access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email endpoint exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
‘AdFection’ Turns Ad Impressions Into Zero-Click Spyware Delivery
Spyware vendors are exploiting targeted ad bidding in the digital ecosystem to identify and track individuals and organizations of interest. First seen on darkreading.com Jump to article: www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery also interesting: 75 zero-days seen in 2024 as nations, spyware vendors continue exploitation Apple’s new Memory Integrity Enforcement system deals a huge blow to spyware developers Apple…
-
Eight US States Sue OpenAI Over Alleged ChatGPT Safety Risks to Children
Eight US states have sued OpenAI over alleged ChatGPT safety risks to children. Here’s what the lawsuits claim and how the company is responding. The post Eight US States Sue OpenAI Over Alleged ChatGPT Safety Risks to Children appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-eight-states-sue-openai-chatgpt-child-safety/ also interesting: Security for AI:…
-
Google Messages’ New Scam Protection Uses Cloud AI: What Happens to Your Privacy?
Google Messages is adding optional cloud Gemini scam detection. Here’s what happens on-device, what moves to Private AI Compute, and what remains unclear. The post Google Messages’ New Scam Protection Uses Cloud AI: What Happens to Your Privacy? appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-messages-enhanced-protection-privacy/ also interesting: 7 biggest cybersecurity…
-
Microsoft Edge Is Testing Restart-Free Security Updates: What Works Now
Microsoft has demonstrated Edge updates without restarts, but the feature is still a prototype. Here is what users and IT teams can enable today. The post Microsoft Edge Is Testing Restart-Free Security Updates: What Works Now appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-edge-restart-free-security-updates/ also interesting: Kernel-Schwachstelle: Zero-Day-Lücke in Windows wird…
-
Your Security Stack Knows Who Logged In. But Does It Know What AI Agents Do Next?
AI agents expose gaps in enterprise access controls and audit trails. Here’s how security leaders can rethink identity, data governance, and oversight. The post Your Security Stack Knows Who Logged In. But Does It Know What AI Agents Do Next? appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-ai-agents-enterprise-security-access-controls/ also interesting: Beyond…
-
DHS Bans DeepSeek From Federal Civilian Agencies
Supply-Chain Order Sweeps in Vendor Tools Running on DeepSeek Models. Federal civilian agencies must scrub DeepSeek and any vendor tools running on its models from their networks under a U.S. Department of Homeland Security supply-chain order signed months before it surfaced Monday. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/dhs-bans-deepseek-from-federal-civilian-agencies-a-33146 also interesting: 6 hot cybersecurity…
-
Hackers hijack AOMEI update servers to secretly spread malware
Hackers reportedly compromised AOMEI’s servers to distribute malware through a built-in promotional feature in its backup software, briefly tampering with configuration files before restoring them to their original state to hide the attacks.a First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/ also interesting: The most notorious and damaging ransomware of all time Cybersecurity Snapshot: CISA…
-
OpenAI Engineer Accused of Spying on Executives Ordered to Remain in Custody
A judge ordered Abdulrahman Alfozan to remain in custody, likening the Saudi government’s offer to secure the former OpenAI engineer’s release to a “blank check.” First seen on wired.com Jump to article: www.wired.com/story/openai-engineer-accused-of-spying-on-executives-ordered-to-remain-in-custody/ also interesting: AI programming copilots are worsening code security and leaking more secrets MY TAKE: The Pentagon punished Anthropic for red lines…
-
States Fine Pediatric Practice, IT Vendor $2.7M Over Hack
Settlements Stem From 2024 Hack Claimed by BianLian Affecting Nearly 900,000. A pediatric practice in New York and Connecticut and one of its former IT services vendors will collectively pay those two states financial penalties of $2.7 million for a 2024 hacking incident that affected nearly 900,000 people. Ransomware gang BianLian claimed responsibility for the…
-
NASA CIO Ties IT Modernization to Mission Goals
Network and Cloud Upgrades Support NASAs Lunar and Science Missions. NASA CIO Sean Gallagher says modernization must follow mission needs, from resilient networks and shared services to cloud and financial system upgrades. He explains how the agency applies engineering review, cybersecurity and human oversight before mission-critical work. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/nasa-cio-ties-modernization-to-mission-goals-a-33145…
-
Plex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto Miners
Attackers exploit Plex2Shell flaws to install crypto miners and proxy software. Admins should update their Plex Media Server. Plex Media Server is designed to make movies, music, and other media available across devices. But when a server is exposed to the internet and runs vulnerable software, it can become an entry point for attackers who…
-
Two more Serbian opposition figures targeted with spyware, researchers say
A phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia’s national elections. First seen on therecord.media Jump to article: therecord.media/serbia-spyware-pegasus-elections also interesting: Israeli spyware maker Paragon bought by US private equity giant…
-
Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information. First seen on therecord.media Jump to article: therecord.media/whatsapp-denied-appeal-alleged-nso-group-violation-injunction also interesting: UK and France push for international agreement on spyware Thai Court Dismisses Activist’s Suit Against…
-
PSA: Patch your Plex media server before someone hacks it
A researcher says attacks chaining 4 vulnerabilities is hacking unpatched boxes. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/recently-fixed-plex-media-vulnerabilities-are-being-exploited-to-install-malware/ also interesting: 7 biggest cybersecurity stories of 2024 6 rising malware trends every security pro should know Navigating a Heightened Cyber Threat Landscape: Military Conflict Increases Attack Risks The cybercrime industry continues to challenge CISOs in…
-
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell.The vulnerabilities First seen on…
-
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public.According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell.The vulnerabilities First seen on…
-
Bullhorn takes staffing platform offline to contain cyberattack
Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack/ also interesting: Altgeräte bedrohen Sicherheit in Unternehmen Nvidia-GPUs anfällig für Rowhammer-Angriffe Ivantis EPM-Systeme anfällig für Angriffe Entwickler werden zum Angriffsvektor
-
Neuro-Symbolic AI Could Make Computer Agents Cheaper
Hybrid Neuro-Symbolic Approach Reuses Workflows, Cutting Token Costs for Repetitive Tasks. Autonomous computer company Simular found a way to run computer agents more cheaply, using a method typically used to improve accuracy. The company applied a hybrid of neuro-symbolic AI so its computer-use agent, Sai, discovers workflows and follows those same steps at each run…
-
Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic
At risk, the Oregon Democrat warned, are online crime tipsters, whistleblowers and others. First seen on cyberscoop.com Jump to article: cyberscoop.com/wyden-urges-federal-adoption-encrypted-client-hello/ also interesting: Cybersecurity Snapshot: Tenable Highlights Risks of AI Use in the Cloud, as UK’s NCSC Offers Tips for Post-Quantum Cryptography Adoption The 10 biggest issues CISOs and cyber teams face today Cybersecurity Snapshot:…
-
ConnectWise CTO Sees ‘Light At End Of Tunnel’ In Bid To Restore ConnectWise Cloud Backup Microsoft 365 Access
ConnectWise CTO David Raissipour says the company has made “significant progress” in its bid to restore ConnectWise Cloud Backup access for Microsoft 365 to more than several thousand MSPs. First seen on crn.com Jump to article: www.crn.com/news/security/2026/connectwise-cto-sees-light-at-end-of-tunnel-in-bid-to-restore-connectwise-cloud-backup-microsoft-365-access also interesting: Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities Detecting cloud ransomware…
-
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16.Any site that installed and activated…
-
Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding
San Rafael, United States, October 19th, 2026, CyberNewswire Built on an evolutionary engine first released in 2018, STAR Fuzzer by Bright Security finds crashes, memory exhaustion and memory-safety bugs in security-critical code without a running application. In its first open source research run, it found High or Critical issues in 45% of the projects tested,…
-
OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ also interesting: Securing cloud-native applications: Why a comprehensive API security strategy is essential From Clawdbot to Moltbot to OpenClaw: Security…
-
OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified a small number of users that API keys they used with external providers were exposed in a security breach. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/ also interesting: Top 5 real-world AI security threats revealed in 2025 Software developers: Prime cyber targets and a rising risk…
-
Hackerangriff: Schweizer Onlinemagazin Republik verliert Nutzerdaten
Ein ungepatchtes Analyse-Tool reißt ein Loch in eine interne Datenbank. Dort stehen auch Klarnamen zu anonym veröffentlichten Kommentaren. First seen on golem.de Jump to article: www.golem.de/news/hackerangriff-schweizer-onlinemagazin-republik-verliert-nutzerdaten-2610-214269.html also interesting: Over 26,000 Dark Web Discussions Focused on Hacking Financial Organizations Vor diesen Ransomware-Banden sollten Sie sich hüten Cybersecurity in smart cities, under scrutiny Der Raspberry-Pi-Weckruf für CISOs
-
WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
Tags: data-breachAround 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue. First seen on wired.com Jump to article: www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/ also interesting: Critical infrastructure under attack: Flaws becoming weapon of choice Plex tells users to change passwords due to data breach,…
-
Denmark stands against critics of public sector AI plans
Public authorities to get standing permit to process personal data with artificial intelligence, but critics say it plays too loosely with rights against government intrusion First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652378/Denmark-stands-against-critics-of-public-sector-AI-plans also interesting: UK Cybersecurity Weekly Update 2 March 2025 Top cybersecurity M&A deals for 2025 TDL 008 – Defending the Frontline: Ransomware,…
-
Denmark stands against critics of public sector AI plans
Public authorities to get standing permit to process personal data with artificial intelligence, but critics say it plays too loosely with rights against government intrusion First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366652378/Denmark-stands-against-critics-of-public-sector-AI-plans also interesting: From Risk to ROI: How Security Maturity Drives Business Value TDL 007 – Cyber Warriors Digital Shadows: Insights from Canada’s…
-
US Ransomware Negotiator Suspected of Helping ShinyHunters Extort Victims
Federal investigators suspect a US ransomware negotiator helped ShinyHunters operate an extortion site used to pressure nearly 100 organisations. First seen on hackread.com Jump to article: hackread.com/us-ransomware-negotiator-shinyhunters-extort-victims/ also interesting: Dual Ransomware Attacks: A Quicker Route to Extortion Ransomware Hackers Look for New Tactics Amid Falling Profits 12 ways attackers abuse cloud services to hack your…
-
Russian social media giant VK faces disruptions after data center drone strike
The disruptions began Sunday, when users complained of difficulties loading news feeds, playing music and accessing other features of VK’s platforms. First seen on therecord.media Jump to article: therecord.media/russian-social-media-giant-vk-faces-disruptions-drone-strike-data-center also interesting: Top 12 ways hackers broke into your systems in 2024 Zero-day exploits hit enterprises faster and harder Russians caught stealing personal data from Ukrainians…
-
Ahold Delhaize confirms ‘malicious actions’ behind cyber outages affecting grocery brands
Ahold Delhaize, the Dutch multinational grocery retailer, said Monday that a cyberattack forced it to take systems offline across most of its U.S. and European brands, impacting shoppers on both sides of the Atlantic. First seen on therecord.media Jump to article: therecord.media/ahold-delhaize-cyberattack-grocery also interesting: The 7 most in-demand cybersecurity skills today China-linked hackers target Japan’s…
-
How JetStream Aims To Build A ‘Lasting’ AI Security Platform With The Channel: Execs
Amid the surging demand for businesses to deploy AI agents for boosting workplace productivity, AI security startup JetStream Security is looking to build up an enduring platform with the help of channel partners, JetStream founders told CRN. First seen on crn.com Jump to article: www.crn.com/news/security/2026/how-jetstream-aims-to-build-a-lasting-ai-security-platform-with-the-channel-execs also interesting: UK CMA Clears Alphabet, Anthropic Partnership 6 types…
-
Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/exploited-vulnerabilities-three/ also interesting: Patch Samsung flaw exploited to deliver spyware (CVE-2025-21042) CISA Urges Patch of Actively Exploited Flaw in Oracle Identity Manager CVE-2025-64155: Exploit Code Released for Critical Fortinet…
-
OnlyFans Copyright Takedowns Expose Compromised Websites
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard’s Greg Pollock explains what universities, government websites, and security teams need to think about next. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/onlyfans-copyright-takedowns-expose-compromised-websites also interesting: AI development pipeline attacks…
-
Microsoft fixes game, app crashes caused by recent Windows update
Microsoft has resolved a bug that caused games and apps using AC-3 (Dolby Digital) audio decoding to crash after installing the September 2026 Windows 11 preview update (KB5124010). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-fixes-game-app-crashes-caused-by-windows-kb5124010-preview-update/ also interesting: Week in review: Windows Themes spoofing bug >>returns<<, employees phished via Microsoft Teams Microsoft issues outband fix…
-
DHS to ban DeepSeek from federal civilian agencies
The order cites national security concerns, including sending data to servers in China, the potential malware and the overall risk to federal IT systems. First seen on cyberscoop.com Jump to article: cyberscoop.com/dhs-bans-deepseek-federal-agencies/ also interesting: 8 biggest cybersecurity threats manufacturers face Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework…
-
ConnectWise suspends Cloud Backup service as hacker targets Microsoft 365 users
Managed service providers said an attacker used compromised credentials to gain access to tenants. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/connecwise-suspends-cloud-backup-hacker-microsoft-365/833345/ also interesting: Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework Cybersecurity Snapshot: CISA Analyzes Malware Used in SharePoint Attacks, as U.K. Boosts Cyber Assessment Framework Hackers…
-
Boards confident on cybersecurity, AI oversight, but tech changes outpace readiness
Nearly half of corporate directors think board members need cybersecurity expertise, a new survey found. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/corporate-boards-cybersecurity-ai-oversight-bdo/833350/ also interesting: The Imperative of Tunnel-Free Trusted Cloud Edge Architectures The Triple Threats CISOs cannot ignore: A Perfect Storm of Digital Frontlines, Dark AI and Quantum Leaps Cyber defense: From reactive to…
-
Einblicke in Googles Red Team – So rüsten sich Red Teamer gegen KI-Angriffe in Maschinengeschwindigkeit
First seen on security-insider.de Jump to article: www.security-insider.de/google-gsec-muenchen-ki-cyberangriffe-red-team-a-46aa26409df8fb566f8b6003a4e4c102/ also interesting: KI-Malware ist keine Theorie mehr KI-Malware ist keine Theorie mehr KI-Malware ist keine Theorie mehr What is AI fuzzing? And what tools, threats and challenges generative AI brings
-
Conduent Agrees to Pay $80m to Settle Data Breach Class Action
The 2024 cyber incident affected the healthcare data of 62 million people, who launched a class action lawsuit against the business services firm First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/conduent-settle-data-breach-action/ also interesting: How CISOs can balance business continuity with other responsibilities When it comes to security resilience, cheaper isn’t always better When it comes…
-
âš¡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More
The worst problems don’t always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks wrong, the damage may already be done.This week had plenty of that. Trusted connections became a problem. Hardware wasn’t as safe as…
-
The Evolving Cybersecurity Lexicon: Vulnerability Discovery to Resilience
An industry-wide laser focus on vulnerabilities has left cybersecurity teams without enough room to strategize for resilience. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/cybersecurity-lexicon-vulnerability-discovery-resilience also interesting: 6 hard truths security pros must learn to live with Ransomware attacks: The evolving extortion threat to US financial institutions Where CISOs need to see Splunk go next…
-
F5 releases outband patches for critical NGINX vulnerabilities
F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/f5-releases-out-of-band-patches-for-critical-nginx-vulnerabilities/ also interesting: AMD discloses new CPU flaws that can enable data leaks via timing attacks CISA Warns of Active Exploitation of…
-
Inside the Underground Market for Know Your Client Services
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/inside-the-underground-market-for-know-your-client-services/ also interesting: Security leaders top 10 takeaways for…
-
Meta wants to scrape your website to train its AI, and you can’t say no
Meta wants the right to scrape your website for AI training. If you have a business account, that includes you. At the end of the month, Meta plans to change its commercial terms in a way that matters to every company advertising or selling through its platforms. The new language takes effect on October 30,…
-
KI-Angriffsfläche wächst um 63 Prozent
Censys hat den State of the Internet-Report 2026 veröffentlicht. Der jährliche Forschungsbericht analysiert die globale Internet-Infrastruktur und untersucht, wie sich öffentlich erreichbare Systeme, Technologien und potenzielle Angriffsflächen verändern. Der diesjährige Bericht zeigt, dass insbesondere die rasante Verbreitung von KI-Anwendungen neue potenzielle Angriffsflächen entstehen lässt. Gleichzeitig bleiben bekannte Schwachstellen sowie mangelnde Transparenz über die eigene IT-Infrastruktur…
-
1Password CTO Nancy Wang: Identity Security Must Adapt To ‘New World’ Of AI Agents
As AI agents begin to work across a variety of browsers and IT systems, a massive challenge is arising for businesses whose identity security controls were designed around humans, 1Password CTO Nancy Wang says during the latest episode of CRN’s Security or Else! podcast. First seen on crn.com Jump to article: www.crn.com/news/security/2026/1password-cto-nancy-wang-identity-security-must-adapt-to-new-world-of-ai-agents also interesting: Top…