One event. Every artifact.

2026-018: Critical Vulnerabilities in PHP

On 20 October 2026, the PHP project announced an upcoming security release addressing two critical vulnerabilities in PHP. Public reports indicated that these vulnerabilities could lead to remote code execution (RCE). The PHP team released the fixes today, 21 October 2026 at 13:30 UTC, in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities can allow unauthenticated remote code execution. Technical details are now being discussed publicly, and initial proofs of concept (PoCs) have begun to circulate. This raises the likelihood that attackers are already exploiting the vulnerabilities. [New] On 23 October, PHP disclosed a new RCE vulnerability. However, it affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. PHP will not issue an

2026-019: Critical Vulnerability in GitLab Community and Enterprise Editions

On 21 October 2026, GitLab published a security advisory addressing several vulnerabilities among which a critical flaw that could allow an unauthenticated user to execute arbitrary code on a GitLab server. CERT-EU recommends organisations to update affected assets as soon as possible, prioritising internet facing assets, and to run an assessment to identify compromised assets.

GDPR Enforcement Tracker

List and overview of fines and penalties under the General Data Protection Regulation (GDPR). Searchable database of 3417 enforcement actions across the EU and EEA.

Search Data Security Breaches

This Google™ translation feature is provided for informational purposes only.

Sigma - Generic Signature Format for SIEM Systems

Main Sigma Rule Repository. Contribute to SigmaHQ/sigma development by creating an account on GitHub.

Nuclei Templates

Community curated list of templates for the nuclei engine to find security vulnerabilities. - projectdiscovery/nuclei-templates

Exploits + Shellcode + GHDB

exploitdb // The official Exploit-Database repository

CVE-1999-0095 cve@mitre.org 1988-10-01T04:00:00.000 2026-06-16T21:47:34.460 Modified en The debug command in Sendmail is enabled, allowing attackers to execute commands as root. cve@mitre.org n/a n/a n/a affected nvd@nist.gov Primary 2.0 AV:N/AC:L/Au:N/C:C/I:C/A:C 10 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE HIGH 10 10 false true false false false nvd@nist.gov Primary en NVD-CWE-Other OR false true cpe:2.3:a:eric_allman:sendmail:5.58:*:*:*:*:*:*:* 1D07F493-9C8D-44A4-8652-F28B46CBA27C http://se

CVE-1999-0082 cve@mitre.org 1988-11-11T05:00:00.000 2026-06-16T21:47:32.300 Modified en CWD ~root command in ftpd allows root access. cve@mitre.org n/a n/a n/a affected nvd@nist.gov Primary 2.0 AV:N/AC:L/Au:N/C:C/I:C/A:C 10 NETWORK LOW NONE COMPLETE COMPLETE COMPLETE HIGH 10 10 false true false false false nvd@nist.gov Primary en NVD-CWE-Other OR false true cpe:2.3:a:ftp:ftp:*:*:*:*:*:*:*:* 30D7F58F-4C55-4D19-984C-79B6C9525BEB http://www.alw.nih.gov/Security/Docs/admin-guide-to-cracking.101.html

ATT&CK® STIX Data

STIX data representing MITRE ATT&CK. Contribute to mitre-attack/attack-stix-data development by creating an account on GitHub.

GitHub - github/advisory-database: Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software. · GitHub

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software. - github/advisory-database

CVE List V5

CVE cache of the official CVE List in CVE JSON 5 format - CVEProject/cvelistV5

Useful Work Can Increase Energy Use: Demand Elasticity and Proof of Useful Work

arXiv:2611.13131v1 Announce Type: new Abstract: A serious criticism of Bitcoin's Proof-of-Work is its enormous electricity consumption. Proof-of-Useful-Work (PoUW), introduced by Ball, Rosen, Sabin, and Vasudevan (2017), in which mining performs useful computations, was suggested as an alternative to reduce electricity expenditure, with matrix multiplication (MatMul) as a recent concrete instantiation by Komargodski and Weinstein (2026). Perhaps surprisingly, we show that switching to PoUW may increase the total electricity consumption, echoing Jevons' paradox. Intuitively, the PoUW mechanism acts as a subsidy that lowers the effective price of the useful work. Recall that demand is elastic if a discount of x percent in the price leads to an increase of more than x percent in the quantity

Splitting for Stability: a Modified Reward Scheme for Transaction-Fee-Only Regimes

arXiv:2611.13252v1 Announce Type: new Abstract: As Bitcoin's block subsidy declines over time, miner revenue will come to depend increasingly on transaction fees. In fee-dominated regimes, winner-take-all reward structures can create incentives for undercutting and fork-based mining strategies, leading to instability and reduced transaction throughput. To prevent this instability, we propose a reward-splitting mechanism in which the winning block producer receives an $\alpha$-portion of the block reward, while the rest is distributed among other miners; this incentivizes mining on previous blocks with higher rewards, while preserving the incentive to produce blocks with high rewards. We evaluate the proposed reward structure through analysis and simulation. Our analysis derives a local pro

Google Brotli Unchecked Return Value Vulnerability

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

ISC Stormcast For Wednesday, November 11th, 2026 https://isc.sans.edu/podcastdetail/10174, (Wed, Nov 11th)

СберСпасибо (SberSpasibo) - 3,288,711 breached accounts

In March 2023, data allegedly taken from СберСпасибо (SberSpasibo), the loyalty program of Russian bank Сбербанк (Sberbank), was published online. The data contained records relating to 48M users, including 3.3M unique email addresses alongside phone numbers and dates of birth. Data also included bank card numbers stored as unsalted SHA-1 hashes, plus loyalty program details such as membership dates and the redemption of bonus points for partner offers.

[N0n]

data collaboration and identity resolution · United States | identity graph feeds of 39055 files and 2.2 terabytes delivered to the organization, dated October 2026; 1,006 per client audience delivery files of 220.5 gigabytes across purchase, OTT, demographics and predictive segments; 19.2 million hashed email identities in those audiences resolved to named individuals; device refinement feeds and daily compliance opt out feeds, October 2026 | [NOT PAID — EXPOSED]

[N0n]

digital sports entertainment and gaming · United States | 6.3 million mobile device advertising identifiers across three gaming audiences of a digital sports entertainment company, 2020; 7.4 million hashed consumer email addresses across two gaming audiences, 2020, of which 2,886,388 resolved to named individuals; Campaign demographic analytics for a November 2019 campaign: age, gender, language, handset, carrier and app profiles across 11,421 devices, 88.4% male | [NOT PAID — EXPOSED]

[medusalocker]

DSV provides logistics, transportation, and supply chain services, including sea, air, and road freight as well as warehousing and customs services.

US Army member arrested in UK over allegations of spying for Russia

The unnamed soldier was arrested by British counterterrorism police “working closely” with U.S. authorities, including the FBI and the military, the Metropolitan Police said in a statement.

US Army member arrested in UK over allegations of spying for Russia

The unnamed soldier was arrested by British counterterrorism police “working closely” with U.S. authorities, including the FBI and the military, the Metropolitan Police said in a statement.

Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row

An exploited Outlook vulnerability drew most of the attention in Microsoft's latest Patch Tuesday, which listed 1,093 bugs total.

Microsoft’s Patch Tuesday surpasses 1,000 bugs for second month in a row

An exploited Outlook vulnerability drew most of the attention in Microsoft's latest Patch Tuesday, which listed 1,093 bugs total.

[bravox]

Workforce Development, Vocational Training and Employment Solutions.

[Dark Project]

About MTM&O Gold Refinery DMCC MTM&O Gold Refinery DMCC is one of the largest refineries in the region and is a leader in terms of customer service, reliability, efficiency and quality. As a result of a hacker attack on one of the region’s largest gold refineries, documents were stolen. These included employee passports and other documents, as well as the company’s know-how and technologies, and confidential information totaling more than 43 GB.

[Dark Project]

About Bear Valley Community Hospital Bear Valley Community Healthcare District offers a wide range of emergency medical and healthcare services in Big Bear Valley, including urgent care, family health, and specialized medical treatments. Their services encompass various fields such as cardiology, behavioral health, rehabilitation, and dental care, catering to patients of all ages. The organization aims to provide high-quality healthcare regardless of insurance status, ensuring accessibility for the community. A Bear Valley Community Hospital suffered a cyberattack leading to the theft of over 400 GB of sensitive data. As a result of the data breach, employee data, the company’s confidential financial information, bank documents, patients’ personal documents, Social Security numbers, medica

[play]

United States

[play]

United States

[play]

United States