Sami Laiho (@samilaiho.com)

Sami Laiho

@samilaiho.com

Keynote-speaker, Chief Research Officer, Microsoft MVP since 2011 More info: https://samilaiho.com/

1.6K followers 184 following4.7K posts

Sami Laiho

@samilaiho.com

enclave.ai/blog/authmas...

enclave.aiEnclave: AuthMask: We Made Microsoft Authenticator Hand Over Tokens to an App With Zero PermissionsHow one exported activity in Microsoft Authenticator let an unprivileged app get tokens for any Microsoft service.

Sami Laiho

@samilaiho.com

Work to protect DNS from quantum decryption attacks is speeding up www.theregister.com/networks/202...

theregister.comWork to protect DNS from quantum decryption attacks is speeding upPLUS: Regional internet registry reform nears; Trustworthy-sounding domains attract scammers

Sami Laiho

@samilaiho.com

'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets www.darkreading.com/cyberattacks...

darkreading.com'Gheist' Weaponizes GitHub Tokens to Steal Cloud SecretsAn ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.

Sami Laiho

@samilaiho.com

PHP2Shell security flaws now sucessfully exploited in the wild www.bleepingcomputer.com/news/securit...

bleepingcomputer.comPHP2Shell security flaws now sucessfully exploited in the wildTwo critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively tracked as PHP2Shell, have been successfully exploited in the wild.

Sami Laiho

@samilaiho.com

CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products URL: security.paloaltonetworks.com/CVE-2026-111... Classification: Critical, Solution: Workaround, Exploit Maturity: Not Defined, CVSSv3.1: 9.2

security.paloaltonetworks.comCVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks ProductsPalo Alto Networks is aware of the vulnerability in Brotli: CVE-2026-111497. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on al...

Sami Laiho

@samilaiho.com

Fortinet: Multiple Node.js CVEs being investigated URL: fortiguard.fortinet.com/psirt/FG-IR-... Classification: Critical, Solution: Unavailable, Exploit Maturity: Not Defined, CVSSv3.1: 9.8

fortiguard.fortinet.comPSIRT | FortiGuard LabsNone

Sami Laiho

@samilaiho.com

AI coding agents hijacked using AGENTS.md file in Downloads folder www.bleepingcomputer.com/news/securit...

agents.mdAGENTS.mdAGENTS.md is a simple, open format for guiding coding agents. Think of it as a README for agents.

Sami Laiho

@samilaiho.com

Oracle Security Alert Advisory - CVE-2026-114820 URL: www.oracle.com/security-ale... Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1

oracle.comoracle.com

Sami Laiho

@samilaiho.com

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot www.bleepingcomputer.com/news/securit...

bleepingcomputer.comBlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure BootA new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere wit...

Sami Laiho

@samilaiho.com

Autonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deeds www.theregister.com/security/202...

theregister.comAutonomous attack agent in 'Skynet mode' hijacks other models to carry out its evil deedsDesigned to carry out 100,000 steps without human approval

Sami Laiho

@samilaiho.com

How new PHP vulnerabilities threaten home users www.kaspersky.com/blog/how-to-...

kaspersky.comHow new PHP vulnerabilities threaten home usersTwo critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) pose a risk to home users and their data. We explain the danger and how to stay protected.

Sami Laiho

@samilaiho.com

Abandoned Popcorn Time app exposed millions of devices to RCE attacks www.bleepingcomputer.com/news/securit...

bleepingcomputer.comAbandoned Popcorn Time app exposed millions of devices to RCE attacksResearchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute...

Sami Laiho

@samilaiho.com

CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud thehackernews.com/2026/10/cisa...

thehackernews.comCISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloudCISA adds exploited Collabora Online and Arista VeloCloud flaws to KEV, with federal agencies directed to patch by October 26.

Sami Laiho

@samilaiho.com

www.bleepingcomputer.com/news/microso... Microsoft says Teams will begin using AI-powered phishing detection in early November 2026 to detect malicious behavior in messages.

bleepingcomputer.comMicrosoft Teams to get AI-powered, context-aware phishing detectionMicrosoft has announced plans to add AI-powered phishing detection to Teams messages starting in early November 2026.

Sami Laiho

@samilaiho.com

Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions thehackernews.com/2026/10/expo...

thehackernews.comExposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute IntrusionsRansomware affiliates used human-approved AI workflows to exploit edge systems, steal data, and target an estimated 62 organizations.

Sami Laiho

@samilaiho.com

Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials thehackernews.com/2026/10/hack...

thehackernews.comHackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 CredentialsA campaign attributed to k0t exploits exposed network devices, establishes persistent access, and exfiltrates data using Rclone.

Sami Laiho

@samilaiho.com

UK threatens subsea cable saboteurs with 14 years behind bars www.theregister.com/networks/202...

theregister.comUK threatens subsea cable saboteurs with 14 years behind barsWhitehall wants tougher penalties and new powers over telecoms operators as Russian activity raises alarm

Sami Laiho

@samilaiho.com

Fortinet Releases Security Hardening Release for Multiple Products URL: www.fortinet.com/blog/ciso-co... Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None

fortinet.comFortinet Releases Security Hardening Release for Multiple Products | CISO CollectiveFortinet announces frontier AI hardening releases for a range of products including FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator.…

Sami Laiho

@samilaiho.com

HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10

Sami Laiho

@samilaiho.com

tolmo.com/blog/faster-...

tolmo.comWe can now find flaws faster than anyone can fix them · TolmoIn 2024 our audit of PHP's core reported two flaws in the exact code behind php2shell and filed one as a crash. Two years later, three teams independently turned the same defect into a working attack ...

Sami Laiho

@samilaiho.com

How likely is successful mass exploitation of PHP2SHELL? www.pwndefend.com/2026/10/21/h...

pwndefend.comHow likely is successful mass exploitation of PHP2SHELL? – PwnDefend

Sami Laiho

@samilaiho.com

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions thehackernews.com/2026/10/node...

thehackernews.comNode.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported VersionsNode.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled data.

Sami Laiho

@samilaiho.com

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk www.theregister.com/security/202...

theregister.comPHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg

Sami Laiho

@samilaiho.com

Arista patches new VeloCloud Orchestrator zero-day exploited in attacks www.bleepingcomputer.com/news/securit...

bleepingcomputer.comArista patches new VeloCloud Orchestrator zero-day exploited in attacksArista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments.

Sami Laiho

@samilaiho.com

The Current Landscape of OAuth Attacks unit42.paloaltonetworks.com/current-land...

unit42.paloaltonetworks.comThe Current Landscape of OAuth AttacksUnit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments.

Sami Laiho

@samilaiho.com

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia securelist.com/uefi-bootkit...

securelist.comNew BlackX UEFI bootkit exploiting Baton DropKaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.

Sami Laiho

@samilaiho.com

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes thehackernews.com/2026/10/two-...

thehackernews.comTwo CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel FixesTwo CVSS 9.0 flaws in Linux KSMBD could enable remote code execution; one needs no authentication, and neither has a mainline fix.

Sami Laiho

@samilaiho.com

TiDB Breach Exposes Flawed Cloud Security Assumptions www.darkreading.com/cloud-securi...

darkreading.comTiDB Breach Exposes Flawed Cloud Security AssumptionsCloud providers may be storing sensitive customer data, without either party knowing it. But when there's a breach, the data comes home to roost.

Sami Laiho

@samilaiho.com

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected www.bleepingcomputer.com/news/securit...

bleepingcomputer.comJapan's Onamae Desktop Cloud hacked, up to 27,000 servers affectedHackers compromised the infrastructure of Onamae Desktop Cloud, a popular provider of VPS services in Japan, and installed malware on up to 26,739 customers' servers.

Sami Laiho

@samilaiho.com

CISA Releases 20 Industrial Control Systems Advisories URL: www.cisa.gov/news-events/... Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 10.0

cisa.govcisa.gov

Sami Laiho

@samilaiho.com

LiteLLM supply chain attack hoovers up passwords and secrets www.theregister.com/security/202...

theregister.comLiteLLM supply chain attack hoovers up passwords and secretsPlus a RAT for good measure - get threat hunting now

Sami Laiho

@samilaiho.com

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections thehackernews.com/2026/10/atta...

thehackernews.comAttackers Hijacked Over 300 Tor Exit Relays to Intercept SSH ConnectionsAttackers hijacked over 300 Tor exit relays to intercept SSH connections and steal passwords from users who accepted changed host keys.

Sami Laiho

@samilaiho.com

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise www.microsoft.com/en-us/securi...

microsoft.comAI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | Microsoft Security BlogStorm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.

Sami Laiho

@samilaiho.com

Operation FlashHole: Lazarus breaks security, defies control securelist.com/lazarus-oper...

securelist.comDissecting Operation FlashHole, a complex attack by LazarusKaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security softw...

Sami Laiho

@samilaiho.com

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet www.wiz.io/blog/php2she...

wiz.ioPHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz BlogCore PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

Sami Laiho

@samilaiho.com

Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products URL: security.paloaltonetworks.com/CVE-2026-109... Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.2

security.paloaltonetworks.comCVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks ProductsPalo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory er...

Sami Laiho

@samilaiho.com

GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 URL: docs.gitlab.com/releases/pat... Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None

docs.gitlab.comGitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 | GitLab DocsLearn more about GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 for GitLab Community Edition (CE) and Enterprise Edition (EE).

Sami Laiho

@samilaiho.com

Trump Appointees Asked a Federal Cybersecurity Agency to Secretly Acquire a Voting Machine — and Hack It www.propublica.org/article/cisa...

propublica.orgTrump Appointees Asked a Federal Cybersecurity Agency to Secretly Acquire a Voting Machine — and Hack ItThough not acted on, the request shows how the Trump administration has tried to use the Cybersecurity and Infrastructure Security Agency for its own ends while draining it of resources to help its mi...

Sami Laiho

@samilaiho.com

Defense contractors in two NATO allies hacked in recent Russia-linked campaign therecord.media/european-def...

therecord.mediaDefense contractors in two NATO allies hacked in recent Russia-linked campaignThe Russian group known as APT28 and Fancy Bear used a recently documented backdoor to dwell in the networks of two defense contractors and a law enforcement agency in two NATO allies, researchers sai...

Sami Laiho

@samilaiho.com

Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys www.darkreading.com/cyber-risk/t... "The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237."

darkreading.comTech Giants Block eMudhra Certificates Tied to 8 Compromised KeysGoogle, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian certificate authority (CA).

Sami Laiho

@samilaiho.com

ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform www.forescout.com/blog/romulus...

forescout.comROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform - ForescoutThreat hunting researchers at Forescout’s Vedere Labs uncover a new multi-payload ClickFix delivery platform. See how it works and how to detect.

Sami Laiho

@samilaiho.com

ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan thehackernews.com/2026/10/clic...

thehackernews.comClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access TrojanSiemens patched a DLL sideloading flaw in Software Center exploited in ClickFix attacks to execute malicious code through a trusted application.

Sami Laiho

@samilaiho.com

Nikkei discloses third data breach in a month, 1.8M records exposed www.bleepingcomputer.com/news/securit...

bleepingcomputer.comNikkei discloses third data breach in a month, 1.8M records exposedNikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records.

Sami Laiho

@samilaiho.com

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA thehackernews.com/2026/10/qili...

thehackernews.comQilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFAQilin and INC ransomware actors continue exploiting a patched Palo Alto Networks flaw to gain network access, bypass MFA, and establish VPN sessions.

Sami Laiho

@samilaiho.com

There's only so much code: the rise in vulnerability numbers blog.talosintelligence.com/theres-only-...

blog.talosintelligence.comThere's only so much code: the rise in vulnerability numbersThe September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase i...

Sami Laiho

@samilaiho.com

www.php.net/archive/2026... Critical alert

php.netPHP: News Archive - 2026PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

Sami Laiho

@samilaiho.com

Google Chrome Releases Stable Channel Update for Desktop URL: chromereleases.googleblog.com/2026/10/stab... Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None

chromereleases.googleblog.comStable Channel Update for DesktopThe Chrome team is delighted to announce the promotion of Chrome 156 to the stable channel for Windows, Mac and Linux. This will roll out ...

Sami Laiho

@samilaiho.com

Oracle Critical Patch Update Advisory - October 2026 URL: www.oracle.com/security-ale... Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 10.0

oracle.comoracle.com

Sami Laiho

@samilaiho.com

emudhra.we-have-a-problem.com eMudhra Intermediate CA Compromise

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

Sami Laiho

@samilaiho.com

www.neowin.net/news/microso...

neowin.netneowin.net