Abandoned Popcorn Time app exposed millions of devices to RCE attacks
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. The vulnerability, tracked as CVE-2026-30612, affects Windows and macOS updaters that contacted the app’s abandoned domain […]
Microsoft Teams to get AI-powered, context-aware phishing detection
Microsoft says Teams will begin using AI-powered phishing detection in early November 2026 to detect malicious behavior in messages. The rollout is part of a targeted release phase expected to end by mid-November, with the new security feature likely reaching general availability worldwide between early and mid-December. Microsoft first revealed in a Microsoft 365 Roadmap […]
Microsoft: Windows Server 2016 reaches end of support in January
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. Windows Server 2016 was released in September 2016 at Microsoft’s annual Ignite conference and reached general availability one month later, on October 12, 2016 It reached the end of mainstream support in January 2022, and […]
Quest Diagnostics confirms data breach exposed patient records
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. The company learned about the breach on October 21 and deployed its incident response protocol “to contain the activity, assess and investigate the nature and scope of the incident and […]
HPE patches eight max severity RCE and auth bypass AOS flaws
Hewlett Packard Enterprise (HPE) released security updates to patch 72 vulnerabilities in the Aruba Operating System (ArubaOS), including eight maximum-severity authentication bypass and code execution issues. Also known as AOS, ArubaOS powers Aruba Networking enterprise wireless infrastructure, including mobility conductors, access points, controllers, and gateway devices. The eight maximum-severity security flaws patched today affect multiple […]
Railway warns devs to rotate secrets after potential breach
Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. The company says its investigation indicates that, in some cases, an unauthorized third party may have obtained decrypted variables and urges all users to proactively rotate secrets and credentials. “Our […]
Capcom confirms data breach affecting 11.7 million accounts
Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. Apart from emails, exposed data includes account creation date, last login timestamp, number of logins, and the IP address used at the last login. Capcom found that for a small […]
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. The supply-chain attack affected all PyPI wheels (.whl installation packages) for LiteLLM version 1.107.0, impacting Windows, Linux, and macOS systems. LiteLLM is an open-source Python SDK and AI gateway that enables applications to […]
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. VCO is a web-based management portal that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices. Tracked as CVE-2026-114625, this critical-severity flaw can allow attackers with basic privileges, access to […]
Microsoft shares how to fix broken Exchange Online EWS apps
Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. EWS is an API for developing apps that can access Exchange mailbox items (e.g., email messages, meetings, and contacts) from Exchange Online and on-premises Exchange servers. This API is used by […]