A survey of 700 IT and security leaders, published by Imprivata and the FIDO Alliance, finds that login friction delays care, production and deliveries. Workarounds and AI-assisted impersonation add risk, while passwordless adoption lags.
EasyDMARC, the Email Trust Platform, has entered a strategic partnership with certificate authority GMO GlobalSign. Customers can now pair DMARC-based email authentication with certificates that put a verified logo in the inbox.
Microsoft will begin rolling out AI-powered phishing detection in Teams in early November 2026. It reads conversation context to flag suspicious behavior, especially in first-contact chats from outside an organization.
Researchers at Eye Security remotely shut down the vulnerable updater in the abandoned Time4Popcorn app, a Popcorn Time fork. The flaw, CVE-2026-30612, could have let attackers run code with top-level privileges on millions of machines.
The PHP security team has published a stopgap for a remote code execution vulnerability that has no patch yet. It affects only unusual configurations, but the PHP2Shell flaws are already drawing attack attempts.
GitLab has shipped security updates for CVE-2026-110264, a maximum-severity vulnerability in its Regular Expression Compiler that could let attackers run code on a server. Self-managed instances need the patch right away.
Two remote code execution bugs in the Linux kernel's built-in SMB server, KSMBD, carry 9.0 ratings from Trend Micro's Zero Day Initiative. Neither has a named fix in the mainline kernel.
Claims that AI agents are operating inside customer accounts at Morgan Stanley, Bank of America, JPMorgan Chase and Wells Fargo have not been verified. They still expose a real cybersecurity gap in how banks handle automated access.
Arista Networks has issued a security patch for CVE-2026-114625, a critical zero-day in VeloCloud Orchestrator On-Prem that attackers are already exploiting. The company has published indicators, mitigation steps and two IP addresses to block.
Zeabur will wind down its platform between December 1 and December 31, 2026, after a second breach in one year. Bluesky, PingCAP, Andromeda and Genesys also confirmed security incidents.
FileJump is selling a 2TB lifetime plan for a one-time $59, down from $467. The cloud storage service offers optional zero-knowledge encryption and browser-based editing through OnlyOffice.
Attackers broke into LiteLLM's release pipeline on October 21 and published version 1.107.0 to PyPI and Docker registries with a credential-stealing payload. Maintainers have pulled the packages and urge affected users to rotate every exposed secret.
