Article: Worm armed 42 GitHub repos by hiding a payload too big to fail - published 11 days ago.
Content: A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to stay hidden from GitHub and automated scanners, according to JFrog researchers. Threat hunters at SafeDep, an open source supply chain securi...
Copy Link: https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570   
Published: 2026 10 26 22:29:01
Received: 2026 11 05 17:19:18
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Article: Alibaba's Qwen AI caught trying to contact server in China - published 11 days ago.
Content: Open-weight models from China have become very popular, but they've also raised some security suspicions. Cohere, a Canada-based biz that offers AI models to enterprises, says that when it was testing Alibaba's Qwen3.8-Flash-Next in its evaluation sandbox, the model attempted to send data to China. "Asked to write a defensive detection rule, Qwen3.8-Flash-N...
Copy Link: https://www.theregister.com/ai-and-ml/2026/10/26/alibabas-qwen-ai-caught-trying-to-contact-server-in-china/5305561   
Published: 2026 10 26 21:27:37
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Free Score Certificate

Article: LiteLLM supply chain attack started with an exposed master key - published 11 days ago.
Content: LiteLLM has traced last week’s supply chain attack to a master key it accidentally committed to a public GitHub repository in May. The cloud and AI model secret-stealing part of the incident began when someone uploaded a poisoned version (1.107.0) of the popular open source AI gateway to PyPI and its container registries last Wednesday. This compromised ver...
Copy Link: https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544   
Published: 2026 10 26 20:30:53
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Score Summary

Article: Breach of Confidence: 26 October 2026 - published 11 days ago.
Content: Hello, Anil Dash wrote a lovely piece on installing apps on a Commodore 64 this week. I had a ZX Spectrum 128k, where installing anything meant twenty minutes of tape hiss, a prayer, and a volume knob set entirely by feel. It was still more reliable than most vendor update processes. https://anildash.com/2026/10/08/install-an-app-commodore-64/ Clo...
Copy Link: https://javvadmalik.com/2026/10/26/breach-of-confidence-26-october-2026/   
Published: 2026 10 26 20:00:14
Received: 2026 11 05 17:15:38
Feed: J4vv4D
Source: J4vv4D
Category: Cyber Security
Topic: Cyber Security

Article: Oracle Security Alert Advisory for CVE-2026-109618 and CVE-2026-109619 - published 11 days ago.
Content:
Copy Link: https://www.oracle.com/security-alerts/alert-cve-2026-109618.html    
Published: 2026 10 26 20:00:00
Received: 2026 11 05 17:13:59
Feed: Oracle Security Alerts
Source: Oracle Security Alerts
Category: Alerts
Topic: Vulnerabilities

Article: Microsoft releases emergency .NET security fixes for Google Brotli bug - published 11 days ago.
Content: To address a vulnerability in Google's Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update "as soon as possible" after releasing an out-of-band (OOB) security update. It released new versions for .NET 8, 9, 10, and .NET 11 to patch against the Brotli bug, following similar updates from...
Copy Link: https://www.theregister.com/security/2026/10/26/microsoft-releases-emergency-net-security-fixes-for-google-brotli-bug/5305515   
Published: 2026 10 26 17:58:00
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Your Score Explained

Article: Lessons Learned From 'AdFection' and What To Do Next - published 11 days ago.
Content:
Copy Link: https://www.eff.org/deeplinks/2026/10/lessons-learned-adfection   
Published: 2026 10 26 17:28:02
Received: 2026 11 05 17:19:27
Feed: Deeplinks
Source: Deeplinks
Category: Cyber Security
Topic: Cyber Security

Article: Anti-Circumvention Laws Raise the Cost of Knowledge - published 11 days ago.
Content:
Copy Link: https://www.eff.org/deeplinks/2026/10/anti-circumvention-laws-raise-cost-knowledge   
Published: 2026 10 26 17:20:40
Received: 2026 11 05 17:19:27
Feed: Deeplinks
Source: Deeplinks
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Gold Score Certificate

Article: Anthropic’s Claude AI Model Accessed US Voter Data - published 11 days ago.
Content: Did Claude AI hack voter data? Security leaders discuss. 
Copy Link: https://www.securitymagazine.com/articles/102696-anthropics-claude-ai-model-accessed-us-voter-data   
Published: 2026 10 26 17:05:00
Received: 2026 11 05 17:01:50
Feed: Security Magazine – All Feeds
Source: Security Magazine
Category: News
Topic: Security

Article: 8 Million Records Allegedly Stolen by AI Hacking Group - published 11 days ago.
Content: South Korean law enforcement apprehended seven suspects in connection with a cybercrime ring. 
Copy Link: https://www.securitymagazine.com/articles/102695-8-million-records-allegedly-stolen-by-ai-hacking-group   
Published: 2026 10 26 17:00:00
Received: 2026 11 05 17:01:50
Feed: Security Magazine – All Feeds
Source: Security Magazine
Category: News
Topic: Security

Cyber Tzar Score Analysis

Article: PHP2Shell Exploited in the Wild - published 11 days ago.
Content: PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been exploited in the wild. 
Copy Link: https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild   
Published: 2026 10 26 16:15:00
Received: 2026 11 05 17:01:50
Feed: Security Magazine – All Feeds
Source: Security Magazine
Category: News
Topic: Security

Cyber Tzar Risk Impact Distribution

Article: UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest - published 11 days ago.
Content: A UK-based developer and pentester has claimed a $2,000 Bitcoin prize for demonstrating the exploitability of the PHP2Shell vulnerabilities that melted the internet last week. Jaydip Modhwadia, 26, otherwise known as “Killa,” claimed the prize set by James Pavur, who launched the "Steal My Bitcoin" site on October 24. Pavur launched the CTF (capture the fla...
Copy Link: https://www.theregister.com/security/2026/10/26/uk-pentester-killa-claims-2k-bitcoin-prize-in-php2shell-capture-the-flag-contest/5305429   
Published: 2026 10 26 16:14:00
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Article: Trumpets blare and skies part as AI hypefest culminates in Anthropic IPO filing - published 11 days ago.
Content: Anthropic has filed for an IPO that could rank among Wall Street's biggest ever, revealing an $80.7 billion half-year loss, a startlingly complex governance structure, and warnings that its AI models could blackmail humans, resist shutdown, or create "existential risks" to society. The Claude maker filed its S-1 registration statement with the US Securities...
Copy Link: https://www.theregister.com/ai-and-ml/2026/10/26/trumpets-blare-and-skies-part-as-ai-hypefest-culminates-in-anthropic-ipo-filing/5305456   
Published: 2026 10 26 15:47:05
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Risk Impact Assesment

Article: Maigret – OSINT Username Search Tool - published 11 days ago.
Content:
Copy Link: https://www.darknet.org.uk/2026/10/maigret-osint-username-search-tool/   
Published: 2026 10 26 15:16:34
Received: 2026 11 05 17:15:22
Feed: Darknet - The Darkside
Source: Darknet - The Darkside
Category: Cyber Security
Topic: Cyber Security

Article: Taxpayers May Pay Up to $25,000 to Address County Data Breach - published 11 days ago.
Content: Taxpayers may be paying the price for a data breach. 
Copy Link: https://www.securitymagazine.com/articles/102692-taxpayers-may-pay-up-to-25-000-to-address-county-data-breach   
Published: 2026 10 26 14:26:00
Received: 2026 11 05 17:01:51
Feed: Security Magazine – All Feeds
Source: Security Magazine
Category: News
Topic: Security

Cyber Tzar Your Score Explained

Article: The US Government Is Hiding a Secret Court Ruling About How It Spies on Americans - published 11 days ago.
Content:
Copy Link: https://www.wired.com/story/the-us-government-is-hiding-a-secret-court-ruling-about-how-it-spies-on-americans/   
Published: 2026 10 26 14:09:00
Received: 2026 11 05 17:00:34
Feed: Wired.com – Security Feed
Source: Wired
Category: News
Topic: Cyber Security

Article: We shouldn't be surprised about the PHPocalypse, as the internet is built on sticks and glue - published 11 days ago.
Content: We've spent the past several decades using duct tape, string, and chewing gum to chain the world's computers together into this thing we call the internet, so there's really no good reason to be surprised that most of it is full of software containing vulnerabilities that are practically just as old. You can listen to the latest episode of The Kettle right ...
Copy Link: https://www.theregister.com/security/2026/10/26/we-shouldnt-be-surprised-about-the-phpocalypse-as-the-internet-is-built-on-sticks-and-glue/5305186   
Published: 2026 10 26 13:14:00
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Risk Groups Explained

Article: Your Older Android Phone Is Getting a New Scam Defense — Here’s What Google Changed - published 11 days ago.
Content:
Copy Link: https://www.techrepublic.com/article/news-google-android-scam-call-protection/   
Published: 2026 10 26 12:52:38
Received: 2026 11 05 17:19:12
Feed: IT Security Blog | TechRepublic
Source: IT Security Blog | TechRepublic
Category: Cyber Security
Topic: Cyber Security

Article: UK Biobank back online soon, months after someone tried to sell 500k people's data on Alibaba - published 11 days ago.
Content: UK Biobank (UKB) says its platform is now "secure" and that academics will soon regain access, months after a major data leak of volunteer health data. The charity, which runs the eponymous research project and describes itself as the custodian of the world's most comprehensive biomedical dataset, said it is waiting for approval from health data controllers...
Copy Link: https://www.theregister.com/security/2026/10/26/uk-biobank-back-online-soon-months-after-someone-tried-to-sell-500k-peoples-data-on-alibaba/5305363   
Published: 2026 10 26 12:38:00
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Change Over Time (Extended)

Article: CISA Adds Two Known Exploited Vulnerabilities to Catalog - published 11 days ago.
Content:
Copy Link: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog   
Published: 2026 10 26 12:00:00
Received: 2026 11 05 22:24:07
Feed: CISA Current Activity
Source: Cybersecurity and Infrastructure Security Agency (CISA)
Category: News
Topic: Cyber Security

Article: Bias in Qwen3-Coder Model - published 11 days ago.
Content: Interesting research: TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it. One word tilts the co...
Copy Link: https://www.schneier.com/blog/archives/2026/10/bias-in-qwen3-coder-model.html   
Published: 2026 10 26 11:03:31
Received: 2026 11 05 17:18:10
Feed: Schneier on Security
Source: Schneier on Security
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Change Over Time (Extended)

Article: Britain bets big on AI to defend against the threats AI is helping create - published 11 days ago.
Content: The UK government is throwing £130 million at AI-powered cyber defenses, including plans to deploy autonomous AI agents across critical infrastructure to hunt down security flaws before attackers get there first. The money is part of a wider £600 million-plus AI spending spree announced by the Treasury ahead of this week's Budget, with ministers also promis...
Copy Link: https://www.theregister.com/security/2026/10/26/britain-bets-big-on-ai-to-defend-against-the-threats-ai-is-helping-create/5305319   
Published: 2026 10 26 11:00:00
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Article: Passkey enrollment and account recovery, the new weak point - published 11 days ago.
Content:
Copy Link: https://www.darkoperator.com/blog/2026/10/26/passkey-enrollment-and-account-recovery-the-new-weak-point   
Published: 2026 10 26 10:00:00
Received: 2026 11 05 17:16:56
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Change Over Time (Extended)

Article: Russian Hackers Use Experimental Network In Ukraine Strike - published 11 days ago.
Content:
Copy Link: https://www.silicon.co.uk/cybersecurity/russia-ukraine-yggdrasil-632000   
Published: 2026 10 26 09:30:04
Received: 2026 11 05 17:01:06
Feed: Silicon UK – Security
Source: Silicon UK
Category: News
Topic: Cyber Security

Article: PHP2Shell: No login, no app code, no warning. What next? - published 11 days ago.
Content: If you run PHP anywhere in your environment, patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. Two critical flaws disclosed last week, CVE-2026-109618 and CVE-2026-109619 (nicknamed "PHP2Shell"), let an unauthenticated attacker run code on a server with nothing more than a crafted web request. Both carry a CVSS v4.0 score of 9.2, every earlier release is a...
Copy Link: https://www.theregister.com/security/2026/10/26/partner-content-no-login-no-app-code-no-warning-what-next/5305336   
Published: 2026 10 26 08:00:00
Received: 2026 11 05 17:19:19
Feed: The Register - Security
Source: The Register - Security
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Change Over Time (Extended)