What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,639 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 3d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
CISA added the widely publicized PHP vulnerabilities to the KEV, but didn't specify what kind of exploitation it was observing.
-
Microsoft offers exits to thousands of employees, including staff on AI and Copilot teams
Microsoft is offering voluntary exit packages to about 60,000 employees, roughly 27 per cent of its workforce, including staff on teams building Copilot and other AI products, as the company looks for ways to fund its AI investmen…
-
HPE Patches Dozens of Critical Flaws in Networking Products
Eight max-severity security defects could lead to remote code execution and authentication bypass. The post HPE Patches Dozens of Critical Flaws in Networking Products appeared first on SecurityWeek .
-
Australia’s spies are sharing intelligence with hacking targets — and want them to share back
More than half of the individual warnings from the Australian Signals Directorate (ASD) drew on previously secret material that had been cleared for disclosure, underscoring the growing role of intelligence sharing to prevent atta…
-
Sekoia introduces self-hosted deployment for organizations with strict data controls
Sekoia has introduced Sekoia Self-Hosted, a deployment model that brings the Sekoia SOC platform into the customer’s own infrastructure. Designed for large organizations, including government agencies, defense organizations, criti…
-
Quantapocalypse: A Q-Day Documentary. Sponsored by Keyfactor.
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 27, 2026 – Watch the Quantapocalypse Documentary Quantapocalypse, a Cybercrime Magazine 10-minute documentary sponsored by Keyfactor, exam…
-
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Key Points Introduction Over the past two months, we have been tracking a campaign that abuses the popularity of AI tools such as ChatGPT and Claude to spread a custom malware chain we call Yoba. The attackers use fake GitHub proj…
-
DNSFilter LUMINATE unifies DNS security, AI controls and remote work protection
DNSFilter has launched LUMINATE by DNSFilter, a security platform that allows organizations to deliver five security solutions from one agent, one console and one policy. Shadow AI is now one of the fastest-growing risks in busine…
-
Camera Management Software Compromise Leads to Malware Deployment
Attackers compromised camera management software to deploy malware, establish persistence, and beacon to C2. Huntress breaks down the attack chain and IOCs.
-
FireMon Agentic AI helps teams investigate access and prepare policy changes
FireMon has announced FireMon Agentic AI, changing how enterprises investigate network access, make policy decisions, and prepare security changes. Built into FireMon’s network security management solutions, the new agentic AI cap…
-
Exeon expands threat detection to shadow AI and autonomous agents
Exeon Analytics has introduced Exeon.AgentGuard, a new AI security solution designed to give organizations visibility into approved and shadow AI use, autonomous agent activity and the data flows created through connected tools an…
-
Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack
University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted …
-
Simplify User Access Management with SCIM on Rapid7 Command Platform
Managing access to security tools shouldn't require another manual process. As organizations grow, keeping user accounts and permissions up to date becomes increasingly complex. Employees join, change roles, and leave, creating a …
-
CISA lays out plan to push cyber adversaries out of US critical infrastructure
The Cybersecurity and Infrastructure Security Agency (CISA) has released CISA 2030: Defend, Harden, Prevail, a strategy to strengthen national security and the resilience of critical infrastructure. It addresses intersecting cyber…
-
ThreatAware brings governance to AI-built security applications
ThreatAware has announced the launch of Dimension, its governed workspace that provides organisations with a foundation for building, running and managing their own customised security applications. Dimension gives security teams …
-
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks …
-
Unexplained DreamHost Incident Prompts Email, FTP Password Resets
The company says it reacted to an issue affecting some of its systems, including DreamHost webmail. The post Unexplained DreamHost Incident Prompts Email, FTP Password Resets appeared first on SecurityWeek .
-
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
A Kaspersky expert presents a cloud isolation bypass case honored at Russian Pentest Award 2026. Learn how vulnerabilities in Kubernetes, Konnectivity, and the overlay network lead to RCE and compromise of other tenants' services.
-
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones. The post iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 appeared fir…
-
Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices tha…
-
Cyberattack on University of Copenhagen exposes data of 525,000 people
The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal dat…
-
AI-Generated Fake Login Pages Are Making Account Takeovers Easier
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees o…
-
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication eq…
-
Hiding Capabilities in AI Models
Interesting research: AI Models Can Provably Hide Arbitrary Capabilities Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capa…
-
Private repos still leak secrets to Gheist, a stolen GitHub token campaign
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen …
-
Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
Anthropic presents its own initial public offering as a step toward mitigating the risks it believes AI poses. The post Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI appeared first on SecurityWee…
-
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]
-
In Pictures: Reseller News Innovation Awards 2026 Welcome Reception
More than 400 members of New Zealand’s technology channel ecosystem gathered at the Cordis in Auckland on 15 October for the black-tie Reseller News Innovation Awards 2026, celebrating excellence across partners, vendors, distribu…
-
DreamHost incident triggers password resets, locks customers out of email and FTP accounts
DreamHost has brought its File Manager back online after an incident that disrupted several of its services, though some of its customers still can t get into their email or FTP accounts until someone sets a new password for them.…
-
This is Fine: What NetScaler Zero-Days Tell Us about the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon. The post This is Fine: What NetScaler Zero-Days Tell Us about the New Normal appeared first on SecurityWeek .
-
From federal SOCs to Talos: Ryan Fetterman on practical security research
What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without burning out.
-
What happens when security tools go dark before the ransomware
A China-linked ransomware crew disabled the security tools at a critical infrastructure operator before it launched the encryptor. Most security budgets never priced that in. The post What happens when security tools go dark befor…
-
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
Running at system boot, it periodically polled the update domain to execute any code served, with full privileges. The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek .
-
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained acc…
-
Energy giant ENGIE discloses data breach affecting customers
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. [...]
-
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a …
-
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday. [...]
-
AI Autopsy: Deluge of Japanese Data Breaches Puts the Spotlight on API Security
Companies are haemorrhaging data through their web systems Security by obscurity is no longer hiding internal endpoints and services from hackers, finds Phil Muncaster Read the rest of AI Autopsy: Deluge of Japanese Data Breaches …
-
Weekly Update 527: Cybergeddon News v. Reality
As the news from last week has settled down, it would seem this headline was pretty spot on. The foretold apocalypse didn t eventuate, and there were no internet-destroying outages. In fact, it took days before I could find a sing…
-
Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems
Blue Initiative indexes nearly 30,000 IT and OT vulnerabilities relevant to ships and ports, 37 of them in maritime-specific products. The post Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems appe…
-
AfD: 345,439 accounts breached
Data exposed: Email addresses, Email messages. In September 2026, the German political party Alternative für Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of giga…
-
Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines
Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug fin…
-
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the…
-
Several AI security market categories are headed for bigger platforms
In this interview with Help Net Security, Jonathan Care, Lead Analyst and Practice Lead AI at KuppingerCole Analysts, compares AI security startups to the early fraud market he helped define at Gartner. He explains which categorie…
-
“There are agents everywhere, Neo.” And here’s what to do about them.
Before our very eyes, technological progress has once again bolted ahead at full gallop. It s all we can do to keep shutting them (or opening them wide) in astonishment! In literally just a few years, countless AI this-that-and-th…
-
Microsoft Authenticator vulnerability let rogue Android apps steal work account access
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn t need permissions, and you didn t need to tap anything…
-
LLM agent security needs more than guardrails
Madhu Shashanka, Chief Scientist at Concentric AI, explains why securing LLM tools and agents depends more on your data than on the model. Controls on model behavior, such as guardrails and injection detection, lower the rate of b…
-
Amutable Foundations is a Linux system with no SSH and no package manager
Amutable opened signups for the private preview of Amutable Foundations, a Linux system in which each machine sends a signed report of the software and configuration it runs, drawing on local hardware to make the report easier to …
-
71% of vulnerability exploitation starts within a week of disclosure
Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape Report. The company reported an average of three days betw…
-
Cybersecurity jobs available right now: October 27, 2026
Cybersecurity Expert / Penetration Tester Barrion Sweden On-site View job details As a Cybersecurity Expert / Penetration Tester, you will test web applications and APIs for authentication, authorisation, and business logic vulner…
Last fetch 2m ago · 1 new · 1 source error(s)