InfoSecBulletin Cybersecurity for mankind
A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a website’s source code.
An examination of the text input fields in web browsers revealed that the coarse-grained permission model underpinning Chrome extensions violates the principles of least privilege and complete mediation.
Daily Cyber security update for 24. 10. 2026
By infosecbulletin
/ Saturday , October 24 2026
Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...
Read More
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
By infosecbulletin
/ Friday , October 23 2026
The PHP security team shared ways to protect against a new flaw that lets someone run unwanted code on certain...
Read More
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
By infosecbulletin
/ Friday , October 23 2026
Major US banks have detected unauthorized access to customer accounts by third-party AI agents, with some systems taking actions beyond...
Read More
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
By infosecbulletin
/ Thursday , October 22 2026
Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated...
Read More
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
By infosecbulletin
/ Wednesday , October 21 2026
Hacker offers to sell Rajasthan Government’s Department of Information Technology & Communication (DoIT&C) data in a underground forum. The threat...
Read More
Update now! PHP2Shell: Critical PHP vulnerabilities patched
By infosecbulletin
/ Wednesday , October 21 2026
The PHP team released urgent security updates to fix PHP2Shell, two serious flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run...
Read More
Trump says data centres should pay dividends to local community
By infosecbulletin
/ Wednesday , October 21 2026
US President Donald Trump said on Wednesday that companies building data centers should pay a "dividend" to the communities where...
Read More
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
By infosecbulletin
/ Tuesday , October 20 2026
Ransomware groups are using a flaw in Palo Alto Networks GlobalProtect VPN to get around multi-factor authentication and access corporate...
Read More
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
By infosecbulletin
/ Tuesday , October 20 2026
The U.S. Department of Homeland Security (DHS) ordered federal agencies to stop using DeepSeek products and remove it from all...
Read More
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
By infosecbulletin
/ Monday , October 19 2026
NSA, CISA, and NIST have released security guidelines to find, control, and stop AI agents that go beyond their allowed...
Read More
Additionally, the researchers found that numerous websites with millions of visitors, including some Google and Cloudflare portals, store passwords in plaintext within the HTML source code of their web pages, allowing extensions to retrieve them.
Click to read full report.
