Railway warns devs to rotate secrets after potential breach (2026-10-22 21:25 UTC)
Kurz: Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. […]
Capcom confirms data breach affecting 11.7 million accounts (2026-10-22 20:22 UTC)
Kurz: Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. […]
Kurz: Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. […]
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data (2026-10-23 07:50 UTC)
Kurz: Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their “Node2Shell” proof of concept ran code on the official Node.js 24.22.0 image …
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware (2026-10-23 07:40 UTC)
Kurz: Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harde…
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat (2026-10-22 19:05 UTC)
Kurz: Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching. Nobody reviewed its access. Nobody owns …