News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
554 articles · page 4 of 12
A cyberattack on Sunday night disrupted hundreds of French supermarkets by hacking refrigeration controllers, causing food spoilage and fires. Security researchers had warned about exploitable vulnerabilities in these devices months earlier, and patches were available, but many systems remained exposed.
Security researchers have found dozens of websites attempting to manipulate AI agents through instructions hidden in HTTP headers, the metadata that travels with web page content. A scan of 217 million page responses from the Common Crawl archive identified 30 sites attempting indirect prompt injection, alongside nearly 8,000 sites using headers to communicate with visiting bots.
Hackers compromised roughly 1,900 GitHub accounts and used them to inject credential-stealing workflows into more than 30,000 repositories, according to security firms tracking the GhostAction campaign. The malicious GitHub Actions jobs targeted CI/CD secrets, cloud access keys and API keys belonging to AI providers including Anthropic, OpenAI and OpenRouter.
Researchers at the University of Toronto’s Citizen Lab report that mercenary hackers have used targeted advertisements as a delivery mechanism for zero-click exploits, infecting at least 45 devices belonging to employees of international media organisation Al Jazeera with sophisticated spyware. The campaign, which the lab named AdFection, is believed to be the first confirmed instance of zero-click mercenary spyware being distributed through advertising networks.
A threat actor uploaded malicious packages to the Arch User Repository (AUR) impersonating the popular helper tools yay and paru, prompting the AUR team to ban the account and remove the packages. The trojanised builds carried a legitimate upstream source combined with an install script that executed a remote shell script with root privileges.
Threat actors are actively exploiting a critical command execution flaw in the Collabora Online Built-in CODE Server app for Nextcloud, planting PHP webshells and hunting for credentials on affected servers. The vulnerability, tracked as CVE-2026-110447, was under attack for roughly a month before formal disclosure, according to administrator reports.
A proxyjacking campaign has compromised internet-connected devices in 34 countries, installing a legitimate bandwidth-sharing application on victims' hardware to monetise their connections without consent, according to threat intelligence firm GreyNoise.
An Israeli advertising technology company, Discover-Tech, helped place spyware on dozens of devices used by Al Jazeera employees and other organisations, according to a Citizen Lab investigation published Thursday. The spyware, developed by the US-blacklisted firm Candiru, was delivered through what researchers describe as the first known instance of a zero-click targeted advertising attack.
· 2 sourcesA security investigation by The Verge has revealed that the Eiliko, a new digital pet robot that can change expressions and converse over Wi-Fi, stores everything users tell it on Chinese servers that are vulnerable to hacking. The reporter bought the toy from Amazon in late August and within a day found that the company behind it, Energize Lab, appears to have left user data and the robot's personality open to hijacking.
Security researchers at the University of Toronto's Citizen Lab have discovered that government spyware makers are abusing global advertising networks to hack devices without the victim needing to click a link or open a message. A new report published Thursday identifies an Israeli company called Discover-Tech as a bridge between ad vendors and the mercenary spyware ecosystem, enabling targeted attacks with zero-click exploits.
· 3 sourcesLaw enforcement agencies from 17 Latin American and European countries have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups, the international police body announced Thursday.
Ukrainian drone strikes on Yandex data centers have sharply disrupted Russian cloud services but have done little to reduce Russian disinformation bot traffic, according to a new Cloudflare analysis. Traffic on Yandex Search and Yandex.Cloud remains at 10% to 15% of normal levels, yet malicious bot activity quickly migrated to other hosting providers, leaving overall Russian bot traffic essentially flat.
US Air Force personnel in the early 2000s routinely used USB flash drives bought from local markets, including in Afghanistan, to transfer mission data between unclassified and classified systems — a practice that introduced malware into sensitive networks and ultimately led to a Pentagon-wide ban on removable media after a 2008 worm attack attributed to Russian groups.
The UK Legal Aid Agency (LAA) has revealed that hackers who breached its systems in April 2025 stole records dating back to 1978, with approximately 250,000 records predating 2007. The agency, which manages legal aid for England and Wales, said the vast majority of stolen data relates to applications, claims or payments made between 2007 and May 2025, but confirmed a fractionally small number of records date from before 1990, with the earliest verified record from 1978.
· 2 sourcesThe Information Commissioner's Office (ICO) has reprimanded London's Metropolitan Police Service and issued an enforcement notice after officers used the retail crime platform Auror for more than 18 months without formal approval or the required data protection checks, unlawfully processing personal data of 179 people.
A coordinated cyber attack on refrigeration systems at an estimated 700 supermarkets across France has caused widespread food spoilage and, in some cases, electrical fires, French authorities have reported. The incident, which occurred earlier this week, involved the exploitation of known security flaws in internet-connected controllers used to remotely manage store-wide refrigeration and freezer systems.
Cisco is urging customers to patch a critical vulnerability in its Secure Email Gateway that attackers are already exploiting in the wild, using a malicious email to gain root access to the appliance without authentication.
· 2 sourcesPalo Alto Networks has released security updates for a high-severity zero-day vulnerability in PAN-OS, the operating system that runs its firewalls, after confirming the flaw is being exploited in attacks targeting the management interface.
Security startup Xbow, using OpenAI's GPT-5.6 Sol model, chained three Chrome zero-day vulnerabilities into a full exploit that escapes the browser's sandbox on Windows, potentially affecting one billion users. Google patched the flaws and paid a $250,000 bounty, the company's top reward for a full-chain Chrome exploit.
The US Department of Justice has disrupted a North Korean remote IT worker scheme by arresting two American facilitators, charging 14 individuals, and seizing nearly 187 laptops from so-called 'laptop farms' in Texas. The operation, codenamed Lonestar Roundup, targeted the Famous Chollima threat group (also known as WageMole), which uses stolen identities to place North Korean IT workers at companies worldwide and generate revenue for the DPRK regime.
Android is rolling out an upgraded Scam Detection feature for Google Messages that uses cloud-based Gemini AI models to evaluate conversations with unrecognized senders, aiming to catch sophisticated mobile fraud that evolves over time.
A coordinated international operation has disrupted a cybercriminal ecosystem that sent more than a billion phishing messages targeting over 75,000 organizations across 150 countries. Since the start of the year, more than 750 million malicious emails and SMS texts were aimed at Microsoft customers alone.
· 2 sourcesThe FBI, with help from cybersecurity firm CrowdStrike, has dismantled more than 40 North Korean laptop farms in Texas, seizing over 200 devices used by operatives posing as remote IT workers, according to The New York Times. No arrests have been made, but authorities warned that those involved could face criminal penalties.
Ledger has asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales of its hardware wallets while it investigates devices fitted with a hidden implant, following suspected thefts of more than $86 million in cryptocurrency. The company said the only confirmed incidents remain in Southeast Asia and that it has not verified a drain linked to a device bought elsewhere.
· 2 sourcesA new Android banking trojan named Hirudo steals account credentials by replacing legitimate banking apps with modified versions that disable security checks, giving attackers remote control of infected devices, researchers at mobile security firm ThreatFabric reported today.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) by Friday, after warning that the flaw is being exploited in zero-day attacks. Ivanti released software updates on Tuesday and urged customers to act immediately.
The heads of the Bank of England and the International Monetary Fund have warned that a surge in cyber attacks and online fraud risks eroding public trust in the financial system, with people potentially reverting to holding cash outside banks.
· 3 sourcesRansomware gangs are increasingly turning to real-world harm and psychological trauma to force victims into paying extortion demands, according to a new report from cybersecurity firm Semperis. The study, based on 1,200 post-ransomware organizations surveyed worldwide, found that more than a third of attacks now involve threats against employees, their families, or personal property, with tactics including doxxing, swatting, and even sending packages to investigators' homes.
Pluto Security has emerged from stealth with $42 million in funding to help companies manage the security risks posed by employees using AI tools. The startup says newly released AI tools can appear inside corporate environments within hours, and about 60 per cent of risks it detects come from applications built by non-developers, often using so-called 'vibe coding' practices.
· 2 sourcesThe US Justice Department announced coordinated actions on Tuesday against an elaborate North Korean scheme that planted remote IT workers inside American companies, revealing raids on more than 40 'laptop farms' in Texas, the seizure of over 180 computers, and arrests of at least two American facilitators accused of helping sanctioned North Korean hackers infiltrate employers and steal sensitive data.
· 2 sourcesMicrosoft has released the October 2026 Patch Tuesday cumulative updates for Windows 11, delivering new emoji, a Tips widget, and File Explorer enhancements alongside security fixes for more than 1,400 vulnerabilities — a record monthly volume that far exceeds September's near-1,000 patches. The updates are mandatory and contain patches for hundreds of flaws, including one zero-day already exploited in the wild.
· 2 sourcesA critical heap buffer overflow vulnerability in the widely used Ghostscript interpreter could allow attackers to take over servers by uploading specially crafted PDF files, researchers at Wordfence have discovered. The flaw, tracked as CVE-2026-39919, affects all versions of Ghostscript from 9.21 through 10.07.1 and was patched on September 8 in version 10.08.0.
A Saudi national who worked as an engineer at OpenAI has been charged with secretly planting an encrypted recording device in an executive conference room at the company's San Francisco offices, federal prosecutors announced Tuesday. Abdulrahman Alfozan, 35, was arrested on October 9 and faces up to five years in prison if convicted.
· 10 sourcesDocker has disclosed a critical vulnerability in Docker Hub that allowed attackers to impersonate other users and potentially tamper with container images by exploiting a flaw in how personal access tokens (PATs) were reassigned during account-to-organization conversions.
New analysis of the threat actor exploiting the Ivanti Connect Secure zero-day shows the intruders were stealing credentials, tampering with logs and preparing for lateral movement into victim networks, with criminal motives rather than espionage suspected. Researchers also believe the attackers may have used large language models to support their operations. Ivanti has patched two of the three vulnerabilities in the chain, but a privilege escalation flaw remains open.
· 2 sourcesA series of cyberattacks on supermarket refrigeration systems in France has driven temperatures as high as 50°C (122°F), forcing retailers including Carrefour, Intermarché and Monoprix to discard perishable food. The incidents, reported on October 13, 2026, involved the compromise of Danfoss refrigeration controllers, and some stores suffered fires. French cybersecurity authority CERT-FR has advised disconnecting or restricting network access to the affected equipment.
Hundreds of French supermarkets were hit by an unprecedented cyberattack that targeted internet-linked refrigeration systems, causing tonnes of food to perish and, in some cases, sparking fires. The attacks, confirmed by retailers on Monday, raised temperatures in fridges and freezers to as high as 50 degrees Celsius (122F) overnight when shops were closed.
A critical remote command execution vulnerability in the Zimbra Collaboration Suite mail platform, tracked as CVE-2026-73570 with a CVSS score of 8.9, is under widespread active exploitation, enabling adversaries to harvest complete mailbox archives and persistent authentication credentials without prior system access.
SAP has released its October 2026 security updates, patching 20 vulnerabilities across various products, including a maximum-severity OAuth2 server-side request forgery (SSRF) flaw in the Cloud SDK for Python that could allow remote attackers to exfiltrate credentials without prior authentication.
An Akira ransomware affiliate gained initial access to an organization's network on August 4, 2026, by successfully password-spraying a SonicWall SSL VPN account that lacked multi-factor authentication (MFA). The incident, detailed in a cybersecurity report, underscores a persistent security gap where certain access paths remain protected only by passwords, enabling attackers to compromise credentials and data before ransomware deployment was halted.
Denmark's Central Register of Persons (CPR) breach, which exposed information belonging to 8.8 million people, may have been enabled by a company account protected by the password "123456," according to a person claiming responsibility and Danish media reports.
· 2 sourcesMore than 350 scientists from over 30 countries have signed an open letter calling for an international body to track and publish artificial intelligence security failures, warning that recent hacks by AI models into external systems represent a preventable lapse in basic cybersecurity practices.
· 2 sourcesThe owner of Phase Eight, Hobbs and Whistles has disclosed a cyber-attack on its UK retail brands that may have exposed customer data. TFG London, the South African listed parent company, said it detected the "cybersecurity incident" on Sunday and has paused online orders while an investigation continues. Stores remain open.
· 3 sourcesLedger has asked resellers in six Southeast Asian countries and Hong Kong to remove its hardware wallets from shelves, as new details emerged of an LTE-enabled implant that captured recovery phrases from tampered devices sold by reseller CryptoBilis. The request came as rival Trezor scaled back its authorized reseller network and European retailer MediaMarktSaturn removed Ledger products from stores and online.
· 10 sourcesHackers targeted hundreds of French supermarkets in a cyberattack that caused refrigerators and freezers to overheat to 50 degrees Celsius, spoiling food and sparking fires, according to reports confirmed by retail executives and European officials.
· 4 sourcesGoogle paid a researcher $90,000 for discovering a critical vulnerability in its developer documentation platform DevSite, but took two months to patch the flaw, which allowed unauthenticated remote code execution through a reused OAuth client secret.
The cyberattack that wrecked refrigeration at hundreds of French supermarkets is being described as a “wake-up call” for New Zealand retailers, with a security analyst saying the intrusion also affected supermarkets in Spain, Portugal, Poland, Germany and Belgium.
· 6 sourcesGitLab has warned administrators of self-managed installations to patch immediately after disclosing a maximum-severity vulnerability in its CI/CD Regular Expression Compiler that could allow remote attackers to run arbitrary code on affected servers. The flaw, tracked as CVE-2026-97229, is fixed in the latest releases of GitLab Community and Enterprise Edition.