Fri 30 Oct
LiveGet it free
ZOTPAPER

News without the noise

Security

Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.

552 articles · page 2 of 12

AllAIHardware & DevicesCryptoProgrammingSecurity
Viewgridlistcompact
Security

Apple patches 329 vulnerabilities across devices, including camera access flaw

Apple released a sweeping set of security updates on October 26, addressing 329 unique vulnerabilities across iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari. The patches include fixes for a CoreMedia vulnerability that could allow a malicious app to access the camera without permission, an Apple Intelligence flaw that could let a remote attacker access sensitive user data, and multiple WebKit issues that could enable arbitrary code execution.

·2 min
Security

AI-assisted attacks hit South Korean banks before arrests in separate case; 68,000 data records stolen

Between late September and early October, an attacker breached seven South Korean financial institutions and exfiltrated the personal data of about 68,000 people, cybersecurity firm CrowdStrike reported, in a wave of AI-assisted attacks that preceded arrests in a separate campaign that stole 8.2 million records from more than 90 organizations. Seoul police announced the arrest of seven suspects in that case on October 26.

·2 min·3 sources
Security

CISA unveils 'CISA 2030' strategy to harden US cyber defences, prioritise critical infrastructure

The US Cybersecurity and Infrastructure Security Agency (CISA) on Monday released its new strategic plan, CISA 2030: Defend, Harden, Prevail, setting out a more aggressive posture for protecting the nation’s critical infrastructure from increasingly sophisticated cyber threats. The strategy aligns with President Trump’s Cyber Strategy for America and the National Resilience Strategy.

·2 min
Security

NIST, CISA and NSA issue AI agent incident guidance as OpenCode reports key exposure

The National Institute of Standards and Technology, the Cybersecurity and Infrastructure Security Agency and the National Security Agency have jointly published ten voluntary practices for organisations that train or deploy AI agents, setting out how to handle incidents in which agents act without direction. The 14-page guide, released October 16, comes as open-source coding agent OpenCode disclosed that API keys stored by some users of its Console service were exposed.

·3 min
Security

ASD warns of ‘inevitable’ online disruptions as AI supercharges cyber threats

Australians should prepare for more frequent and unexpected disruptions to everyday online services, the nation’s top cyber spy has warned, as the Australian Signals Directorate releases an annual threat assessment outlining an 80 per cent surge in malicious activity driven by frontier artificial intelligence models. The ASD also revealed it had successfully dismantled a major criminal botnet, cutting off access to 180,000 compromised computers worldwide.

·3 min·7 sources
Security

Samsung TV tracking researcher says OpenAI banned account over AI reverse-engineering

A cybersecurity researcher who reverse-engineered Samsung's Tizen operating system to reveal extensive user tracking says OpenAI banned his account for using its tools during the process. The researcher, known as log4j, discovered code indicating always-on microphone monitoring, screenshot capture, automatic content recognition and AI-powered user profiling on a 2025 Samsung smart TV, sparking fresh privacy concerns about smart devices.

·3 min·2 sources
Security

PingCAP confirms breach as FulcrumSec says it stole 10.6 TB

PingCAP, the company behind the open-source TiDB database, has confirmed that an attacker gained unauthorised access to its internal systems and stole source code and customer-related data. The cyber extortion group FulcrumSec claims to have taken 10.6 TB of data, including the TiDB Cloud control plane, customer SQL statements, API keys, and a four-year log of customer connections, though PingCAP says an external forensic review found no evidence of persistent access to production systems or impact on customer data stored in TiDB itself.

·4 min
Security

Symantec uncovers AI attack agent designed to hijack exposed models for autonomous attacks

Security researchers have uncovered an AI agent built by threat actors to scan the internet for exposed AI models, hijack them, and run autonomous attacks including database theft, credential harvesting, and cryptocurrency mining, all without human approval. The Symantec Threat Hunter Team captured the agent's full instruction set in an AI honeypot over the summer, giving researchers a detailed view of the tool's capabilities. The agents have found no evidence that the tool has been used in real-world attacks yet.

·3 min
Security

New BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot in Central Asia espionage campaign

A previously unknown UEFI bootkit dubbed BlackX has been used in an espionage campaign targeting diplomatic agencies in Central Asia, exploiting the old Baton Drop vulnerability to bypass Secure Boot protections, according to researchers at Kaspersky. The operation, detected in early 2026, has been attributed with medium confidence to the Chinese state-sponsored threat group APT41, also known as Brass Typhoon, Wicked Panda and Barium.

·3 min
Security

Researchers disable vulnerable updater in abandoned Popcorn Time fork, closing RCE risk on millions of devices

Security researchers have remotely disabled a critical vulnerability in the abandoned Time4Popcorn application, a fork of the Popcorn Time BitTorrent client, that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. The flaw, tracked as CVE-2026-30612, stemmed from unencrypted HTTP connections to an expired domain and a total lack of digital signature verification on updates.

·2 min·2 sources
Security

Quest Diagnostics confirms data breach on Quanum lab testing system, patient records accessed

Medical lab testing giant Quest Diagnostics has confirmed a cyberattack and data breach affecting its Quanum platform, which handles lab test requests, billing and a wide array of patient health records. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission on Wednesday, saying unauthorized access included the accessing of certain patient records.

·2 min·2 sources
Security

US bans dashboard camera and wireless video transmitter under new chip-level security rule

The US Federal Communications Commission (FCC) has issued its first bans under a new rule allowing it to block devices based on the internal chips they contain, rather than specific products or brands. The bans, announced on 23 October 2026, target a dashboard camera and a wireless video transmitter because they contain a chip from HiSilicon, a Huawei subsidiary on the US government's national security risk list.

·2 min
Security

Switch 2 security bypassed in software-only jailbreak

Security researcher Sammy Hajhamid has demonstrated a software-only partial jailbreak of the Nintendo Switch 2, exploiting a 32-bit integer overflow in the SmileBasic 4 interpreter. The vulnerability, discovered with the assistance of OpenAI's Codex, provides userland access that enables homebrew software, game modding, save file backups, and peripheral manipulation. The hack requires a tethered connection to a macOS or Linux PC on the same network.

·2 min
Security

ABC and Critical Infrastructure Targeted in Spyware Campaign Weaponising Online Ads

The Australian Broadcasting Corporation (ABC) has confirmed it was among more than two dozen Australian government agencies, critical infrastructure providers, universities and media organisations targeted in a sophisticated cyber espionage campaign. The campaign, dubbed 'Adfection', was identified by The Citizen Lab, which found that the Israel-based company Discover-Tech exploited online advertising systems to deliver spyware to devices merely by viewing an ad. The ABC said a small number of staff devices were exposed, but no evidence of tracking or compromise has been found.

·2 min·2 sources
Security

GitLab patches maximum-severity remote code execution flaw in regex compiler

GitLab has released security updates for a maximum-severity vulnerability in its Regular Expression Compiler that could allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers. The flaw, tracked as CVE-2026-110264, affects all versions of GitLab Community Edition and Enterprise Edition prior to the just-released patches, and the company has urged administrators to upgrade immediately.

·2 min·2 sources
Security

Indian certificate authority eMudhra exits global SSL/TLS business after weak key scandal

Indian certification authority eMudhra has announced it is withdrawing from the global SSL/TLS certificate business, days after reports revealed it had used laughably weak private keys, including one valued at the number 4, to sign certificates. The company said the intense scrutiny following the disclosure, combined with growing compliance costs and competition from free certificate providers, made the business increasingly difficult to justify. eMudhra stressed that global SSL/TLS contributes only about 1 percent of its revenue and that the affected intermediate certificate authorities had issued no end-entity certificates.

·3 min·2 sources
Security

North Korean Lazarus hackers use post-quantum cryptography in campaign against South Korean firms

North Korea's Lazarus hacking group has been observed using a post-quantum cryptographic mechanism to secure malicious payload delivery in a campaign targeting South Korean companies, according to researchers at Kaspersky. Dubbed FlashHole, the operation uses a complex infection chain that combines both old and new malware, with the group employing the standardized ML-KEM post-quantum mechanism to communicate with command-and-control servers.

·2 min
Security

ICO reprimands firms after 'Password1' test account exposed data of 3,300, mostly children

The UK Information Commissioner's Office has reprimanded Ogi Networks Limited and Data Cymru after a ransomware attack in November 2024 used a test account protected by the password 'Password1' to steal the personal information of 3,300 people, most of them children. The ICO found both organisations breached UK GDPR rules by failing to properly protect systems and by not regularly reviewing security measures.

·2 min·3 sources