What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,635 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
Microsoft fixes Remote Desktop failures caused by recent Windows updates
Microsoft has resolved a known issue that prevents non-admin users from connecting to devices via Remote Desktop when the "Administrator protection" security feature is enabled. [...]
-
Hackers could poison AI models by tampering with core infrastructure
AI systems rely on a complex web of hardware. Compromising any one component could let adversaries change model weights.
-
Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps
Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions. The post Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps appeared …
-
Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop
Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI s Codex, Microsoft s VS Code and Anthropic s Claude Desktop. In all five, a web page or a local file reached the…
-
Cohere’s Qwen Story: Looks More Like Model Jaggedness
Key findings On October 26, Cohere reported a puzzling incident involving Qwen3.8-Flash-Next, an open-weight model from Alibaba. The task was straightforward: write a detection rule for suspicious curl downloads followed by bash e…
-
Quoting Ben Hylak
every product i use should just be a headless mcp, that feeds into an agent, where i never have to think about anything underneath. except for our product, of course. in our product, customers love the ui and love us very much. we…
-
3 Ways AI Agents Already Operate in Your Browser
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why tr…
-
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries.
-
Reports of SIEM's Death Have Been Greatly Exaggerated
SIEM isn't dead. Its bloated pricing model is. Discover why legacy pricing models need to go, how AI fits in, and how to build a smarter, cost-effective security logging strategy.
-
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]
-
FTC to probe airlines, gig worker firms over personalized pricing and pay
The Federal Trade Commission ordered nine food delivery, airline and ride-sharing companies to turn over detailed information on how they harness personal data to set individual consumer prices and employee compensation.
-
Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation. The post Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek .
-
Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities
Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key…
-
Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network
Volt Typhoon, a Chinese state-sponsored APT group that s focused on cyberespionage and United States critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen …
-
Cyberattack disrupts Belgian tax services before filing deadline
The Federal Public Service Finance (FPS Finance), which oversees taxation and other financial administration, said Wednesday that it was investigating the extent of the attack and had temporarily suspended access to MyMinfin, the …
-
University of New Mexico restores hospital systems, urges no contact with hackers
The University of New Mexico was able to restore systems used by its healthcare facilities after a cyberattack forced it to divert ambulances and cancel classes at its medical school.
-
BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts
BAE Systems says no data was extracted and no PII was breached in the incident that disrupted US bankruptcy court notices for weeks. The post BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts appeared first on Secur…
-
Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL i…
-
Fake Anthropic AI previews lure in overeager employees
Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cyber security company Cofense describes a phishing campaign that hooks overeager enterprise users by making them thi…
-
There Aren’t Enough CISOs. 95% of Clients Will Pay Their Provider to Fill In.
According to Cybersecurity Ventures, there are about 35,000 CISOs worldwide. Cynomi s 2026 State of vCISO Report shows what clients need from the providers who could fill the gap. Sausalito, Calif. – Oct. 29, 2026 – Watch the YouT…
-
Massive leak exposes 41,000 DHS workers and undercover ICE agents
The leak reveals undercover agents, surveillance groups, and sensitive DHS access.
-
Over 41,000 DHS Employee Records Leaked Online
The personal and work information was allegedly stolen from an Okta single sign-on system earlier this year. The post Over 41,000 DHS Employee Records Leaked Online appeared first on SecurityWeek .
-
Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws
Google’s Gemini 4 Carbon is a frontier AI model designed for software engineering and cybersecurity tasks, with safeguards built on those of its predecessor, Argon. SEC-bench Pro (Source: Google) Google says its teams have seen Ca…
-
Security Roundup October 2026
Curated advice, guidance, learning and trends in cybersecurity and privacy, as chosen by our consultants. Experienced security advice on demand Ideally, every organisation would have a chief information security officer who can gu…
-
Ubuntu Core Desktop returns as Canonical’s plan for an immutable default desktop
Canonical has restarted work on Ubuntu Core Desktop, the immutable and attestable version of Ubuntu that the company says will over time become the default Ubuntu desktop. Jon Seager, Canonical s VP of engineering, laid out the pl…
-
Windows 11 KB5127936 update released with 41 changes and fixes
Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements. [...]
-
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram f…
-
The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers
AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tas…
-
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimme…
-
New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. [...]
-
Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
The data of So-net and Plala customers in Japan was exposed, along with 54,401 email account passwords and 16 bank account records. The post Hackers Steal 2.6 Million Records From Sony s Japanese ISP So-net appeared first on Secur…
-
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The v…
-
A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards
Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.
-
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed. The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon s Silent Train Network appear…
-
GitHub Launches npm Firewall to Block Malicious Packages Before Installation
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for sign…
-
Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents
Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace. The group handed the data to t…
-
Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes
The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale — but with key security features turned off.
-
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
-
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Tracked as CVE-2026-76418 and assigned a CVSS scor…
-
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let…
-
HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
Hackers stole personal information and iRhythm account and device data from third-party-hosted business applications. The post HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million appeared first on SecurityWeek .
-
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that …
-
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek .
-
Unknown APT uses NetamLoader to attack a Win10 OS customized for governments in Asia
Kaspersky researchers analyze a complex targeted attack employing NetamLoader, a sophisticated malicious framework and targeting a customized government OS.
-
Cyber Vulnerabilities Besiege Italy, Absent Clear Cause
Researchers can't quite explain why cyber threats look so different in Italy compared to everywhere else.
-
Qualys CISO on what security teams can do as exploit campaigns grow
In this Help Net Security interview, Nathan Smolenski, CISO at Qualys, talks about how security teams can handle the growing volume of AI-discovered vulnerabilities. He explains why CISOs should track the average window of exposur…
-
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been we…
-
IT bosses are confident they’ve found the certificates they don’t know about
Forty percent of 500 senior IT and security leaders surveyed for certificate authority Sectigo said they are very prepared for monthly TLS certificate renewals because automated systems are already in place. Their more specific an…
-
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo A…
-
Shame and sleepless nights haunt scam victims long after the money is gone
Scams and identity theft hurt people in different ways, and recovering involves much more than getting money back, according to ITRC’s 2026 Consumer Impact Report. Scam victims often struggle with shame and self-blame, while ident…
Last fetch 4m ago · 0 new · 1 source error(s)