Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. [...]
Intelligence Feed
Curated cybersecurity reporting and advisories. Headlines link to original sources.
Items
136
Last update
Oct 28, 2026, 11:10 PM (UTC)
No matching results
Try a different keyword, or switch the source filter back to “All sources”.
Discord to let search engines index public server messages
Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. [...]
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train u…
Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catal…
Sony ISP subsidiary data breach exposes 2.5 million customer records
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers' personal information. [...]
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five mon…
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity…
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]
Japan’s GMO Internet Urges Customers to Disconnect PCs
GMO Internet has told customers to unplug their PCs in advance of a possible ransomware attack
Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries
Attackers have used fake ChatGPT and Claude projects to distribute Yoba malware
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek.
Microsoft urges Entra ID admins to migrate users to passkeys
Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. [...]
AI Is Turning CISOs Into Business-Risk Translators, Says Nvidia’s Head of Cyber
Nvidia’s Mark Weatherford says CISOs must translate AI cybersecurity risks into business priorities, clarify risk ownership and balance innovation with security controls
Energy Giant Engie Notifies Customers of Supply Chain Breach
An undisclosed number of Engie customers have had their data compromised after a supply chain incident
InfraTrust report warns of exploited flaws in critical network infrastructure
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as "PHP2Shell" put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. [...]
Upwind Security Raises $400 Million at $3.8 Billion Valuation
The massive funding round comes just days after reports emerged that Upwind had attracted acquisition interest from several companies, including Datadog The post Upwind Security Raises $400 Million at $3.8 Billion Valuation appeared first on SecurityWeek.
Even after PHP2Shell, blast radius matters more than a CVSS score
PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabiliti…
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches. The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek.
TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers. The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices appeared first on SecurityWeek.
Dan McCrum’s Backstory of Wirecard, Germany’s Biggest Post-War Fraud Scandal
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 28, 2026 – Listen to the Podcast Episode Award winning investigative reporter Dan McCrum joined the Financial Times in 2007. He has covered business and finance from bo…
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authe…
Hackers now scanning systems for recently-patched Oracle flaw
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. [...]
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization. The post China-Linked Hackers Exploit PHP2Shell to Root Firewalls appeared first on SecurityWeek.
Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI fir…
Wazuh and AI for Enhanced SOC Workflows
Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, a…
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as fol…
Long-Hidden Flaws Patched in EPICS Research Facility Control Software
Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs. The post Long-Hidden Flaws Patched in EPICS Research Facility Control Software appeared first on SecurityWeek.
CISA warns of hackers now exploiting critical Node2Shell flaw
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and HTTP2Shell. [...]
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies. The post Nobody Trusts the Security Questionnaire. We Rely on It Anyway. appeared firs…
American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while le…
Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise
The company will use the Series B funds to expand its platform for securing AI agents’ access to sensitive systems. The post Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise appeared first on SecurityWeek.
Nefilim and Hive ransomware affiliate gets 70 months in prison
A Ukrainian national was sentenced to 70 months in prison for his role in ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021. [...]
Hackers Start Probing Fresh Oracle EBS Vulnerability
CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution. The post Hackers Start Probing Fresh Oracle EBS Vulnerability appeared first on SecurityWeek.
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit. The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted…
FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering
The U.S. Department of Justice (DoJ) on Tuesday announced the seizure of a domain associated with a bulletproof hosting provider (BPH) named Virtualine. The move was in response to the service being used to commit and facilitate prolific criminal activity, inc…
Japan's GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading Cloud Breach
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program opened on October 28 and pays only if a tip…
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how Tailscale SSH forwards network connections…
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifier, CVE-2026-35273, in June. Its root is a…
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active expl…
Japan's GMO urges customers to shut down PCs amid ransomware threat
The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today. [...]
OpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in tests
OpenAI confirmed GPT-6.1 Terra is safer overall than some of its older models, but its safety testing also found other problems. [...]
UNM Health ransomware attack disrupts patient care, surgeries
The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]
Hackers hijack Convertr analytics script to steal payment card data
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout. [...]
Every Scam Tells a Bigger Story
Fighting scams takes more than awareness—it takes collaboration, intelligence, and compassion. –Michelle McCluer, Vice President, Global Fusion and Intelligence, Mastercard San Jose, Calif. – Oct. 27, 2026 It started with a text that appeared to be meant for s…
CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed se…
Microsoft releases Windows OOB updates to distrust eMudhra certificates
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. [...]
Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulances
The University of New Mexico is working to restore systems following the incident, which has been claimed by the BYOD ransomware group
Hackers Infect 953 Online Stores With Scanner-Evading Code
Attackers have infected 953 online stores with a scanner-evading JavaScript loader since July 2025
OpenAI Compaction Flaw Exposed AI Reasoning to Researchers
Researchers uncovered an OpenAI API flaw that exposed hidden AI reasoning traces, prompting a fix and a $6000 bug bounty reward
ISC2 Launches Cyber-AI Workforce Coalition to Address the Future of AI Security Jobs
ISC2’s new Cyber-AI Workforce Coalition serves as a “vendor-neutral convener” to map the future of AI security careers, ISC2 CEO Scott Beale told Infosecurity
GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL bac…
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could resu…
Quantapocalypse: A Q-Day Documentary. Sponsored by Keyfactor.
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 27, 2026 – Watch the Quantapocalypse Documentary Quantapocalypse, a Cybercrime Magazine 10-minute documentary sponsored by Keyfactor, examines how organizations can pre…
Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes
Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and…
Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key
An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners…
AI-Generated Fake Login Pages Are Making Account Takeovers Easier
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations. Some fake log…
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.…
Copenhagen University Breach Compromises Data on Half a Million People
Hackers have stolen personal information on over 520,000 people from the University of Copenhagen
First ISC2 AI Security Certification Expected for Early 2027
ISC2 is seeking 3000 volunteers to enrol to a pilot exam phase for its upcoming AI security certification
Watchdog Urges Police and Fire Service to Improve Cybersecurity
UK police forces and fire and rescue services have been urged to strengthen cybersecurity as rising cyber threats outpace current defenses
Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operatio…
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections
OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and…
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the de…
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the…
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, the activity is designed to add a small piece of code to the…
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be rea…
CISA 2030 Sets Out ‘Aggressive, Anticipatory’ Cyber Defense Strategy for Critical Infrastructure
CISA’s new strategy, CISA 2030, will focus on rapid detection and response and resiliency of critical services ahead of “passive defense”
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malwar…
Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens
A large-scale GitHub campaign abused stolen access tokens to target 13,500+ branches and repositories with secret-stealing workflows
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More
This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are showing up everywhere. Hackers are scanning for targets, some flaws are already being used in attacks, and security team…
Linux Flaws Exposed Before Fixes as Root Exploit Goes Public
Six Linux flaws were made public, including one with a working root exploit and no merged fix
How Bad Is The 2026 Data Breach Crisis?
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 26, 2026 – Read the Full Story from Encryption Consulting Cybersecurity Ventures projects global cybercrime damage costs rising from $10.5 trillion in 2025 to $12.2 tri…
Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw
Microsoft’s updates address two newly disclosed vulnerabilities in the .NET developer platform, as well as flaws not fully addressed in an earlier release
Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it, the project's maintainers say. An attacker would first need a vulnerable Wasmt…
Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the…
Blue Initiative Offers Maritime Sector Dedicated Vulnerability Database
Blue Initiative launches a new vulnerability database for IT and OT CVEs relevant to the maritime industry
uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official…
PHP Publishes Mitigation Advice for New RCE Flaw
PHP warns of critical RCE vulnerability CVE-2026-115560, but says limited exploit conditions mean most deployments are unlikely to be affected
Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts at 79 organizations. Huntress…
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Ent…
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real cust…
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding,…
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a Euro…
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models. "Based on the current state of alignment research, monitoring…
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, Microsoft's .NET, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497…
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration…
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may cho…
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet
Between November 2025 and March 2026, the Dutch security firm Eye Security pushed more than 2 million updates to computers it did not own to switch off a background updater that it said could have allowed an outsider to take over the machine. The updater belon…
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active…
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026…
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially cra…
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an "Autonomous Red Team Kill Chain Framework" referred to as Phan…
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also indicate that operators…
Cybercrime Is The World’s Third-Largest Economy. AI Attacks And Defends.
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 23, 2026 – Read the Full Story in The Times of Israel Imagine a country without borders, universities, factories or an elected government. It manufactures almost nothin…
Gaming Giant Capcom Confirms Data Breach Exposed Users’ Personal Information
Japanese video games giant Capcom confirmed unauthorized access to its online account system
PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws. The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP c…
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining ini…
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause
EU Regulators to Investigate Booking.com Over Scam Risks
The EU Commission will assess whether Booking.com has adequately protected customers from phishing attacks
Iranian Hacking Group Found Hosting C2 Infrastructure in the US
Stealthy malware campaign by ‘Prince of Persia’ threat group targeting organisations worldwide discovered operating on American soil
Why CISOs Watch YouTube Videos To Find Cybersecurity Vendors
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 22, 2026 – Watch the YouTube Video Where and how do chief information security officers (CISOs) find new cybersecurity vendors? Registering on vendor websites with thei…
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform
PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure
Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities
Cloud Security Maturity Lags Despite Widespread Adoption, SANS Warns
Nearly all organizations now run production workloads in the cloud, but a new SANS survey found most have yet to achieve mature cloud security programs
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say…
New PhaaS Platform Uses AI to Craft Phishing Lures and Mask Malicious Activity
Researchers have uncovered Athena StealthRoute, a phishing-as-a-service platform featuring an AI Studio that generates phishing lures and decoy content designed to conceal attacks
Symantec Uncovers AI Agent Hijacking Models for Autonomous Cyber-Attacks
Researchers at Symantec have uncovered an AI agent designed to operate a full cyber-attack without human intervention
The Best Cybersecurity Lies In Artificial Intelligence
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 21, 2026 – Read the Full Story in Fast Company Cybersecurity Ventures estimated that global cybercrime costs hit $10.5 trillion in 2025, and a World Economic Forum repo…
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks - and both are evolving their tactics in an attempt to outdo one another
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the group’s tactics
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches
Children’s Data Stolen After Ransomware Attack Compromises ‘Password1’ Account
The ICO has slammed security failings by the Welsh local government data unit and IT service provider following the 2024 incident
Head of AI Security Roles Surge in Large Organizations
A new IANS report has found that despite the growth of the head of AI security role, accountability for AI governance in firms remains unsettled
Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk
OpenCode silently patched a critical RCE flaw, leaving vulnerable users unaware of the security risk, researchers at Pillar Security warned
Cybersecurity Companies: YouTube Channels With The Most Subscribers
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 20, 2026 We recently reported that the award-winning Cybercrime Magazine has the no. 1 b2b focused cybersecurity channel with more than 1.3 million subscribers and many…
AI Agent Adoption Creates Risk as Oversight Struggles to Keep Pace, Splunk Finds
Rapid adoption of agentic AI comes with potential business benefits. But if done incorrectly it also carries risks around AI activity management and security
Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw
Siemens identified the activity to be from the Romulus multi-platform ClickFix campaign, with Siemens Software Center users urged to apply an update
Exploited Vulnerabilities Typically Take Three Months to Patch, Moody’s Finds
Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report
Conduent Agrees to Pay $80m to Settle Data Breach Class Action
The 2024 cyber incident affected the healthcare data of 62 million people, who launched a class action lawsuit against the business services firm
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group…
OpenCode Breach Could Affect OpenAI, Anthropic and Google
A breach affecting the OpenCode Console may lead to the exposure of API keys for Anthropic, OpenAI and Google Gemini users
Cybersecurity Underpins Saudi Arabia’s Digital Future
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 19, 2026 – Read the Full Story in Arab News Cybersecurity Ventures projected that global cybercrime damages would reach $10.5 trillion annually by 2025, up from $3 tril…
ConnectWise Shuts Off Cloud Services After ‘Unauthorized Access’ to Microsoft 365 Tenants
Cloud Backup, SaaS Security, and Cloud Management services offline as IT service provider investigates possibility that unknown attackers have full access to client environments via stolen tokens
US Cybersecurity Job Postings Fall 26%, Hitting Four Year Low
CyberSN observed a particularly big dip in cybersecurity leadership positions such as CISO and Cybersecurity Director in 2026 compared to 2025
Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments
New report warns that threats of violence against employees of organizations hit by ransomware are on the rise as attackers find new ways to guarantee payments
Fighting Cybercrime in Sri Lanka: A Resilience-Driven Approach To Cybersecurity
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 16, 2026 – Read the Full Story in The Morning Global cybercrime expenses are expected to increase from $11 trillion USD by 2027 to $12.2 trillion by 2031, according to…
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence
Cyber Incident at BAE Systems Disrupts US Federal Bankruptcy Noticing
Several services of the US Bankruptcy Noticing Center are unavailable due to a cyber incident affecting defense contractor BAE Systems
France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack
France-based operators of Danfoss refrigeration controllers have sharply reduced their internet exposure after the October 11 cyber-attack
New Aoki Infostealer Targets AI Coding Assistant Credentials
Symantec warned that Aoki can steal API keys and tokens from a number of popular AI coding assistants, including Claude and Gemini
Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
CVE-2026-35029 and CVE-2026-59823 affect LiteLLM, which is commonly used by enterprises to connect their AI applications to providers like OpenAI and Anthropic
Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages
Microsoft and partners reveal a major Chinese-language phishing network centered around the Yam Store marketplace
ICO Reprimands Met Over Third-Party Data Leak
The ICO has handed the Metropolitan Police a reprimand and enforcement notice after privacy failings linked to the Auror platform
Page 1 of 1 0 results