Critical x402 SDK flaws let malicious APIs drain AI agent wallets
Security researchers found three critical vulnerabilities in x402 SDKs that allowed malicious APIs to drain AI agent token balances or bypass payments entirely.
Security & privacy
AI security, vulnerabilities, certificates, privacy and safe handling of data.
Chinese hackers used AI agents to breach ConnectWise and spy on thousands
State-aligned hackers stole credentials from ConnectWise’s cloud backup service and used AI agents to access thousands of corporate Microsoft environments at high speed.
Node.js patches remote code execution flaw in bundled Brotli decoder
Node.js released security updates for versions 22, 24, and 26 to fix a high-severity out-of-bounds write in the Brotli decoder that could allow remote code execution.
PHP2Shell flaws exploited before public disclosure
Attackers targeted PHP2Shell vulnerabilities days before the official patch release, exploiting a leak that forced an early disclosure.
AI discovers critical PHP flaws, sparking disclosure debate
Two critical PHP vulnerabilities forced emergency patches and triggered a dispute over early release by Chainguard amid AI-driven discovery.
LiteLLM 1.107.0 compromise injects credential stealer via build pipeline
A malicious LiteLLM release on PyPI installed a credential stealer and backdoor by modifying the build configuration, affecting all major operating systems.
PHP2Shell: Why configuration tweaks fail and how to mitigate risk before patching
PHP is releasing emergency patches for two critical remote code execution flaws. Experts warn that popular configuration workarounds are insufficient and urge immediate isolation strategies.
PHP releases urgent security patches for critical remote code execution flaws
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two critical vulnerabilities allowing unauthenticated remote code execution via memory corruption and stale global state.
PHP releases emergency patches for critical PHP2Shell remote code execution flaws
PHP has issued urgent updates to fix two critical vulnerabilities in its runtime engine that allow unauthenticated remote code execution. The flaws affect nearly all PHP versions and are already being
Critical PHP zero-day triggers global outages and urgent patching
Two critical vulnerabilities in PHP are being actively exploited, affecting millions of websites and causing government site outages across Europe.
AI discovers critical PHP flaws affecting 70% of the web
Wiz Research used frontier AI models to uncover and exploit decade-old memory safety bugs in core PHP, leading to immediate patches for a vulnerability affecting most websites.
Meta halts Muse chat sharing after DNS leak exposes private data
Researchers found over 6,800 public Muse links via DNS records, revealing sensitive business and personal data. Meta has paused the sharing feature to address the vulnerability.
Hidden AI instructions in WhatsApp help pages blocked regulator advice
Investigative analysis reveals hidden text in WhatsApp help pages instructed its AI chatbot to avoid recommending data protection regulators or citing privacy laws when users mentioned legal action.
ConnectWise suspends cloud backup services after application identity breach
ConnectWise has suspended its Cloud Backup service and reset credentials following a security incident involving unauthorized access to application identities in Microsoft 365 tenants.
OVHcloud CLI releases hijacked to steal secrets via GitHub account compromise
Attackers replaced binaries in five OVHcloud CLI releases for 94 minutes on October 19, targeting users who installed updates without hash verification.
