What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,636 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
Hitachi Vantara hires Yasser Elgammal to lead A/NZ channel
Hitachi Vantara has appointed former Dicker Data sales and vendor alliances head Yasser Elgammal as its channel partner and alliances director for Australia and New Zealand (A/NZ). In the new position, Elgammal will be responsible…
-
SnapperNet welcomes launch of Sophos ‘shadow AI’ detection tool
A newly introduced security tool from Sophos which uncovers shadow AI use offers IT partners a practical opportunity to help their customers adopt AI with greater confidence, says local distributor SnapperNet. Sophos AI Defense wa…
-
OpenAI Engineer Accused of Spying on Executives Ordered to Remain in Custody
A judge ordered Abdulrahman Alfozan to remain in custody, likening the Saudi government’s offer to secure the former OpenAI engineer’s release to a “blank check.”
-
OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. [...]
-
Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls. The new privileged user in your environment Security teams spent two decades learning how t…
-
Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness
Nearly half of corporate directors think board members need cybersecurity expertise, a new survey found.
-
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already …
-
Inside the Underground Market for Know Your Client Services
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques us…
-
Axonius AI Workforce pairs asset intelligence with automated action
Axonius has announced Axonius AI Workforce, the latest expansion of Axonius AI. It enables organizations to deploy teams of Virtual Workers that monitor their environments, identify high-risk exposures and assets that deviate from…
-
STOP hyperventilating about AI doing something “at machine speed.” 😱 ALL SOFTWARE RUNS AT MACHINE SPEED. IT AL…
STOP hyperventilating about AI doing something “at machine speed.” 😱 ALL SOFTWARE RUNS AT MACHINE SPEED. IT ALWAYS HAS. THAT’S WHAT AUTOMATION *IS*.
-
Microsoft fixes classic Outlook bug that hid Copilot buttons
Microsoft has fixed a known issue that removed the Copilot Chat and Copilot buttons in the classic Outlook desktop mail client for some Windows users. [...]
-
With open-weight AI, more of the security burden falls on enterprises
Organizations that run open-weight AI models on their own infrastructure may have to supply safety and security controls that an AI provider would otherwise handle for them, Microsoft and NVIDIA warn in a joint paper on managing t…
-
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic C…
-
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics. The post MITRE ATT CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks appeared first on SecurityWeek .
-
Anthropic Acquires Confidential AI Startup Opaque Systems
Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardware. The post Anthropic Acquires Confidential AI Startup Opaque Systems appeared first on SecurityWe…
-
Weekly Update 526: Building HIBP AI/SI First
I have this sense that we ve passed the point where vibe coding is a derogatory term. I have no empirical evidence for this; it s more a feeling that those weaponising the term have now accepted the inevitability and are just gett…
-
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted ser…
-
Half the AI bot traffic hammering your website comes from Meta
AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between Septemb…
-
Sysdoc’s Serendata lands global partnership with SAP to address ‘transformation spaghetti’
Serendata, the technology platform arm of New Zealand-founded Sysdoc, has secured a global strategic partnership with SAP to integrate the vendor’s Signavio suite into its transformation platform. Combining SAP Signavio’s suite of…
-
llm-tools-datasette 0.1.1
Release: llm-tools-datasette 0.1.1 When I switched LLM over to httpx2 in LLM 0.33 I forget that this would break any plugins which used https without directly depending on it. llm-tools-datasette was one of those plugins, now fixe…
-
llm-echo 0.5
Release: llm-echo 0.5 I'm working towards a new LLM release, and testing PRs caused me to revisit the llm-echo debug plugin. This plugin provides a "model" which doesn't involve an LLM at all - it just repeats back the prompts tha…
-
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
CyberSN’s Cybersecurity Jobs Report provides visibility into the US cybersecurity job market. It’s a mixed bag. The post US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars appeared first on SecurityWeek .
-
Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Strands Box: Open-source sandbox for AI agents AWS released Strands Box, an open source sandbox for AI agents that pairs operating-s…
-
Federal agencies recommend cyber controls, independent testing for frontier AI systems
While voluntary, the document marks the federal government’s most detailed cybersecurity guidance for securing sandbox environments during AI model tests. The post Federal agencies recommend cyber controls, independent testing for…
-
Quoting Addy Osmani, Morgan Westlee Lunt, and Qing Wang
We think "did a human read the code?" is an imprecise proxy for "what could go wrong with this change, and which check—automated or human—is the right one to catch it?" Asking that question also changed when review happens. Before…
-
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.
-
Enterprise AI Enters Risk Management Phase as Security Concerns Rise
Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.
-
AI Takes Control of Robotic Arm in 16 Minutes Flat
Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.
-
If you missed my two day AI Risk Assessment course at Wild West Hackin' Fest in Deadwood last week, I'm teach…
If you missed my two day AI Risk Assessment course at Wild West Hackin' Fest in Deadwood last week, I'm teaching it again in Denver in February and we're offering it virtually too. Hope to see you there! https:// wildwesthackinfe…
-
Managing open-weight model risk in enterprise deployments
New whitepaper from Microsoft and NVIDIA helps enterprises manage open-weight AI model risks with a shared taxonomy, evaluations, and controls. The post Managing open-weight model risk in enterprise deployments appeared first on M…
-
AI data centre capex will far exceed forecast revenue through 2030
Investors are pouring more into AI data centre infrastructure than they can hope to recoup by 2030, according to Gartner. “Enterprise and consumer AI revenue will be insufficient to support profitable returns on all planned AI cap…
-
RE: https:// infosec.exchange/@josephcox/11 7445944739761002 How long does it take for skills to atrophe? I wo…
RE: https:// infosec.exchange/@josephcox/11 7445944739761002 How long does it take for skills to atrophe? I wonder if there are already folks that don't remember how to do their jobs without AI. Or, in extreme cases, can't do thei…
-
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network, spent test c…
-
Employees using personal ChatGPT at work? Here's what IT admins need to do
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and b…
-
When AI Agents Commit Breaches, Humans May Not Be Held Liable
As agents escape containment and access external systems, responsibility remains human. Accountability, however, is much less settled.
-
AI Decision Models and Their Impact on AI SOC Platforms
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its…
-
Backdooring Open-Weight AI Models
This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it s the most…
-
Android adds AI-powered scam alerts, hangs up on bank impostors
Google’s new scam protections cover Google Messages and third-party messaging apps, with an enhanced protection mode, expanded scam alerts and safeguards against call-forwarding and screen-sharing scams. “With scams growing harder…
-
CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents went beyond their a…
-
Stolen AI API keys are paying for hackers’ autonomous scans
A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key s owner pays for the scans. Bitsight s threat intelligence team tracked the shif…
-
New infosec products of the week: October 16, 2026
Here’s a look at the most interesting products from the past week, featuring releases from NinjaOne, Qualys, Scytale, and SolarWinds. NinjaOne combines Katana AI and MCP server to accelerate IT problem resolution NinjaOne has anno…
-
sparqlite: SPARQL 1.1 inside SQLite, written in Rust
Research: sparqlite: SPARQL 1.1 inside SQLite, written in Rust This research task is really an experiment in running Claude Code for web in "Ultracode" mode, as described in Orchestrate subagents at scale with dynamic workflows in…
-
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft. The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure…
-
Proofpoint to buy Varonis for $6.3 billion
The deal pairs the email security giant's massive threat intelligence with Varonis' visibility into corporate data, as both companies race to secure the AI agents now roaming enterprise networks. The post Proofpoint to buy Varonis…
-
AI Slop Isn't Just for Social Media; It's Ruining Cyberattacks, Too
Don't buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it.
-
Android gets AI defenses against messaging scams, fake calls
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
-
Chirp Pong
Tool: Chirp Pong Another game experiment - I wanted to see if it was feasible to have a two player game on two separate phones running in static HTML where the networking code uses chirps sent via the microphone. It seems to work!…
-
The next election influence campaign will target your AI chatbot
Someone is seeding the internet with hyperlocal content about political races. Researchers say it’s designed to train AI chatbots to favor candidates across a broad range of issues. The post The next election influence campaign wi…
-
ChatGPT now lets you target ads based on specific prompts or any phone number or email address. This is absolu…
ChatGPT now lets you target ads based on specific prompts or any phone number or email address. This is absolutely 100% going to be used for harassment. https://www. 404media.co/how-chatgpt-target s-ads-to-you-based-on-your-prompt…
-
ServiceNow gives AI agents a passport, and limits on what they can do
ServiceNow has announced a new AI Passport solution and significant advances in AI governance to help ensure AI agents are production-ready by combining runtime governance, platform integration, and comprehensive oversight, all in…
Last fetch 6m ago · 0 new · 1 source error(s)