What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,641 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 3d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 3d ago
-
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package withou…
-
West African scammers targeted in joint international government-industry operation
Participants said it was the largest joint scam operation to date and the first focused on the region. The post West African scammers targeted in joint international government-industry operation appeared first on CyberScoop .
-
West African scam compounds raided, more than 100 suspected trafficking victims ‘rescued’
More than two dozen people were arrested by police in Ghana and Nigeria as part of a U.K.-hosted operation that also included tech companies.
-
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services. The post Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach appeared first on Securi…
-
North Korean hackers target Ukrainian experts for possible intelligence on Russia's war
North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy amid Pyongyang’s growing military cooperation with Russia.
-
Privacy's Defenders Podcast: No Privacy Without Encryption
When we communicate online today – from your personal emails and DMs to secure international commerce – we usually do so with encryption. Encryption converts readable data into unreadable gibberish to protect our privacy and secur…
-
Boost Mobile to launch in New Zealand
Boost Mobile is set to enter the local mobile market with a promise to deliver more competition and product innovation. The company will operate as a mobile virtual network operator (MVNO) on the One NZ network. Boost Mobile New Z…
-
Dangerous flaws in refrigeration equipment were disclosed months before retail attacks
Hundreds of French supermarkets faced a sophisticated hack where industrial controls were manipulated.
-
The MFA Gaps Attackers are Still Exploiting
Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how orga…
-
Why you can’t afford to ignore supply chain security – part 2
In the first part of this blog, we covered how critical business services today increasingly depend on multiple third parties, ranging from cloud providers, software vendors, and managed service providers to payroll platforms, CRM…
-
Russian internet provider SkyNet reports outages after cyberattack claimed by Ukrainian hackers
One of St. Petersburg's major internet providers said its network had been under a distributed denial-of-service (DDoS) attack since October 6, affecting services including online gaming, voice calls and video conferencing.
-
Ledger says hardware implant in cryptocurrency wallets stole recovery phrases
Ledger cryptocurrency wallets sold through a Southeast Asian reseller had an implant allowing outsiders to drain funds, the company said.
-
Ukrainian drones hit Yandex data centers, sparking claims that Russian troll farms went quiet
Russian tech giant Yandex confirmed that drones hit three of its data centers, shutting down the facilities in Sasovo and Vladimir and knocking out part of the infrastructure in Kaluga. On October 11, Yandex Cloud told its custome…
-
South African clothing retailer Foschini Group investigating cyberattack on British fashion brands
The South African retail giant The Foschini Group (TFG) disclosed a cyberattack that disrupted IT systems at three of its British fashion brands, leaving some services unavailable.
-
Luang Prabang – day two: temples, stupas, and a high-speed railroad too!
ສະບາຍດີ folks! Back to Laos – for a continuation of my tales (and pics) from the Luang Prabang side… Curiously, the city is the country s alternative capital (the government hopped back and forth between Vientiane and Luang Praban…
-
Cyber incident hits grocery stores in US, Netherlands and Belgium
Ahold Delhaize, the Dutch multinational retailer, announced it was taking precautionary measures following a cybersecurity incident, with stores in the U.S., Netherlands and Belgium reportedly impacted.
-
XWorm RAT Evolves Into Surveillance Platform
Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions. The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek .
-
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers. The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek .
-
Breach of Confidence: 12 October 2026
A day late but hopefully not a dollar short! Here s what happened last week that I caught and maybe you did too, or maybe you didn t. The CISO who forgot rule one A CISO spent half a million on security patches, then used r3@lg00d…
-
Cyberattack Prompts Ahold Delhaize to Disconnect Systems
The company says it took some of its systems offline to contain a security issue within its network. The post Cyberattack Prompts Ahold Delhaize to Disconnect Systems appeared first on SecurityWeek .
-
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover
Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the ma…
-
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers
Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through…
-
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on O…
-
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue that, under …
-
Refrigeration Controller Hack Spoils Food Across European Supermarkets
A cyberattack targeted refrigeration controllers, setting refrigerators and freezers across hundreds of supermarkets to defrost. The post Refrigeration Controller Hack Spoils Food Across European Supermarkets appeared first on Sec…
-
GTA 6 leaker threatens to release full playable version of game ahead of official launch
The hacker behind a high-profile string of leaks involving the upcoming release of the Grand Theft Auto (GTA) 6 videogame has threatened to release a complete, playable build. Read more in my article on the Hot for Security blog.
-
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which …
-
Cybersecurity jobs available right now: October 13, 2026
The post Cybersecurity jobs available right now: October 13, 2026 appeared first on Help Net Security .
-
EonFibre launches connectivity solution for future data centre developments
One New Zealand’s dedicated fibre business, EonFibre, has launched a connectivity offering for data centre developers, hyperscalers, neoclouds, and carriers looking to enter or expand in New Zealand. According to EonFibre, the ser…
-
Ingram Micro signs distribution deal with homegrown NSPM provider ThreatSabre
A new distribution agreement with New Zealand cyber security specialist ThreatSabre will give Ingram Micro partners access to a homegrown network security posture management (NSPM) platform. Announcing the agreement, Ingram Micro …
-
Ahold Delhaize experiencing cybersecurity issue
The company said it took some systems offline as part of precautionary measures. Websites for all five of the grocer s U.S. banners were down Monday morning.
-
Yandex confirms service outage as users lose access to cloud files
Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. [...]
-
No Identity, No Recovery: Cyber Resilience Starts With IAM
The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink.
-
Hello Python 3.15, goodbye 3.10, and now I can use 3.11
Python 3.15 is here ! Here's the essential What's new in Python 3.15 guide, this year curated by 3.14 and 3.15 release manager Hugo van Kemenade. As someone who builds open source software that works in every supported Python vers…
-
IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion
The acquisition pairs Elisity's zero-trust access controls with IonQ's post-quantum cryptography business as federal agencies and major companies accelerate timelines for quantum-ready encryption. The post IonQ to buy zero-trust s…
-
Ledger confirms hardware wallet spy implant behind crypto thefts
Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. [...]
-
Cyberattacks hit European grocers: French supermarket freezers hijacked, Dutch and Belgian stores disrupted
European food retailers have been affected by two separate disruptive cyberattacks: In France, several supermarket chains have had their freezers tampered with and chilled/frozen products destroyed, while in the Netherlands and Be…
-
Cyberattack shuts down refrigerators at French supermarkets
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. [...]
-
FBI Arrests Suspect in FBI-Hacking Case
In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster . Last week, the FBI arrested (alternate link ) someone associated with tha…
-
IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion
The all-stock deal brings Elisity’s least-privilege access technology into IonQ’s security portfolio. The post IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion appeared first on SecurityWeek .
-
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-b…
-
CMMC Level 2 Non-Negotiable Requirements Explained | Huntress
Learn the CMMC Level 2 requirements you can’t skip, the new 88-point minimum score, and how the 180 day POA M clock affects contract eligibility.
-
Retail giant Ahold Delhaize takes systems offline after cyberattack
Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it had to take some systems offline in response to a "cybersecurity incident" affecting its network. [...]
-
Overnight stays on a Sayan Oka rafting trip – with a surprising, quirky cultural layer.
Today s post is all about the campsites we stayed at on our summer rafting trip down the Sayan Oka River, of which there are many and in different flavors, but which all turned out to be decent. Even though there was a pretty heav…
-
Cybersecurity FAQ: How Do CFOs Collaborate With CISOs?
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 12, 2026 – Read the full story in TradeFlock The toll of cybercrime on the global economy is staggering, estimated at $10.5 trillion annua…
-
Passing the Baton: Dark Reading Names New Editor-in-Chief
Fahmida Y Rashid will keep the momentum going as she leads Dark Reading.
-
Ukraine strikes third Yandex data center, disrupting digital services across Russia
A third Yandex data center in Russia was hit by Ukrainian drones over the weekend, forcing it to shut down and causing further disruptions to cloud services, payments, deliveries and other online services across the country.
-
Canonical Websites Disrupted in Second DDoS Attack This Year
The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal The post Canonical Websites Disrupted in Second DDoS Attack This Year appeared first on SecurityWeek .
-
Microsoft: Windows 11 23H2 reaches end of support in 30 days
Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. [...]
-
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US. The post Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US appeared first on Securi…
Last fetch 2m ago · 0 new · 1 source error(s)