What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,636 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
EFF’s State Legislative Agenda to End ALPR Mass Surveillance
Police agencies across the U.S. have deployed Automated License Plate Readers (ALPRs) to capture images of passing vehicles along with time, date, and GPS coordinates. While the technology itself isn’t new (ALPRs have existed in v…
-
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Protections have been added against scams and social engineering, including new site warnings and server-side Gemini analysis. The post Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections appeared first on Se…
-
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and one GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal coding tasks. The AI company …
-
OpenAI agents disabled safety monitoring, one lied about it
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. [...]
-
‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets
Deceptive prompts lure AI agents into decoys and dead ends, cutting attack success by up to 91% in tests and raising the cost of a successful attack 23-fold. The post ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With…
-
ClickFix has never been bigger, and AI tools are its most convincing lure yet
ClickFix attacks are surging as cybercriminals use fake AI installers, malicious search results, and trusted chatbot platforms to trick users into executing malware. Push Security examines how these attacks evade traditional defen…
-
AI Guardrails Aren’t Stopping Criminal Hackers
Hackers around the world are all-in on using agentic AI to wage attacks—and manipulating tools like Anthropic’s Claude to help them carry out their crimes.
-
NVIDIA unveils security architecture that can stop AI agents crossing set boundaries
NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. It builds on NVIDIA’s existing OpenShell security software, combini…
-
Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security
Asymptote Labs raises $5.5M seed led by Tower Research Ventures to commercialize its Beacon AI agent runtime security platform. The post Asymptote Labs Lands $5.5 Million Seed for AI Agent Runtime Security appeared first on Securi…
-
The Best Cybersecurity Lies In Artificial Intelligence
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 21, 2026 – Read the Full Story in Fast Company Cybersecurity Ventures estimated that global cybercrime costs hit $10.5 trillion in 2025, a…
-
A Design Flaw in Share Links Exposes Users’ Personal Conversations With Meta’s Muse
The company is suspending the feature after security researchers discovered how easy it was to access sensitive information shared with the AI assistant.
-
OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
In two internal incidents, agents read routine coding instructions as permission to weaken monitoring, and one gave a false answer about it. The post OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor appear…
-
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports
Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized, and unique to each recipient, and…
-
China Defends DeepSeek After US Ban of Its AI From Government Systems
The DHS said agencies should remove DeepSeek products as well as third-party products and services developed using DeepSeek from their IT systems. The post China Defends DeepSeek After US Ban of Its AI From Government Systems appe…
-
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth ac…
-
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Tasked with writing an application for a US defense contractor, the model made the code 19% more likely to be hackable. The post Chinese AI Model Writes More Hackable Code When Told It s for US Contractor appeared first on Securit…
-
Grafana Labs connects observability and incident response with Knowledge Graph
Grafana Labs has announced a Knowledge Graph in every Grafana Cloud stack, alongside new Digital Experience Monitoring capabilities and updates to Grafana Cloud Incident Response Management (IRM). The releases connect infrastructu…
-
ThreatLocker adds external controls for AI agent access and execution
ThreatLocker has announced the launch of Zero Trust AI Control (ZTAIC), giving organizations a tool to deploy agentic AI without surrendering control of their environments. ZTAIC enables security teams to give AI agents exactly wh…
-
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations," under a Department of Homeland Sec…
-
Privacy-preserving AI can protect your heart data, the bill is the problem
A heart monitor used to be a box beside a hospital bed. Electrodes fed a cable, the cable fed a screen, and a nurse watched the screen. The threat model fit on a sticky note. Cardiac care doesn t work like that anymore. A patch or…
-
Bringing AI into the SOC means watching for shadow AI and loose permissions
In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools. He explains how LLMs help with vulnerability analysis and detection…
-
Google open-sourced TorchTPU, so PyTorch on TPUs just got a lot easier
Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units. Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan train…
-
Battle Drones - a vibe coded RTS with audio-based multiplayer
My latest vibe coded game experiment is a Command Conquer style RTS (Real Time Strategy) game called Battle Drones ( play it here ). Unlike my previous experiments , this one is actually fun to play . I'm somewhat embarrassed to a…
-
Ex-OpenAI Engineer Held Over Secret Recorder, Saudi Ties
A judge ordered that Abdulrahman Alfozan be detained after he was arrested earlier this month for allegedly bugging an OpenAI conference room.
-
When a platform offers you privacy, always ask Privacy from whom? Of course, while locking a chat can limit ac…
When a platform offers you privacy, always ask Privacy from whom? Of course, while locking a chat can limit access, it doesn’t address concerns about how sensitive information is stored or handled...locking a chat doesn’t create e…
-
OpenAI says GPT-6.1 Sol is dramatically better at migrating legacy code
OpenAI confirmed that its newer models are much better at writing and migrating software in older programming languages. [...]
-
US Agencies Detail Incident Response Practices for Rogue AI Agents
NIST, CISA and NSA share ten voluntary practices for preparing for, detecting, responding to, recovering from, and reporting rogue AI agent incidents. The post US Agencies Detail Incident Response Practices for Rogue AI Agents app…
-
Close Identity Gaps in Software Development Before Unleashing AI
Artificial Intelligence is complicating security in the software development lifecycle, but a Dark Reading roundtable found collaboration, better identity visibility, and reduced testing costs offer CISOs a way ahead.
-
Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree
A Chinese-speaking attacker has compromised hundreds of websites across the globe, looting from big fish like John Deere, SharkNinja, and engine manufacturer Cummins.
-
AI security hiring focuses on red-teaming, SOC orchestration and governance
Roles mitigating AI deepfakes and overseeing post-quantum encryption rollouts are on the horizon, according to a new report.
-
The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations
Key Findings Introduction Antidetect browsers conceal their users’ digital identities, enabling a single operator or small team to simultaneously run thousands of isolated accounts across multiple platforms such as Facebook, Insta…
-
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the intern…
-
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. The post The Key to AI Software Security Isn’t Speed, It’s Maturity appeared first on SecurityWeek .
-
Abstract links automated response actions directly to SIEM detection rules
Abstract has announced new AI SOC capabilities in its agentic SIEM: investigation, hunt, and triage powered by a combination of Abstract s own trained and tuned models and frontier foundation models, and SOAR response capabilities…
-
ThreatModeler NexusAI tracks architectural changes and proposes security updates
ThreatModeler has announced the launch of NexusAI, its new AI-powered threat modeling partner within the ThreatModeler Nexus platform. NexusAI helps enterprises automate more of the work involved in creating, analyzing, and mainta…
-
IDENTOS PolicyArc gives AI agents task-specific, time-limited access
IDENTOS has announced that PolicyArc is now generally available. The new solution gives security, platform, and compliance teams a single place to define, enforce, and audit access policy across their applications. PolicyArc is bu…
-
AI Platform Cairn Abused to Hack Over 100 Organizations
At least three threat actors have been abusing Cairn for persistent access and financial theft. The post AI Platform Cairn Abused to Hack Over 100 Organizations appeared first on SecurityWeek .
-
Ex-OpenAI Worker Accused of Bugging Conference Room Planned to Fly to Saudi Arabia, Prosecutors Say
Abdulrahman Alfozan’s wife and young son also left the country the day after the 35-year-old Saudi national’s arrest. The post Ex-OpenAI Worker Accused of Bugging Conference Room Planned to Fly to Saudi Arabia, Prosecutors Say app…
-
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators
WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privac…
-
What Security Teams Can Do To Tame Wild Code
A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes par…
-
Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
Microsoft says companies should treat AI agents as insiders, and is adding controls that grant access per task and tighten it as an agent’s risk rises. The post Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scor…
-
Teradata expands AI data security with post-quantum protection and immutable backups
Teradata has announced new privacy, security, and resiliency capabilities designed to address one of the defining challenges of enterprise AI: how sensitive data is protected, who and what can access it, and whether it remains ava…
-
Extend Verify helps AI agents flag suspicious documents before acting
Extend has announced Extend Verify, a document fraud detection API that helps developers and AI agents assess the integrity of documents before using them to make decisions. Much of the work businesses want AI agents to perform be…
-
US Army is developing AI agents that could strike enemy networks and vanish without a trace
The US Army is looking for AI agents that can slip into an adversary s network, find their target, copy themselves onto nearby tablets and computers, and then erase themselves before anyone notices. Over the past few months, AI ag…
-
Microsoft wants to limit AI agents’ permissions when they stray from the job
Microsoft’s Guardian Agents in Project Perception adapt as agent activity, risk, security context and organizational policy change. They help security teams understand why risk changed, investigate relevant evidence, recommend or …
-
Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge
A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensit…
-
DataMasque makes Asia Pacific inroads with ‘synthetically identical’ data copies
New Zealand-founded DataMasque is making inroads in the Asia Pacific (APAC) market with technology which swaps real data for ‘synthetically identical’ copies to train AI tools. The sensitive data discovery and masking platform has…
-
Cloudflare bets you’re overpaying an LLM to read your invoices
Cloudflare released a preview of Clairic, an extraction model that pulls typed values out of messy text and images in one pass without generating tokens. In Cloudflare’s test on a damaged-product support claim, a pipeline built ar…
-
Meta’s new commercial terms say if its AI makes a mistake, it will legally be the customer’s fault
In Meta commercial terms changes slated to kick in on 30 October, the company will shift the liability for any mistakes made by its AI models to its enterprise customers. The new language also makes those IT executives responsible…
-
Gentrack secures billing software contract with Australia’s Momentum Energy
Listed utility software developer Gentrack Group has secured a contract with Australian gas and electricity retailer Momentum Energy for its cloud-based g2 billing offering. In a statement released to both New Zealand’s Stock Exch…
Last fetch 1m ago · 0 new · 1 source error(s)