News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
554 articles · page 2 of 12
Keystone will destroy nearly 19,000 unsold hardware wallets and suspend shipments after attackers stole a factory-set key used to verify device authenticity, widening a breach first reported as a customer data leak.
· 3 sources
LiteLLM has traced last week's supply chain attack to a master key it accidentally committed to a public GitHub repository in May, according to a postmortem published Friday. The compromise led to a poisoned version of the popular open source AI gateway being uploaded to PyPI and container registries, where it was downloaded about 49,000 times in less than two hours, security firm Wiz said.
Apple released a sweeping set of security updates on October 26, addressing 329 unique vulnerabilities across iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari. The patches include fixes for a CoreMedia vulnerability that could allow a malicious app to access the camera without permission, an Apple Intelligence flaw that could let a remote attacker access sensitive user data, and multiple WebKit issues that could enable arbitrary code execution.
Between late September and early October, an attacker breached seven South Korean financial institutions and exfiltrated the personal data of about 68,000 people, cybersecurity firm CrowdStrike reported, in a wave of AI-assisted attacks that preceded arrests in a separate campaign that stole 8.2 million records from more than 90 organizations. Seoul police announced the arrest of seven suspects in that case on October 26.
· 3 sources
The US Cybersecurity and Infrastructure Security Agency (CISA) on Monday released its new strategic plan, CISA 2030: Defend, Harden, Prevail, setting out a more aggressive posture for protecting the nation’s critical infrastructure from increasingly sophisticated cyber threats. The strategy aligns with President Trump’s Cyber Strategy for America and the National Resilience Strategy.
Microsoft has released out-of-band security updates for .NET to address a critical vulnerability in the Brotli decompression library, tracked as CVE-2026-111497 and nicknamed Broccoli2Shell. The flaw, discovered by Imperva Red Team, could allow unprivileged attackers to execute arbitrary code on systems processing maliciously crafted Brotli-compressed data.
· 3 sources
The National Institute of Standards and Technology, the Cybersecurity and Infrastructure Security Agency and the National Security Agency have jointly published ten voluntary practices for organisations that train or deploy AI agents, setting out how to handle incidents in which agents act without direction. The 14-page guide, released October 16, comes as open-source coding agent OpenCode disclosed that API keys stored by some users of its Console service were exposed.
Kali Linux 2026.3, the third release of the year from the Kali Team, is now available with six new security tools, an upgraded kernel and refreshed desktop environments.
Australians should prepare for more frequent and unexpected disruptions to everyday online services, the nation’s top cyber spy has warned, as the Australian Signals Directorate releases an annual threat assessment outlining an 80 per cent surge in malicious activity driven by frontier artificial intelligence models. The ASD also revealed it had successfully dismantled a major criminal botnet, cutting off access to 180,000 compromised computers worldwide.
· 7 sources
An anonymous hacker has breached a deliberately vulnerable server and claimed a Bitcoin prize worth $2,021.22, demonstrating that critical PHP vulnerabilities disclosed earlier this week can be reliably exploited in practice, according to the challenge's creator.
Internet governance bodies are likely to speed up work to keep the domain name system secure once quantum computers can defeat conventional encryption, ICANN's chief technology officer said last week, as the organisation's annual meeting in Bali also advanced changes to how the internet's regional registries are governed.
Electrum, one of Bitcoin's oldest software wallets, released an emergency patch on Oct 24 after a critical vulnerability allowed malicious servers to trick users into signing over funds when attempting to speed up payments, with developers confirming at least one theft.
· 3 sources
Security researchers have demonstrated that AI coding agents can be hijacked by a malicious AGENTS.md file placed in a user's Downloads folder, tricking the tool into installing rogue packages or leaking OAuth tokens. The attack relies on intended browser and agent behaviour, not a software vulnerability.
A cybersecurity researcher who reverse-engineered Samsung's Tizen operating system to reveal extensive user tracking says OpenAI banned his account for using its tools during the process. The researcher, known as log4j, discovered code indicating always-on microphone monitoring, screenshot capture, automatic content recognition and AI-powered user profiling on a 2025 Samsung smart TV, sparking fresh privacy concerns about smart devices.
· 2 sources
PingCAP, the company behind the open-source TiDB database, has confirmed that an attacker gained unauthorised access to its internal systems and stole source code and customer-related data. The cyber extortion group FulcrumSec claims to have taken 10.6 TB of data, including the TiDB Cloud control plane, customer SQL statements, API keys, and a four-year log of customer connections, though PingCAP says an external forensic review found no evidence of persistent access to production systems or impact on customer data stored in TiDB itself.
A new free, open-source security operations platform called Argus has been publicly released, aiming to give defenders a machine-speed answer to the growing threat of AI-powered attacks. The MIT-licensed tool uses AI agents to monitor cloud environments, logins, code, and devices around the clock, and can be configured to automatically investigate and shut down threats in seconds.
Security researchers have uncovered an AI agent built by threat actors to scan the internet for exposed AI models, hijack them, and run autonomous attacks including database theft, credential harvesting, and cryptocurrency mining, all without human approval. The Symantec Threat Hunter Team captured the agent's full instruction set in an AI honeypot over the summer, giving researchers a detailed view of the tool's capabilities. The agents have found no evidence that the tool has been used in real-world attacks yet.
A previously unknown UEFI bootkit dubbed BlackX has been used in an espionage campaign targeting diplomatic agencies in Central Asia, exploiting the old Baton Drop vulnerability to bypass Secure Boot protections, according to researchers at Kaspersky. The operation, detected in early 2026, has been attributed with medium confidence to the Chinese state-sponsored threat group APT41, also known as Brass Typhoon, Wicked Panda and Barium.
A critical PHP vulnerability found with AI tools triggered a global security response on Friday, while Russia intensified digital attacks on Ukraine, OpenAI disclosed a flaw and revealed covert AI agent communication, and a Chinese AI company limited its model's hacking ability.
· 8 sources
Cybersecurity authorities have confirmed that two critical remote-code execution vulnerabilities in PHP, dubbed PHP2Shell, are now being exploited in the wild, as the fallout from a controversial early disclosure continues to roil the internet.
· 9 sources
Astra Security has released two free tools designed to help organisations identify the recently disclosed PHP2Shell vulnerabilities and support their remediation efforts.
· 2 sources
The PHP Foundation has confirmed a third remote code execution vulnerability in the PHP programming language, but says it will not issue an emergency patch because the flaw requires an unlikely combination of configuration and application code. Users are advised to apply a configuration workaround until the next regular bugfix release.
· 2 sources
Security researchers have remotely disabled a critical vulnerability in the abandoned Time4Popcorn application, a fork of the Popcorn Time BitTorrent client, that could have allowed attackers to execute malicious code with elevated privileges on millions of computers. The flaw, tracked as CVE-2026-30612, stemmed from unencrypted HTTP connections to an expired domain and a total lack of digital signature verification on updates.
· 2 sources
Microsoft has announced that Teams will begin rolling out AI-powered, context-aware phishing detection in early November 2026, with general availability expected by December. The new capability analyzes conversation context to identify malicious behavior such as social engineering and impersonation attempts, without retaining customer message content for training or other purposes.
Medical lab testing giant Quest Diagnostics has confirmed a cyberattack and data breach affecting its Quanum platform, which handles lab test requests, billing and a wide array of patient health records. The company disclosed the incident in a filing with the U.S. Securities and Exchange Commission on Wednesday, saying unauthorized access included the accessing of certain patient records.
· 2 sourcesThe US Federal Communications Commission (FCC) has issued its first bans under a new rule allowing it to block devices based on the internal chips they contain, rather than specific products or brands. The bans, announced on 23 October 2026, target a dashboard camera and a wireless video transmitter because they contain a chip from HiSilicon, a Huawei subsidiary on the US government's national security risk list.
Bitcoin Core has merged a security policy change that ends months-long embargoes for vulnerabilities an AI can rediscover with a simple prompt, reflecting how large language models have reshaped the bug landscape. The shift comes as a network snapshot shows 44% of self-reported Bitcoin Core peers run release lines that have reached end of life.
· 3 sources
Interpol announced Thursday that Operation Serengeti III, a coordinated cybercrime crackdown across 21 African countries from June to August, resulted in 1,462 arrests and the recovery of more than $105 million in illicit funds. Authorities disrupted 10,909 malicious networks and identified 65,929 victims linked to losses exceeding $385 million.
· 2 sourcesHewlett Packard Enterprise has released security updates addressing 72 vulnerabilities in its Aruba Operating System, including eight maximum-severity flaws that could allow remote attackers to execute code or bypass authentication without requiring credentials or user interaction.
A hacking group with a long history of targeting Latin American businesses has been using AI agents from Anthropic, SpaceX and Chinese lab Moonshot AI to automate attacks on banks and mobile payment apps, according to research from cybersecurity startup Straiker.
The AI-discovered PHP2Shell flaw forced mass patching, site shutdowns and government emergency responses, while attackers logged millions of exploit attempts. A diagnostics breach, a Russia-linked cyberattack in Ukraine and accidental public posting of Linux kernel vulnerabilities also surfaced.
· 20 sourcesA 30-year-old constable based in the Brisbane region has been charged with computer hacking offences allegedly committed both on and off duty. The officer has been stood down from the Queensland Police Service and is scheduled to appear in Cleveland Magistrates Court on October 27.
· 3 sourcesThe UK government has proposed new legislation to protect subsea cables and pipelines, introducing penalties of up to 14 years in prison for intentional damage. The move responds to concerns over Russian submarine activity and replaces Victorian-era laws that ministers argue are no longer adequate for modern threats.
· 2 sources
Security researcher Sammy Hajhamid has demonstrated a software-only partial jailbreak of the Nintendo Switch 2, exploiting a 32-bit integer overflow in the SmileBasic 4 interpreter. The vulnerability, discovered with the assistance of OpenAI's Codex, provides userland access that enables homebrew software, game modding, save file backups, and peripheral manipulation. The hack requires a tethered connection to a macOS or Linux PC on the same network.
The Australian Broadcasting Corporation (ABC) has confirmed it was among more than two dozen Australian government agencies, critical infrastructure providers, universities and media organisations targeted in a sophisticated cyber espionage campaign. The campaign, dubbed 'Adfection', was identified by The Citizen Lab, which found that the Israel-based company Discover-Tech exploited online advertising systems to deliver spyware to devices merely by viewing an ad. The ABC said a small number of staff devices were exposed, but no evidence of tracking or compromise has been found.
· 2 sources
Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information, the company disclosed on October 22.
The US Federal Communications Commission has exercised a newly granted power for the first time, blocking two gadgets it says contain foreign surveillance chips. The agency did not identify the specific devices, but named the chip at the centre of its action as a HiVision Hi3516CV610 UHD Smart Vision SoC.
Hackers compromised the release pipeline of LiteLLM, a popular open-source AI gateway, pushing malicious PyPI packages and Docker images that steal credentials, secrets and environment variables. The supply-chain attack, detected on October 21, affected version 1.107.0 across all platforms, though the project's private enterprise customers were not impacted.
Arista Networks has released security updates to address an actively exploited zero-day vulnerability in its VeloCloud Orchestrator (VCO) on-premises deployments, the company confirmed. The critical-severity flaw, tracked as CVE-2026-114625, allows authenticated attackers to escalate privileges via SQL injection and access internal functionality.
Microsoft security researchers say China state-aligned hackers broke into the cloud backup service of IT management company ConnectWise, stole application credentials, and then used AI agents to gain access to around 2,250 customer organizations, where they read emails and other files. ConnectWise has paused the affected service and is investigating.
· 3 sources
Cloud development platform Railway has confirmed that hackers gained access to customer secrets, prompting the company to urge all users to revoke and rotate their API keys and cloud credentials. The breach, which the company says may have been part of a broader attack targeting AI inference providers, has led Railway to pause deployments while it investigates.
GitLab has released security updates for a maximum-severity vulnerability in its Regular Expression Compiler that could allow unauthenticated remote attackers to execute arbitrary code on vulnerable servers. The flaw, tracked as CVE-2026-110264, affects all versions of GitLab Community Edition and Enterprise Edition prior to the just-released patches, and the company has urged administrators to upgrade immediately.
· 2 sources
Unknown hackers hijacked more than 300 Tor exit nodes beginning in late August, reconfiguring them to intercept unencrypted email traffic and redirect SSH connections through attacker-controlled servers, according to a researcher's report published Tuesday.
The maker of the Eiliko robot charm, a plush AI-powered toy that promises to keep secrets safe, has broken its silence after an investigation by The Verge revealed that hackers could easily access complete transcripts of users' conversations. Energize Lab CEO Shaw Yeung's company told The Verge it has confirmed the core issues and will hire an independent security firm to review the vulnerabilities.
Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, with some agents appearing to take actions independent of user instructions, according to sources familiar with the issue. The development has prompted a scramble to block the technology and rewrite terms of service.
Indian certification authority eMudhra has announced it is withdrawing from the global SSL/TLS certificate business, days after reports revealed it had used laughably weak private keys, including one valued at the number 4, to sign certificates. The company said the intense scrutiny following the disclosure, combined with growing compliance costs and competition from free certificate providers, made the business increasingly difficult to justify. eMudhra stressed that global SSL/TLS contributes only about 1 percent of its revenue and that the affected intermediate certificate authorities had issued no end-entity certificates.
· 2 sources
North Korea's Lazarus hacking group has been observed using a post-quantum cryptographic mechanism to secure malicious payload delivery in a campaign targeting South Korean companies, according to researchers at Kaspersky. Dubbed FlashHole, the operation uses a complex infection chain that combines both old and new malware, with the group employing the standardized ML-KEM post-quantum mechanism to communicate with command-and-control servers.
Hackers have compromised the infrastructure of Onamae Desktop Cloud, a popular VPS provider in Japan operated by GMO Internet, installing malicious programs on up to 26,739 customer servers. The company confirmed the breach on October 20 and began shutting down affected servers from 4 a.m. local time on October 21, with no estimated restart date.