On 20 October at 15:20 UTC, a Hacker News post leaked details of two critical PHP vulnerabilities that could allow remote code execution. The post was removed, but screenshots circulated on X and Mastodon.
Eight eMudhra intermediate CA keys were compromised, some as weak as 3 bits. Learn the code-signing risk and the steps to hunt for misuse and close the gap from TrendAI™.
Two critical PHP flaws leaked before patches shipped, and the same day Mozilla disclosed weak eMudhra certificate authority keys. In this post, TrendAI™ Global CISO Sundari Parekh gives security leaders a practical playbook.
Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns.
David Levine, Vice President of Corporate and Information Security and CSO for Ricoh USA, Inc., shares his thoughts on reinforcing a security mindset in the organization and how a cloud-first strategy helps enable their operations in the "new normal"
Darkside ransomware surfaced, operators behind Crysis/Dharma released a hacking toolkit, a targeted email campaign was used to propagate Negasteal, and a coinminer was seen bundled with legitimate applications.
We found some fake Facebook accounts stolen from influential accounts to sell, change the details, and/or reused for phishing.
We rounded up information on recently published patches for Adobe, Citrix, Intel, and vBulletin.
Further investigation led us to a developer’s Xcode project that contained XCSSET source malware, which leads to a rabbit hole of malicious payloads. Most notable in our investigation is the discovery of two zero-day exploits.
We found online dating website scam campaigns primarily targeting Japanese customers for their personal and financial information.
Security issues often arise as a result of applications being rushed for deployment without adequate checks and protections. What are the top security risks to applications and what can organizations do to secure their DevOps pipeline?
A Russian group dubbed as Cosmic Lynx initiated more than 200 BEC campaigns targeting hundreds of multinational companies.
In this report, we discussed new ransomware family Avaddon, updates on techniques of other ransomware, and our latest figures.
F5 Networks urges users to patch their BIG-IP networking systems ASAP, after the provider disclosed two vulnerabilities, namely CVE-2020-5902 and CVE-2020-5903.
22. Oktober 2026
5 min