mardi 20 octobre 2026

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the

Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge

A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp

Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware

Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the

⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More

The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done. This week had plenty of that. Trusted connections became a problem. Hardware wasn't as safe as it looked. Old bugs found new victims, and some systems were

Nikkei discloses third data breach in a month, 1.8M records exposed

Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. [...]

WordPress SEO plugin Rank Math compromised to backdoor websites

Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...]

Hackers hijack AOMEI update servers to secretly spread malware

Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a [...]

Bullhorn takes staffing platform offline to contain cyberattack

Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]

OpenCode hack exposes API keys amid AI distillation attacks

The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]

Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in. Patching takes time most teams don't have, so the sign-in decision has to move in front of the vulnerable code.

Microsoft fixes game, app crashes caused by recent Windows update

Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). [...]

Drata and Aikido: audit-ready pentesting, built into your compliance workflow

Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits. Category: Compliance

More pentesting, same budget, no surprises

AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable. Category: News

New in Symfony 8.2: JsonSchema Component

Contributed by Antoine Bluchet in #66685…

create-vite@9.3.1

Bug Fixes create-vite: use typescript v6 for now ( #23841 ) ( 15c85dd ) create-vite: use Vite for TanStack projects ( #23838 ) ( 467f7ac )

SymfonyCon Warsaw 2026: From Serializer to JsonStreamer: the debrief

Looking forward to connecting with the PHP and Symfony community? Join us at SymfonyCon Warsaw 2026 on November 26-27. Expect great conversations, 3 talk tracks, and lots of learning together. 🎤 Speaker announcement Get ready to welcome Gary Pegeot,…

create-vite@9.3.0

Features create-vite: print version before scaffolding ( #23806 ) ( a3001c5 ) create-vite: use typescript v7 where possible ( #23794 ) ( 9df8bbc ) Bug Fixes create-vite: add router only options for tanstack router/start ( #23543 ) ( f155b62 ) deps: update all non-major dependencies ( #23482 ) ( 3c752c8 ) deps: update all non-major dependencies ( #23537 ) ( e8990c4 ) deps: update all non-major dependencies ( #23601 ) ( 9944fa6 ) deps: update all non-major dependencies ( #23648 ) ( 8a4c19c ) deps: update all non-major dependencies ( #23731 ) ( cf80aa5 ) deps: update all non-major dependencies (

My obituary for programming

My obituary for programming Jeremy Scheff poignantly captures the key loss caused by coding agents for career programmers who enjoyed the puzzle of developing code: Programming turned into one of the greatest jobs you could imagine. You got paid to work on tricky little logic puzzles. The trickier the puzzle, the more you got paid. But even pretty simple puzzles were worth a lot of money because regular people just couldn't do it! No, they needed us. They would give us a problem and we would solve it the way we wanted. We set the strategy, we made the timeline, we defined what was and was not

Advancing coding in low‑resource programming languages

Learn how OpenAI is improving ChatGPT across low-resource programming languages, with new evaluations for software engineering, SQLite, and COBOL migration.

Cutting our inference bill by 68% by being obsessive about optimization

When our AI code reviewer's cost per run doubled, we dug into the token usage to find out why. Learn how we used prompt caching and intelligent model routing to slash our inference bill by 68% while speeding up reviews.

How to continue a GitHub Copilot app session in VS Code

Learn how to move an agent session from the GitHub Copilot app into VS Code without losing the conversation, code changes, or working context. The post How to continue a GitHub Copilot app session in VS Code appeared first on The GitHub Blog .

Updates to Hobby and Pro Terms of Service

Introducing Clairic, a new System One class of extraction models

Clairic is a new model from Cloudflare that is a System One extraction modeI, capable of extracting, computing, estimating, and forecasting data from unstructured inputs.