What's happening in security
Breaches, credential dumps, actively exploited bugs and AI incidents — pulled from 5,638 items across public feeds, Have I Been Pwned and CISA KEV.
Biggest this week
- Westcon-Comstor posts record US$3.37B first-half sales as APAC demand for AI, cloud and cyber accelerates — Reseller News (NZ), 2d ago
- GitHub Octoverse 2026 — Simon Willison (AI), 4d ago
- Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen — The Hacker News, 2d ago
- Upwind Security Raises $400 Million at $3.8 Billion Valuation — SecurityWeek, 4d ago
- Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds — The Record, 2d ago
-
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites prese…
-
Chrome flags malicious commands that scammers pass off as fixes
Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced Enhanced Protection for Chrome’s Safe Browsing feature in…
-
ConnectWise customers hit by supply-chain attack linked to compromised API secret
Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded. The post ConnectWise customers hit by supply-chain attack linked to compromised AP…
-
DOJ escalates fight for election supremacy with California raids
The arrests were paired with comments from DOJ and DHS officials, threatening to investigate, arrest or prosecute tens of thousands of California voters if they vote in November. The post DOJ escalates fight for election supremacy…
-
AOMEI Backupper servers hijacked for minutes at a time to push backdoor
An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered …
-
DHS bans DeepSeek products across US federal civilian agencies
The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. [...]
-
Incomplete security patches show hackers where to look next
Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kep…
-
AOMEI yet to notify customers after hackers hijacked its software updates
In an email, the Hong Kong-registered company confirmed to Recorded Future News that hackers repeatedly altered configuration files on its update servers between April and July, redirecting the software to download malware for min…
-
Anti-Putin messages disrupt nationwide school assessments in Russia
A pro-Ukraine group that says it operates within Russia took responsibility for anti-Putin messages appearing on an education assessment platform. Authorities said they had restored systems.
-
AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework. The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek .
-
Hacker gets 8 years for stealing $3.3 million from taxpayers
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...]
-
Bali déjà vu: welcome to SAS-2026!
Ooh – déjà vu! These scenes out the window sure looked familiar – but of course they did: I was only here last month! And here are some of our guests flying in! We step out onto the beach – and it s déjà vu all over again… Everyth…
-
Ahold Delhaize Restoring Services Disrupted by Cyberattack
The company has restored many websites and apps in Europe and expects e-commerce brands in the US to be restored in days. The post Ahold Delhaize Restoring Services Disrupted by Cyberattack appeared first on SecurityWeek .
-
Introducing ITDR Lookback: Find Out Who Was in Your Microsoft 365 Tenant Before You Were
Attackers may be in your tenant before you connect it. Huntress Managed ITDR Lookback reviews 180 days of Microsoft 365 logins & our SOC acts on active incidents.
-
Identity Posture Assessment for Microsoft 365 | Managed ISPM
Build identity resilience with Identity Posture Assessment, an on-demand Microsoft 365 report that scores your identity defenses and shows how fast you can fix the gaps.
-
Cybersecurity Companies: YouTube Channels With The Most Subscribers
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 20, 2026 We recently reported that the award-winning Cybercrime Magazine has the no. 1 b2b focused cybersecurity channel with more than 1.…
-
Meta Muse exposes users' personal and business secrets when they share conversations
A single query is all that's required to find thousands of conversations listed by title.
-
Quarantined, but still on your calendar: The explosion of invite-based attacks
There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned. Sublime recorded a 1,216% month-over-month increase in Augus…
-
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns
Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built on the new release will refuse …
-
OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware. [...]
-
Windows Server 2025 gets support for quick machine recovery
Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]
-
Ahold Delhaize: Cyberattack affects services across US and Europe
Ahold Delhaize, one of the world's largest food retail chains, confirmed that last week's cyberattack disrupted services at stores across Europe and the United States. [...]
-
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Syma…
-
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security inciden…
-
Revolut outage disrupts online banking operations worldwide
Fintech company Revolut is working to resolve a massive outage that disrupted most of its services worldwide earlier today. [...]
-
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build design…
-
The journey of a paper unicorn: adventures inside a modern warehouse
Kaspersky experts explain the security issues affecting warehouse environments. We break down initial access vectors specific to warehouses, and discuss the impact of a compromise.
-
EasyDMARC and GMO GlobalSign connect email authentication with verified branding
EasyDMARC has partnered with GMO GlobalSign to help organizations establish trusted email identities through DNS security, sender authentication, and verified branding in recipients’ inboxes. As organizations rely on an increasing…
-
SoftwareOne sharpens NZ focus following Crayon channel integration
As SoftwareOne integrates Crayon’s channel business under a single brand, New Zealand partners are openly receptive to the rebranded distributor’s partnership-led approach. Locally based partners have come to understanding the val…
-
Your frontline workers have a workaround for that MFA prompt
Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security de…
-
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a mal…
-
My obituary for programming
My obituary for programming Jeremy Scheff poignantly captures the key loss caused by coding agents for career programmers who enjoyed the puzzle of developing code: Programming turned into one of the greatest jobs you could imagin…
-
Require Police to Get a Warrant to Search ALPR Data
This post was co-written by Andi Cao , an EFF legal intern. Automated license plate readers (ALPRs) are mass surveillance. They photograph every passing car and log where and when it was captured, building a searchable record of w…
-
Tait Communications partners with Zetron on voice consoles for PSN land mobile radio network
Tait Communications has partnered with global command and control technology provider Zetron to implement voice consoles for New Zealand’s emergency services. Under the contract, Zetron is supplying voice consoles to be integrated…
-
WordPress SEO plugin Rank Math compromised to backdoor websites
Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week. [...]
-
Researchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
-
'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest.
-
Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.
-
ConnectWise suspends Cloud Backup service after supply chain attack
ConnectWise initially said on Friday that it was investigating “attempts of unauthorized access associated with the ConnectWise Cloud Backup environment,” and confirmed such access on Saturday.
-
Hackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI's servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide t…
-
ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
Researchers say attackers authenticated into Microsoft 365 tenants using ConnectWise credentials; ConnectWise says customer impact remains unconfirmed.
-
Bullhorn takes staffing platform offline to contain cyberattack
Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. [...]
-
Two more Serbian opposition figures targeted with spyware, researchers say
A phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia's national elections.
-
Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic
At risk, the Oregon Democrat warned, are online crime tipsters, whistleblowers and others. The post Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic appeared first on C…
-
Announcing Privacy Badger for Safari on macOS
Exciting news for Safari users: Privacy Badger is now available on Safari for macOS! You’ll need Safari version 26.5 or higher to use it. Whether you want to protect yourself from data brokers or just don’t want Big Tech profiting…
-
Lao’s hidden gem: the museum of wooden carvings in Vientiane.
With our tourist weekend in Luang Prabang over, it was time to get down to business. The next couple of days in Vientiane were pretty much all work, work, work (meetings, introductions, handshakes, negotiations, and so on – busine…
-
Ahold Delhaize confirms 'malicious actions' behind cyber outages affecting grocery brands
Ahold Delhaize, the Dutch multinational grocery retailer, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic.
-
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Ran…
-
EFF Launches Privacy Badger for Safari on macOS
Free Tracker Blocker Used by Millions Will Protect Even More Users Privacy SAN FRANCISCO—Privacy Badger, the award-winning tracker blocker made by the member-supported digital rights nonprofit Electronic Frontier Foundation (EFF),…
-
WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.
Last fetch just now · 0 new · 1 source error(s)