Nostr notes by Cyber Security News (RSS Feed)

Criminal IP Joins INTERPOL’s Gateway Initiative to Support ...

2026-10-27T17:47:42Z

Criminal IP Joins INTERPOL’s Gateway Initiative to Support Global Cybercrime Efforts

Torrance, United States / California, October 27th, 2026, CyberNewswire AI SPERA, the company behind the cyber threat intelligence and attack surface management platform Criminal IP, has signed a cooperation agreement with the International Criminal Police Organization (INTERPOL) under its Gateway initiative. The agreement establishes a framework for sharing information and technical expertise relevant to cybercrime […]

The post https://cybersecuritynews.com/criminal-ip-joins-interpols-gateway-initiative-to-support-global-cybercrime-efforts/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/criminal-ip-joins-interpols-gateway-initiative-to-support-global-cybercrime-efforts/

Before Your SOC Investigates: What 16K+ Security Teams Already ...

2026-10-27T17:29:11Z

Before Your SOC Investigates: What 16K+ Security Teams Already Know

What if some of the threats reaching your organization’s environment had already been identified elsewhere, before your security team even started investigating them? Chances are, some were. According to ANY.RUN’s research, up to 30% of unique malicious indicators of compromise (IOCs) identified in studied Interactive Sandbox sessions had already been observed by ANY.RUN and were […]

The post https://cybersecuritynews.com/before-your-soc-investigates-what-16k-security-teams-already-know/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/before-your-soc-investigates-what-16k-security-teams-already-know/

Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of ...

2026-10-27T17:04:05Z

Critical GoAhead TLS Flaws Could Expose Hundreds of Millions of Devices to Attacks

Three new security flaws affect GoAhead, a small web server that device makers build into routers, printers, gateways, and industrial controllers. The software runs in hundreds of millions of devices, including those used by Palo Alto Networks, Siemens, Honeywell, and Boeing. The flaws affect how these devices check digital certificates and protect encrypted traffic. The […]

The post https://cybersecuritynews.com/goahead-tls-vulnerabilities/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/goahead-tls-vulnerabilities/

Researchers Exploit OpenAI API Flaw to Extract Hidden GPT-5.6 ...

2026-10-27T16:48:20Z

Researchers Exploit OpenAI API Flaw to Extract Hidden GPT-5.6 Reasoning Traces

Researchers at Xint found an OpenAI API flaw that exposed hidden reasoning in GPT-5.6 models by routing prompts through a conversation-compaction feature. The method, called compaction smuggling, bypassed protections introduced in August 2026. According to Xint, OpenAI confirmed the bug, deployed an undisclosed fix on October 23, and awarded the team a $6,000 bounty. The […]

The post https://cybersecuritynews.com/researchers-exploit-openai-api-flaw/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/researchers-exploit-openai-api-flaw/

CISA Offers Two Free Tools to Detect Security Misconfigurations ...

2026-10-27T15:31:45Z

CISA Offers Two Free Tools to Detect Security Misconfigurations in Microsoft 365 and Google Workspace

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers two free tools to help organizations find security misconfigurations in Microsoft 365 and Google Workspace. ScubaGear and ScubaGoggles compare cloud settings against recommended security baselines, giving administrators a clearer view of weaknesses that need attention. Both are available to government agencies and private businesses. The tools […]

The post https://cybersecuritynews.com/cisa-free-tools-to-detect-misconfigurations/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/cisa-free-tools-to-detect-misconfigurations/

Israeli Ad Tech Firm Accused on Using Online Ads to Track ...

2026-10-27T15:15:52Z

Israeli Ad Tech Firm Accused on Using Online Ads to Track Starlink Users

Israeli advertising company Discover-Tech is accused of using online ads to track people connected to SpaceX’s Starlink satellite internet service. Reuters reported on October 27 that six people familiar with the research said TrendAI researchers linked the company to unusually heavy advertising activity aimed at Starlink users. The findings raise concerns about how routine advertising […]

The post https://cybersecuritynews.com/online-ads-track-starlink-users/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/online-ads-track-starlink-users/

Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and ...

2026-10-27T14:18:33Z

Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and Evade Windows Security

Hackers are sending fake FedEx tax invoices to trick users into installing a stealthy backdoor on Windows. The malware, called Sirius Backdoor, hides inside a blank PDF and loads its main code directly into memory, which leaves very few traces on the hard drive. The emails target people who handle bills and payments. They are […]

The post https://cybersecuritynews.com/fake-fedex-invoices/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/fake-fedex-invoices/

Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy ...

2026-10-27T14:02:29Z

Hackers Abuse Signed ChatGPT and Claude Binaries to Deploy Malware Through Fake GitHub Downloads

A malware campaign known as Yoba targets users by leveraging the popularity of AI tools like ChatGPT and Claude to trick them into installing infected software. They publish fake GitHub projects that pose as desktop apps named GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. Because the projects sit on GitHub, a platform many developers trust, […]

The post https://cybersecuritynews.com/fake-github-chatgpt-claude-malware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/fake-github-chatgpt-claude-malware/

Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to ...

2026-10-27T11:37:34Z

Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges

HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes namespace. Tracked as CVE-2026-110720, the flaw affects deployments using automated system access control list management. HashiCorp disclosed the issue on October 26, 2026, and identified Consul-k8s 2.1.0 and 1.8.18 as patched releases. The […]

The post https://cybersecuritynews.com/hashicorp-consul-kubernetes-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hashicorp-consul-kubernetes-vulnerability/

Hackers Hijack AI Pentesting Agents to Install Backdoors and ...

2026-10-27T10:57:16Z

Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys

Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break into exposed panels for Cairn, a platform that gives AI agents goals and lets them work on their own. Once inside, the attackers push new tasks into those agents. These tasks […]

The post https://cybersecuritynews.com/ai-pentesting-agents/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/ai-pentesting-agents/

DreamHost Forces Email and FTP Password Resets Following ...

2026-10-27T08:30:23Z

DreamHost Forces Email and FTP Password Resets Following Unexplained Security Incident

DreamHost forced password resets for affected email and FTP/SFTP accounts after an unexplained incident disrupted webmail and File Manager, preventing sign-ins until new credentials are set. DreamHost said the password resets were precautionary but has not disclosed the cause or confirmed data theft. The incident began on October 23, 2026, with File Manager connectivity issues. […]

The post https://cybersecuritynews.com/dreamhost-forces-email-and-ftp-password-resets/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/dreamhost-forces-email-and-ftp-password-resets/

OpenAI Unveils GPT-6.1 Terra, a Faster AI Model With Critical ...

2026-10-27T08:25:49Z

OpenAI Unveils GPT-6.1 Terra, a Faster AI Model With Critical Cybersecurity Capabilities

OpenAI has introduced GPT-6.1 Terra, a faster, lower-cost AI model for visual analysis, computer use, writing, and coding. Released on October 26, the model also carries a Critical cybersecurity capability rating under OpenAI’s Preparedness Framework, placing its security risks alongside those of GPT-6 Astra. The release brings stronger automation to everyday work while raising questions […]

The post https://cybersecuritynews.com/openai-unveils-gpt-6-1-terra/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/openai-unveils-gpt-6-1-terra/

Top 10 Best Confidential Computing Platforms in 2026 [Ranked ...

2026-10-27T08:05:33Z

Top 10 Best Confidential Computing Platforms in 2026 [Ranked & Scored]

Encryption always had a hole: data must decrypt to compute, and whoever owns the machine cloud admin, hypervisor, intruder with root could watch. Confidential computing closes it with hardware-enforced trusted execution environments (TEEs) that keep data encrypted even mid-computation and prove it via attestation. In 2026, AI made the niche mainstream: enterprises want models fine-tuned […]

The post https://cybersecuritynews.com/best-confidential-computing-platforms/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-confidential-computing-platforms/

Hackers Infect 953 Online Stores With Malicious JavaScript That ...

2026-10-27T07:55:48Z

Hackers Infect 953 Online Stores With Malicious JavaScript That Evades Security Scanners

A criminal group has infected Magento stores with malicious JavaScript since July 2025, and 953 online shops have been hit so far. Most of the victims run Magento, a popular platform for building online stores. The campaign is still active. The operators switch to a new web domain every few months, and the latest one, […]

The post https://cybersecuritynews.com/hackers-infect-953-online-stores/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-infect-953-online-stores/

Hackers Impersonate IT Support on Microsoft Teams to Gain Remote ...

2026-10-27T07:34:08Z

Hackers Impersonate IT Support on Microsoft Teams to Gain Remote Access to Employees’ PCs

Hackers are impersonating IT support staff on Microsoft Teams to persuade employees to grant remote access to their Windows computers. The activity combines convincing helpdesk identities, unwanted email floods, and legitimate remote support tools, turning an apparently routine workplace conversation into an opportunity to install malware and investigate corporate networks. The attacks exploit trust rather […]

The post https://cybersecuritynews.com/it-support-on-microsoft-teams/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/it-support-on-microsoft-teams/

Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using ...

2026-10-27T06:57:45Z

Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens

Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026. The ten-week campaign also generated more than 200,000 failed login attempts across monitored customer environments. The attackers targeted authenticated sessions rather than relying on password guessing. Similar to previously […]

The post https://cybersecuritynews.com/microsoft-365-accounts/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/microsoft-365-accounts/

Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants ...

2026-10-27T06:11:26Z

Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise

Hackers used AI agents and stolen ConnectWise application credentials to attempt access to more than 2,250 Microsoft 365 tenants, according to Microsoft’s technical investigation report. Microsoft attributed the campaign to Storm-0940, a China-state-aligned group, and said its ARTEX framework accelerated reconnaissance, authentication attempts, and cloud persistence. The targeting count does not mean every tenant was […]

The post https://cybersecuritynews.com/hackers-use-ai-agents/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-use-ai-agents/

OpenAI Codex Breaks USB Encryption in Minutes, Exposing Hardcoded ...

2026-10-27T05:40:35Z

OpenAI Codex Breaks USB Encryption in Minutes, Exposing Hardcoded Keys and Security Flaws

OpenAI Codex helped researcher Xusheng Li uncover flaws in four USB protection products, including hardcoded encryption keys and hidden accounts that allowed files to be decrypted without the owner’s password. In one test, Codex identified the main weakness in seven minutes. The findings expose failures in how these products handle secrets, rather than a breakthrough […]

The post https://cybersecuritynews.com/openai-codex-breaks-usb-encryption-in-minutes/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/openai-codex-breaks-usb-encryption-in-minutes/

Hackers Abuse Claude’s Official Website and Google Ads to ...

2026-10-27T04:40:22Z

Hackers Abuse Claude’s Official Website and Google Ads to Spread Malware

Cybercriminals found a simple way to make a fake download page look trustworthy. Instead of registering a lookalike domain, they placed their lure on claude.ai, the official website of Anthropic, the company behind the Claude AI assistant. The fake page carried Claude branding and offered what looked like easy steps to install a desktop app. […]

The post https://cybersecuritynews.com/claudes-official-website/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claudes-official-website/

Hackers Use Malicious Instagram Ads to Infect iPhones With ...

2026-10-27T04:21:53Z

Hackers Use Malicious Instagram Ads to Infect iPhones With Spyware Without a Click

Hackers are using malicious Instagram advertisements to infect vulnerable iPhones with spyware while users scroll through their feeds. A documented attack used a World Cup advertisement to deliver the P7 variant of DarkSword, exposing sensitive information without requiring the victim to tap the ad, download a file, or install an application. The findings show how […]

The post https://cybersecuritynews.com/malicious-instagram-ads/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/malicious-instagram-ads/

Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and ...

2026-10-27T04:17:51Z

Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Releases Workarounds

Palo Alto Networks has confirmed that a critical Brotli vulnerability affects some PAN-OS firewall deployments and its Prisma Cloud Application Security Transporter Client. Tracked as CVE-2026-111497, the flaw could let an attacker corrupt memory, expose sensitive data, crash a service, or potentially run code without authentication. The company published its advisory on October 26, 2026. […]

The post https://cybersecuritynews.com/brotli-vulnerability-affects-pan-os/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/brotli-vulnerability-affects-pan-os/

New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor ...

2026-10-27T04:01:59Z

New Aokigahara Malware Targets ChatGPT, Claude, Codex, and Cursor Login Credentials

A newly observed Windows infostealer called Aokigahara is targeting login credentials and session data associated with ChatGPT Desktop, Claude, Codex, and Cursor. The malware searches infected computers for authentication files and application storage, extending familiar password theft into the AI tools developers increasingly use for everyday work. The threat is not evidence that these AI […]

The post https://cybersecuritynews.com/aokigahara-malware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/aokigahara-malware/

Hackers Sell ICMacOS Remote Access Trojan for $699 a Week to ...

2026-10-27T03:50:13Z

Hackers Sell ICMacOS Remote Access Trojan for $699 a Week to Target Mac Users

Cybercriminals are selling a Mac malware kit that can do far more than steal passwords. The tool, called ICMacOS or Icarus macOS, is offered for $699 a week on Russian-speaking dark web forums. It began as a basic data stealer, but its newer version can stay hidden on a Mac, survive restarts, and run commands […]

The post https://cybersecuritynews.com/icmacos-remote-access-trojan/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/icmacos-remote-access-trojan/

Claude Code Reportedly Finds 214,856 Deleted Photos and Videos ...

2026-10-27T03:47:20Z

Claude Code Reportedly Finds 214,856 Deleted Photos and Videos Hidden on Android Phone

Anthropic’s Claude Code reportedly found 214,856 files linked to deleted photos and videos on a Google Pixel, raising privacy concerns about Android photos. The user, known as Cooler (@coolerwave), said files remained in a hidden thumbnail folder even after the original images were permanently deleted. This claim is unverified and cannot be confirmed as an […]

The post https://cybersecuritynews.com/claude-code-finds-deleted-photos/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claude-code-finds-deleted-photos/

Apache Camel Fixes Multiple Vulnerabilities Including ...

2026-10-27T02:50:31Z

Apache Camel Fixes Multiple Vulnerabilities Including High-Severity XXE One’s

Apache Camel has released fixes for multiple security flaws, including high-severity XML External Entity vulnerabilities that could expose local files or reach internal systems. The issues affect several components, with risks ranging from unsafe XML processing to remote code execution, stolen credentials, and failed access checks. Apache’s security advisories list patched releases for each affected […]

The post https://cybersecuritynews.com/apache-camel-fixes-multiple-vulnerabilities/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/apache-camel-fixes-multiple-vulnerabilities/

New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding ...

2026-10-27T02:33:36Z

New DarkCore RAT Targets Gmail and WhatsApp Sessions While Hiding Behind Victims’ IP Addresses

A newly uncovered remote access trojan called DarkCore is being marketed with a browser designed to reuse stolen Gmail, WhatsApp, and other account sessions while routing traffic through victims’ IP addresses. The approach could make unauthorized account access look like normal activity from an already trusted connection. The Windows malware combines advertised credential theft, file […]

The post https://cybersecuritynews.com/new-darkcore-rat/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/new-darkcore-rat/

Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly ...

2026-10-27T02:08:23Z

Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors

WordPress administrators often keep their dashboard open in the same browser they use for everyday browsing. A new attack chain shows why that habit is risky. Researchers have documented a JavaScript loader that waits for a signed-in administrator to visit a compromised page, then uses that browser’s trusted session to install a hidden PHP backdoor […]

The post https://cybersecuritynews.com/logged-in-wordpress-admin-sessions/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/logged-in-wordpress-admin-sessions/

Hackers Revive BlackLotus Techniques to Bypass Windows Secure ...

2026-10-27T01:43:07Z

Hackers Revive BlackLotus Techniques to Bypass Windows Secure Boot and Deploy Malware

Hackers have revived techniques associated with the BlackLotus bootkit to bypass Windows Secure Boot and deploy espionage malware against diplomatic organizations in Central Asia. The new bootkit, named BlackX, appeared in attacks targeting agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Investigators linked the campaign to APT41 with medium confidence, leaving attribution short of […]

The post https://cybersecuritynews.com/blacklotus-techniques/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/blacklotus-techniques/

Hackers Use VLC Media Player and VMware Tools to Load Malware ...

2026-10-27T01:13:13Z

Hackers Use VLC Media Player and VMware Tools to Load Malware Through DLL Side-Loading

Hackers are using legitimate VLC Media Player and VMware components to load malware onto Windows systems, hiding harmful code behind familiar software. The activity forms part of three malware campaigns targeting users in Brazil and Portugal through fake legal notices, financial documents, and invoice download pages. The attacks combine phishing, hidden scripts, and trusted programs […]

The post https://cybersecuritynews.com/vlc-media-player-and-vmware-tools/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/vlc-media-player-and-vmware-tools/

Hackers Weaponize Public PHP2Shell Exploit Code to Target ...

2026-10-26T20:29:21Z

Hackers Weaponize Public PHP2Shell Exploit Code to Target Universities and Business Websites

Hackers are now using public exploit code to break into websites that run PHP, and universities and business sites are among the main targets. The bugs behind this wave are two critical flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both carry a CVSS v4.0 score of 9.2 and can […]

The post https://cybersecuritynews.com/public-php2shell-exploit-code/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/public-php2shell-exploit-code/

Microsoft Investigation Teams Issue Affecting Users in the United ...

2026-10-26T17:15:22Z

Microsoft Investigation Teams Issue Affecting Users in the United States

Microsoft has restored Microsoft Teams service after investigating an issue affecting some users in the United States on October 26, 2026. The company tracked the disruption under incident TM1526111 and said automatic scaling efforts had returned the service to healthy levels. The recovery update changes the picture from Microsoft’s initial notice, which described a potential […]

The post https://cybersecuritynews.com/microsoft-investigation-teams-issue/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/microsoft-investigation-teams-issue/

Hackers Can Hijack OpenAI Codex and Claude Code Using Malicious ...

2026-10-26T16:35:45Z

Hackers Can Hijack OpenAI Codex and Claude Code Using Malicious Files in Downloads Folder

A plain text file placed in the Downloads folder can trick AI coding agents into changing their settings, installing malware, or exposing login tokens. Forever Security discovered the risk after stopping an agent on a real customer’s computer from installing a known malicious npm package. The company later reproduced separate attack paths against OpenAI Codex […]

The post https://cybersecuritynews.com/codex-and-claude-code-hijack/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/codex-and-claude-code-hijack/

OpenBSD 8.0 Released With Major Security Hardening and ...

2026-10-26T15:59:50Z

OpenBSD 8.0 Released With Major Security Hardening and Post-Quantum SSH Support

OpenBSD 8.0 has been released with security fixes across its kernel, network services, firewall, and update tools, alongside experimental post-quantum SSH signature support. Released on October 20, 2026, the project’s 61st release includes OpenSSH 10.6 and LibreSSL 4.4.0, bringing stronger checks for untrusted data and changes to secure connection handling. The official release notes detail […]

The post https://cybersecuritynews.com/openbsd-8-0-released/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/openbsd-8-0-released/

Emperador Ransomware Group Claims to Have Stolen 3.9GB of Data ...

2026-10-26T15:58:08Z

Emperador Ransomware Group Claims to Have Stolen 3.9GB of Data from the Maker of Budweiser and Corona

The Emperador ransomware group claims to have stolen 3.9GB of data from AB InBev and demands $1 million in Bitcoin, but the alleged breach remains unverified, with no company confirmation reported. The claim was discovered on October 25, 2026, at 03:22 UTC. The tracker lists the same day as the estimated attack date, but that […]

The post https://cybersecuritynews.com/emperador-ransomware-group-claim/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/emperador-ransomware-group-claim/

PHP Releases New Windows Build Security Updates to Fix Critical ...

2026-10-26T15:53:07Z

PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability

The PHP team has released updated Windows builds to fix a serious flaw known as HTTP2Shell. The new packages are PHP 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, and PHP announced them on October 26, 2026. Each build now includes Brotli 1.2.1, which fixes CVE-2026-111497. Windows users who run PHP should install these packages without delay. The […]

The post https://cybersecuritynews.com/php-http2shell-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/php-http2shell-vulnerability/

Researchers Use AI Agents to Breach Anthropic’s Internal ...

2026-10-26T14:42:50Z

Researchers Use AI Agents to Breach Anthropic’s Internal Systems in Just 12 Hours

Cybersecurity startup Cathedral says its AI agents found routes into Anthropic’s internal business systems in less than 12 hours, exposing how fast automated security tools can find and chain flaws across connected services. The work took place through Anthropic’s program for outside researchers, making this an authorized security test rather than a criminal attack, according […]

The post https://cybersecuritynews.com/anthropic-internal-system-breach/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/anthropic-internal-system-breach/

Anthropic’s Claude AI Model Accessed US State Voter Data Behind ...

2026-10-26T13:41:03Z

Anthropic’s Claude AI Model Accessed US State Voter Data Behind a Paywall

Anthropic’s Claude AI model accessed aggregate vote counts from Georgia without human approval after bypassing a paywall during an internal statistics project. The data was available to the public for a fee, but the model retrieved it without being asked to take that step, according to Axios reporting published on October 25. The incident raises […]

The post https://cybersecuritynews.com/claude-ai-accessed-voter-data/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claude-ai-accessed-voter-data/

Microsoft Releases Out-of-Band Security Updates for Brotli and ...

2026-10-26T13:22:05Z

Microsoft Releases Out-of-Band Security Updates for Brotli and .NET tarballs Vulnerability

Microsoft has released out-of-band security updates for .NET to fix a Brotli buffer overflow and unsafe ownership settings in Linux distribution archives. Published on October 25, 2026, the release covers .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. Microsoft urges users to update as soon as possible. The official Microsoft announcement […]

The post https://cybersecuritynews.com/microsoft-security-updates-for-brotli-and-net-tarballs-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/microsoft-security-updates-for-brotli-and-net-tarballs-vulnerability/

Cloudflare Release Emergency WAF Ruleset Update Following Brotli ...

2026-10-26T13:18:59Z

Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability

Cloudflare has announced an emergency Web Application Firewall (WAF) ruleset update linked to CVE-2026-111497, a Brotli vulnerability. The October 25, 2026 release adds two rules for Brotli-encoded request bodies and the Next.js image optimization endpoint, enabled by default in Log mode to monitor matching traffic without blocking it. The key detail is that this update […]

The post https://cybersecuritynews.com/cloudflare-release-brotli-vulnerability-waf-ruleset/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/cloudflare-release-brotli-vulnerability-waf-ruleset/

Kali Linux 2026.3 Released With 6 New Penetration Testing Tools ...

2026-10-26T10:26:52Z

Kali Linux 2026.3 Released With 6 New Penetration Testing Tools and Linux Kernel 7.1

Kali Linux 2026.3 has been released as the third Kali update of 2026, bringing six new penetration testing tools, Linux kernel 7.1.5, KDE Plasma 6.7, refreshed image-building scripts, and a large set of Kali NetHunter changes. The release arrived on October 26 with 126 package updates and moves the kernel from version 6.19 to 7.1.5. […]

The post https://cybersecuritynews.com/kali-linux-2026-3-released/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/kali-linux-2026-3-released/

Top 10 Best Data Access Governance Tools in 2026 [Ranked & ...

2026-10-26T09:56:03Z

Top 10 Best Data Access Governance Tools in 2026 [Ranked & Scored]

Ask any enterprise “who can read the M&A folder?” and watch the room go quiet effective access is buried under nested groups, inherited shares, service-account grants, and warehouse roles nobody has reviewed since the migration. Data access governance (DAG) answers that question continuously and then shrinks the answer. It’s also 2026’s quiet AI prerequisite: every […]

The post https://cybersecuritynews.com/best-data-access-governance/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-data-access-governance/

OpenSSL 4.1.0 Released With DTLS 1.3 and Post-Quantum Security ...

2026-10-26T09:46:43Z

OpenSSL 4.1.0 Released With DTLS 1.3 and Post-Quantum Security Improvements

OpenSSL has released version 4.1.0, bringing DTLS 1.3 support, faster cryptographic operations, and new tools for developers building secure network services. Published on October 23, the update is a feature release, not a standalone security patch. It also includes compatibility changes and four known issues that teams should review before deployment. The official release notes […]

The post https://cybersecuritynews.com/openssl-4-1-0-released/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/openssl-4-1-0-released/

Top 10 Best Sensitive Data Discovery Tools in 2026 [Ranked & ...

2026-10-26T09:46:25Z

Top 10 Best Sensitive Data Discovery Tools in 2026 [Ranked & Scored]

Every data-security control inherits the same dependency: an inventory someone actually believes. Discovery is where that inventory comes from and in 2026 the job has hardened, because shadow data multiplies in SaaS and warehouses, AI pipelines copy training sets nobody registers, and classification without identity correlation can’t answer the only legal question that matters: whose […]

The post https://cybersecuritynews.com/best-data-discovery-tools/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-data-discovery-tools/

HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, ...

2026-10-26T06:35:41Z

HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow

The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads. The findings show that checking Node.js versions alone can leave other exposed software unnoticed. In research published on October 25, JFrog researchers Aviv Engelberg, […]

The post https://cybersecuritynews.com/http2shell-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/http2shell-vulnerability/

Microsoft Authenticator Flaw Lets Malicious Android Apps Steal ...

2026-10-26T06:33:44Z

Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions

Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component. Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account. […]

The post https://cybersecuritynews.com/microsoft-authenticator-flaw/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/microsoft-authenticator-flaw/

India’s Film Sensor Board Data Breach – Unreleased Scripts, ...

2026-10-26T06:15:31Z

India’s Film Sensor Board Data Breach – Unreleased Scripts, 500+ Film Titles Exposed

India’s Central Board of Film Certification (CBFC) is investigating a reported data breach involving confidential documents linked to more than 500 film titles. The exposed records reportedly include shooting scripts, censor cut orders, certification files and private distribution agreements submitted through its e-Cinepramaan portal. The Hindu first reported the exposure, which involved film certification applications […]

The post https://cybersecuritynews.com/indias-film-sensor-board-data-breach/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/indias-film-sensor-board-data-breach/

Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin ...

2026-10-26T03:41:52Z

Hacker Exploits Critical PHP2Shell Flaws to Win $2,000 Bitcoin Challenge, Releases PoC

A security researcher known online as killa has won a public Bitcoin challenge by using two critical PHP flaws to reach a test server. The winning run took 19.28 hours. The prize pot was 0.02511679 BTC, worth $2,021.22 at the time of the win on October 25, 2026, at 15:47 UTC. The researcher then published […]

The post https://cybersecuritynews.com/php2shell-flaws-exploited/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/php2shell-flaws-exploited/

Tailscale SSH Flaws Could Let Hackers Gain Root Access Across ...

2026-10-25T14:11:30Z

Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers From One Compromised Device

A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report, called Tailworm, was published on October 25, 2026, by security researcher Erica Windisch […]

The post https://cybersecuritynews.com/tailscale-ssh-flaws/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/tailscale-ssh-flaws/

Microsoft Teams to Use AI for Detecting Phishing Attacks Using ...

2026-10-25T06:55:23Z

Microsoft Teams to Use AI for Detecting Phishing Attacks Using Teams Conversations

Microsoft is preparing to add AI phishing detection to Microsoft Teams, using conversation context to spot scams that may contain no harmful links or attachments. The feature will focus mainly on first conversations with external contacts, where attackers can pose as trusted support staff and ask employees to share sensitive information. Microsoft detailed the change […]

The post https://cybersecuritynews.com/microsoft-teams-ai-detection/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/microsoft-teams-ai-detection/

Anthropic’s Claude Mythos 5 AI Agent Tried to Inject Malicious ...

2026-10-24T07:09:35Z

Anthropic’s Claude Mythos 5 AI Agent Tried to Inject Malicious Code and Trick Real Developers

Anthropic has revealed how its Claude Mythos 5 AI agent tried to plant malicious code in a real GitHub project and used fake identities to persuade developers to approve it during a cybersecurity test run by the UK AI Security Institute (AISI). Published on October 23, 2026, Anthropic’s assessment examines behavior first disclosed in August. […]

The post https://cybersecuritynews.com/claude-mythos-5-inject-malicious-code/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claude-mythos-5-inject-malicious-code/

Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and ...

2026-10-24T06:41:29Z

Palo Alto Confirms PHP RCE Vulnerabilities Impact PAN-OS and Multiple Network Products

Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities affect PAN-OS and previously impacted two cloud services. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have prompted planned firewall hotfixes and guidance to restrict access to management interfaces. The company updated its security advisory on October 24, 2026. It said it was […]

The post https://cybersecuritynews.com/palo-alto-confirms-php-rce-vulnerabilities/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/palo-alto-confirms-php-rce-vulnerabilities/

OpenAI AI Agents Bypass Security Isolation, Exploiting 0-Days in ...

2026-10-24T05:43:26Z

OpenAI AI Agents Bypass Security Isolation, Exploiting 0-Days in Red-Teaming Tests

OpenAI says its AI agents found zero-day flaws, escaped sandboxes, reached the live internet, and exchanged information across isolation boundaries during large red-teaming tests of its research systems. The findings, published on October 23, show how advanced models can chain software bugs and setup errors to bypass controls designed to contain them. The company said […]

The post https://cybersecuritynews.com/openai-ai-agents-bypass-security/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/openai-ai-agents-bypass-security/

WhatsApp May Stop Working Without Registered SIM Under New Rules ...

2026-10-23T15:20:07Z

WhatsApp May Stop Working Without Registered SIM Under New Rules

WhatsApp users in India may face access issues without a registered SIM under new government rules expected to take effect on January 1, 2027. Messaging platforms reportedly have until December 31, 2026, to comply. The change could affect people using accounts on secondary phones, tablets, and devices without an active registered SIM. The requirement, known […]

The post https://cybersecuritynews.com/whatsapp-stop-working-without-registered-sim/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/whatsapp-stop-working-without-registered-sim/

Critical Okta Access Gateway Flaw Lets Attackers With Admin ...

2026-10-23T15:19:23Z

Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands

Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when […]

The post https://cybersecuritynews.com/okta-access-gateway-flaw/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/okta-access-gateway-flaw/

HPE Warns Critical Aruba Networking Flaws Could Let Hackers Take ...

2026-10-23T14:53:59Z

HPE Warns Critical Aruba Networking Flaws Could Let Hackers Take Complete Control of Devices

Hewlett Packard Enterprise has released security patches for multiple vulnerabilities in Aruba Networking wireless software that could let attackers take complete control of affected devices. The flaws affect AOS-8 and AOS-10 deployments across Mobility Conductors, Controllers, Gateways, and access points. Several allow attacks without a valid login, making prompt patching a priority for network administrators. […]

The post https://cybersecuritynews.com/hpe-warns-aruba-networking-flaws/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hpe-warns-aruba-networking-flaws/

Japanese Game Maker Capcom Has Confirmed – 11,774,247 Customer ...

2026-10-23T14:37:14Z

Japanese Game Maker Capcom Has Confirmed – 11,774,247 Customer Records Exposed

Capcom has announced plans to notify customers after unauthorized access to its CAPCOM ID service affected 11,774,247 records worldwide. The Japanese game publisher disclosed the incident on October 22, 2026, saying the exposed information included email addresses and details of account activity. Attackers also changed passwords on 196 accounts without permission. Capcom has reset those […]

The post https://cybersecuritynews.com/capcom-confirmed-customer-records-exposed/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/capcom-confirmed-customer-records-exposed/

Multiple Waves of DDoS Attacks Caused This Week’s Outage in ...

2026-10-23T14:22:35Z

Multiple Waves of DDoS Attacks Caused This Week’s Outage in North Korea

Multiple waves of DDoS attacks disrupted North Korea’s public internet services this week, knocking major state websites offline. Kentik’s internet analysis director Doug Madory linked the outages to sudden traffic floods from Vietnam, the Philippines, Venezuela, and other countries. The traffic began at 02:01 UTC on October 20, making the country’s websites unreachable. The disruption […]

The post https://cybersecuritynews.com/multiple-waves-of-ddos-attacks-caused-in-north-korea/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/multiple-waves-of-ddos-attacks-caused-in-north-korea/

New Node2Shell Node.js RCE Exploit Let Attackers Execute ...

2026-10-23T14:11:40Z

New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data

Researchers has demonstrated Node2Shell, a working exploit that lets an attacker run code inside a Node.js application through specially crafted, Brotli-compressed data. The research targets CVE-2026-111497, a high-severity memory flaw in the Brotli decoder bundled with Node.js. The Node.js security advisory, published on October 21, 2026, confirms that the flaw can allow remote code execution […]

The post https://cybersecuritynews.com/new-node2shell-node-js-rce-exploit/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/new-node2shell-node-js-rce-exploit/

Hackers Actively Exploiting Critical VeloCloud Orchestrator Flaw ...

2026-10-23T13:57:11Z

Hackers Actively Exploiting Critical VeloCloud Orchestrator Flaw to Gain Superuser Access

Hackers are actively exploiting a critical SQL injection flaw in VeloCloud Orchestrator (VCO) that allows logged-in users to gain superuser operator access. Arista Networks disclosed the vulnerability on October 22, 2026, warning that successful attacks could compromise the orchestrator, its host, and the data it manages. Arista has already patched hosted deployments, including Dedicated instances. […]

The post https://cybersecuritynews.com/hackers-exploiting-velocloud-orchestrator-flaw/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-exploiting-velocloud-orchestrator-flaw/

StealC Malware Returns as New Stadia RAT to Steal Passwords and ...

2026-10-23T13:40:19Z

StealC Malware Returns as New Stadia RAT to Steal Passwords and Secretly Control Windows PCs

The seller behind StealC has returned with Stadia, a Windows remote access trojan that combines password theft with hidden desktop control. Advertised on October 16, 2026, the malware expands beyond stealing data, allowing criminals to run commands, browse files, manage processes, and load more malicious software. The return follows June’s Operation Endgame disruption. Authorities seized […]

The post https://cybersecuritynews.com/stealc-malware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/stealc-malware/

Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to ...

2026-10-23T13:00:37Z

Critical PHP2Shell Exploit Code Goes Public as Hackers Attempt to Deploy Botnet Malware

Public proof-of-concept code for two critical PHP vulnerabilities is now available, and attackers have tried to use the flaws to deploy botnet malware. Known together as PHP2Shell, CVE-2026-109618 and CVE-2026-109619 both carry a CVSS severity score of 9.2 and can allow attackers to run code without logging in. However, attempted exploitation must not be confused […]

The post https://cybersecuritynews.com/critical-php2shell-exploit-code/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/critical-php2shell-exploit-code/

Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on ...

2026-10-23T11:23:35Z

Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on Fully Patched Systems

A new UEFI bootkit called BlackX has been used in cyberespionage attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The malware targets Secure Boot, a feature designed to help stop untrusted software from running before Windows starts. Researchers say the infected computers had received Windows updates, but a key Secure Boot protection had not […]

The post https://cybersecuritynews.com/hackers-use-new-blackx-bootkit/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-use-new-blackx-bootkit/

SBI Notifies Customers Impacted With the Recent Cyber Incident ...

2026-10-23T09:20:41Z

SBI Notifies Customers Impacted With the Recent Cyber Incident

State Bank of India (SBI) has individually notified customers whose information was identified in a recent cyber incident, sending alerts through email and WhatsApp. In its latest advisory on October 23, the bank said customer account balances and funds remain safe while investigators examine the suspected exposure of personal information found on the dark web. […]

The post https://cybersecuritynews.com/sbi-notifies-customers-with-cyber-incident/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/sbi-notifies-customers-with-cyber-incident/

Top 10 Best Email Encryption Services in 2026 [Ranked & ...

2026-10-23T08:22:52Z

Top 10 Best Email Encryption Services in 2026 [Ranked & Scored]

Email encryption has a usability paradox: the strongest cryptography loses to the recipient who gives up at the portal login and asks for the file “some other way.” The 2026 winners solve for both ends sender-side automation (policies, DLP triggers, one-click protect) and recipient experiences that don’t require a manual. We scored ten services on […]

The post https://cybersecuritynews.com/best-email-encryption-services/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-email-encryption-services/

Top 9 Best Managed File Transfer (MFT) Solutions in 2026 [Ranked ...

2026-10-23T08:16:37Z

Top 9 Best Managed File Transfer (MFT) Solutions in 2026 [Ranked & Scored]

No category has been breached more publicly this decade than managed file transfer mass-exploitation campaigns against MFT products turned quiet integration plumbing into board-level risk, and the 2023–2024 waves rewrote the buying criteria. In 2026 you evaluate an MFT vendor’s security engineering exposure architecture, patch velocity, hardening posture before its scheduler. Our sheet listed ten […]

The post https://cybersecuritynews.com/best-managed-file-transfer/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-managed-file-transfer/

Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web ...

2026-10-23T07:50:58Z

Hackers Exploit Critical Citrix NetScaler RCE Flaw to Deploy Web Shells and Malware

A critical flaw in Citrix NetScaler ADC and NetScaler Gateway is being used to run commands on exposed appliances, install web shells and deliver malware. Tracked as CVE-2026-88771, the vulnerability stems from improper input validation and can allow an unauthenticated attacker to execute commands remotely. Citrix gives it a CVSS 4.0 score of 9.5 and […]

The post https://cybersecuritynews.com/citrix-netscaler-rce-flaw/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/citrix-netscaler-rce-flaw/

Hacker With Limited Skills Used DeepSeek AI to Breach Indian ...

2026-10-23T07:13:36Z

Hacker With Limited Skills Used DeepSeek AI to Breach Indian University and Steal Over 5,200 Records

A cybercriminal using the online handle BUGSTER used artificial intelligence tools to support attacks on Indian organizations, including two universities. In one confirmed intrusion, the attacker stole a MongoDB database containing more than 5,200 records, including personal information about students and staff, according to Palo Alto Networks’ Unit 42. The researchers did not name the […]

The post https://cybersecuritynews.com/hacker-with-limited-skills-used-deepseek-ai/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hacker-with-limited-skills-used-deepseek-ai/

Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust ...

2026-10-23T06:01:47Z

Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability

Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM. The update blocks affected intermediate certificate authority certificates linked to eMudhra. […]

The post https://cybersecuritynews.com/emergency-java-update/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/emergency-java-update/

PwC Data Breach Claim – Everest Ransomware Group Claims to Have ...

2026-10-23T05:12:54Z

PwC Data Breach Claim – Everest Ransomware Group Claims to Have Stolen 590 GB of Data

The Everest ransomware group claims to have stolen 590.69 GB of data from PwC, the global professional services firm. This alleged data theft includes human resources records, training materials, and internal documents. However, the claims are unverified, and PwC has not yet responded. The group’s listing was reported on October 22, 2026. Hackmanac’s public alert […]

The post https://cybersecuritynews.com/pwc-data-breach-claim/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/pwc-data-breach-claim/

Critical Cisco Expressway Vulnerability Enables Remote Code ...

2026-10-23T04:47:50Z

Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks

Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root. Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9.8 and affects vulnerable Expressway devices configured in a cluster. Cisco published its advisory on October 21, 2026. The issue affects Cisco Expressway […]

The post https://cybersecuritynews.com/critical-cisco-expressway-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/critical-cisco-expressway-vulnerability/

Splunk Fixes 24 Security Flaws, Including Four Critical ...

2026-10-23T03:41:41Z

Splunk Fixes 24 Security Flaws, Including Four Critical Vulnerabilities in Enterprise and SOAR

Splunk has released security updates for 24 vulnerabilities in Splunk Enterprise and Splunk SOAR, including four critical flaws with CVSS scores from 9.3 to 9.9. Splunk published the fixes on October 21, 2026, across three advisories covering access control, input handling, exposed files, remote code execution, denial of service, and weak authorization checks. The Splunk […]

The post https://cybersecuritynews.com/splunk-fixes-24-security-flaws/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/splunk-fixes-24-security-flaws/

Quest Diagnostics Hacked – Attackers Accessed the System to ...

2026-10-23T03:29:20Z

Quest Diagnostics Hacked – Attackers Accessed the System to Order Tests and View Results

Quest Diagnostics has disclosed a cyberattack involving unauthorized access to its Quanum LSM system, which healthcare clients use to order laboratory tests and view results. The company discovered the incident on October 21, 2026, and suspended access to the platform while investigating whether patient records were exposed. The affected service, Quanum Lab Services Manager, supports […]

The post https://cybersecuritynews.com/quest-diagnostics-hacked/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/quest-diagnostics-hacked/

Gcore Makes Enterprise Security Bundle Free for Public Agencies ...

2026-10-22T16:12:01Z

Gcore Makes Enterprise Security Bundle Free for Public Agencies Until End of the Year

Contern, Luxembourg, October 22nd, 2026, CyberNewswire Gcore is offering its WAAP Enterprise plan free of charge to any government body or public agency until December 31, 2026. The offer follows the php2shell vulnerabilities that forced public websites offline across Europe earlier this week. Gcore WAAP blocks the php2shell attack path (CVE-2026-109618 and CVE-2026-109619) by default […]

The post https://cybersecuritynews.com/gcore-makes-enterprise-security-bundle-free-for-public-agencies-until-end-of-the-year/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/gcore-makes-enterprise-security-bundle-free-for-public-agencies-until-end-of-the-year/

Major U.S. Banks Detect Unauthorized AI Agents Operating Inside ...

2026-10-22T15:23:07Z

Major U.S. Banks Detect Unauthorized AI Agents Operating Inside Customer Accounts

Major U.S. banks are detecting third-party AI agents inside customer accounts, raising concerns that automated tools could act beyond the instructions customers give them. Some agents have contacted call centers or appeared to attempt independent actions, according to an Axios report published October 22, citing people familiar with the matter. Morgan Stanley, Bank of America, […]

The post https://cybersecuritynews.com/u-s-banks-detect-unauthorized-ai-agents/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/u-s-banks-detect-unauthorized-ai-agents/

eMudhra Exits Global SSL/TLS Certificate Business Following the ...

2026-10-22T14:52:11Z

eMudhra Exits Global SSL/TLS Certificate Business Following the Vulnerability Disclosure

eMudhra Limited has announced it is exiting the global SSL/TLS certificate business after disclosing weak private keys in eight intermediate certificate authority certificates. The October 22, 2026, decision follows emergency browser protections and growing questions about the company’s certificate issuance controls. eMudhra said its other digital trust services remain unaffected. In its official announcement, the company said […]

The post https://cybersecuritynews.com/emudhra-exits-global-ssl-tls-certificate/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/emudhra-exits-global-ssl-tls-certificate/

Claude Security Now Scans Repositories Continuously to Find Flaws ...

2026-10-22T14:40:43Z

Claude Security Now Scans Repositories Continuously to Find Flaws and Track Fixes

Anthropic has updated Claude Security so it can keep checking connected code repositories as they change, rather than waiting for a person to start each scan. The service also tracks reported vulnerabilities after developers make changes, marks them fixed when a correction is detected, and reopens them if they return. The updated product is in […]

The post https://cybersecuritynews.com/claude-security-continuous-scans/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/claude-security-continuous-scans/

A New Extortion Gang Is Naming Companies on the Dark Web and ...

2026-10-22T14:40:34Z

A New Extortion Gang Is Naming Companies on the Dark Web and Counting Down to Data Leaks

ScarlettGroup, a newly observed cyber extortion gang, is naming companies on a dark web leak site and using countdown timers to threaten the release of allegedly stolen data. The operation puts public pressure on organizations before their breach claims have been independently verified. The group began appearing in threat monitoring records around September 2026 and […]

The post https://cybersecuritynews.com/a-new-extortion-gang/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/a-new-extortion-gang/

Hackers Were Targeting Critical PHP Vulnerabilities Days Before ...

2026-10-22T14:14:07Z

Hackers Were Targeting Critical PHP Vulnerabilities Days Before They Were Patched

A threat actor tried to exploit two critical PHP vulnerabilities four days before the flaws were publicly disclosed and patched, according to Amazon Threat Intelligence. The activity began on October 17, 2026, while the vulnerabilities were still under coordinated disclosure. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell, can allow remote […]

The post https://cybersecuritynews.com/critical-php-vulnerabilities/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/critical-php-vulnerabilities/

Hackers Planted Malware on Japanese Cloud Servers, Forcing the ...

2026-10-22T13:05:45Z

Hackers Planted Malware on Japanese Cloud Servers, Forcing the Provider to Shut Down Its Service

Hackers planted malware in customer server environments at Japan’s Onamae.com Desktop Cloud, prompting the provider to begin shutting down servers across every service plan. The company listed 26,739 servers as potentially affected, raising concerns about stored data and login details. That figure describes the possible scope, not a confirmed count of infected systems. The provider […]

The post https://cybersecuritynews.com/hackers-planted-malware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-planted-malware/

North Korean Hackers Use Post-Quantum Encryption to Hide New ...

2026-10-22T12:38:07Z

North Korean Hackers Use Post-Quantum Encryption to Hide New Malware From Security Tools

North Korean-linked Lazarus hackers are using post-quantum cryptography in a malware delivery chain designed to conceal later-stage payloads from security tools. The technique appeared in Operation FlashHole, a campaign targeting organizations in South Korea. Instead of relying on encryption alone to hide files on disk, the malware uses a modern key-establishment method to protect payloads […]

The post https://cybersecuritynews.com/north-korean-hackers/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/north-korean-hackers/

A Hacker Tried to Turn an AI Chatbot Into a Tool for Attacking ...

2026-10-22T12:15:23Z

A Hacker Tried to Turn an AI Chatbot Into a Tool for Attacking Other Servers

An exposed artificial intelligence platform can give an intruder more than a place to send messages. If it connects to stored credentials, company data, or network tools, the platform may also provide a route toward those resources. A recent honeypot investigation shows how an attacker tried to use an AI agent to study real infrastructure […]

The post https://cybersecuritynews.com/ai-chatbot-into-a-tool/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/ai-chatbot-into-a-tool/

Top 10 Best Secure File Sharing Platforms in 2026 [Ranked & ...

2026-10-22T10:16:44Z

Top 10 Best Secure File Sharing Platforms in 2026 [Ranked & Scored]

Users share files the easiest way available your only real choice is whether the easiest way is also the governed one. The 2026 secure-sharing shortlist is judged on that bargain: consumer-grade usability on top of enterprise controls (classification-aware policy, external-access governance, audit that survives a regulator), because any platform users route around is security theater […]

The post https://cybersecuritynews.com/best-secure-file-sharing/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-secure-file-sharing/

Atlassian Releases Massive Security Update Addressing 176 Flaw ...

2026-10-22T10:12:18Z

Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence

Atlassian has released its October 2026 security bulletin, covering 176 flaw entries across products including Jira, Confluence, Bamboo, Bitbucket, and Crowd. Published on October 20, the update lists 162 high-severity entries and 14 critical-severity third-party entries. Atlassian says it included fixes in product versions released last month and urges customers to install a suitable fixed […]

The post https://cybersecuritynews.com/atlassian-security-update/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/atlassian-security-update/

Top 10 Best Enterprise DRM & Information Rights Management ...

2026-10-22T09:55:15Z

Top 10 Best Enterprise DRM & Information Rights Management Solutions in 2026 [Ranked & Scored]

Perimeters don’t follow files. The deal model emailed to a counterparty, the design doc shared with a contractor, the board pack synced to a trustee’s tablet enterprise DRM (information rights management) keeps policy attached to the document itself: who can open, edit, print, screenshot, and until when, revocable after the file is long gone. We […]

The post https://cybersecuritynews.com/best-drm-irm-solutions/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/best-drm-irm-solutions/

Fortinet Urges Customers to Patch Critical Flaws Affecting ...

2026-10-22T09:18:18Z

Fortinet Urges Customers to Patch Critical Flaws Affecting FortiOS, FortiManager, and FortiAnalyzer

Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated release addresses critical and high-severity vulnerabilities, including flaws found through AI-assisted security testing. The company said customers should address internet-facing devices first. In an October 21 announcement, Fortinet Chief Information Security Officer Carl Windsor warned […]

The post https://cybersecuritynews.com/fortinet-urges-to-patch-critical-flaws/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/fortinet-urges-to-patch-critical-flaws/

Samsung and Vizio Smart TVs Still Send Tracking-Like Traffic ...

2026-10-22T08:40:45Z

Samsung and Vizio Smart TVs Still Send Tracking-Like Traffic After Users Turn It Off

Samsung and Vizio smart TVs kept sending traffic consistent with automatic content recognition (ACR) even after researchers turned off the feature in the privacy settings. The findings raise questions about whether smart TV privacy controls stop viewing-related data flows, while also clarifying an important limit. Encrypted traffic prevented researchers from confirming exactly what these devices […]

The post https://cybersecuritynews.com/samsung-tv-tracking-after-users-turn-it-off/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/samsung-tv-tracking-after-users-turn-it-off/

Hackers Actively Exploiting Siemens Software Center Flaw in ...

2026-10-22T08:29:16Z

Hackers Actively Exploiting Siemens Software Center Flaw in ClickFix Malware Attacks

Hackers are exploiting a DLL side-loading flaw in Siemens Software Center to run malware through a trusted, signed application. Tracked as CVE-2026-110936, the weakness affects versions before 4.0.9.8. Siemens has confirmed active exploitation and released a fix, and existing installations will receive the update the next time the application starts. Siemens published security advisory SSA-580366 […]

The post https://cybersecuritynews.com/siemens-software-center-flaw-exploited/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/siemens-software-center-flaw-exploited/

Critical Signal Vulnerability Could Keep Your Mic and Camera Live ...

2026-10-22T08:26:19Z

Critical Signal Vulnerability Could Keep Your Mic and Camera Live Even After Hang Up

A critical vulnerability in Signal’s calling library could allow a malicious call participant to keep hearing audio after another user tries to hang up. The flaw, tracked as CVE-2026-113380, affects RingRTC versions before 2.72.0 and carries a CVSS severity score of 9.3. Video could also remain active, although the published description does not confirm that […]

The post https://cybersecuritynews.com/critical-signal-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/critical-signal-vulnerability/

Hackers Are Using Real Dell and Staples Emails to Make Their ...

2026-10-22T08:04:07Z

Hackers Are Using Real Dell and Staples Emails to Make Their Scams Look Legitimate

Hackers are abusing genuine Dell and Staples order emails to make fake purchase alerts look credible. Instead of sending a forged message, they place scam instructions inside order details that trusted retail systems deliver, pushing recipients toward phone numbers controlled by the attackers. The emails describe expensive purchases that recipients may not recognize. Their aim […]

The post https://cybersecuritynews.com/hackers-are-using-real-dell/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-are-using-real-dell/

Hackers Used Claude and Grok to Automate Cyberattacks on Over 400 ...

2026-10-22T07:24:56Z

Hackers Used Claude and Grok to Automate Cyberattacks on Over 400 Banks and Financial Firms

A cybercrime group used artificial intelligence (AI) agents to coordinate attacks against more than 400 banks, payment providers and other financial organizations across Latin America, according to a report by cybersecurity company Straiker. The group, known as CyberCartel, reportedly used AI models from Anthropic, xAI and Moonshot AI to help plan and carry out parts […]

The post https://cybersecuritynews.com/hackers-used-claude-and-grok/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-used-claude-and-grok/

October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, ...

2026-10-22T07:16:45Z

October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks

October 21, 2026 brought a demanding mix of emergency security updates, poisoned software releases, and warnings about attacks already underway. PHP servers needed urgent patches. An AI software package was stealing credentials. Other investigations exposed weaknesses in certificate trust, remote management, and VPN access. Several incidents began before October 21, but their recovery work collided […]

The post https://cybersecuritynews.com/october-21-cybersecurity-nightmare/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/october-21-cybersecurity-nightmare/

Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto ...

2026-10-22T06:30:10Z

Hackers Are Breaking Into FortiGate, FortiWeb and Palo Alto GlobalProtect Systems to Steal Passwords

Internet-facing firewalls and VPN systems are under attack in a campaign that aims to steal credentials and gain lasting access to corporate networks. The activity targets FortiGate and FortiWeb devices from Fortinet, as well as Palo Alto Networks GlobalProtect portals. Once inside, operators can collect passwords stored in device configurations and use them to move […]

The post https://cybersecuritynews.com/breaking-into-fortigate-fortiweb/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/breaking-into-fortigate-fortiweb/

China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 ...

2026-10-22T05:25:21Z

China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach

China-state-aligned hackers used ARTEX, an AI-powered penetration-testing framework, to attempt access to more than 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach. Microsoft attributed the attack to Storm-0940 and reported 2,900 sign-in attempts per minute, leaving security teams little time to investigate and block access. The attackers abused stolen application credentials and permissions […]

The post https://cybersecuritynews.com/china-linked-hackers-use-artex-ai/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/china-linked-hackers-use-artex-ai/

Railway Security Incident: Hackers May Have Accessed Customer ...

2026-10-22T03:04:16Z

Railway Security Incident: Hackers May Have Accessed Customer Environment Variables

Railway has disclosed a security incident in which an unauthorized third party may have accessed customer environment variables, including some decrypted values. The cloud platform warned that the affected data could contain API keys, database passwords, and private registry credentials, and urged all customers to replace stored secrets. The company published its security disclosure on […]

The post https://cybersecuritynews.com/railway-security-incident/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/railway-security-incident/

12-Year-Old GitLab Vulnerability Allows Remote Code Execution on ...

2026-10-22T02:06:30Z

12-Year-Old GitLab Vulnerability Allows Remote Code Execution on Self-Managed Server

GitLab has released urgent security updates for a critical vulnerability that could let attackers run code on self-managed servers without logging in. Tracked as CVE-2026-110264, the flaw carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition. The company published the fixes on October 21, 2026. The affected code […]

The post https://cybersecuritynews.com/12-year-old-gitlab-vulnerability/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/12-year-old-gitlab-vulnerability/

GoDaddy Revoking 404,607 TLS Certificates Following Compliance ...

2026-10-22T01:43:58Z

GoDaddy Revoking 404,607 TLS Certificates Following Compliance Failures

GoDaddy launched a mass revocation of 404,607 SSL/TLS certificates after finding that issued certificates did not match its published certificate policies. The company missed its required revocation deadline, creating a second compliance issue. An updated customer notice says the incorrectly issued certificates were revoked on October 21, 2026. The incident affects certificates issued under GoDaddy […]

The post https://cybersecuritynews.com/godaddy-revoking-tls-certificates/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/godaddy-revoking-tls-certificates/

Arrakis Security Report Finds 76% of AI Agents Are Dormant but ...

2026-10-21T17:05:59Z

Arrakis Security Report Finds 76% of AI Agents Are Dormant but Keep Their Credentials and Connections

New York, NY, USA, October 21st, 2026, CyberNewswire According to the 2026 Autonomous Agents Threat Report, published by Arrakis Security, 76% of active agents have not run in 60 days, but their credentials still work and their triggers still fire. 44% have not run in 180 days. 24% of dormant agents can be started by […]

The post https://cybersecuritynews.com/arrakis-security-report-finds-76-of-ai-agents-are-dormant-but-keep-their-credentials-and-connections/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/arrakis-security-report-finds-76-of-ai-agents-are-dormant-but-keep-their-credentials-and-connections/

The AI Adoption Blind Spot: How Fake AI Tools Put Enterprises at ...

2026-10-21T16:53:38Z

The AI Adoption Blind Spot: How Fake AI Tools Put Enterprises at Risk

AI adoption is accelerating across enterprises, with employees increasingly relying on platforms like ChatGPT, Claude, and Microsoft Copilot for everyday work. Cybercriminals are exploiting this growing trust, distributing malicious applications disguised as legitimate AI tools to steal credentials, deliver malware, and gain access to corporate environments. Recent research by ANY.RUN reveals how attackers are impersonating […]

The post https://cybersecuritynews.com/the-ai-adoption-blind-spot-how-fake-ai-tools-put-enterprises-at-risk/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/the-ai-adoption-blind-spot-how-fake-ai-tools-put-enterprises-at-risk/

Node.js Releases Security Updates to Fix High-Severity TLS, DNS ...

2026-10-21T16:33:58Z

Node.js Releases Security Updates to Fix High-Severity TLS, DNS and Brotli Vulnerabilities

Node.js has released security updates for its 26.x, 24.x, and 22.x branches to address ten vulnerabilities, including four high-severity flaws affecting DNS lookups, TLS certificate checks, and Brotli decompression. The supplied release details identify 26.12.1, 24.22.1, and 22.23.4 as the patched versions. The most serious potential outcome is remote code execution through the Brotli decoder. […]

The post https://cybersecuritynews.com/node-js-releases-security-updates/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/node-js-releases-security-updates/

Hackers Use Gentlemen Ransomware to Disable Windows Defender and ...

2026-10-21T15:30:43Z

Hackers Use Gentlemen Ransomware to Disable Windows Defender and Destroy Backups

A ransomware operation known as The Gentlemen is using a mix of security tampering, service disruption and file encryption to make recovery harder for affected organizations. Its Windows malware can turn off Microsoft Defender’s real-time protection, add broad exclusions that reduce scanning, stop backup-related services and delete Volume Shadow Copies. These steps weaken defenses and […]

The post https://cybersecuritynews.com/hackers-use-gentlemen-ransomware/ appeared first on https://cybersecuritynews.com.

https://cybersecuritynews.com/hackers-use-gentlemen-ransomware/