Cybersecurity, GRC, and advisory headlines.
Updates pulled from the feeds you keep in the admin list. Open any headline to read the summary on this site, and follow through to the publisher for the original.
-
Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say
Saudi national Abdulrahman Alfozan was arrested Friday and terminated by OpenAI. The post Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say appeared first on SecurityWeek.
-
OpenAI engineer arrested for allegedly planting spy device in office
A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. [...]
-
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs.
-
Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
Ivanti customers are in familiar territory, responding to yet another actively exploited zero-day affecting one of the vendor’s most commonly targeted security products. Volexity researchers, which discovered in-the-w…
-
DOJ charges 14 over a sprawling North Korean remote work scheme
Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme. The Justice Department announced the indictment Tuesday, highlightin…
-
Ghostscript flaw lets hackers hijack servers via PDF uploads
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. [...]
-
North Korea Phishes Ukrainians for War Intel
The Democratic People's Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.
-
Anthropic warns self-replicating AI could spread to your smart devices
Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without re…
-
Two arrested as DOJ takes down laptop farms responsible for $3 million in North Korean revenue
More than 40 residences in Texas were the target of a federal operation in September to clamp down on remote worker scams that feed money back to the North Korean regime.
-
Anthropic Finds Ingredients for Future AI Worms
Anthropic's latest study combined IoT and network tests to explore AI self-replication, which researchers said would be "challenging" to shut down.
-
FTC: Company netted at least $60 million charging sextortion victims for help it didn’t provide
An Ohio-based company charged individuals thousands of dollars to fight sextortion scams, but the operation itself was fraudulent, according to a Federal Trade Commission complaint.
-
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days
Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]
-
Microsoft releases Windows 10 KB5126657 extended security update
Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. [...]
-
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's…
-
FTC says ‘sextortion’ protection companies deceived customers about services
The Federal Trade Commission is asking a court to force the owner of multiple digital security and privacy companies from further operations, saying the businesses are serially defrauding their customers out of millio…
-
Microsoft: Windows 11 24H2 Home and Pro reached end of support
Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. [...]
-
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
CVE-2026-104935 affects Ivanti Connect Secure and it can be exploited for unauthenticated remote code execution with elevated privileges. The post Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN…
-
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic. The fr…
-
UK Housing Ombudsman Service investigates 'security incident'
The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. [...]
-
U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Iv…
-
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence th…
-
Windows 11 KB5127648 & KB5126653 cumulative updates released
Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. [...]
-
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws…
-
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on S…
-
Claude submitted fake murder tip to Philly police during summertime testing
An Anthropic AI model submitted a fabricated tip about an unsolved homicide through an online form run by the Philadelphia Police Department (PPD). The tip, filed July 18 through PhillyUnsolvedMurders[.]com by “someon…
-
Adobe Patches 140 Vulnerabilities Across 10 Products
The flaws affect products such as Commerce, Photoshop, ColdFusion, Substance 3D, Dimension, FrameMaker and Bridge. The post Adobe Patches 140 Vulnerabilities Across 10 Products appeared first on SecurityWeek.
-
Google Partially Reverses Chrome Bug Bounty Cuts
Google is restructuring bug bounty rewards with a focus on complex memory safety vulnerabilities. The post Google Partially Reverses Chrome Bug Bounty Cuts appeared first on SecurityWeek.
-
Anthropic conjures another threat that doesn't exist yet to stoke fears of AI apocalypse
Nothing sells AI products as well as fear. Using new research, Anthropic claims that self-replicating AI worms could be just months away from spreading across vulnerable IoT devices, which would be a problem if it cam…
-
TFG London cyberattack disrupts systems at Hobbs and Whistles retailers
TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. [...]
-
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's p…
-
Sandbox vulnerability gives rogue AI agents a path to escape and leak data, research says
The new research, published by AI security startup AIR, found that a network filtering flaw in Vercel Sandbox — a tool used to run code in isolated environments — could allow agents to exploit certificate validation p…
-
West African scammers targeted in joint international government-industry operation
A joint international law enforcement and industry operation against scammers netted 28 arrests, rescued 117 trafficking victims and led to the takedown of more than 3.7 million accounts, the Justice Department announ…
-
West African scam compounds raided, more than 100 suspected trafficking victims ‘rescued’
More than two dozen people were arrested by police in Ghana and Nigeria as part of a U.K.-hosted operation that also included tech companies.
-
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Most of the affected individuals are Meta employees in the United States and they are being offered credit monitoring services. The post Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach appeared fi…
-
Ivanti warns of Connect Secure zero-day exploited in attacks
Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]
-
Docker Hub flaw let attackers impersonate users, tamper with images
Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). [...]
-
North Korean hackers target Ukrainian experts for possible intelligence on Russia's war
North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy amid Pyongyang’s growing military cooperation with Russia.
-
Almost Half of Defense Contractors Pressing Ahead With CMMC Despite Phase 2 Pause
CCI staff share recent surveys, reports and analysis on risk, compliance, governance, infosec and leadership issues. Share details of your survey with us: editor@corporatecomplianceinsights.com. 47% DIB continuing to…
-
GRC Business Roundup: Caseware, Confide, FS Vector, SignWell, Schellman & More
The business of GRC is ever-expanding, GRC technology is one of the fastest-growing segments in enterprise software, and compliance professions are rapidly evolving. Here’s the latest from across the industry. New pro…
-
Anthropic Shows How Small AI Models Could Replicate Across IoT Devices
Anthropic researchers show how small AI models could autonomously replicate across IoT devices, raising concerns about adaptive, AI-powered botnets. Anthropic published a paper this week that should make anyone who ma…
-
The MFA Gaps Attackers are Still Exploiting
Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough…
-
Q&A: 3 Rulings Shifted Federal Labor Law; 1 Election Won’t Shift It Back.
It is tempting, with the midterms a few weeks out, to read the recent upheaval in federal labor and employment law as something the next election could swing back. Steve Kruzel, a partner in Quarles’ labor and employm…
-
European Retail Firms Confirm Cyber Incidents
Several Europe-based retail firms have confirmed experiencing cyber incidents, while H&M said it is “investigating” such claims
-
GitLab Patches Max-Severity Vulnerability CVE-2026-97229
GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS…
-
Trellix Wise for Private Cloud delivers auditable AI investigations for security teams
Trellix has announced Trellix Wise for Private Cloud, an on-premises, federated AI core for agentic security operations. The solution extends a security fabric across an organization’s existing infrastructure to impro…
-
Defenders Reluctant to Deploy Agentic AI as a Cybersecurity Tool
Flashpoint research suggests that only 25% of security teams have actively deployed AI, with many concerned about AI Agents’ negative impact
-
NinjaOne combines Katana AI and MCP server to accelerate IT problem resolution
NinjaOne has announced Katana AI, an agentic AI technician that supports and elevates IT workers, and the NinjaOne MCP server, an agentic orchestration connector that extends the platform’s governed access to the AI t…
-
Ukrainian drones hit Yandex data centers, sparking claims that Russian troll farms went quiet
Russian tech giant Yandex confirmed that drones hit three of its data centers, shutting down the facilities in Sasovo and Vladimir and knocking out part of the infrastructure in Kaluga. On October 11, Yandex Cloud tol…
-
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. The administrati…
-
Lattice Sentry 5.0 brings quantum-resistant firmware security to AI data centers
Lattice Semiconductor has released version 5.0 of its Lattice Sentry solution stack, adding post-quantum cryptography (PQC) to its platform firmware resilience (PFR) and attestation capabilities. The update provides C…
-
Grindr users’ sensitive data shared through ad auctions without valid consent
Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr…
-
Ridge Security’s RidgeOne keeps autonomous penetration testing data inside customer environments
Ridge Security has announced RidgeOne, a self-contained solution that brings autonomous AI-powered penetration testing and agentic red teaming to mid-sized organizations. Combining Ridge Security’s RidgeGen agentic se…
-
Cyberattacks crank French supermarket refrigeration systems up to 50°C
Cyberattacks on supermarket refrigeration systems reportedly pushed temperatures as high as 50°C (122°F), affecting hundreds of stores in France and forcing retailers to discard food. Major supermarkets such as Carref…
-
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-96951 Microsoft Windows Command Injection Vulnerability CVE-2026-104935 I…
-
Swann Communications SWIFI-SE2KIC
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following versions of Swann Communications SWIFI-SE2KIC are affected: SW…
-
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. CISA is aware of cyber…
-
Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own. The post Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic War…
-
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls
The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalatio…
-
Mozilla’s Firefox Enterprise lets companies block shadow AI in the browser
Mozilla’s Firefox Enterprise is a paid platform that lets organizations control how sensitive data is shared, check device security, and manage employee access to web applications. The platform pairs the browser with…
-
Hackers heat up supermarket fridges, spoiling food across France
A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold.The attack caused significant financial losses a…
-
'123456' password linked to Denmark data breach affecting 8.8M people
A person claiming responsibility for the breach of Denmark's Central Register of Persons (CPR) says they gained access through an IT company's account protected by the password "123456." The person told Danish news ou…
-
XWorm RAT Evolves Into Surveillance Platform
Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions. The post XWorm RAT Evolves Into Surveillance Platform appeared first on Securit…
-
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network
Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an a…
-
AI Turns Familiar Cyberattacks Into a Race Against Time
IBM’s Steve Wallin talks to SecurityWeek on the effect of AI-driven attacks on enterprise defenses. The post AI Turns Familiar Cyberattacks Into a Race Against Time appeared first on SecurityWeek.
-
Weekly Update 525: AI Data Breach Hyperbole
I remember the name of that AI doco now - The AI Doc: Or How I Became an Apocaloptimist. I was watching it on the long-haul flight home the other day, and what I found particularly engrossing was the polar-opposite op…
-
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers. The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek.
-
Product Walkthrough: Bitdefender AI Visibility and Control
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloa…
-
UK Government Announces Sweeping New AI Security Plans
The government is planning tweaks to legislation, new incident response and more to head of AI security threats
-
Owner of fashion brands Hobbs and Whistles joins autumn pwned collection
The owner of Hobbs, Phase Eight, and Whistles is the latest fashion retailer to suffer a cyberattack, leaving several IT systems offline and customers facing order delays. South African retail giant The Foschini Group…
-
Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems
The company says it took some of its systems offline to contain a security issue within its network. The post Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems appeared first on SecurityWeek.
-
Meta outlines Muse Wonder safeguards for AI agents acting on your behalf
Meta’s Muse Wonder and Muse Wonder Full models are built for AI agents that handle tasks such as preparing insurance claims, reviewing leases and developing software. The models combine document analysis and tool use…
-
GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)
GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab server…
-
npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover
Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repositor…
-
Fifth of CISOs Take Time Off to Avoid Patch Tuesday
Socura report claims CISOs are calling in sick or taking holiday to miss Patch Tuesday
-
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers
Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached…
-
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrator control of the server, the company says. Progress publishe…
-
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue…
-
Hackers cranked French supermarkets’ freezers up to 50 degrees, causing hundreds of stores to lose their stock
Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions. Overnight from Sunday to Monday, a large cyberattack hit the refrigeration syst…
-
Scammers know your name, and they’re counting on you to reply
Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations.Last week, we showed how a Facebook Marketplace listing used the recipient’s name to make a text a…
-
VMware is pushing so many patches, it thinks users need new tools to manage the flood
VMware has discovered so many flaws in its products using AI that it felt the need to create a new product to help users manage them. Prashanth Shenoy, vice president of product marketing in the VMware Cloud Foundatio…
-
Be a good AI ancestor: Cybersecurity already gave us the playbook
AI has brought us to a familiar inflection point in the story of privacy, cybersecurity, and online safety. We have an opportunity to apply decades of cybersecurity experience before the next generation of technology…
-
Boards put AI investments at risk due to lack of knowledge and skills, PwC survey finds
Companies risk wasting their AI investments because boards don’t rate the information underpinning the strategy and directors don’t understand how the technology works or creates value. The post Boards put AI investme…
-
Compliance must counter rising third-party financial crime risks with risk-based, integrated due diligence
Third-party risks around financial crime are accelerating and becoming more complex. Evolving sanctions rules, a renewed focus in the EU and UK on money laundering, bribery and corruption, and the UK’s Failure to Prev…
- ISC Stormcast For Tuesday, October 13th, 2026 https://isc.sans.edu/podcastdetail/10134, (Tue, Oct 13th)
-
CVE-2026-104935 — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti · Connect SecureIvanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.Required action. Apply mitigations i…
-
CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability
Microsoft · WindowsMicrosoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.Required action. Apply mitigations in accordance w…
-
Flock can now issue CVEs for its own products. Should we trust it?
Flock, the controversial public safety company entangled in controversy amid recurring law enforcement abuse of its products, gained authority to assign CVE IDs to vulnerabilities in its own products and grade those d…
-
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position.
-
ShinyHunters arrest number three: a Canadian ransomware negotiator
A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t. ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to…
-
Canonical Hit by Second DDoS Attack in 2026, Public Websites Disrupted
Canonical suffered its second DDoS attack this year, disrupting public websites for over four hours while Launchpad and the Snap Store remained online. Ubuntu’s parent company Canonical spent part of last week fightin…
-
Prominent Ransomware Negotiator Faces Extortion Charges
Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.
-
No Identity, No Recovery: Cyber Resilience Starts With IAM
The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink.
-
IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion
IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’…
-
Chatbot refuseniks edge out users in the US, and they’re not for turning
If you thought everyone was into chatbots, think again: about half of US adults never use the AI tools, and most have no interest in starting. According to Pew Research Center, older adults are the least likely to use…
-
Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings
Leaked documents suggest a multi-pronged operation, with social engineering and more technical attackers working together to manipulate a single target
-
FBI Arrests Suspect in FBI-Hacking Case
In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster. Last week, the FBI arrested (alternate link) someone associat…
-
SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure. Attackers have begun exploiting a critical flaw in SonicWall SMA 1000…
-
Ukrainian drone strikes on Yandex datacenters knock cloud and payments offline
Yandex engineers are working to restore services after Ukraine launched drone strikes on three of its five Russian datacenters. The strikes began overnight on October 7-8, "seriously damaging" Yandex's Sasovo datacent…
-
How “123456” became the key to almost 9 million personal records
An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made t…
-
Passing the Baton: Dark Reading Names New Editor-in-Chief
Fahmida Y Rashid will keep the momentum going as she leads Dark Reading.
-
Major French Supermarket Chains Hit by Cyber-Attack, Food Stock Impacted
The CEO of Cooperative U confirmed a cyber-attack affected the food stock in several stores from October 11
-
25 Years After Sarbanes-Oxley, How Is Fraud This Simple Still Possible?
The alleged frauds that took down First Brands and Tricolor were almost mundane — misstated assets, double-pledged collateral, inflated invoices — yet they ran for years before anyone caught them. Anne Eberhardt, an a…
-
Treat the Release Note as a Third-Party Risk Event
A vendor can switch on AI decision-making through a routine software update that sets off none of the usual diligence gates: no purchase, no contract event, nothing for a reviewer to flag. Technology executive Robin H…
-
Feds Got Warrants to Use Fake Cell Towers to Hunt Down Don Lemon’s Producer
Investigators also sought permission to use an invasive surveillance tool called a cell-site simulators against journalist Georgia Fort and a Minnesota state Senate candidate.
-
Phishing emails are baiting your AI assistant
You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender.Then you asked your AI assistant to summarize your inbox.Could the message you wisely avoided find its way back…
-
ISO 15489 Toolkit – 92 Records Management Templates
The ISO 15489 Toolkit follows the standard’s own structure ISO 15489-1:2016 is the international standard for records management. It is the second edition, published in April 2016, and ISO reviewed and confirmed it in…
-
Imagine there's no Shiny Hunters – AI could make human hacking crews obsolete
KETTLE The FBI has announced what appears to be a third arrest in the ShinyHunters investigation, following the group's breach of Bureau systems, even as AI advances potentially leave human hackers on borrowed time. Y…
-
Net Closes Around ShinyHunters with Another FBI Arrest
The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHunters
-
Your AI agent is only as safe as the packages it downloads
Strip away the model names and the headlines, and this year’s AI agent incidents share a feature that has little to do with how capable the models are. Nearly all of them ran through the software supply chain. Start w…
-
CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
CyberXero used 51 AI agents to support cyberattacks, stealing 628,000 Ukrainian records, including sensitive data from energy infrastructure. CyberXero is an operation that combines traditional hacking tools with AI a…
-
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May
-
Karaoke Giant Reveals Data Breach Impacting Eight Million
Daiichi Kosho says a supply chain breach has exposed personal data on over eight million karaoke customers
-
A week in security (October 5 – October 11)
Last week on Malwarebytes Labs: ASOS breach update: Hackers stole customer details and shopping searches Attackers hijack country-code domains to impersonate Google and other services Amazon has an uncomfortably perso…
-
GTA 6 Leaker Demands $30M Meme Coin Market Cap to Release Full Game
CyberLeek threatens to leak a playable GTA 6 build if its Solana meme coin hits a $30 million market cap, but the build remains unverified. CyberLeek, the anonymous figure behind this summer’s wave of GTA 6 leaks, jus…
- ISC Stormcast For Monday, October 12th, 2026 https://isc.sans.edu/podcastdetail/10132, (Mon, Oct 12th)
-
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 3
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the t…
-
AI systems are fully capable of carrying out nightmare attacks against infrastructure and nobody's ready
Autonomous AI systems are fully capable of carrying out a nightmare cyberattack scenario – finding and attacking critical operational technology and industrial equipment, and shutting down access to water, power, and…
-
Internal Audit Toolkit – 87 Templates for the IIA Global Internal Audit Standards
The Internal Audit Toolkit is built on the Standards’ own structure The IIA’s Global Internal Audit Standards took effect on 9 January 2025 and replaced the 2017 International Professional Practices Framework. They ar…
-
Canadian cybersecurity executive arrested in federal extortion case
Federal authorities arrested a Canadian cybersecurity executive Thursday in Pennsylvania on charges of conspiracy of extortion, according to federal court records posted Friday. Edward Dubrovsky, 54, is a former emplo…
-
AI Is Getting Really Good at Messing With Cybercriminals
Anti-cybercrime initiatives are increasingly using AI to scam the scammers by tricking them into talking to lifelike bots that they think are real victims.
-
Two characters open up a world of typosquatting opportunities in Chromium browsers
Researchers say two characters available to typosquatters and phisherfolk can trick Chromium browsers into displaying lookalike URLs as genuine web addresses. Wangling a domain name to look an awful lot like that of a…
-
Why TLP should not replace your internal information classification, (Sat, Oct 10th)
The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far).
-
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested an executive at a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved t…
-
American Express hit with $350M penalty for lax BSA/AML compliance program
The Office of the Comptroller of the Currency and the U.S. Federal Reserve Board (FRB) each took enforcement action against American Express for deficiencies in its Bank Secrecy Act/anti-money laundering compliance pr…
-
Companies responsible for decisions made by ‘autonomous’ AI, says ICO
The UK’s data regulator has issued a strong warning that companies remain responsible for protecting personal data when they use AI systems, even when the technology acts autonomously. The post Companies responsible f…
-
Cleo AI paid $17M to settle allegations it deceived customers
Cash advance app Cleo AI agreed to meet compliance obligations for 10 years and to pay $17 million to settle allegations that it deceived millions of customers. The post Cleo AI paid $17M to settle allegations it dece…
-
Priceline’s online ads reportedly subject to an up to $500M fine from the FTC
The FTC is taking action against Bookings Holding, Priceline’s owner, over misleading third-party online hotel ads. The fine could be $500 million, Reuters reported on Wednesday. The post Priceline’s online ads report…
-
ASOS Breach Reveals the Risks in Customer-Facing SaaS
The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network.
-
Friday Squid Blogging: I Caught a Squid
On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of which we could keep). And…I caught a squid! Near as…
-
AI Scramble Drives Cybersecurity M&A Boom
Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Many of the buyers are not your typical cybersecurity firms.
-
AWS AgentCore security undone by prompt requesting credentials
UPDATED Bob, possibly the same Bob whose conversations with Alice draw so much interest from eavesdropping Eve, was browsing a site we'll call TechHub. The site hosts an AI agent served by Amazon Bedrock AgentCore. Bo…
-
What We Missed: FBI Strikes Back at ShinyHunters
In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected ShinyHunters operative to the compromise of a Pentagon-run data center.
-
Security Threats Don't Stop at the Office: Why Executives' Families Need Training, Too
Those closest to executives must match their security postures because the weakest link in a family can become the entry point for attacks.
-
Wikimedia Says Rogue AI Agents Abused its Platforms
Wikimedia says OpenAI agents performed unauthorized actions on its platforms, including edits to wikis
-
Social Engineering AI Agents: The New BEC for 2026
As AI agents gain authority over business systems, attackers can manipulate them like business email compromise (BEC) victims.
-
Q3 2026 Sets New Record for Ransomware Attacks
Comparitech observed 2627 claimed ransomware attacks in Q3, with critical sectors like finance, technology, education and healthcare experiencing significant increases
-
When a Governance Lead Leaves, the Escalation History Often Goes With Them
A control concern can be open for nine months — challenged repeatedly, promised and re-promised, one missed deadline from escalation — and still reach a successor as a single line marked “open.” Glenn Oborne of Ingen…
-
ASOS breach update: Hackers stole customer details and shopping searches
The customer data stolen from global fashion retailer ASOS includes more than just names and contact details, raising questions about its early reassurances.As we reported earlier this week, ASOS customers received a…
-
UK and Allies Warn of Cyber Threat from China’s Integrity Technology Group
The UK, US and allies have issued an alert detailing malicious activity linked to China’s Integrity Technology Group
- ISC Stormcast For Friday, October 9th, 2026 https://isc.sans.edu/podcastdetail/10130, (Fri, Oct 9th)
-
ICE Agent at NYC Shooting Has History of Alleged Violence and Illegal Arrests
Brenden Cuni, an ICE supervisor, has been accused of excessive force and tackling a pregnant woman to the ground. Several of his arrests were later found to be unlawful in federal court.
-
EU banking regulator issues new TPRM guidelines for large banks, FS firms
The European Union’s key banking regulator has issued guidelines to help large banks manage the risk of disruption if an important IT provider has an outage or a third party cannot continue to supply critical services…
-
Former Florida TD Bank employee admits laundering millions for Colombian criminals
A former employee at a Florida TD Bank branch has pleaded guilty to laundering about $4.8 million for Colombians involved in criminal activity in exchange for small bribes. The post Former Florida TD Bank employee adm…
-
Vietnam’s AML rules require banks to trace owners beyond its borders
Vietnam has introduced temporary measures to strengthen its anti-money laundering framework. It requires financial institutions to collect and clarify how they identify beneficial owners. The post Vietnam’s AML rules…
-
Leader of 764 pleads guilty, faces up to 30 years in prison
A 21-year-old from North Carolina who joined and helped establish 764 as an underage teenager and quickly emerged as the leader of the child sextortion group until his arrest last year pleaded guilty in federal court…
-
Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
Anthropic announced a new program Thursday that will combine its AI tools with outside cybersecurity companies to find and fix cybersecurity vulnerabilities in critical infrastructure and open-source software. Adverti…
-
Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027
Let's Encrypt is continuing a push toward tighter security by reducing free SSL/TLS certificate lifetimes from 90 days to 64 days, starting February 10, 2027. For administrators already implementing modern ACME client…
-
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)
We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8 of the most popular AI coding assistants and agents inc…
-
Attackers hijack country-code domains to impersonate Google and other services
According to Google, attackers compromised infrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for…
-
Amazon has an uncomfortably personal profile on you
Amazon’s “About You” page reveals what it thinks it knows about you—and you can’t simply switch it off. Dexerto reports that one shopper discovered her profile included the observation: “has flat buttocks” She suggest…
-
Satel Netco Design
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files,…
-
Grid Protection Alliance openPDC and openHistorian
View CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-202…
-
Red Lion Controls N-Tron 700 Series
View CSAF Summary Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configura…
-
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Publication October 8, 2026 Executive Summary Chinese government-l…
- CISA, FBI, NSA and International Partners Warn of China-based Cybersecurity Company Enabling Threat Actors to Target Multiple Critical Infrastructure Sectors Worldwide
-
Meta’s Muse AI files away your friendships, arguments, and secrets
If you thought that having companies trawling your social media, browsing history, and TV habits for behavioral clues was bad, sit tight. Meta is just getting started. Its Muse personal AI agent is taking surveillance…
-
How Technology Empowers—and Imperils—Dictators
This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs. Two weeks after Moscow’s full-scale invasion of Ukraine in March 2022, the Russian TV Channel One editor Marina Ovsyannikova burst…
-
Why the rise of countersanctions is increasing compliance risks on multiple fronts
Compliance teams in global companies are already grappling with constantly evolving sanctions regimes in the US, UK, and EU. Now, they must also watch countersanctions emerging in countries including Russia and China.…
-
The Man Behind a West Bank Telegram Channel Trying to Keep Palestinian Drivers Safe
With no accurate Big Tech mapping app to help him, Anas Hattab launched a Telegram group to get himself home at night. Now nearly 350,000 Palestinians rely on it to navigate the occupied West Bank.
- ISC Stormcast For Thursday, October 8th, 2026 https://isc.sans.edu/podcastdetail/10128, (Thu, Oct 8th)
-
CVE-2015-5477 — ISC BIND Data Processing Errors Vulnerability
ISC · BINDISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.Required action. Apply mitigations in accordance with vendor instructi…
-
CVE-2016-3081 — Apache Struts Command Injection Vulnerability
Apache · StrutsApache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.Required action. Apply mi…
-
CVE-2023-22894 — Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi · StrapiStrapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted…
-
CVE-2021-3199 — ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE · DocsONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.Required action. Appl…
-
CVE-2015-3306 — ProFTPD Improper Access Control Vulnerability
ProFTPD · ProFTPDProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.Required action. Apply mitigat…
-
Shaq Got Hacked. Now He’s Pitching for a VPN
At a recent event for security firm NordVPN, NBA superstar Shaquille O’Neal revealed that he got hacked—and warned the public about the need to “have control of their own information.”
-
The Pentagon Hopes to Speed Up ‘Kill Chain’ AI Buys With 5-Minute Videos
The US government’s Tradewinds initiative has made it easier to throw millions of dollars at “nontraditional” defense contractors, including OpenAI, Anthropic, and Google.
-
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially…
-
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. K…
-
Google issues Android security updates: who can get them and how
Google has published security fixes for Android. The October updates are available for Android operating system versions 14, 15, 16, 16-qpr2, and 17 where “qpr” stands for Quarterly Platform Release. QPRs are interim…
-
Apple’s Verified Photography System
Apple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple i…
-
Marching Orders for DOJ’s Reshuffled Corporate Fraud Enforcers
The DOJ’s newest division has given its corporate fraud prosecutors their most substantive public guidance yet in the form of a memo that outlines factors they are to consider when deciding whether to bring charges ag…
-
AI-powered phishkit arms criminals with account-hijacking tools in 10 minutes
In August, the Malwarebytes research team reported on a new malicious turnkey kit that makes it possible for almost anyone to launch a sophisticated online scam. The kit was not simply a fake website. It bundled the c…
- ISC Stormcast For Wednesday, October 7th, 2026 https://isc.sans.edu/podcastdetail/10126, (Wed, Oct 7th)
-
Hackers obtain counterfeit TLS certificates for Google and other large services
Attackers hijacked three top-level domains and used their control to mint counterfeit TLS certificates for Google and other large organizations, Google said Tuesday. The attackers launched a series of attacks on the .…
-
More RMM Tools In the Wild, (Tue, Oct 6th)
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild.…
-
OpenAI agents tried to hack Wikipedia tools and flooded it with traffic
The publisher of Wikipedia said Monday that OpenAI agents attempted to hack a note-taking tool it hosts, made unauthorized edits, and sent millions of resource-intensive requests to its infrastructure, in the latest i…
-
Johnson Controls EasyIO FG
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. The following versions of Johnson Controls EasyIO FG are affected: EasyIO FG f…
-
Hitachi Energy REB500
View CSAF Summary Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS…
-
Hitachi Energy Asset Suite
View CSAF Summary Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause…
-
Hitachi Energy SOI
View CSAF Summary Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out…
-
Savannah lwIP SMTP client
View CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client a…
-
Hitachi Energy RTU500
View CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are assoc…
-
Possible Vulnerability in Apple’s Automatic Reboot
404Media is reporting (alternate link) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone…
-
Smooth Talk: Why Organizations Mistake Communication for Competence
Organizations claim to hire and promote based on competence, but most of that judgment happens through communication — interviews, presentations, meetings — where fluency and confidence can stand in for ability that w…
-
MCP for agent-to-agent comms may be the riskiest protocol you've never heard of
The adoption of AI agents in millions of organizations is creating new opportunities for attackers to make them take malicious actions, such as exfiltrating database contents and sensitive business and personal inform…
-
Another Historic Cipher Falls to AI
This one is from 1809, written by Napoleon’s nephew.
-
Exploring California’s Generative AI Training Data Transparency Act
California’s Generative Artificial Intelligence Training Data Transparency Act went into effect in January and got over the first hurdle of a constitutional challenge. Stephanie Sharron, Marian Waldmann Agarwal &…
-
AI Meeting Assistants Raise Eavesdropping Concerns & Discovery Headaches
A class action against AI notetaker Otter flags real liability risks with meeting assistants. Patrick E. Zeller, general counsel of JetStream Security, writes that organizations that will feel the pain of meeting assi…
-
Weekly Update 524: Live From Copenhagen
I'm in Denmark! Well, just, I'm now at Copenhagen airport ready to begin the long trek home, with the final event at GOTO now done and going just perfectly. This week, there are two ShinyHunters arrests in the news: P…
-
CVE-2026-88779 — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix · NetScalerCitrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that…
-
Muse Creates Detailed Profiles of All Your Friends and Family
Millions have downloaded Meta’s AI agent Muse. But getting it to do your bidding comes with privacy costs.
-
Apple changes full-disk access permissions to curb abuse from AI agents
Apple says it is changing its macOS privacy settings to stop third-party app developers from misusing them to access message histories. Friday's announcement comes two weeks after tech columnist Jason Aten said that M…
-
Friday Squid Blogging: EU is Trying to Fight Unregulated Squid Fishing
The EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic. I’m not optimistic. As usual, you can also use this squid post to talk about the security stories in the news that…
-
ICE Has Been Dumping Protester Photos Into a Palantir Database
DHS agents not only tracked and intimidated people observing ICE activity in Maine, but stored information about them in a database run on Palantir software, newly unsealed court filings say.
-
Unidentified Flock Cameras in Florida
St. Lucie County in Florida discovered (alt link) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted. I am reminded of the decade-old story of StingRay cell phone…
-
How American Political Campaigns Are Using AI—and What They’re Spending on the Tools
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. New campaign finance disclosure data shines a light on which US political campaigns are using AI tools and how much they are spen…
-
A Flaw in ChatGPT’s Mac App Could Have Let Hackers Grab Sensitive Data
While the focus has been on AI agents’ hacking capabilities, a recently patched vulnerability in a ChatGPT app shows that AI software is itself an inviting—and vulnerable—target.
-
CVE-2026-102490 — Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH · ZammadZammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-10248…
-
CVE-2026-102489 — Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH · ZammadZammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.Required action. Apply…
-
Hacks of 2 federal agencies in a month have spilled a bonanza of sensitive data
The Pentagon is informing more than 2 million current and former military members that their personnel records storing sensitive personal information were stolen over a monthslong compromise of one of its networks. Th…
-
Experience What It’s Like to Travel in the Occupied West Bank
Traverse barriers and checkpoints in the occupied West Bank—your choices reflect the reality of nearly 3.5 million Palestinians who live there.
-
CISA Malcolm
View CSAF Summary The following versions of CISA Malcolm are affected: Malcolm CVSS Vendor Equipment Vulnerabilities v3 8.8 CISA CISA Malcolm Improper Neutralization of Input During Web Page Generation ('Cross-site Sc…
-
Meari IoT Cloud Platform OpenAPI Service
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials…
- CISA Launches Cybersecurity Awareness Month: Securing the Next 250
-
Connected Cars Are a Surveillance Platform
Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy in their drivers: The new Northeastern study shows, for the first time, data flowing among the vehicle…
-
The Secrets of the US Spyware King
In an exclusive interview with WIRED, Paragon Solutions CEO Andrew Boyd reveals the limits of the company’s promise to keep bad actors from abusing its powerful espionage tool.
-
CVE-2026-104286 — Fortinet FortiMail Path Traversal Vulnerability
Fortinet · FortiMailFortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the u…
-
Attackers have been exploiting critical Zimbra flaw to steal emails
Hackers have been exploiting a critical vulnerability in the Zimbra Collaboration Suite in an attempt to obtain email backups and authentication credentials of vulnerable organzations, Microsoft has warned. The vulner…
-
Cloudflare plans to issue quantum-safe TLS certificates
Cloudflare said Tuesday it plans to issue quantum-proof TLS certificates, making it one of the first authorities to issue such certificates, which use a form of cryptography that is widely believed to withstand attack…
-
How Israeli Checkpoints Choke Palestinian Life in the Occupied West Bank
Lost time. Lost jobs. Lost friends. Lost family. Lost lives. Our joint investigation reveals the system that has divided the West Bank and measures what it cost people to move through it.
-
CVE-2026-76504 — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco · Catalyst SD-WAN ManagerCisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user du…
-
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Authorities in the Netherlands have arrested a 24-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the…
-
Weekly Update 523: Live From a Norwegian Fjord
How's that view?! With NDC Oslo now done, it's a little bit of sightseeing before heading to Denmark for GOTO in Copenhagen for Scott's and my "Cyber-broken" talk. In the meantime, this week is mostly about the ShinyH…
-
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months i…
-
Your uncle’s frozen Mac says it’s infected after viewing a Google ad. Now what?
Researchers say they recently found Google ads delivering a sophisticated tech support scam that freezes the screens of both Windows and Mac devices and displays messages urgently instructing them to phone a bogus cal…
-
There's a new way to break RSA that's faster than anything we've seen before
The world has known for decades that the RSA cryptosystem’s days are numbered. Once quantum computing becomes practical (estimates for that range from 3 to 20 or more years), the foundational security it provides will…
-
FBI rushes to investigate if ShinyHunters hack of thousands of employees is real
The FBI is now investigating claims from a hacker group that thousands of current and former employees’ personal data was stolen after the group exploited a previously unknown bug found on an agency jobs website. On T…
- CISA Whitepaper Charts Path to Establishing and Maturing CVE Program Quality
-
Weekly Update 522: Live From Oslo with Scott Helme
Heads up: the first 7 mins is a bit quiet until we worked out the external mic was misbehaving - sorry! But get through that and have a listen to Scott's experiences with how Report URI is identifying malware-infected…
-
Microsoft disrupts AI-assisted platform that compromised 12,000 accounts
Microsoft said Tuesday that it led an industry-wide disruption of a subscription-based scam platform that used an AI chatbot to compromise 12,000 Microsoft accounts over a few-month span. Named EvilTokens, the platfor…
-
Could One Person Do Too Much?
In IT, access requests often look simple. Someone needs a new account, a different permission, a password reset, or a system change. The request may be routine, the deadline may be tight, and the person completing it…
- CISA Hosts Cyber Storm X, Nationwide Cybersecurity Exercise to Strengthen Resilience
-
Data Broker Radaris Loses Domains in Privacy Fight
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company rec…
- New CISA Guidance Helps Critical Infrastructure Detect, Observe and Impede Malicious Cyber Activity
- CISA and NIST Release Guidelines to Protect Federal Cloud Identity Systems from Token Theft, Forgery, and Misuse
-
SOC 1 Toolkit – 87 SSAE 18 / ISAE 3402 Service Organization Templates
The SOC 1 Toolkit is built on what management actually has to produce A SOC 1 report has three parts, and management writes two of them. The service auditor examines management’s description of the system and manageme…
-
TPRM Toolkit – 86 Third-Party Risk Management Templates
The TPRM Toolkit is built on the lifecycle every regulator uses Every supervisor that asks to see a third-party risk management programme asks for the same five things in the same order: how you plan an engagement, ho…
-
GENIUS Act Toolkit – 126 Stablecoin Compliance Templates
The GENIUS Act Toolkit is built on the statute, not the proposals The GENIUS Act Toolkit is a complete compliance documentation set for permitted payment stablecoin issuers under the Guiding and Establishing National…
-
Weekly Update 521: Breach Perception v. Reality
I think what really resonates with me this week is being able to completely turn the tables on perceptions around things like AI being the big bad hacking tool the news would have you believe. There's the stat I talk…
- CISA Releases Updated Insider Threat Guide With New Insights to Mitigate Physical and Cyber Threats
-
Microsoft Plugs Nearly 1,000 Security Holes
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helpi…
- CISA, NSA and FBI Warn of China-Based AI Companies Targeting US AI Models with Industrial-Scale Knowledge Distillation Campaigns to Shortcut AI Development
-
EU AMLR Toolkit – 99 AML Compliance Templates
The EU AMLR Toolkit is built on the Regulation, not the Directive it replaces The EU AMLR Toolkit is a complete AML-CFT documentation set for Regulation (EU) 2024/1624, which applies from 10 July 2027. It is a Regulat…
-
Weekly Update 520: The Unscripted Edition
I've started playing around with YouTube's "create video thumbnail", which hopefully will give me back a bit of time in my day (it used to be a manual job in Photoshop) and be a bit more interesting. And on that note,…
-
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whos…
-
Weekly Update 519: Breaches & Data Integrity
It does feel like I've bitten off too much and am now chewing like crazy this week. The 3D printing talk with Elle in Oslo, the "normal" NDC infosec talk, the cyber-broken talk with Scott in Copenhagen and then those…
-
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever.…
-
A Cautionary Tale About Data Breach Claims, Verification and Carhartt
You're not going to believe this, but turns out you can't always take criminals at their word. Actually, I'll walk that back a bit as it may not even be the cybercrime guys who got this wrong, but it all starts here:…
-
Your Product Is Talking. Are You Listening?
When an organization launches a new software feature, the signs of success can appear straightforward. The functionality is available. Training has been completed. The process is documented. Users have been told what…
- CISA Advisory Highlights Red Team Findings to Help Organizations Assess Risk, Identify Threats and Enable Effective Incident Response
-
BengalSEO Part 1: Anatomy of the Operation
Key Takeaways The DFIR Report Offerings Check out our Products here and our Services here. Want a demo, more information on our services, pricing or just want to chat? Get in Touch Contact us today for pricing or a de…
-
Weekly Update 518: IoT Doorlock Nirvana with UniFi
I genuinely think I've nailed the IoT door lock situation! Well, Ubiquiti has, but I think I've worked out how to put it all into a residential house and have it make sense. There are a few basic tenets:Main power (ne…
-
Welcoming the Sri Lankan Government to Have I Been Pwned
Today, we welcome the 48th government onboarded to Have I Been Pwned’s free gov service: Sri Lanka. Sri Lanka CERT now has access to monitor Sri Lankan government domains against the data in HIBP, helping identify exp…
-
Financial Confidence Is Built Before the Numbers
Most people assume Finance is just there to handle the forecast. But really, our job is much bigger: we’re here to help everyone understand what those numbers are actually trying to tell us about our business. Long be…
- CISA Releases Foundational, Flexible Guidance to Help Federal Agencies Implement Effective Logging, Visibility and Operational Standards
-
Weekly Update 517: Cyber Ransoms
The current ransomware situation is a bit of a kludge (deep breath): a lot of ransomware (which often doesn't even involve "ware", it's just extortion) is carried out by kids who successfully make a truckload of money…
-
Who’s Tracking You? Use This New Service to Find Out
It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily…
-
Weekly Update 516: Live From Vietnam
A little wind noise, a little connectivity flakiness, and a little lip-sync issues from YouTube, but look at that view! 🤩 Back to business, it's the Brinks Home FAQ I found most interesting this week. I mean, how do y…
-
Microsoft Plugs Nearly 400 Security Holes
Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others…
-
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
Key Takeaways This case was first reported to customers in a threat brief released in July 2025 and in a public flash alert in August 2025 in partnership with Swisscom B2B CSIRT, which observed another intrusion tied…
-
MiCA Toolkit – 100+ Comprehensive Templates
About the MiCA Toolkit This MiCA Toolkit is the most comprehensive resource currently available for implementing a crypto-asset regulatory compliance programme in accordance with Regulation (EU) 2023/1114 (Markets in…
-
The Risk Pattern Was There. The Report Missed It.
I’m sharing this from my role as a Data & Insights Partner at LogicManager because reporting is often where unknown knowns either stay hidden or finally become actionable. The data may already exist, but without t…
-
When Customer Signals Stay in Silos: Connecting CRM Data, Customer Success, and Risk Insight
This is a perspective from our roles in CRM architecture and Customer Success at LogicManager. We’re sharing it because customer risk rarely starts as a surprise. More often, the signals are already there, but they li…
-
When Engineering Metrics Reveal Business Risk
This is a perspective from my role as Director of Software Development at LogicManager. We’re sharing it because engineering metrics are not just a measure of team activity. When viewed together, they can reveal where…
-
When Banking Risk Workflows Don’t Match Reality
This is a perspective from Christian Parker, Senior Onboarding & Enablement Specialist at LogicManager. We’re sharing it because strong risk programs are not built through configuration alone. They are built when…
-
Comprehensive ISO 37001 Anti-Bribery Toolkit – 55 Compliance Templates
About the ISO 37001 Anti-Bribery Toolkit ISO 37001 is judged on whether an anti-bribery management system is genuinely operating — proportionate due diligence, controls over gifts and hospitality, a working reporting…
-
Comprehensive COBIT 2019 IT Governance Toolkit – 31 Templates
About the COBIT 2019 IT Governance Toolkit COBIT 2019 is a governance framework, not a checklist: it separates the governance of enterprise IT from its management and expects each objective to have clear ownership, me…
-
Comprehensive ITIL 5 Toolkit – 57 Templates (ITIL Version 5)
About the Comprehensive ITIL 5 Toolkit ITIL (Version 5) is the first substantial change to the framework since 2019, and it is not only a rename. The service value chain’s six activities become an eight-activity produ…
-
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware
The EtherRAT malware family was first reported by Sysdig back in December 2025. At that time, the initial access vector was exploitation of CVE-2025-55182 (React2Shell) targeting Linux servers. In March 2026, a Window…
-
From Oversight to Insight: Internal Audit as the Bridge Between Silos and Strategy
This is a perspective from my role as ERM Program Manager at LogicManager. We’re sharing it during Internal Audit Month because internal audit plays a critical role in helping organizations connect findings, strengthe…
-
Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting
Key Takeaways We identified an exposed server that provided unusual visibility into a large-scale, multi-victim exploitation and collection operation. Artifacts on the host showed that Claude Code and OpenClaw were em…
-
It Worked as Designed. That Was the Problem: A Lesson in Cross-Functional Controls
This is a real example from my role as Director of People Operations at LogicManager. We’re sharing it because risk management isn’t theoretical here. It shows up in how we evaluate processes, challenge assumptions, a…
-
25 Million Victims: The Vendor Risk Failure Behind the Conduent Breach
25 Million Victims: The Vendor Risk Failure Behind the Conduent BreachLast Updated: May 8, 2026 When most people hear about a data breach, they assume the story is about hackers. In reality, it is far more often a fai…
-
European Union: EU Commission and Courts consider national digital laws inapplicable
In brief This article has practical relevance for online service providers that are either established in an EU Member state or subject to the Digital Services Act and currently see themselves pressured to comply with…
-
Singapore: HSA Updates Defect Reporting and Recall Guidance
In brief On 28 January 2026, the Health Sciences Authority (HSA) issued Version 3 of its product defect reporting and recall procedures for therapeutic products (TPs) and cell, tissue and gene therapy products (CTGTPs…
-
Singapore: HSA Releases AI Medical Software Consultation Findings
In brief On 13 February 2026, the Health Sciences Authority (HSA) published the findings of its public consultation on the proposed exemption from manufacturer’s licensing and product registration requirements for art…
-
South Africa: AI Policy Moves Towards Approval
Government advances sector‑based AI regulation as public consultation nears In brief South Africa’s Draft National AI Policy has formally entered the Cabinet approval process, signalling a decisive shift from high‑lev…
-
Draft Organic Law On Public Integrity: A Further Step In The Fight Against Corruption In Spain
The Council of Ministers has approved the Draft Organic Law on Public Integrity, a wide‑ranging legislative initiative designed to prevent corruption—understood in a broad and comprehensive sense—and to strengthen the…
-
United States: Navigating the Laws of Chatbots and AI Assistants
In brief A growing wave of lawsuits and regulatory actions alleging addictive use and physical harm has made companion chatbot safety a key concern. Chatbots of all kinds face a multifaceted compliance landscape, incl…
-
Apache ActiveMQ Exploit Leads to LockBit Ransomware
Key Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon. This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) o…
-
United Kingdom: FCA Launches Review on Future AI Approach
In brief On 27 January 2026 the Financial Conduct Authority (FCA) launched the Mills Review to examine the long-term impact of AI on financial services. Led by Sheldon Mills, this initiative invites industry feedback…
-
Australia: Treasury Moves to Strengthen MIS Governance Standards
Treasury consults on reforms to strengthen MIS governance and oversight. In brief The Australian Treasury (“Treasury“) is consulting on proposals to enhance the governance of registered managed investment schemes (MIS…
-
Australia: Landmark Penalty for Cyber Security Failures
Federal Court imposes AUD 2.5 million fine for breach of AFSL obligations In brief The Federal Court of Australia in Australian Securities and Investments Commission v FIIG Securities Limited [2026] FCA 92 has ordered…
-
Malaysia: Securities Commission Clarifies Requirements on Digital Asset Broking
In brief On 30 January 2026, the Securities Commission Malaysia (SC) provided clarity on the regulatory framework governing the offering of broking services for digital assets. The SC has affirmed the position that Ca…
-
South Korea: Introduction of Attorney-Client Privilege
In brief On 29 January 2026, the Korean National Assembly passed an amendment introducing statutory attorney-client privilege (ACP), granting attorneys and clients the right to protect confidential legal communication…
-
United Kingdom: New Cryptoassets Regime Published
In brief On 4 February 2024, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (“Cryptoassets Regulations”) were made, establishing a comprehensive regulatory framework for cryptoassets in th…
-
Cat’s Got Your Files: Lynx Ransomware
Key Takeaways The DFIR Report Services Contact us today for pricing or a demo! The intrusion began in early March 2025 with a single successful Remote Desktop Protocol (RDP) logon to an internet-exposed system. Notabl…
-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
Key Takeaways Private Threat Briefs: 20+ private DFIR reports annually. Contact us today for pricing or a demo! Table of Contents: Case Summary Analysts Initial Access Execution Persistence Privilege Escalation Defens…
-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs
Key Takeaways Private Threat Briefs: 20+ private DFIR reports annually. Contact us today for pricing or a demo! Table of Contents: Case Summary Analysts Initial Access Execution Persistence Privilege Escalation Defens…
-
Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
Overview Bumblebee malware has been an initial access tool used by threat actors since late 2021. In 2023 the malware was first reported as using SEO poisoning as a delivery mechanism. Recently in May of 2025 Cyjax re…
-
KongTuke FileFix Leads to New Interlock RAT Variant
Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware, a shift from the previous…
-
CVE-1999-1198 — BuildDisk program on NeXT systems before 2.0 does not prompt users for the root password, which allows loca…
BuildDisk program on NeXT systems before 2.0 does not prompt users for the root password, which allows local users to gain root privileges.Published 3 Oct 1990 · CVSS 7.2http://ciac.llnl.gov/ciac/bulletins/b-01.shtmlh…
-
CVE-1999-1391 — Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges…
Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges via a combination of the npd program and weak directory permissions.Published 3 Oct 1990 · CVSS 7.2http://ciac…
-
CVE-1999-1392 — Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privil…
Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges.Published 3 Oct 1990 · CVSS 7.2http://ciac.llnl.gov/ciac/bulletins/b-01.shtmlhttp://www.cert.org/advisori…
-
CVE-1999-0209 — The SunView (SunTools) selection_svc facility allows remote users to read files.
The SunView (SunTools) selection_svc facility allows remote users to read files.Published 14 Aug 1990 · CVSS 5http://www.securityfocus.com/bid/8http://www.securityfocus.com/bid/8
-
CVE-2000-0388 — Buffer overflow in FreeBSD libmytinfo library allows local users to execute commands via a long TERMCAP env…
Buffer overflow in FreeBSD libmytinfo library allows local users to execute commands via a long TERMCAP environmental variable.Published 9 May 1990 · CVSS 7.5http://www.securityfocus.com/bid/1185http://www.securityfoc…
-
CVE-1999-0084 — Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and sett…
Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.Published 1 May 1990 · CVSS 8.4https://exchange.xforce.ibmcloud.com/vulnerabilities/78https:/…
-
CVE-1999-1506 — Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up to 4.0.3, allows remote attackers to access user…
Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up to 4.0.3, allows remote attackers to access user bin.Published 29 Jan 1990 · CVSS 7.5http://www.cert.org/advisories/CA-90.01.sun.sendmail.vulnerabilityhttp://…
-
CVE-1999-1467 — Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary command…
Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary commands as root, possibly related to the configuration of the nobody user.Published 26 Oct 1989 · CVSS 10http://www.…
-
CVE-1999-1122 — Vulnerability in restore in SunOS 4.0.3 and earlier allows local users to gain privileges.
Vulnerability in restore in SunOS 4.0.3 and earlier allows local users to gain privileges.Published 26 Jul 1989 · CVSS 4.6http://www.cert.org/advisories/CA-1989-02.htmlhttp://www.ciac.org/ciac/bulletins/ciac-08.shtmlh…
-
CVE-1999-1471 — Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root pr…
Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.Published 1 Jan 1989 · CVSS 7.2http://www.cert.org/advisori…
-
CVE-1999-0082 — CWD ~root command in ftpd allows root access.
CWD ~root command in ftpd allows root access.Published 11 Nov 1988 · CVSS 10http://www.alw.nih.gov/Security/Docs/admin-guide-to-cracking.101.htmlhttp://www.alw.nih.gov/Security/Docs/admin-guide-to-cracking.101.html
-
CVE-1999-0095 — The debug command in Sendmail is enabled, allowing attackers to execute commands as root.
The debug command in Sendmail is enabled, allowing attackers to execute commands as root.Published 1 Oct 1988 · CVSS 10http://seclists.org/fulldisclosure/2019/Jun/16http://www.openwall.com/lists/oss-security/2019/06/0…
- The Hacker News Cybersecurity · Visit publisher
- BleepingComputer Cybersecurity · Visit publisher
- Krebs on Security Cybersecurity · Visit publisher
- SecurityWeek Cybersecurity · Visit publisher
- Dark Reading Cybersecurity · Visit publisher
- Help Net Security Cybersecurity · Visit publisher
- Infosecurity Magazine Cybersecurity · Visit publisher
- The Record Cybersecurity · Visit publisher
- CyberScoop Cybersecurity · Visit publisher
- Security Affairs Cybersecurity · Visit publisher
- Schneier on Security Cybersecurity · Visit publisher
- The Register — Security Cybersecurity · Visit publisher
- Ars Technica — Security Cybersecurity · Visit publisher
- Wired — Security Cybersecurity · Visit publisher
- Malwarebytes Labs Cybersecurity · Visit publisher
- SANS Internet Storm Center Cybersecurity · Visit publisher
- The DFIR Report Cybersecurity · Visit publisher
- Troy Hunt Cybersecurity · Visit publisher
- Compliance Week GRC · Visit publisher
- Corporate Compliance Insights GRC · Visit publisher
- Global Compliance News GRC · Visit publisher
- GovernanceDocs — GRC GRC · Visit publisher
- LogicManager GRC · Visit publisher
- CISA — Cybersecurity Advisories Advisories · Visit publisher
- CISA — Industrial Control Systems Advisories Advisories · Visit publisher
- CISA — News Advisories · Visit publisher
- Australian Cyber Security Centre — Alerts Advisories · Visit publisher
- Australian Cyber Security Centre — Threats Advisories · Visit publisher
- CISA — Known Exploited Vulnerabilities (JSON) Advisories · Visit publisher
- NIST — National Vulnerability Database API Advisories · Visit publisher
Summaries come from the publishers’ own feeds. Names and marks belong to their owners. Punic Systems is not affiliated with these publishers. Each headline also has an HTML page on this site. To remove a source, delete it in the admin panel.