News Archive
2287 stories · page 7 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
A suspected member of the ShinyHunters hacking group, known online as "Rey," has reportedly been detained in Jordan and is cooperating with the FBI to identify and locate other members of the extortion group. The individual has been identified as Saif al-Din Khader, who was reportedly taken into custody on Tuesday. Sources indicate that Khader is assisting the FBI and international law…
Anthropic's super bug-hunting model Mythos is hardcore good at math, as latest vuln under attack shows
A critical authentication bypass vulnerability, tracked as CVE-2026-61500, in Rejetto HTTP File Server (HFS) has been actively exploited in the wild, with initial activity originating from a China-hosted IP address. The flaw, which can lead to full administrative access and remote code execution, was discovered by researchers using Anthropic's AI bug-hunting model, Mythos.
Fake Zoom installer hides macOS backdoor CloudSyncD
Jamf Threat Labs has uncovered a new macOS backdoor, dubbed CloudSyncD, which is distributed through a fake Zoom installer. The malware was first observed in development on September 15, 2026, and quickly transitioned to live command-and-control infrastructure within two days.
YARA-X 1.21.0 Release, (Sat, Oct 3rd)
The YARA-X project has announced the release of version 1.21.0, which includes five new improvements and four bug fixes. The update was made available on Saturday, October 3rd.
MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics
MI5 has issued a warning regarding a Chinese state security service operation that reportedly involved over 100 academics linked to the U.K. The U.K.'s domestic intelligence and security agency stated that these individuals have inadvertently or wittingly contributed to China's intelligence gathering efforts. The alert, issued on September 30, 2026, specifically named the China General…
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
The suspected China-linked threat actor known as Warlock has reportedly been exploiting vulnerabilities in Microsoft SharePoint to disable security tools and deploy ransomware. This activity, observed by the Symantec and Carbon Black Threat Hunter Team, indicates a continued weaponization of SharePoint flaws, potentially including both previously known and newly discovered vulnerabilities. The…
Danish university DTU breach exposes data of up to 200,000 people
The Technical University of Denmark (DTU) has disclosed a data breach that may have exposed personal information belonging to as many as 200,000 individuals. The incident involved unauthorized access to DTUBasen, the university's identity and access management (IAM) system, by an attacker using compromised credentials.
Dutch Vulnerability Institute Breached Via Zammad 0-Days
The Dutch Institute for Vulnerability Disclosure (DIVD) has reportedly suffered a security breach, with attackers exploiting two zero-day vulnerabilities in the Zammad ticketing system. The incident led to remote code execution and ultimately granted the attackers root access to affected systems.
Muse Creates Detailed Profiles of All Your Friends and Family
Meta's new AI assistant, Muse, has been observed creating detailed profiles of individuals within a user's social circle, including family, friends, partners, and colleagues. This functionality was discovered by independent AI safety and security researcher Karan Joshi, who extracted Muse's internal operating instructions by prompting the AI through its regular chat interface to share its own…
doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures
doxx.net has announced it has raised $38 million in funding to further develop its platform aimed at preventing "AI agent-on-the-internet misadventures." The company's new ADN platform is designed to provide a safeguard for AI agents operating under a user's authority, mitigating potential risks associated with autonomous AI actions online.
Fortra Patches Critical Vulnerabilities in BoKS
Fortra has released patches addressing critical vulnerabilities within its BoKS product line. The reported flaws collectively present a significant security risk, potentially enabling attackers to bypass authentication mechanisms, execute arbitrary shell commands, and trigger memory corruption issues. These vulnerabilities underscore the ongoing challenges in securing privileged access…
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations
A recent report on the state of cybersecurity in 2026 indicates that the landscape is being profoundly influenced by the continued expansion of cloud computing, artificial intelligence, and distributed systems. This evolution is driving organizations to prioritize continuous visibility and control over a sprawling infrastructure encompassing numerous identities, devices, and data repositories.
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
GitLab has released patches for a critical vulnerability in its AI Gateway, identified as CVE-2026-90970, which could enable an authenticated user to execute arbitrary commands on self-hosted gateway instances. The flaw, which carries a CVSS score of 9.9, was publicly disclosed by GitLab on October 2, 2026.
Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
Cisco Talos researchers have identified a new Rust-based backdoor, dubbed Antino, which a China-linked threat actor known as UAT-11587 is using to conduct espionage against government and policy organizations in Asia. The backdoor uniquely leverages Microsoft 365 services, specifically Outlook and OneDrive, for its command-and-control (C2) communications, allowing its traffic to blend in with…
N0n Ransomware Group Emerges, Quickly Targets Victims
A new ransomware operation, dubbed N0n, has reportedly emerged and is actively targeting organizations, according to recent observations. The group has quickly established an online presence, including a dark web leak site where it claims to be publishing data from compromised entities. This rapid operationalization suggests a prepared and potentially well-resourced threat actor.
U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in Zammad GmbH's Zammad helpdesk software to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies address them by October 5, 2026. These flaws, identified as CVE-2026-102489 and CVE-2026-102490, have been actively exploited in the wild, including in a recent breach of…
Friday Squid Blogging: EU is Trying to Fight Unregulated Squid Fishing
The European Union is reportedly moving to implement import controls as a measure to combat unregulated squid fishing in the Southwest Atlantic. This initiative aims to address the challenges posed by fishing activities that operate outside established regulatory frameworks in the region.
Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus
A California federal judge has dismissed a lawsuit filed by a group of Salvadoran journalists who alleged their devices were infected with Pegasus spyware. The judge ruled on Wednesday, October 1st, 2026, that the case lacked jurisdiction in California, marking the second such dismissal after an initial rejection in March 2024.
RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail
A new report indicates that the offensive cyber operations startup RemoteThreat is advocating for a shift in how security teams approach red teaming exercises. The company suggests that current methodologies may not adequately prepare organizations for the sophisticated capabilities increasingly employed by real-world attackers, particularly in scenarios where initial defensive layers have…
ICE Has Been Dumping Protester Photos Into a Palantir Database
Newly unsealed court documents allege that the U.S. Department of Homeland Security (DHS) has been collecting information, including photographs and license plate numbers, of individuals observing Immigration and Customs Enforcement (ICE) activities and storing this data in a Palantir-built database known as Investigative Case Management (ICM). The allegations are part of a proposed…
Bipartisan backlash to ALPRs grows as two high-profile bills are introduced
Two new bills introduced in Congress highlight a growing bipartisan concern over artificial intelligence-powered automatic license plate recognition (ALPR) cameras, signaling increased political scrutiny for companies like Flock, Motorola, and Axon.
Frontline Education breach exposes school district employee data
Frontline Education, a provider of administration and workforce management software for school districts, has confirmed a data breach that exposed employee information, including Social Security numbers, after attackers exploited a vulnerability in a third-party software product. The company began notifying affected school districts of the incident in early October 2026.
Warlock ransomware breach SharePoint in water, telecom operator attacks
The Warlock ransomware group, identified by Symantec as Longlegs, has been observed targeting a range of organizations, including a water utility, a telecommunications provider, a regional government body, and a university. These attacks, which have primarily focused on Portuguese and Spanish-speaking countries in Europe, Africa, and Latin America over the past two months, leverage…
The legal questions raised by agentic AI hacks
The recent surge in "agentic hacks," where AI models autonomously breach organizations, has prompted a widespread call among policymakers, regulators, and legal experts for accountability from AI developers. While there is broad consensus that action is necessary, the application of existing laws and regulations to these incidents remains largely unclear.