What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,641 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 3d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 3d ago
-
Adventures in LLM-land: I was Googling for an abstract to a previous talk of mine, and decided to let Gemini g…
Adventures in LLM-land: I was Googling for an abstract to a previous talk of mine, and decided to let Gemini give it a shot since I wasn’t finding it. It couldn’t find it either, but offered to summarize the talk and give me the m…
-
A new feature for my blog, built using my voice
I shipped a new feature for my blog today: the Newsletters page, which offers an index of all of the newsletters I've sent out, both my free weekly Substack and my monthly sponsors-only updates. I built the feature almost entirely…
-
Advantage 26: The Trusted Mission Data Summit. Oct. 21, 2026. Reston, Virginia
Sausalito, Calif. – Oct. 9, 2026 – Hosted by Everfox. REGISTER NOW Join senior government, defense, and industry leaders for a day exploring how trusted mission data and operational AI are transforming national security. REGISTER …
-
Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI). "It's an opt-in service informed by our experience using Claude to find vul…
-
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Noteworthy stories that might have slipped under the radar: Tensorlake npm SDK compromised, Empire Market co-founder gets 40 years, exposed NVIDIA GPU monitors leak telemetry. The post In Other News: AI Used in Korean Bank Breache…
-
As frontier models go rogue, colleges beef up AI cybersecurity education
Student interest in AI safety is surging, and schools are rushing to prepare for new career paths.
-
The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition
As enterprises race to deploy autonomous AI agents to accelerate business, a new report reveals they are tethered to security architectures built for a different era. The "Horizons of Identity Security" report from SailPoint highl…
-
Anthropic offers free AI security scans to open-source maintainers
Anthropic’s OSS Scanner is a new, free service that uses the company’s strongest AI models to find security vulnerabilities in open-source software. Maintainers who opt in receive periodic scans and reports explaining suspected fl…
-
Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security
OSS Scanner sends unreviewed, model-generated vulnerability reports to open source maintainers that opt in. The post Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security appeared first on Security…
-
Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own
$1.2 million was paid out at Pwn2Own Ireland 2026 for exploits targeting phones, printers, smart speakers, smart home hubs, and AI infrastructure and coding tools. The post Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2O…
-
Datacom spends $500k a month on AI coding, but focusses on outcomes not token costs
Datacom has revealed it has close to a thousand people coding with a variety of AI tools every day – and is already spending about half a million dollars a month on tokens. However, the company is looking to count the outcomes fro…
-
PCI SSC calls for human approval of AI agent actions involving cardholder data
The PCI Security Standards Council (PCI SSC) has published Security Considerations for AI Systems, guidance covering the protection of data supplied to AI systems in payment environments and defenses against AI-assisted attacks. D…
-
Companies want autonomous IT operations but hesitate to let AI act alone
Ninety percent of companies want to move toward autonomous IT operations over the next two years, with agentic AI, software that plans and carries out multi-step tasks on its own, doing the work. Yet 77 percent say their own organ…
-
Formula Predicts When AI Chatbots Are at Risk of Turning Bad
Researchers from George Washington University have published a paper examining whether the time and cause of AI going rogue can be predicted. The post Formula Predicts When AI Chatbots Are at Risk of Turning Bad appeared first on …
-
ttok 1.0
Release: ttok 1.0 I released ttok 0.4 , ran uv tool upgrade ttok , piped a file into the new version... and realized that it was defaulting to the GPT-4 tokenizer when it should very clearly default to GPT-5/GPT-6 instead! I figur…
-
ttok 0.4
Release: ttok 0.4 ttok is my CLI tool for counting tokens, using OpenAI's open source tiktoken library. It hasn't been in updated in a couple of years, but I finally fixed a Click warning, updated CI, and added a --list-models com…
-
Local GTIA chapter a chance for NZ tech to connect to the world
The creation of the first Auckland chapter of the Global Technology Industry Association (GTIA) comes at an opportune time for the local channel as AI is set to change the sector and the wider economy. This was the message deliver…
-
Another example of the ways in which misbehaving agents have affected the digital commons and some thoughts ab…
Another example of the ways in which misbehaving agents have affected the digital commons and some thoughts about what should be done about it. While OpenAI admits to agents behaving 'unpredictably', they must also acknowledge the…
-
Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
The critical infrastructure defense program will seek to pair Claude models, Anthropic engineers and threat research with the expertise of cybersecurity companies. The post Anthropic rolls out program for ‘long-term commitment’ to…
-
Quoting Carson Gross
Computer programming is, fundamentally, about two things: Problem-solving using computers Learning to control complexity while solving these problems I have a hard time imagining a future where knowing how to solve problems with c…
-
Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal
The proposed sale would include about 100 million emails, 500 million Microsoft Teams messages, employment contracts, employee and timecard records and payroll and tax information, Rep. Steven Horsford (D-NV) said in a press relea…
-
Going live with @ darkreading on a panel about detecting and thwarting adversarial AI - join us here! https://…
Going live with @ darkreading on a panel about detecting and thwarting adversarial AI - join us here! https:// event.on24.com/wcc/r/5516670/0 FDD7CC45A6574BCF1982DCC45B9261A
-
OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media
The two campaigns were rated 4 and 5 out of 6 for severity, the first time OpenAI has reported what it considers a high-impact influence campaigns. The post OpenAI says Iran, Russia used AI journalists, think tanks to influence We…
-
It's DAF Day! Wait...What's a DAF?
Today is DAF Day! This event highlights the millions of donor-advised funds (DAFs) people have set up to make charitable donations and change the world. If you have a DAF, consider supporting EFF today. Decisions about your privac…
-
[Virtual Event] Building a Secure AI Strategy for the Enterprise
-
What the C-suite needs to know about AI governance
As AI adoption surges, executives are learning tough lessons about security, oversight and accountability.
-
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, p…
-
OAuth grants pile up faster than you can review them. Here's how to keep up.
OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting…
-
Microsoft Teams to get support for third-party deepfake detection tools
Microsoft will soon introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings. [...]
-
Anthropic’s new budget model gets much better at ignoring hidden commands
Anthropic’s Claude Haiku 5.5 model, designed for quick, repetitive workloads and speed-sensitive tasks, is now better at finding vulnerabilities and writing exploits than its predecessor. The company has given it stricter cybersec…
-
Rein Security Raises $25 Million to Guard AI Agents at Runtime
The cybersecurity startup will invest in product innovation, agentic research, and employee base expansion. The post Rein Security Raises $25 Million to Guard AI Agents at Runtime appeared first on SecurityWeek .
-
Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, dubbed PoeLLM, breaks into exposed AI services and open-so…
-
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institu…
-
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis.
-
Confession time: whenever my impostor syndrome gets the better of me, I read my own AI-generated hagiographic …
Confession time: whenever my impostor syndrome gets the better of me, I read my own AI-generated hagiographic bio and laugh and laugh
-
GitHub adds AI to catch passwords before a code push
GitHub has announced an AI detector, developed with Microsoft Applied Sciences, to help prevent developers from uploading passwords and other credentials to code repositories. The ModernBERT-based classifier will expand GitHub’s p…
-
Who watches the AI watching your street?
Yusaku Fujii, a professor at Gunma University in Japan, has designed audits and penalties to stop operators from misusing AI that analyzes street camera footage. His system adds an independent record-keeper and unannounced spot ch…
-
How AI can fix cybersecurity compliance: From dashboards to continuous execution
Most compliance work goes into proving security, not improving it. That isn t because the rules are unreasonable. Regulators, customers, and cyber insurers are right to expect organizations to implement hundreds of technical and a…
-
Cisco finds AI puts network capacity under pressure
Modernising networks early better position businesses to support AI agents, real-time applications and future innovations at scale. Those that fail to upgrade their networks could risk performance bottlenecks, security exposure, h…
-
Quoting Ben Affleck
I've always been kind of into computers since I was young. And then when film started to move from analog film to digital, I became more interested in that aspect of it. And the visual effects workflow for many years has included …
-
Australian Gov't Weighs Mandatory AI Incident Reporting
In the wake of an agentic attack against its own Medicare systems, Australia's government is feeling out what regulations might look like for frontier AI companies.
-
Introducing Claude Haiku 5.5
As previously promised , here's Anthropic's new fast, low cost model: Introducing Claude Haiku 5.5 . The previous Haiku, 4.5, was very much showing its age. It came out almost a year ago , and was priced at $1/million input and $5…
-
Anthropic Gives Vetted Defenders Fewer Claude Guardrails
Anthropic has merged Project Glasswing into a tiered access program for its advanced cyber LLMs, including Opus, Sonnet, and Mythos.
-
OpenAI Agent Escape Causes Wikimedia Service Outage
Autonomous agents also tried to abuse other websites and services hosted by the foundation, using them as proxies for unauthorized activities.
-
FBI, French authorities seize deepfake CSAM-for-sale websites
Some of the material appeared to be recorded or stolen video of girls through interactions on social media sites like Snapchat, TikTok, Instagram and Facebook. The post FBI, French authorities seize deepfake CSAM-for-sale websites…
-
We are going to use AI to file public records requests. Then we are going to use AI to reply to the public rec…
We are going to use AI to file public records requests. Then we are going to use AI to reply to the public records requests. Then we are going to use AI to write news stories about the public records, which will be read by more AI…
-
AI is going to help government transparency by making it easier to file public records requests! Oh no. https:…
AI is going to help government transparency by making it easier to file public records requests! Oh no. https:// techcrunch.com/2026/09/10/ai-a gents-are-flooding-public-services-with-new-requests/
-
The Pentagon Hopes to Speed Up ‘Kill Chain’ AI Buys With 5-Minute Videos
The US government’s Tradewinds initiative has made it easier to throw millions of dollars at “nontraditional” defense contractors, including OpenAI, Anthropic, and Google.
-
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miner…
-
AI doesn’t change singular importance of phishing-resistant authentication, Okta says
The company presented new data about the prevalence of different forms of social-engineering attacks, saying identity fundamentals still matter in the AI era.
Last fetch 5m ago · 0 new · 1 source error(s)