.S. no-exceptions replacement mandate versus Asia-Pacific containment allowances, creating operational and budgeting complexity for practitioners managing legacy infrastructure.
The Toronto chapter of Crime Stoppers disclosed details about a data breach and announced it would suspend operations, breaking away from the national organization. The disclosure came late Wednesday night and included a timeline of the organization's knowledge of the incident.
Why it matters: Organizations that collect public tips and personal information must communicate breach timelines transparently; practitioners managing incident disclosure and stakeholder trust should monitor how this nonprofit handles public accountability.
Researchers at VulnCheck developed an exploit that bypasses Address Space Layout Randomization (ASLR) protections to achieve remote code execution against CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities disclosed October 22, 2026. The exploit chains a memory leak to achieve RCE on PHP 8.4.26 with ASLR enabled and production configurations, overcoming a major barrier that had previously blocked practical attacks on real-world systems. The finding underscores that artificial intelligence (AI) is accelerating adversary exploit development and that memory protections alone cannot stop determined attackers.
Why it matters: Organizations running vulnerable PHP versions must patch immediately, as ASLR and configuration hardening are no longer reliable defenses against PHP2Shell exploitation in production environments.
Federal authorities disrupted North Korean infrastructure operations within the United States as part of "Operation Lonestar Justice." The item also notes a separate incident involving Staples gift card distribution. The piece is a roundup video covering news stories that the editors did not report on in depth.
Why it matters: Organizations should track how U.S. law enforcement addresses foreign nation-state infrastructure on domestic soil, as this shapes threat landscape and attribution trends; Staples customers may face fraud exposure depending on the nature of the gift card incident.
Capcom confirmed a breach of its CAPCOM ID membership service that exposed more than 11.7 million customer email addresses and associated information. The Japanese gaming giant disclosed the incident affecting its user database.
Why it matters: Capcom customers with CAPCOM ID accounts should monitor for phishing and credential abuse; practitioners should track this for impact on gaming industry supply chains and customer trust.
CVE-2025-71438 is an out-of-bounds read vulnerability in GPAC/MP4Box's gf_odf_ac4_cfg_dsi_v1 function that processes AC-4 audio streams. The flaw arises when a crafted AC-4 file supplies an invalid frame rate index that indexes beyond fixed-size lookup tables in odf/descriptors.c. An attacker can trigger information disclosure or denial of service by delivering a malicious AC-4 stream to a user running vulnerable versions of GPAC prior to the fix commit.
Why it matters: Developers and users of GPAC/MP4Box need to patch or apply the fix commit to prevent out-of-bounds reads when processing untrusted AC-4 audio files, which could leak sensitive data or crash the application.
A divide by zero vulnerability (CVE-2025-60496) exists in GPAC's MP4Box reframer when processing a crafted truncated MP4 file. The flaw was reported by Alexander A. Shvedov and assigned CVSS 3.1 score of 5.5 (Medium), with a fix committed on October 22.
Why it matters: Developers and systems using MP4Box for media processing face denial of service risk if they process untrusted MP4 files; update to the patched commit f03c946aae129980f0426d4cbae9746d0536fee6 or later.
A NULL pointer dereference vulnerability exists in GPAC's MP4Box component when processing crafted BIFS scene files. The flaw affects version 2.5-DEV and was resolved in commit 75786eb.
Why it matters: Practitioners using GPAC to process untrusted MP4 or BIFS files face denial of service risk; verify whether your deployment includes the patched commit.
A heap use-after-free vulnerability exists in GPAC's MP4Box component within the gf_filter_packet_destroy() function when processing crafted MPEG-2 Transport Stream files. The flaw, tracked as CVE-2025-60478 with a CVSS 3.1 score of 7.8 (high severity), has been patched in the project's repository.
Why it matters: Users and developers of GPAC/MP4Box face potential code execution or denial of service risk if they process untrusted MPEG-2 TS files; update to the fixed commit c592a144bbe339ee581ca88aaa3247362795b742 or later.
CVE-2025-60476 is a heap use-after-free vulnerability in GPAC MP4Box affecting version 2.5-DEV-rev1593-gfe88c3545-master in the AC-4 descriptor cleanup function. The vulnerability has a CVSS 3.1 score of 8.8 and allows remote code execution without user privileges required beyond interaction. A fix is available in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
Why it matters: Organizations using GPAC MP4Box for media processing must patch this vulnerability immediately to prevent remote code execution from malicious MP4 files, particularly in automated transcoding or streaming workflows.
European supermarkets suffered losses totaling millions of euros after outsourcing operational technology (OT) firmware management for climate control systems, resulting in hundreds of stores affected by outdated refrigeration firmware. The incident stemmed from third-party vendors failing to maintain current firmware on critical infrastructure supporting store operations.
Why it matters: Retail operators and facility managers need to audit outsourced OT device management immediately: unpatched climate control systems can trigger operational disruptions and significant financial losses.
Source: Canadian Centre for Cyber Security, Communications Security Establishment Canada.
Splunk issued security advisory AV26-1077 on October 22, 2026, disclosing vulnerabilities affecting multiple versions of Splunk Enterprise and Splunk SOAR (Security Orchestration, Automation and Response). The Cyber Centre recommends users and administrators review the advisory and apply updates as they become available to the affected products.
Why it matters: Organizations running Splunk Enterprise or SOAR should immediately identify their deployed versions and apply the appropriate security updates to close the reported vulnerabilities before exploitation occurs.
Attackers compromised the LiteLLM project's Python Package Index (PyPI) package and Docker image repositories to distribute malware designed to steal credentials, secrets, and environment variables. The malicious payload affected the project's release pipeline, allowing threat actors to reach users of the popular large language model (LLM) library.
Why it matters: Teams using LiteLLM or its Docker images need to audit their environments for compromise indicators immediately, since exposed credentials and secrets pose a direct risk to downstream systems and data.
An article examines exposure to PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) beyond organizations that directly use PHP, noting that dependencies and hosted applications may introduce risk regardless of stated tech stack. The piece suggests that confirming exploitability requires understanding indirect PHP usage across products and containers.
Why it matters: Development teams and security practitioners need to audit indirect dependencies and third-party hosted applications for PHP exposure, since saying 'we don't use PHP' does not guarantee immunity to these vulnerabilities.
Indian tech company eMudhra announced its withdrawal from the certificate business following a security incident where one of its private keys was hardcoded as the number four instead of a random 384-bit value. Cybersecurity researcher Scott Helme publicly disclosed the flaw in a blog post, exposing the fundamental cryptographic weakness in the company's key generation process.
Why it matters: Organizations and users relying on eMudhra-issued certificates face compromised trust anchors; practitioners should audit any eMudhra certificates in their environments and plan revocation and replacement.
Millions of exploit attempts are targeting recently patched PHP vulnerabilities known as PHP2Shell, with hundreds of proof-of-concept exploits circulating online. Security experts warn that successful attacks are likely imminent and recommend immediate patching.
Why it matters: Organizations running unpatched PHP servers face direct risk of compromise; apply patches now before exploitation becomes widespread.
The PHP Foundation's coordinated disclosure process for the PHP2Shell vulnerability broke down when a demonstration video leaked early, and cybersecurity researchers later found exploit attempts predating even those initial leaks. The foundation has acknowledged decision paralysis following the discovery of one flaw in 2024. The incident highlights challenges in managing vulnerability timelines across the open-source ecosystem.
Why it matters: PHP users and maintainers need to assess exposure to PHP2Shell and prioritize patching, since exploitation began before official disclosure and the vulnerability window extended longer than intended.
Tracker inference
No stories match your current filters. Reset search and filters to show all stories.
Stories come from the published source set, are combined when reports cover the same event, and are ordered newest first. Trending uses the last 7 Coordinated Universal Time (UTC) calendar days, while the details feed states each story's published or first-seen date.