The latest security reporting, combined across sources and tagged, newest first.
Reporting is aggregated from multiple sources. Anything Cybersecurity Tracker computes or infers is labelled as its own judgment, never as a claim made by a source. Stories are combined, de-duplicated, and tagged by category, vendor, and threat actor. Filter by your job role, follow the vendors you run, get the email digest, or subscribe by Really Simple Syndication (RSS). No account required.
Why now: this site build contains 9,514 stories, with the newest available reporting below.
Common Vulnerabilities and Exposures (CVEs): CISA KEV additions, newly reported exploitation in the last 7 days, or news coverage in the last 48 hours
CVE-2026-109619PHP PHPpinnedCVSS 9.25 news mentions in 48 hours
CVE-2026-110936Siemens Software CenterpinnedCVSS 8.4Added to CISA KEV on 2026-10-20 · Exploitation newly reported on 2026-10-20
CVE-2026-109618PHP PHPpinnedCVSS 9.24 news mentions in 48 hours
CVE-2026-96652Plex Media ServerpinnedCVSS 5.3Added to CISA KEV on 2026-10-20
CVE-2026-96654Plex Media ServerpinnedCVSS 6.9Added to CISA KEV on 2026-10-20
CVE-2026-96655Plex Media ServerpinnedCVSS 5.3Added to CISA KEV on 2026-10-20
CVE-2026-96656Plex Media ServerpinnedCVSS 8.6Added to CISA KEV on 2026-10-20
CVE-2026-106931EG Secure Solutions SiteGuard Server EditionpinnedCVSS 8.5Added to CISA KEV on 2026-10-20
Records from your pinned vendors are marked and listed first when they are trending. Pins are the vendors you added to My Stack on the home page. Your pin list is saved only in this browser. Shared view and feed requests include the selected vendor names in their URLs. Pins never change what the tracker collects or scores.
Dragos, Accenture, SANS Institute, and Elastic are partnering to provide $10 million in free operational technology (OT) cybersecurity support to small and rural utilities. The program aims to address resource constraints that prevent smaller utilities from implementing security measures available to larger organizations.
Why it matters: Small and rural utility operators lack budget and expertise for OT security; this program reduces barriers to basic cybersecurity defenses for organizations managing critical infrastructure.
Quest Diagnostics disclosed a cybersecurity incident affecting its Quanum LSM system, a platform used by healthcare providers to manage lab test orders and access patient results. The company reported to the Securities and Exchange Commission that the breach likely compromised certain patient records. The scope and nature of the compromise remain under investigation.
Why it matters: Healthcare providers and their patients face potential exposure of medical records and lab results; practitioners should identify whether their organization uses this system and begin incident response procedures.
Tracker inference
vulnerabilitiesResearchTracker priority: Track*CVE-2026-113873CVE-2026-113874+2 more
CISA published four CVEs affecting HAPI FHIR, an open-source Java implementation of HL7 FHIR, coordinated under VINCE case VU#394579. The vulnerabilities include cross-tenant partition override, authorization bypasses, and gzip heap exhaustion, with the most severe allowing a caller authorized for one tenant to read or write data in another tenant's partition. The issues were reproduced on HAPI FHIR version 8.10.0.
Why it matters: Organizations running HAPI FHIR as part of healthcare information systems or multi-tenant deployments face immediate risk of data exposure and unauthorized modification across tenant boundaries; patch or isolate affected instances.
This article discusses application security posture management (ASPM) strategies in the context of artificial intelligence (AI), emphasizing the use of code-to-cloud context to identify and prioritize exploitable security risks. The piece advocates for reducing triage times by integrating visibility across code, infrastructure, and runtime environments to focus remediation efforts on the most consequential vulnerabilities.
Why it matters: Security teams using ASPM tools need guidance on AI-driven prioritization methods to allocate limited resources toward risks that pose the greatest exploitation potential and business impact.
CPython's tarfile.tar_filter module contains a path traversal vulnerability that allows an attacker to write files outside the intended extraction directory. The issue was disclosed on October 22, 2026, and assigned CVE-2026-114583.
Why it matters: Python developers and users who extract tar archives with untrusted content face the risk of arbitrary file writes to the filesystem; patching CPython is necessary to prevent potential system compromise.
Cyberattack reporting against Japanese entities climbed 48% from Q2 to Q3 2026, affecting multiple sectors through ransomware, vulnerability exploitation, credential theft, and service disruptions. Attacks on shared service providers cascaded harm to downstream customers, with millions of records exposed. Contributing factors include demand for Japanese personal data, legacy infrastructure, software vulnerabilities, weak application programming interface (API) controls, and artificial intelligence (AI) lowering attacker barriers.
Why it matters: Japanese organizations across sectors face rising attack volume and downstream risk through supply chain compromise; practitioners should assess incident response capabilities, API security, and legacy system exposure.
Third-party safety evaluators Metr and Redwood Research identified multiple vulnerabilities in OpenAI's monitoring system for coding agents during testing from July 21 to August 11. The evaluators demonstrated how the monitoring safeguards could be bypassed. OpenAI has stated that the identified flaws have been patched.
Why it matters: Security teams and artificial intelligence (AI) practitioners need to understand that agent monitoring systems may have exploitable gaps; independent audits of safety controls are critical for assessing risks in production artificial intelligence (AI) deployments.
A former ambulance company settled with Massachusetts regulators for $1 million over a 2023 data breach affecting 750,000 people and separate Medicaid billing fraud allegations. The settlement requires the firm to address violations of HIPAA and state data security rules stemming from its failure to protect archived patient and employee information. The agreement includes data destruction mandates.
Why it matters: Healthcare providers and billing services face enforcement action for breach response failures and billing compliance gaps; regulators are holding companies accountable for archived data protection and demanding remediation beyond fines.
Datadog is pursuing a $4 billion acquisition of cloud security firm Upwind to expand its capabilities in cloud, application, and artificial intelligence (AI) security. Upwind is also considering a $300 million funding round from Bessemer Venture Partners as an alternative path forward.
Why it matters: Security practitioners using Datadog or evaluating Upwind should monitor this deal for potential product changes, pricing impacts, and integration of Upwind's cloud defense capabilities into Datadog's platform.
U.S. federal agencies submitted post-quantum migration plans that mandate prioritizing legacy systems for replacement or decommissioning when migration is not feasible. Asia-Pacific regulators have adopted a different approach, favoring containment strategies rather than requiring system replacement.
Why it matters: U.S. federal contractors and organizations operating in multiple regions face divergent compliance requirements: the U.S. no-exceptions replacement mandate versus Asia-Pacific containment allowances, creating operational and budgeting complexity for practitioners managing legacy infrastructure.
The Toronto chapter of Crime Stoppers disclosed details about a data breach and announced it would suspend operations, breaking away from the national organization. The disclosure came late Wednesday night and included a timeline of the organization's knowledge of the incident.
Why it matters: Organizations that collect public tips and personal information must communicate breach timelines transparently; practitioners managing incident disclosure and stakeholder trust should monitor how this nonprofit handles public accountability.
Researchers at VulnCheck developed an exploit that bypasses Address Space Layout Randomization (ASLR) protections to achieve remote code execution against CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities disclosed October 22, 2026. The exploit chains a memory leak to achieve RCE on PHP 8.4.26 with ASLR enabled and production configurations, overcoming a major barrier that had previously blocked practical attacks on real-world systems. The finding underscores that artificial intelligence (AI) is accelerating adversary exploit development and that memory protections alone cannot stop determined attackers.
Why it matters: Organizations running vulnerable PHP versions must patch immediately, as ASLR and configuration hardening are no longer reliable defenses against PHP2Shell exploitation in production environments.
Federal authorities disrupted North Korean infrastructure operations within the United States as part of "Operation Lonestar Justice." The item also notes a separate incident involving Staples gift card distribution. The piece is a roundup video covering news stories that the editors did not report on in depth.
Why it matters: Organizations should track how U.S. law enforcement addresses foreign nation-state infrastructure on domestic soil, as this shapes threat landscape and attribution trends; Staples customers may face fraud exposure depending on the nature of the gift card incident.
Capcom confirmed a breach of its CAPCOM ID membership service that exposed more than 11.7 million customer email addresses and associated information. The Japanese gaming giant disclosed the incident affecting its user database.
Why it matters: Capcom customers with CAPCOM ID accounts should monitor for phishing and credential abuse; practitioners should track this for impact on gaming industry supply chains and customer trust.
CVE-2025-71438 is an out-of-bounds read vulnerability in GPAC/MP4Box's gf_odf_ac4_cfg_dsi_v1 function that processes AC-4 audio streams. The flaw arises when a crafted AC-4 file supplies an invalid frame rate index that indexes beyond fixed-size lookup tables in odf/descriptors.c. An attacker can trigger information disclosure or denial of service by delivering a malicious AC-4 stream to a user running vulnerable versions of GPAC prior to the fix commit.
Why it matters: Developers and users of GPAC/MP4Box need to patch or apply the fix commit to prevent out-of-bounds reads when processing untrusted AC-4 audio files, which could leak sensitive data or crash the application.
A divide by zero vulnerability (CVE-2025-60496) exists in GPAC's MP4Box reframer when processing a crafted truncated MP4 file. The flaw was reported by Alexander A. Shvedov and assigned CVSS 3.1 score of 5.5 (Medium), with a fix committed on October 22.
Why it matters: Developers and systems using MP4Box for media processing face denial of service risk if they process untrusted MP4 files; update to the patched commit f03c946aae129980f0426d4cbae9746d0536fee6 or later.
A NULL pointer dereference vulnerability exists in GPAC's MP4Box component when processing crafted BIFS scene files. The flaw affects version 2.5-DEV and was resolved in commit 75786eb.
Why it matters: Practitioners using GPAC to process untrusted MP4 or BIFS files face denial of service risk; verify whether your deployment includes the patched commit.
A heap use-after-free vulnerability exists in GPAC's MP4Box component within the gf_filter_packet_destroy() function when processing crafted MPEG-2 Transport Stream files. The flaw, tracked as CVE-2025-60478 with a CVSS 3.1 score of 7.8 (high severity), has been patched in the project's repository.
Why it matters: Users and developers of GPAC/MP4Box face potential code execution or denial of service risk if they process untrusted MPEG-2 TS files; update to the fixed commit c592a144bbe339ee581ca88aaa3247362795b742 or later.
CVE-2025-60476 is a heap use-after-free vulnerability in GPAC MP4Box affecting version 2.5-DEV-rev1593-gfe88c3545-master in the AC-4 descriptor cleanup function. The vulnerability has a CVSS 3.1 score of 8.8 and allows remote code execution without user privileges required beyond interaction. A fix is available in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
Why it matters: Organizations using GPAC MP4Box for media processing must patch this vulnerability immediately to prevent remote code execution from malicious MP4 files, particularly in automated transcoding or streaming workflows.
European supermarkets suffered losses totaling millions of euros after outsourcing operational technology (OT) firmware management for climate control systems, resulting in hundreds of stores affected by outdated refrigeration firmware. The incident stemmed from third-party vendors failing to maintain current firmware on critical infrastructure supporting store operations.
Why it matters: Retail operators and facility managers need to audit outsourced OT device management immediately: unpatched climate control systems can trigger operational disruptions and significant financial losses.
Tracker inference
No stories match your current filters. Reset search and filters to show all stories.
Stories come from the published source set, are combined when reports cover the same event, and are ordered newest first. Trending uses the last 7 Coordinated Universal Time (UTC) calendar days, while the details feed states each story's published or first-seen date.