News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
554 articles · page 3 of 12
Apple has blocked eight web security certificates that could have been exploited by scammers to impersonate legitimate websites, but a cryptography engineer has warned that Macs may continue to trust the compromised certificates because macOS does not check revocation status.
The UK Information Commissioner's Office has reprimanded Ogi Networks Limited and Data Cymru after a ransomware attack in November 2024 used a test account protected by the password 'Password1' to steal the personal information of 3,300 people, most of them children. The ICO found both organisations breached UK GDPR rules by failing to properly protect systems and by not regularly reviewing security measures.
· 3 sourcesA teenager who was 16 when he was stopped at Heathrow Airport has been jailed for providing cybersecurity support to terrorist groups including al-Qaeda and the Tehrik-e-Taliban Pakistan (TTP). Yusuf Shah, from Ilford, was sentenced to four years and two months in prison after being convicted of multiple terror offences.
· 2 sources
Over the past month, a wave of sophisticated, autonomous cyberattacks driven by artificial intelligence has underscored a fundamental shift in the economics of digital exploitation. Starting in late September, a hacker deployed AI agents that autonomously broke into around 100 companies, costing roughly $50 per successful breach. This tactic has also been used to attack a coding platform and steal data from tens of thousands of bank customers in South Korea, signalling a dangerous new era for cybersecurity.
US and international security agencies issued a joint advisory on October 21 warning organizations to patch exposed systems and protect backups against SafePay ransomware. The guidance details how attackers break into networks, undermine recovery and pressure victims to pay, following attacks affecting roughly 600 organizations across multiple critical infrastructure sectors.
· 2 sources
Major technology companies including Mozilla, Google, Apple, and Microsoft have moved to block eight digital certificates issued by India-based certificate authority eMudhra Limited after discovering their private keys were trivially exploitable, potentially allowing attackers to impersonate legitimate websites and intercept user communications.
TeamUpdraft, the developer of popular WordPress backup and management plugins, has disclosed that an attacker gained unauthorized access to its website and stole UpdraftCentral connection keys, which can send commands to connected websites. Security researchers say attackers are already using the stolen keys to install backdoors on WordPress sites, including fully patched ones, in a campaign that could affect roughly 400,000 websites.
Browser makers and software vendors have begun blocking eight compromised eMudhra intermediate certificates, and the certificate authority has revoked them, after researchers found the private keys were generated with almost no randomness and could be recovered almost instantly.
· 3 sources
The full extent of the eMudhra certificate compromise emerged this week as researchers revealed the Indian certificate authority used tiny integers, including the number 4, as SSL private keys. All eight compromised intermediate certificates were recovered from public data in less than a second, forcing a global emergency patch effort.
· 3 sources
Developer platform Zeabur announced it will shut down all services by the end of December, following a second major security breach in as many months. The company disclosed that attackers exploited leaked plaintext credentials, believed obtained from an August incident, to steal over 3.2 million environment variable records and data from 321,810 accounts, prompting the company to cease operations entirely.
The curl project will switch to publicly handling low and medium-severity vulnerability reports from October 26, as maintainers face an "avalanche" of submissions that senior developer Daniel Stenberg says is pushing the team to its limits. The change, reported by The Register, is part of a survival strategy for the team that keeps the widely-used data transfer tool secure.
Multiple ransomware groups, including Qilin, Inc and Settra, have been exploiting a high-severity authentication bypass in Palo Alto Networks' PAN-OS firewall software for months, the vendor's incident response unit says, gaining initial access to corporate networks, bypassing multi-factor authentication and, in some cases, moving directly into the virtualisation layer to disable security controls.
The UK's Information Commissioner's Office (ICO) has reprimanded broadband provider Ogi Networks Limited (ONL) and the Welsh local government data unit Data Cymru for breaching GDPR rules. An investigation found that a dormant test account protected only by the password 'Password1' allowed cyber criminals to access the personal data of 3,300 people, the majority of whom were children.
· 2 sources
Security researchers have found that Muse, Meta's new general-purpose AI agent, can expose personal and business information when users share conversations by web link, despite a URL design apparently intended to keep such content private.
Leaked U.S. Army documents describe a program to deploy autonomous, self-replicating AI agents that would navigate enemy digital networks, identify targets and neutralize them, according to a report by The Intercept. The program, code-named ECHOTRIBBLE, has drawn safety warnings from cybersecurity experts over the risks of offensive AI worms operating with little human oversight.
· 2 sources
A Nigerian national has been sentenced to eight years in prison for orchestrating a series of spearphishing attacks against US tax preparation businesses, stealing more than $3 million from taxpayers through fraudulent tax refunds and loan applications.
Ahold Delhaize has filed a formal police report with the Dutch police and told regulators that its investigation has not yet found evidence that sensitive customer, associate or partner data was stolen, as it gradually restores services disrupted by the cyberattack it disclosed last week.
French cloud and hosting provider OVHcloud is warning users that attackers hijacked a developer's GitHub account and distributed backdoored versions of its open-source command-line interface (CLI) tool, packing the releases with malware designed to steal credentials and secrets from developers' machines.
A federal judge on Monday ordered former OpenAI engineer Abdulrahman Alfozan to remain in custody, casting doubt on a $1 million bond offered by the Saudi government and citing fears he would flee. New details from court filings, reported by Fortune, show prosecutors alleging Alfozan conducted reconnaissance of OpenAI offices and booked a one-way flight to Saudi Arabia days after his arrest, while his defense argues he had no intention of leaving the United States permanently.
Attackers are actively exploiting recently fixed vulnerabilities in Plex Media Server to break into unpatched devices and install malware, according to a security researcher who tracked the attacks with a decoy server.
A supply-chain attack replaced downloads of the Rank Math PRO WordPress plugin from the vendor's official website with trojanized files last week, prompting warnings that affected site owners should treat their websites as compromised.
Nikkei Inc., the Japanese business news group that owns the Financial Times, has disclosed its third cybersecurity incident in about a month. A breach using stolen credentials exposed 1.83 million records, including personal information belonging to an estimated 150,000 people.
OpenCode, an open-source AI coding agent, disclosed a security breach on Saturday in which attackers broke into an older system and exposed API keys for 1.4% of users of its online platform, OpenCode Console. The incident triggered unauthorized charges on user accounts, with some reporting hundreds of dollars in fees, and forced the company to scramble its defensive response as AI safety filters hindered its investigation.
· 2 sources
Dutch grocery giant Ahold Delhaize, operator of US supermarket chains Food Lion, Giant Food, and Stop & Shop, has confirmed that a cyberattack forced it to take IT systems, including websites and apps, offline across most of its brands in Europe and the United States. The company says it has found no evidence that sensitive customer, associate, or partner data was stolen.
A threat actor tracked as UNC7017 briefly compromised AOMEI’s update infrastructure between April and July 2026, using the software’s built-in promotional feature to distribute malware to organisations across multiple sectors and countries. The attacks, which relied on short windows of tampering with configuration files, were uncovered by researchers at ManageEngine’s Threat Analysis Lab working with Google’s Threat Intelligence Group and Mandiant.
Police in Osceola County, Florida, say scammers used artificial intelligence to clone Sheriff Steve Moser's voice, leaving voicemails that trick residents into believing they have missed jury duty or face an arrest warrant. The scam is part of a growing trend of AI voice cloning used to impersonate law enforcement across multiple states.
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has begun notifying victims of a data breach in which a malicious actor used compromised credentials to access driver license and motor vehicle records, including document images and other personal information. The breach occurred on September 4, 2026, according to a notice posted Friday, and while the department says there is no evidence the data has been misused, it acknowledged it may not have current contact information for many former Florida residents whose data was still stored.
A Chinese-speaking hacker has been observed using artificial intelligence agents to break into more than 100 websites belonging to well-known companies, according to a report from Reuters. The attacks leveraged exposed instances of Carin, an open-source AI problem-solving platform, to probe and exploit vulnerabilities in targets including farming equipment manufacturer Deere and kitchen appliance company SharkNinja.
· 2 sources
F5 has released out-of-band security patches to address multiple vulnerabilities in its NGINX web server software, including three critical flaws that could allow remote attackers to execute code on vulnerable systems. The company is urging administrators to apply the updates promptly, though it has not yet observed active exploitation of the issues.
Canadian cybersecurity executive Edward Dubrovsky has been arrested by the FBI and charged with threatening to disclose stolen or hacked data and interfering with interstate commerce through extortion, according to court records cited by KrebsOnSecurity. The arrest came during an investigation into the ShinyHunters hacking group after its breach of the FBI's recruitment website in September.
ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services after detecting unauthorized access to its systems. Security firm Huntress reports that a compromised Microsoft 365 API secret is being used to infiltrate customer environments, raising fears of a supply-chain attack affecting managed service providers and their clients.
University of Toronto researchers say an Israel-based company secretly weaponised online advertising to profile millions of devices and install spyware, with Australian government agencies, critical infrastructure and the Australian Nuclear Science and Technology Organisation among the targets.
A critical vulnerability in the Linux Kernel-based Virtual Machine (KVM), tracked as CVE-2026-99999 and dubbed PwnEscape, has been disclosed by security researcher Paulos Yibelo. Rated 9.3 on the CVSS severity scale, the flaw allows a guest virtual machine to send malformed IPv4 packets that can corrupt the host operating system's network stack, potentially enabling arbitrary code execution on the host, denial of service, or memory disclosure.
Hackers are exploiting an OS command-injection vulnerability in SiteGuard Server Edition, a web application firewall widely used in Japan, to execute commands with root or SYSTEM privileges on affected systems. The flaw, tracked as CVE-2026-106931, affects the product's statistics function, which is enabled by default, and is rated critical severity by Japan's CERT agency.
ConnectWise has shut down customer access to its Cloud Backup service after hackers exploited application identities to breach Microsoft 365 tenants, giving them the ability to read emails, files, and Teams chats without triggering multi-factor authentication. Security firm Huntress reported at least 162 compromised tenants, and Microsoft confirmed it detected malicious authentication attempts from a single IP address on October 15.
Drupal has released security updates addressing two critical vulnerabilities that could allow attackers to execute arbitrary code on websites running any supported version of the open-source content management system. The project warned administrators to apply the patches promptly, noting that exploits might be developed within hours or days of disclosure.
An unknown cybercriminal group hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores late Sunday night, spiking temperatures, spoiling food and sparking small fires. The attack is the latest example of a rising trend in which digital intrusions target physical infrastructure rather than data, using real-world consequences to maximise leverage over victims.
The Australian cosmetics company Napoleon Perdis has disclosed a data breach affecting nearly 340,000 customers, following a cyber attack on a third-party data storage provider that exposed personal information over several months.
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has reported a data breach that may have exposed driver license information, motor vehicle records, and document images. The unauthorized access occurred on September 4, 2026, using compromised credentials, and was attributed to an international cybercriminal organization, according to the department's public notice.
In a bizarre and unprecedented cyber-attack, hackers remotely overrode the temperature settings on thousands of freezers and chiller cabinets in supermarkets across France, causing food to defrost and cook and forcing stores to throw away tons of spoiled products.
· 2 sourcesA maximum-severity vulnerability, tracked as CVE-2026-103849 and dubbed BlockStrap, has been discovered in Adobe Commerce and Magento Open Source, potentially allowing attackers to execute arbitrary PHP code on store servers. E-commerce security firm Sansec says no attacks have been observed yet, but it expects mass exploitation to occur soon.
Researchers at Citizen Lab have documented a zero-click attack technique, dubbed AdFection, that used targeted online advertisements to deliver Candiru spyware to devices at Al Jazeera Media Network. The attacks, which occurred between 2024 and 2025, required only the rendering of malicious ads on the victim's device, marking the first public technical confirmation of mercenary spyware delivered through targeted ads.
A fake version of WhatsApp has appeared in a sponsored slot directly above the genuine app on Google's Play Store, had racked up more than 500,000 downloads, and was still live at the time of reporting, according to The Verge. The impostor uses the same icon, screenshots and text as the real app, making it hard to distinguish from the authentic WhatsApp.
Newly filed court records show exactly what information Telegram provides to U.S. authorities when complying with legal requests. The documents include a letter containing a user's phone number, user ID and IP address, and also expose Telegram's previously non-public contact point for U.S. law enforcement.
An Israeli spyware company has been identified as the perpetrator of the first-known 'zero-click' targeted advertising attacks, which infected devices used by Al Jazeera journalists without any user action, according to an investigation by Citizen Lab.
Burger King Japan, the Japanese arm of the global fast-food chain, has disclosed a data breach exposing 11.18 million customer records, including names, email addresses, phone numbers and order history from its official smartphone app, after attackers accessed a company server in early October.
A cyberattack on BAE Systems has crippled the Bankruptcy Noticing Center (BNC) for over a week, forcing the US federal judiciary to extend deadlines and halt the distribution of bankruptcy notices nationwide. The Administrative Office of the US Courts confirmed the incident on Thursday, with BAE stating the attack is isolated to the BNC system.
· 2 sourcesBeyondTrust is urging customers to patch a critical authentication bypass vulnerability in its Remote Support product, warning it has been exploited in zero-day attacks since late August by a suspected China-nexus espionage group.