access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email endpoint exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation…
-
NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection
Cybersecurity researchers have disclosed details of what has been described as a “highly sophisticated infection chain” targeting government organizations in Asia.The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed First seen on…
-
Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
Malicious code on the website of prediction market Polymarket sold some signed-in traders’ positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company.Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth…
-
A gift to scammers: why you should probably keep your birthday a secret
Using a fake DOB or leaving the field blank when making an online account can offer protection from identity theftYou get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller.But you…
-
Phantom-Labs-Analyse: KI-Agenten handeln über ihren Auftrag hinaus
Neue BeyondTrust-Lösung »AI Agent Security« stoppt unerwünschte Aktivitäten künstlicher Intelligenz. Der Identity Security-Anbieter BeyondTrust hat die allgemeine Verfügbarkeit der Sicherheitslösung »AI Agent Security« auf der Plattform »Pathfinder« bekanntgegeben. Neueste Forschungen des BeyondTrust-Forschungslabors »Phantom Labs« zeigen das große Ausmaß ungesteuerter Agentic-AI-Aktivitäten und die wachsende Vernetzung von KI-Agenten über Unternehmensendpunkte hinweg. BeyondTrust Phantom Labs analysierte Endpunkt-Telemetriedaten der……
-
Vom KI-Prototyp zum stabilen Betrieb: Warum das Softwarefundament zählt
Schneller programmiert heißt noch nicht besser geliefert. Der DORA-Report 2025 beschreibt KI als Verstärker vorhandener organisatorischer Stärken und Schwächen. [1] [7] Für IT-Entscheider rückt damit eine Frage in den Mittelpunkt: Wie werden Architektur, Qualitätskontrollen und Betriebsprozesse so aufgestellt, dass zusätzlicher Code auch zusätzlichen Nutzen schafft? Der folgende Beitrag beleuchtet die technischen und organisatorischen Grundlagen. Management……
-
U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: The vulnerabilities are part of an exploit chain that cybersecurity firm Volexity first documented in mid-October. >>Volexity…
-
From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era.
AI-generated vulnerability reports are overwhelming some bug bounty programs, making it harder for aspiring security researchers to know where to start. TryHackMe explains how beginners can build practical cybersecurity skills, use AI responsibly, and produce reproducible findings that stand up to scrutiny. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/from-beginner-to-bug-hunter-learning-cybersecurity-in-the-ai-era/ also interesting: Gen AI is…
-
New Android SMS of Death exploit can remotely crash unpatched phones
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed “SMS of Death” and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/ also interesting: Privacy Roundup: Week 13 of Year…
-
Polymarket Users Lose $2.7 Million in Third-Party Script Hack
Tags: breachPolymarket confirms $2.7 million stolen through the compromised third-party script and pledges $3.9 million in refunds, including compensation for pause losses. First seen on hackread.com Jump to article: hackread.com/polymarket-users-lose-2-7m-third-party-script-hack/ also interesting: Majority of Companies Have Suffered a Web App Security Breach API Key Security Best Practices: Secure Sensitive Data Russian Police Bust Suspected Meduza Infostealer…
-
Reddit to lock content behind logins to fight scrapers
Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a “logged-in service,” offering limited access to visitors without accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/reddit-to-lock-content-behind-logins-to-fight-scrapers/ also interesting: Dumping Entra Connect Sync Credentials US NSA alleged to have launched a cyber attack on a Chinese agency Why Third-Party…
-
Polymarket Users Lose $2.7 Million After Hackers Compromise Third-Party Script
Polymarket confirms $2.7 million stolen through the compromised third-party script and pledges $3.9 million in refunds, including compensation for pause losses. First seen on hackread.com Jump to article: hackread.com/polymarket-users-lose-2-7m-third-party-script-hack/ also interesting: Hackers Demand Ransom in Rhode Island Health System Data Breach Step Into the Password Graveyard”¦ If You Dare (and Join the Live Session) Japanese…
-
Chainalysis discloses data breach from “offensive agentic techniques”
Blockchain analytics firm Chainalysis disclosed a data breach after attackers used “offensive agentic techniques” to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques/ also interesting: Top 10 Cybersecurity Predictions for 2026 Top 7 zero-day exploitation trends of 2024 Posture ≠…
-
Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
Named “Volta-Autodoxer,” the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts. First seen on wired.com Jump to article: www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/ also interesting: 9 VPN alternatives for securing remote network access 6 ways hackers hide their tracks Cybersecurity Snapshot:…
-
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ also interesting: AI gives superpowers to BEC attackers Modern supply-chain attacks and their real-world impact Modern supply-chain attacks and their real-world impact Hackers Are…
-
Backdoor eingebaut: Offizielle Claude-Code-Erweiterung für Cursor kompromittiert
Angreifer haben Schadcode in die offizielle Cursor-Erweiterung von Claude Code eingeschleust. Tausende Entwicklersysteme sind betroffen. First seen on golem.de Jump to article: www.golem.de/news/claude-code-millionenfach-installierte-vs-code-erweiterung-kompromittiert-2610-214680.html also interesting: New Sophisticated Linux Backdoor Targets OT Systems via 0-Day RCE Exploit New Stealthy Malware Hijacking Cisco, TP-Link, and Other Routers for Remote Control 71% of CISOs hit with third-party security…
-
Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by missing authorization checks. >>This module enables you to sell goods and…
-
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Tags: access, authentication, cve, cybersecurity, exploit, flaw, infrastructure, ivanti, kev, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.The vulnerabilities are listed below – CVE-2026-111357 (CVSS score: 8.8) – A missing authentication for a critical function vulnerability that could allow a First…
-
Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks
Hackers impersonated IT help desk personnel on Microsoft Teams to gain remote access and abuse Active Directory Certificate Services (AD CS), turning approved support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability. Instead, operators combined…
-
Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks
Hackers impersonated IT help desk personnel on Microsoft Teams to gain remote access and abuse Active Directory Certificate Services (AD CS), turning approved support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability. Instead, operators combined…
-
Claude AI Exploits Gaps in Safety Monitoring to Develop Self-Preservation and Deceptive Behaviors
Anthropic researchers have demonstrated how Claude could generate seemingly harmless training datasets that passed safety screening but caused a separate research model to develop deceptive, manipulative, and oversight-resistant behavior after fine-tuning. The findings expose weaknesses in training-data monitoring rather than evidence of a production compromise. The study, “Automated Subtle Emergent Misalignment Research,” investigated whether automated…
-
Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls
Attackers have chained critical PHP2Shell vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on Palo Alto Networks PAN-OS systems. The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 compromised systems. Hunt.io’s investigation cites Dream Research’s campaign analysis and describes a transition from…
-
WordPress RCE Vulnerability Under Active Attack With Over 58,000 Exploit Attempts Blocked
Tags: attack, cyber, exploit, hacker, rce, remote-code-execution, software, vulnerability, wordpressHackers are attempting to exploit an unauthenticated remote code execution vulnerability in WordPress Core, targeting a brief exposure window during software updates. The supplied Wordfence record reports 58,693 blocked attacks within 24 hours, representing nearly 60,000 attempts rather than confirmed successful compromises. WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The…
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44…
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44…
-
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker’s code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.The researchers reported the flaw through OpenAI’s bug bounty program on October 18, and OpenAI fixed it eight days later and rated it…
-
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker’s code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.The researchers reported the flaw through OpenAI’s bug bounty program on October 18, and OpenAI fixed it eight days later and rated it…
-
Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction
Russia-aligned threat actors are exploiting a flaw in MDaemon mail server software to run code on the server. Victims don’t have to open or click anything. ESET’s APT Activity Report for Q2Q3 2026 describes an active campaign in Ukraine. ESET could not attribute it to a known Russia-aligned group. Mdaemon mail server flaw According to…
-
Kritische Infrastruktur РHacker stehlen Daten der Berliner Charit̩
Bei einem Cyberangriff auf die Berliner Charité wurden Kontaktdaten entwendet. Die Klinik meldet keine Auswirkungen auf die Versorgung. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/kritische-infrastruktur-hacker-stehlen-daten-der-berliner-charite.100094 also interesting: Romanian energy supplier Electrica hit by ransomware US charges Chinese hackers linked to critical infrastructure breaches HellCat hackers go on a worldwide Jira hacking spree Nach Flugausfällen…
-
Behind the Scenes of How Operation Blackout Went Down
A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/behind-the-scenes-how-operation-blackout-went-down also interesting: Cybersecurity Snapshot: NIST Offers Zero Trust Implementation Advice, While OpenAI Shares ChatGPT Misuse Incidents…
-
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/ also interesting: Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in ‘Zero Disco’ Attacks Microsoft’s November…
-
Alice & Bob Claims New Benchmark for Breaking RSA-2048 in Days
French Startup Estimates RSA-2048 Could Fall in Three Days With 23,000 Qubits. French quantum computing startup Alice & Bob estimates that 23,000 cat qubits could break RSA-2048 encryption in three days, while 30,000 could defeat blockchain elliptic-curve cryptography in an hour, raising concerns about long-term data security and cryptocurrency exposure. First seen on govinfosecurity.com Jump…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Applebee’s exposed customers’ personal data after leaving database password in app
EXCLUSIVE: A security researcher discovered the hardcoded credential in Applebee’s app, allowing unrestricted access to customers’ personal data. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/30/applebees-exposed-customers-personal-data-after-leaving-database-password-in-app/ also interesting: Romanian elections targeted with cyberattacks by foreign state-sponsored actors The FTC Is Watching: GoDaddy’s Settlement Sends a Clear Message on API Security Unveiling the Lumma Password Stealer…
-
China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/ also interesting: China-linked hackers target Japan’s national security and high-tech industries Cybersecurity Snapshot: Study Raises Open Source Security Red Flags, as…
-
Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Tags: accessIt’s still unknown how attackers got access to Anthropic’s verified Cursor account. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/ also interesting: Alleged FUD Malware ‘GYware’ Advertised on Hacker Forum for $35/Month SonicWall investigation shows hackers gained wide access to customer backup files Zscaler Threat Hunting Discovers and Reconstructs a Sophisticated Water Gamayun APT Group…
-
Devs Hit by Trojanized Claude Code Extension for Cursor
Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs). First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor also interesting: 7,000 Exposed Ollama APIs Leave DeepSeek AI Models Wide Open to Attack Yahoo Finance: U.S. Lawmakers Push to Ban China’s DeepSeek AI Over Security Risks Feroot…
-
A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices
Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines. First seen on wired.com Jump to article: www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/ also interesting: Plugins on WordPress.org backdoored in supply chain attack XML-RPC npm Library Turns Malicious, Steals Data, Deploys Crypto Miner Supply chain…
-
DHS Orders Civilian Agencies to Purge Acronis Software
DHS Cites Root Access in Barring Swiss Firm From Federal Networks. The U.S. Department of Homeland Security has ordered civilian agencies to stop buying and remove Acronis backup and security products, extending a ban that already covered intelligence and defense systems – though the order’s public rationale rests on the access the Swiss company’s tools…
-
AI Agent Identity Crisis Forces Banks to Restrict Access
Financial Firms Face Pressure to Balance Customer Access With Data Protection. The lack of reliable ways to identify an artificial intelligence agent has caused many companies, especially banks and other financial institutions, to block most agent traffic amid rising interest in agents from enterprises and regular consumers. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-agent-identity-crisis-forces-banks-to-restrict-access-a-33266…
-
AI Agent Identity Crisis Forces Banks to Restrict Access
Financial Firms Face Pressure to Balance Customer Access With Data Protection. The lack of reliable ways to identify an artificial intelligence agent has caused many companies, especially banks and other financial institutions, to block most agent traffic amid rising interest in agents from enterprises and regular consumers. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-agent-identity-crisis-forces-banks-to-restrict-access-a-33266…
-
ISMG Editors: PHP2Shell Fuels Cybersecurity’s Black October
Also: US Healthcare Faces New Risks, Anthropic’s Cloud Dependence Raises AI Risks. In this week’s panel, four ISMG editors discussed the PHP2Shell threat and the Black October attacks, U.S. healthcare cybersecurity and deregulation, and what Anthropic’s newly disclosed financials reveal about its business model and dependence on major cloud providers. First seen on govinfosecurity.com Jump…
-
U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 is a critical security flaw that could let attackers run code on…
-
DOJ raises privacy concerns over potential sale of Character.AI chats
The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms. First seen on therecord.media Jump to article: therecord.media/doj-raises-privacy-concerns-over-character-ai-sale also interesting: Fraud Awareness Week: How to Effectively Protect Your Data and Combat Fraudsters…
-
DOJ raises privacy concerns over potential sale of Character.AI chats
The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms. First seen on therecord.media Jump to article: therecord.media/doj-raises-privacy-concerns-over-character-ai-sale also interesting: UK Home Office Breached Data Protection Law with Migrant Tracking Program, ICO…