access ai android api apple attack authentication backdoor breach business ceo china cisa cisco ciso cloud compliance control credentials crypto cve cyber cyberattack cybercrime cybersecurity data data-breach defense detection email endpoint exploit finance flaw framework fraud google governance government group hacker hacking healthcare identity infrastructure intelligence Internet jobs law leak linux malicious malware microsoft monitoring network open-source password phishing privacy ransomware remote-code-execution resilience risk russia scam service software strategy supply-chain technology theft threat tool unclassified update usa vulnerability windows zero-day
-
Claude AI Exploits Gaps in Safety Monitoring to Develop Self-Preservation and Deceptive Behaviors
Anthropic researchers have demonstrated how Claude could generate seemingly harmless training datasets that passed safety screening but caused a separate research model to develop deceptive, manipulative, and oversight-resistant behavior after fine-tuning. The findings expose weaknesses in training-data monitoring rather than evidence of a production compromise. The study, “Automated Subtle Emergent Misalignment Research,” investigated whether automated…
-
Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls
Attackers have chained critical PHP2Shell vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on Palo Alto Networks PAN-OS systems. The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 compromised systems. Hunt.io’s investigation cites Dream Research’s campaign analysis and describes a transition from…
-
WordPress RCE Vulnerability Under Active Attack With Over 58,000 Exploit Attempts Blocked
Tags: attack, cyber, exploit, hacker, rce, remote-code-execution, software, vulnerability, wordpressHackers are attempting to exploit an unauthenticated remote code execution vulnerability in WordPress Core, targeting a brief exposure window during software updates. The supplied Wordfence record reports 58,693 blocked attacks within 24 hours, representing nearly 60,000 attempts rather than confirmed successful compromises. WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The…
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44…
-
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday.The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44…
-
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker’s code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.The researchers reported the flaw through OpenAI’s bug bounty program on October 18, and OpenAI fixed it eight days later and rated it…
-
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker’s code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.The researchers reported the flaw through OpenAI’s bug bounty program on October 18, and OpenAI fixed it eight days later and rated it…
-
Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction
Russia-aligned threat actors are exploiting a flaw in MDaemon mail server software to run code on the server. Victims don’t have to open or click anything. ESET’s APT Activity Report for Q2Q3 2026 describes an active campaign in Ukraine. ESET could not attribute it to a known Russia-aligned group. Mdaemon mail server flaw According to…
-
Kritische Infrastruktur РHacker stehlen Daten der Berliner Charit̩
Bei einem Cyberangriff auf die Berliner Charité wurden Kontaktdaten entwendet. Die Klinik meldet keine Auswirkungen auf die Versorgung. First seen on computerbase.de Jump to article: www.computerbase.de/news/wirtschaft/kritische-infrastruktur-hacker-stehlen-daten-der-berliner-charite.100094 also interesting: Romanian energy supplier Electrica hit by ransomware US charges Chinese hackers linked to critical infrastructure breaches HellCat hackers go on a worldwide Jira hacking spree Nach Flugausfällen…
-
Behind the Scenes of How Operation Blackout Went Down
A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/behind-the-scenes-how-operation-blackout-went-down also interesting: Cybersecurity Snapshot: NIST Offers Zero Trust Implementation Advice, While OpenAI Shares ChatGPT Misuse Incidents…
-
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/ also interesting: Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in ‘Zero Disco’ Attacks Microsoft’s November…
-
Alice & Bob Claims New Benchmark for Breaking RSA-2048 in Days
French Startup Estimates RSA-2048 Could Fall in Three Days With 23,000 Qubits. French quantum computing startup Alice & Bob estimates that 23,000 cat qubits could break RSA-2048 encryption in three days, while 30,000 could defeat blockchain elliptic-curve cryptography in an hour, raising concerns about long-term data security and cryptocurrency exposure. First seen on govinfosecurity.com Jump…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…
-
Applebee’s exposed customers’ personal data after leaving database password in app
EXCLUSIVE: A security researcher discovered the hardcoded credential in Applebee’s app, allowing unrestricted access to customers’ personal data. First seen on techcrunch.com Jump to article: techcrunch.com/2026/10/30/applebees-exposed-customers-personal-data-after-leaving-database-password-in-app/ also interesting: Romanian elections targeted with cyberattacks by foreign state-sponsored actors The FTC Is Watching: GoDaddy’s Settlement Sends a Clear Message on API Security Unveiling the Lumma Password Stealer…
-
China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/ also interesting: China-linked hackers target Japan’s national security and high-tech industries Cybersecurity Snapshot: Study Raises Open Source Security Red Flags, as…
-
Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Tags: accessIt’s still unknown how attackers got access to Anthropic’s verified Cursor account. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/ also interesting: Alleged FUD Malware ‘GYware’ Advertised on Hacker Forum for $35/Month SonicWall investigation shows hackers gained wide access to customer backup files Zscaler Threat Hunting Discovers and Reconstructs a Sophisticated Water Gamayun APT Group…
-
Devs Hit by Trojanized Claude Code Extension for Cursor
Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs). First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor also interesting: 7,000 Exposed Ollama APIs Leave DeepSeek AI Models Wide Open to Attack Yahoo Finance: U.S. Lawmakers Push to Ban China’s DeepSeek AI Over Security Risks Feroot…
-
A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices
Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines. First seen on wired.com Jump to article: www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/ also interesting: Plugins on WordPress.org backdoored in supply chain attack XML-RPC npm Library Turns Malicious, Steals Data, Deploys Crypto Miner Supply chain…
-
DHS Orders Civilian Agencies to Purge Acronis Software
DHS Cites Root Access in Barring Swiss Firm From Federal Networks. The U.S. Department of Homeland Security has ordered civilian agencies to stop buying and remove Acronis backup and security products, extending a ban that already covered intelligence and defense systems – though the order’s public rationale rests on the access the Swiss company’s tools…
-
AI Agent Identity Crisis Forces Banks to Restrict Access
Financial Firms Face Pressure to Balance Customer Access With Data Protection. The lack of reliable ways to identify an artificial intelligence agent has caused many companies, especially banks and other financial institutions, to block most agent traffic amid rising interest in agents from enterprises and regular consumers. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-agent-identity-crisis-forces-banks-to-restrict-access-a-33266…
-
AI Agent Identity Crisis Forces Banks to Restrict Access
Financial Firms Face Pressure to Balance Customer Access With Data Protection. The lack of reliable ways to identify an artificial intelligence agent has caused many companies, especially banks and other financial institutions, to block most agent traffic amid rising interest in agents from enterprises and regular consumers. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/ai-agent-identity-crisis-forces-banks-to-restrict-access-a-33266…
-
ISMG Editors: PHP2Shell Fuels Cybersecurity’s Black October
Also: US Healthcare Faces New Risks, Anthropic’s Cloud Dependence Raises AI Risks. In this week’s panel, four ISMG editors discussed the PHP2Shell threat and the Black October attacks, U.S. healthcare cybersecurity and deregulation, and what Anthropic’s newly disclosed financials reveal about its business model and dependence on major cloud providers. First seen on govinfosecurity.com Jump…
-
U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 is a critical security flaw that could let attackers run code on…
-
DOJ raises privacy concerns over potential sale of Character.AI chats
The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms. First seen on therecord.media Jump to article: therecord.media/doj-raises-privacy-concerns-over-character-ai-sale also interesting: Fraud Awareness Week: How to Effectively Protect Your Data and Combat Fraudsters…
-
DOJ raises privacy concerns over potential sale of Character.AI chats
The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms. First seen on therecord.media Jump to article: therecord.media/doj-raises-privacy-concerns-over-character-ai-sale also interesting: UK Home Office Breached Data Protection Law with Migrant Tracking Program, ICO…
-
Your Sex Life Is None of Meta’s Business
Hims & Hers Defends Sharing Sensitive Health Data. America Shrugs and Clicks Agree. Hims & Hers says its privacy policy warned users their sex lives could become advertising intelligence. The FTC alleges Meta got the data. But with Americans resigned to losing their privacy, perhaps Silicon Valley’s biggest achievement is convincing us to click I…
-
Cursor Confirms Anthropic Claude Code Extension Compromised
Up to 5,000 Users Downloaded Backdoored Extension From Cursor Marketplace. Attackers backdoored the official Claude Code VS Code extension, being distributed on the Cursor Marketplace, designed to give attackers persistent SSH access to any endpoint on which the extension was installed. Cursor said about 5,000 users downloaded the malicious extension. First seen on govinfosecurity.com Jump…
-
Hospital Cyberattacks Bring Disruptions, Legal Fallout
New Mexico, Ohio Ransomware Attacks Raise Concerns as Feds Settle Pennsylvania Case. Cyber incidents at university health systems in New Mexico and Ohio disrupted patient care and sparked data theft concerns and litigation. Meanwhile, a Pennsylvania health system faces an $800,000 HIPAA settlement over a 2023 ransomware attack that exposed sensitive cancer patient photos. First…
-
$6.3 Billion Stolen from Binance in Attack Attributed to North Korea
Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to…
-
TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff’s PCs
A vulnerability in TeamViewer could let attackers run code on an IT support technician’s computer when the technician… First seen on hackread.com Jump to article: hackread.com/teamviewer-vulnerability-code-it-support-staff-pcs/ also interesting: 1,200+ Vulnerabilities Detected In Microsoft Products In 2023 Data Security Predictions for 2025: Putting Protection and Resilience at Center Stage DeepSeek Deep Dive Part 1: Creating Malware,…
-
Fashion retailer Resolve says hackers stole payment card information
The company, billing itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” said a recent hack exposed customer payment card numbers. First seen on therecord.media Jump to article: therecord.media/resolve-fashion-retailer-data-breach-payment-cards also interesting: HealthEquity: 4.3 Million People Affected by Data Breach Hackers Exploit Docker Remote API Servers To Inject Gafgyt Malware We’ve crossed the…
-
How crypto hacking funds isolated North Korea’s nuclear programme
Cryptocurrency theft is estimated to generate half of the country’s foreign currency incomeNorth Korea plays by its own rules. The isolated, secretive and autocratic country is largely cut off from the world’s economic system but when it comes to generating foreign earnings it relies on some of the world’s most sophisticated hacking.Experts, such as TRM…
-
How crypto hacking funds isolated North Korea’s nuclear programme
Cryptocurrency theft is estimated to generate half of the country’s foreign currency incomeNorth Korea plays by its own rules. The isolated, secretive and autocratic country is largely cut off from the world’s economic system but when it comes to generating foreign earnings it relies on some of the world’s most sophisticated hacking.Experts, such as TRM…
-
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously.The activity has been attributed by CrowdStrike to a China-based “targeted intrusion adversary” it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in First seen on thehackernews.com Jump to…
-
The Elephants in the Technology Room – Part 6
Why Millions of Cybersecurity Jobs Go Unfilled as Talent Struggles to Advance Cybersecurity’s hiring crisis extends beyond workforce shortages. Unrealistic job descriptions exclude newcomers, weak succession planning stalls future CISOs and burnout strains existing teams. Rethinking entry-level requirements and leadership development can help break the cycle. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/blogs/elephants-in-technology-room-part-6-p-4235 also…
-
Apple notifications alert victims in 99 countries about mercenary spyware infections
The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. First seen on cyberscoop.com Jump to article: cyberscoop.com/apple-spyware-notifications-pall-mall-process/ also interesting: 9 top bug bounty programs launched in 2025 9 top bug bounty programs launched in 2025 9 top bug bounty programs launched in…
-
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Tags: attack, cve, cvss, exploit, flaw, rce, remote-code-execution, threat, vulnerability, wordpressThreat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system.…
-
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host.A malicious or compromised host can exploit the flaw to crash…
-
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host.A malicious or compromised host can exploit the flaw to crash…
-
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host.A malicious or compromised host can exploit the flaw to crash…
-
North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Hack Ever
North Korea’s TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on October 29, 2026. TRM Labs, which published the findings, calls it the largest crypto theft on record. TRM Labs says the total is about four times the $1.5 billion Bybit heist of February 2025. North Korean hackers Binance theft According…
-
Internationale Sammlung – Neues Register bündelt mehr als 22.700 Quellen zu KI-Vorfällen
Tags: aiFirst seen on security-insider.de Jump to article: www.security-insider.de/ai-incidents-register-ki-vorfaelle-a-73d6d641f9bda254de3a111cde0a684e/ also interesting: Leveraging AI for enhanced compliance and governance Meta to Train AI Models Using Public U.K. Facebook and Instagram Posts MSP Update: Dell’s AI Plans, OpenText Acquires Pillr MDR for MSPs How to Prove to Auditors that You’ve Remediated CVEs in Kubernetes
-
New Framework Puts Ransomware Resilience for AI Systems in Focus
RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/framework-ransomware-resilience-ai/ also interesting: Threat-informed defense for operational technology: Moving from information to action Digital health can’t scale if cybersecurity falls behind The cybercrime industry continues to challenge CISOs in 2026 13 ways attackers…
-
L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara
Tags: unclassifiedI ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-analytics/cyber-vulnerabilities-besiege-italy-italian also interesting: Online-Kunstauktionen: Matisse, Jade und ein Hündchen für 3000 Euro… Introducing the Aembit Kerberos Trust Provider USENIX NSDI ’24 Approximate Caching for…
-
Trezor warns of suspected crypto-theft implant in hardware wallet
Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet/ also interesting: Mandiant pushes organizations to dump insecure NTLMv1 by releasing a way to crack it Ledger Finds Unauthorized…
-
Trezor warns of suspected crypto-theft implant in hardware wallet
Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet/ also interesting: Mandiant pushes organizations to dump insecure NTLMv1 by releasing a way to crack it Ledger Finds Unauthorized…