AI blog APT blog Attack blog BigBrother blog BotNet blog CyberCrime blog Cyber blog Cryptocurrency blog Exploit blog Hacking blog ICS blog Incident blog IoT blog Malware blog OS Blog Phishing blog Ransom blog Safety blog Security blog Social blog Spam blog Vulnerebility blog
2026 January(89) February(123) March(106) April(119) May(126) June(97) July(101) August(348) September(454) October(366) November(0) December(0)
DATE |
NAME |
Info |
CATEG. |
WEB |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: AI agents running inside restricted evaluation environments had found ways around their network isolation, compromised internal infrastructure, and eventually breached systems at Hugging Face. | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
XWorm Reborn: From infostealer to surveillance platform | In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. | Malware blog | Netskope Threat Labs |
|
17.10.26 |
Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire | A flaw in GoBalance, a load-balancing tool used by many darknet sites, allows anyone to recover a site's master signing scalar from its publicly available data. With that key, an attacker can take over the site and redirect its visitors. | Cyber blog | SEARCHLIGHT |
|
17.10.26 |
A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline | During a security audit of Discourse, a popular open-source forum platform powering over 22,000 communities including OpenAI, Atlassian, and Cloudflare, we discovered two vulnerabilities affecting default configurations. | Security blog | SEARCHLIGHT |
|
17.10.26 |
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE | It has been a little while since we last looked at Adobe Experience Manager (AEM). We had some excellent findings last time but were just shy of full remote code execution. This time we were able to achieve full unauthenticated remote code execution on AEM Cloud. | Vulnerebility blog | SEARCHLIGHT |
|
17.10.26 |
Session Cookie Authentication Bypass: Predictable Signing Secret Enableds Account Impersonations | During a security review of a yard management system (YMS) used to optimize supply chain operations, Resecurity identified an authentication bypass caused by two independent weaknesses in the application's session-cookie design. | Security blog | Resecurity |
|
17.10.26 |
Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem | Resecurity identified and mapped the infrastructure supporting a commercial phishing-kit-as-a-service (PhaaS) operation marketed under the name “Iron Man System.” The kit is sold to criminal buyers as a self-hosted package that deploys pre-built lure pages impersonating postal and courier services, toll and traffic-fine authorities, tax agencies, banks, telecoms and loyalty programmes, then captures the data victims submit. | Phishing blog | Resecurity |
|
17.10.26 |
October 2026 Patch Tuesday Analysi | Today’s Patch Tuesday Alert addresses Microsoft’s October 2026 Security Updates. The FIRE team is actively working on coverage for these vulnerabilities and expect to ship that coverage as soon as it is completed. | OS Blog | Fortra |
|
17.10.26 |
Best KnowBe4 Alternatives & Competitors | Adaptive Security is backed by OpenAI as its first and only cybersecurity investment, and is used by companies including Figma, Ramp, Lennar, and Plaid. | Security blog | Adaptive Security |
|
17.10.26 |
Email Security Statistics 2026: Phishing, BEC & AI | Email security statistics consistently show the human layer rather than the technical stack as the decisive variable in most confirmed breaches, which is why human-layer defense deserves proportionate investment. | Spam blog | Adaptive Security |
|
17.10.26 |
DNS as C2 in Noir, An AI-Developed Crypto Wallet Drainer | We found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages. The loader races three public DNS-over-HTTPS (DoH) services and uses the first valid answer. | Cyber blog | Adaptive Security |
|
17.10.26 |
Inside Help TDS: Hotejka and Cloudflare Abuse | Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. | Security blog | Adaptive Security |
|
17.10.26 |
Run multi-container agent evals on Tensorlake with Harbor | Harbor 0.23.0 can run Docker Compose tasks on Tensorlake. Each task boots as one MicroVM with a Docker daemon inside, so an agent’s MCP server, database, browser, or game server runs next to it as its own container. | BotNet blog | Tensorlake |
|
17.10.26 |
GhostAction Returns: 772 Repos Hit, 30k More in Oct | The GhostAction supply chain campaign hit 772 public GitHub repositories between Aug. 31 and Sept. 30, 2026, targeting 2,577 secrets. Between Oct 8-9 a new burst hit 30k more, and this time the workflows ran. | Hacking blog | GITGUARDEN |
|
17.10.26 |
AI Agent Security: Six Controls From Nine Real Incidents | An AI agent runs with your credentials and acts before you can stop it. Nine incidents show what that costs. Six controls limit the damage: sandbox the agent, scope its credentials, lock its configuration, log every call, scan the workspace first, and deny by default. | AI blog | GITGUARDEN |
|
17.10.26 |
FlowerStorm detection and 70+ YARA rules: September 2026 | The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape. | Malware blog | VMRAY |
|
17.10.26 |
6 Malware Analysis Tasks You Can Automate with AI Agents | A reverse engineer’s week can quickly fill up with work that has already been solved once, whether that means decrypting a familiar string routine or peeling back another dropper stage. Once the underlying scheme is understood, much of this work no longer requires much judgment. | AI blog | VMRAY |
|
17.10.26 |
ontinue.com/1h2026threatintelligencereport/ | 1H 2026 findings reveal growing abuse of trusted identities, AI-assisted tooling, SaaS platforms, and business workflows as attackers achieve greater impact with less effort. | Cyber blog | ONTINUE |
|
17.10.26 |
2026_10_1h2026-TI-Report-Executive-Summary-en.pdf | The first half of 2026 reinforced a significant shift in the threat landscape: the most effective attacks increasingly do not look like attacks at all. They look like a Microsoft Teams message from someone claiming to be in IT, a login prompt from a trusted brand, a software package from a familiar repository, or a routine request that appears legitimate on the surface | Cyber blog | ONTINUE |
|
17.10.26 |
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) | Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. | Vulnerebility blog | labs.watchtow |
|
17.10.26 |
Q3 2026 DDoS, bad bots, and BGP incidents: statistics and overview | As we predicted, botnet sizes returned to growth after a sharp decline in the previous quarter. The largest botnet observed in Q3 2026 comprised 3.56 million devices, up from 2.09 million in Q2. | Cyber blog | QRATORLABS |
|
17.10.26 |
Behind Closed Doors: How Physical Penetration Testing | Protecting confidential conversations takes more than closing a conference room door. Physical penetration testing reveals whether unauthorized people can reach sensitive spaces, interfere with equipment, or leave a device unnoticed. Define the test around the spaces and information you need to protect, then use the results to improve access checks, reporting, and response. | Security blog | Bishop Fox |
|
17.10.26 |
Submit and Execute: Weaponizing Reflected XSS in Siemens | Siemens Teamcenter is one of the most widely deployed product lifecycle management (PLM) platforms in the world, the system of record for the engineering designs, bills of materials, and approval workflows behind aircraft, vehicles, and industrial hardware. We found that a crafted link could execute JavaScript in the browser of a logged-in Teamcenter user. During an authorized assessment, we used it to silently grant one account the ability to act on behalf of another. | Vulnerebility blog | Bishop Fox |
|
17.10.26 |
AI Security Scoping: Define What To Test In Yo | Integrating artificial intelligence into enterprise workflows demands a system view: models are only one component in a chain that includes APIs, orchestration layers, data pipelines, identity, storage, and observability. | AI blog | Bishop Fox |
|
17.10.26 |
The October 2026 Security Update Review | Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). | OS Blog | Zero Day Initiative |
|
17.10.26 |
cikabika-bot-inside-a-discord-rat | Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity. | BotNet blog | darktrace.com |
|
17.10.26 |
Underground AI-as-a-Service: How Cybercriminals are Buying and Selling AI | In under six months, the criminal supply of and demand for AI-powered tools grew into a sophisticated underground economy on hacker forums and platforms, maturing and scaling faster than any market these forums have seen. | AI blog | HALCYON |
|
17.10.26 |
ASOS App Hack: Attackers Used Push Notifications to Send a Ransom Note - Real-time Open Source Software Supply Chain Security | On October 6, 2026, people with the ASOS app got a push notification that said the company had been hacked. Attackers sent it. They had gotten into the third-party tools ASOS uses to message its customers, and they used that access to send an extortion note straight to people’s phones. ASOS has confirmed that names and contact details may have been accessed. The bigger claim, that the attackers “fully compromised” ASOS’s Snowflake data warehouse, is still unproven, and Snowflake says its platform was not breached. | Ransom blog | SAFEDEP |
|
17.10.26 |
tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud - Real-time Open Source Software Supply Chain Security | We found a credential-stealing worm in tensorlake@0.5.144. It runs on install, and npm was serving it as latest for a package with about 106,000 monthly downloads. | Hacking blog | SAFEDEP |
|
17.10.26 |
MALFEX Moves Its npm Loader into a Native Windows DLL - Real-time Open Source Software Supply Chain Security | The npm package imgdecode hides a malicious loader in a compiled Node.js addon. Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub. It decrypts the response and injects the result into a new dllhost.exe process. This code does not need an install script. On 2026-10-13, the package was still available on npm. | Malware blog | SAFEDEP |
|
17.10.26 |
TLD Launch Milestones 2026-2027: What Brand Protection Teams Need to Know | New top-level domain (TLD) launches follow public schedules, giving brand protection teams time to prepare defensive registrations, monitoring, and response plans before new namespaces become broadly available. | Vulnerebility blog | NETCRAFT |
|
17.10.26 |
TRM Labs Supports Microsoft's Disruption of YAM Store, CoGUI, and Iron Man, Three Services Behind Global Scam Operations | | On October 14, 2026, Microsoft's Digital Crimes Unit and Health-ISAC announced that they are dismantling three components of a Chinese-language cybercrime marketplace: YAM Store, CoGUI, and Iron Man. | Cyber blog | TRM Labs |
|
17.10.26 |
MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work - | The MALFEX campaign is a long-running npm supply-chain attack that delivers Remote Access Trojans (RAT), information stealers, or open Node.js processes as payloads. Learn about how the attack works, how to find out if you’re impacted, and what response actions to take. | Malware blog | Checkmarx |
|
17.10.26 |
Malware vs malware: a ClickFix kit at war for your screen | Two ClickFix kits fought over the same screen on hacked WordPress sites. One wrote the fight into its code, in Russian, down to the moment the browser broke. | Malware blog | ADAMNET |
|
17.10.26 |
OFAC Sanctions Tren de Aragua Crypto-Laundering Network | OFAC designated 10 targets in a Tren de Aragua ATM jackpotting scheme that stole at least $40.73 million from U.S. financial institutions. The network used cryptocurrency to launder the proceeds. | Cryptocurrency blog | CHAINALYSIS |
|
17.10.26 |
How Chainalysis Used AI to Trace the $387M Bitget Theft | Since $387 million was stolen from Bitget on September 24, Chainalysis investigators have been working with the exchange and law enforcement partners to trace the stolen funds across multiple blockchains and protocols. | AI blog | CHAINALYSIS |
|
17.10.26 |
Hacking OpenAI | On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors. | AI blog | Hacktron AI |
|
17.10.26 |
Shadow AI Detection for MSPs | Employees have always found and used technology outside the approved IT stack, from unauthorized endpoint applications and browser extensions to personal cloud services. It left a trail: an install, a device on the network, something a scan or an agent could eventually catch. From there, an analyst had to investigate the finding and assess the risk before deciding how to respond. | AI blog | WatchGuard Blog |
|
17.10.26 |
GhostAction Is Now Phishing Open Source Maintainers | GhostAction operators used a targeted GitHub phishing proxy to steal developer credentials and one-time codes using a sophisticated GitHub phishing kit | Hacking blog | OpenSourceMalware |
|
17.10.26 |
GhostAction Attack Escalates By Targeting GitHub Users OpenSourceMalware | OSM has identified a new evolution of the GhostAction attack, which targets GitHub users via malicious CI workflow files and worm-like behaviour | Hacking blog | OpenSourceMalware |
|
17.10.26 |
Threat intel blog | GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farms | Cyber blog | OpenSourceMalware |
|
17.10.26 |
YuanKong RAT: the Android remote-control service that stamps its operators' names into every build | Most Android RATs try hard to hide their server. This one barely hides anything and that turns out to be the interesting part. The dropper leaves the key under the mat: a vault-config.json sitting in assets/ right next to the ciphertext it unlocks, holding the key and IV in cleartext. | Malware blog | STAR Labs |
|
17.10.26 |
Qilin Ransomware: Inside a Rust Encryptor and Its Affiliate Ecosystem | Qilin ransomware combines file encryption with an affiliate operation that manages victims, ransom negotiations, and stolen-data publication. Different intrusion teams deploy its payloads, so identifying Qilin does not automatically identify the attacker or the method used to enter a network. | Ransom blog | Darkatlas |
|
17.10.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | DARKATLAS |
|
17.10.26 |
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) | BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable. | Vulnerebility blog | Sansec |
|
17.10.26 |
Spike in attacks targeting digital video recorders in Ukraine | GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. There are a myriad of malicious use cases for compromising DVRs; one involves gaining the ability to physically survey an area to gain battlespace awareness before, during, and after kinetic strikes. | BigBrother blog | GRAYNOISE |
|
17.10.26 |
skynox7: Proxyjacking Edge Devices Into Residential Proxies | Adversaries have a wide range of mechanisms they can use to obfuscate their public internet protocol (IP) addresses to avoid attribution and reduce their detectable signature. Adversaries have used various types of nodes and services to proxy their traffic including commercial virtual private networks (VPN), virtual private servers (VPS), co-opted victim infrastructure, and more. | Hacking blog | GRAYNOISE |
|
17.10.26 |
Variola: From ClickFix to a Modular Implant | Blackpoint’s Adversary Pursuit Group (APG) traced a ClickFix intrusion to a previously unclassified modular Windows implant, which APG is tracking as Variola. | Security blog | Blackpoint Cyber |
|
17.10.26 |
Pay Day Piracy: How Attackers Talk Their Way Into Your Payroll System | Using behavioral AI to chain anomalies from the help desk to HR payroll systems. | AI blog | Abnormal AI |
|
17.10.26 |
Detecting AI Attackers in the Cloud: 4 Signals That Work | AI-driven cloud attacks pass posture checks and detection rules because every step looks legitimate, and four signals still catch them when they're read together instead of one at a time. | AI blog | Abnormal AI |
|
17.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
17.10.26 |
Next.js Security Update for Upstream Vulnerabilities | Last week we announced an upcoming out-of-band security update for Next.js, including two fixes postponed from the September security release due to upstream dependency delays. | Vulnerebility blog | Next.js |
|
17.10.26 |
Patch Tuesday: October 2026 (Expel’s version) | Microsoft’s October release is the largest in its history: 1,414 CVEs, 78 rated critical and 1329 rated important. | OS Blog | Expel |
|
17.10.26 |
QuartzLine: A working PDF viewer with a backdoor inside | QuartzLine is a working PDF viewer with a backdoor hidden inside. In public analysis so far, the attacker never sent a command in any traffic researchers could decrypt. | Malware blog | Expel |
|
17.10.26 |
Emsisoft Anti-Malware for macOS stable release | After months of testing, feedback, and refinement, Emsisoft Anti-Malware for macOS is now officially available in a stable release. This release brings several performance improvements and tweaks. | Malware blog | Expel |
|
17.10.26 |
LG webOS sync-demo Preauth RCE - | First, the attacker replays the LG-signed manifest embedded in com.webos.app.sync-demo. SSG trusts the signature and follows the STB_INTERNAL_CONNECTION prompt-skip path, issuing a SECURE-tier client-key without a PIN prompt. Then cmp-client navigates to an attacker-controlled interactiveUrl. The loaded page keeps the app instance bridge and calls Luna services as cmp-client. | Vulnerebility blog | SSD Secure Disclosure |
|
17.10.26 |
Mobile Device Management Alone Cannot Address Every Mobile Security Threat | In an article published by HackRead, the limitations of Mobile Device Management (MDM) are examined as organizations face increasingly sophisticated threats targeting employee smartphones and corporate data. While MDM helps enforce device policies and manage access, it does not eliminate risks from mobile phishing, malicious applications, and compromised devices. | Security blog | ZIMPERIUM |
|
17.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Cryptocurrency blog | ZIMPERIUM |
|
17.10.26 |
Banking Scams Now Primarily Target Mobile Devices | A recent report reveals that 90% of banking scam attempts now occur on mobile devices, highlighting the growing role of smartphones in financial fraud. Researchers found that scammers are increasingly exploiting mobile banking interactions through social engineering, impersonation, and deceptive communications to manipulate victims into authorizing fraudulent transactions. | Spam blog | ZIMPERIUM |
|
17.10.26 |
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories - | On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. | Cyber blog | StepSecurity |
|
17.10.26 |
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD | Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. | Exploit blog | Calif |
|
17.10.26 |
Akamai Named a Leader in IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment | Akamai has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment. This is the second time that Akamai has been recognized as a Leader in this assessment. | Security blog | Akamai |
|
17.10.26 |
Comply with PCI 6.4.3 & 11.6.1 Through Client-Side Security Tools | As the payment landscape evolves, compliance with PCI DSS v4 (v4.0.1 is the latest) is now a reality, with the deadline to adopt the future-dated requirements behind us. It is a critical defense against growing web skimming attacks (also known as e-skimming and digital skimming) and data leakage risks. | Security blog | Akamai |
|
17.10.26 |
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain | A WhatsApp-delivered financial document lure carried Statement.exe into a multistage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process. | Social blog | Morphisec Blog |
|
17.10.26 |
Why is Preemptive Cyber Defense Important in 2026 | Preemptive cyber defense is a prevention-first security strategy that stops threats before they execute, rather than detecting and responding to them after they have already run. Instead of recognizing an attack in progress, it removes the conditions an attack needs to succeed, blocking malicious code deterministically at the moment of execution. | Security blog | Morphisec Blog |
|
17.10.26 |
2026 Financial Sector Cyberattack Chain Analysis & Defense | Between September 30 and October 3, 2026, consecutive customer data leaks were confirmed at several major commercial banks in Korea. In particular, most of the leaks were found to have exploited APIs by targeting authentication and authorization flaws, and there are even concerns about potential automated attacks using AI agents. | BigBrother blog | Enki White Hat |
|
17.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The campaign uses PhantomPolia, a JavaScript loader that retrieves an encrypted configuration from an Ethereum Sepolia smart contract through public Remote Procedure Call (RPC) endpoints. The loader then decrypts the configuration locally using PBKDF2 and AES-GCM, revealing the next-stage command-and-control (C2) domain without exposing it directly on the compromised site. | Cryptocurrency blog | LEVELBLUE |
|
17.10.26 |
Now Detecting: CVE-2026-85706 - Unauthenticated Arbitrary File Read in GitLab | A maximum severity flaw in GitLab's repository commits API allows anonymous attackers to read arbitrary files from self-managed servers. We are already detecting it. | Vulnerebility blog | Ethiack |
|
17.10.26 |
Mythos AI Security Implications: The Complete Guide (2026) | Claude Mythos did not create the AI-security asymmetry between attackers and defenders. Mythos made it undeniable. Anthropic's own Frontier Red Team used the model to autonomously discover thousands of high- and critical-severity zero-day vulnerabilities across every major operating system and every major web browser, and it did so at costs that break the historical economics of vulnerability research. | AI blog | Ethiack |
|
17.10.26 |
Front Lines Podcast: What Founders Get Wrong When Pitching CISOs | On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust. | Cyber blog | Socket |
|
17.10.26 |
Socket for Origin Now Available | Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace. | Cyber blog | Socket |
|
17.10.26 |
Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings | Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes. | AI blog | Socket |
|
17.10.26 |
Suspected Chinese spies hit BeyondTrust via zero-day | A suspected Chinese espionage crew broke into BeyondTrust Remote Support appliances through a flaw nobody knew about, weeks before the vendor disclosed it. Google Threat Intelligence Group (GTIG) and Mandiant say the actor they now call ARMORY CASTLE, previously tracked as UNC5221, exploited CVE-2026-102764 as a zero-day in late August 2026, then used the hijacked appliances to steal credentials and reach the machines those appliances are trusted to manage. | Vulnerebility blog | IntelFusions |
|
17.10.26 |
Deploy with Void | VoidZero's tools such as Vite, Vitest, Oxc, and Rolldown — bundled in one toolchain as Vite+ — have made frontend development faster, but building full-stack applications requires more than just a tooling stack. These applications need server routes, databases, local development environments, and a fast and easy way to deploy ideas to production. | Cyber blog | Cloudflare Blog |
|
17.10.26 |
Cloudflare and OpenAI: making AI discovery better for everyone | Optimizing your site for AI is of little use if AI can't find it. The answer to someone's question may already be on your website: the installation guide you spent a week writing, or a first-hand account of using a product, with the details that make the difference for whether they buy it. As more people turn to AI for help, you want those systems to find your work, represent it accurately, and send interested people your way. You also want control over how they access your site. | AI blog | Cloudflare Blog |
|
17.10.26 |
Yandex outage: data shows that instead of going dark, malicious bots went on the move | Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead. There are two autonomous system numbers (ASNs) associated with Yandex: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services. | BigBrother blog | Cloudflare Blog |
|
17.10.26 |
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug | Hyperdrive support for MySQL is now generally available (GA). Hyperdrive, Cloudflare’s database connection pooler for Workers, initially only supported Postgres. Since we announced the beta for MySQL protocol support last year, we have been working on making our MySQL handling as reliable as our Postgres support. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
A fully programmable secure web gateway | Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of network security for nearly 30 years, and it handles the common case well. But it has a ceiling, and customers with complex environments hit that ceiling regularly. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | On August 18, 2026, Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
Acronis Cyberthreats Update, October 2026 | The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in September 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. | Cyber blog | ACRONIS |
|
17.10.26 |
Acronis AI Copilot: Adoption is high and growing among MSPs | Acronis Cyber Platform has a built-in AI assistant. Type a plain-language question into the console, and it generates an answer or completes a supporting task within the console. | AI blog | ACRONIS |
|
17.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
17.10.26 |
AI and the Shared Responsibility Model: What Changes | Whether you are deploying large language models (LLMs), training custom machine learning models, building agentic workflows or embedding AI into existing applications, the major cloud service providers (CSP) have rolled out dedicated platforms to make it easier than ever to get started. | AI blog | GIUDEPOINT |
|
17.10.26 |
Hiring in the Age of Deepfakes: Synthetic Applicants | It’s tough enough to hire the right person in today’s competitive talent market. Candidates ghost interviewers, skill sets don’t match job descriptions and the race for top technical talent is relentless. | Hacking blog | GIUDEPOINT |
|
17.10.26 |
Silent Ransom Group Leaked Chats: Key Findings by GRIT | The chats appear to be from Silent Ransom Group (SRG) and show an attempt at a deliberate rebrand (to Sleepless Threat) to evade law enforcement. The tradecraft analysis matches the FBI’s May 2025 notice on SRG. We assess with moderate-to-high confidence that the people in this chat operate under or alongside, the SRG name. | Ransom blog | GIUDEPOINT |
|
17.10.26 |
러시아 전쟁의 이면에서 우크라이나를 겨냥한 김수키의 Operation GitPower | Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War | APT blog | GENIANS |
|
17.10.26 |
금융분야 침해사고 이슈 분석 | 본 보고서는 2026년 9월 말부터 10월 초까지 국내 금융권에서 연쇄적으로 발생한 개인정보 침해사고를 대상으로, Genians Security Center(GSC)가 공개 보도, 금융당국 발표, 보안업계 분석을 종합하여 사고 경과, 공격 기법, AI 활용 정황 및 국내외 위협 동향을 정리한 것입니다. | APT blog | GENIANS |
|
17.10.26 |
The zod Near-Miss: Publish-Time Scanning at the npm Registry Boundary — | zod is the kind of dependency you add without thinking about it. The schema validation library sits in millions of TypeScript projects; commenters in GitHub’s incident thread put its weekly downloads above 280 million. On Sunday, September 21, 2026, a commit landed in the public colinhacks/zod repository with the message Fix bugs and improve performance. | Hacking blog | Yeeth Security |
|
17.10.26 |
CVE-2026-89111: Critical SAP Cloud SDK SSRF | SAP has disclosed CVE-2026-89111, a maximum-severity server-side request forgery (SSRF) vulnerability in SAP Cloud SDK for Python that can expose OAuth2 client credentials. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
Top RCE Vulnerabilities: 10 Critical CVEs and Exploits | A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the most common way attackers get in: it was the initial access vector in 31% of breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), up from 20% the year before, and the median time to fully patch rose from 32 to 43 days. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days | Microsoft’s October 2026 Patch Tuesday, released on October 13, 2026, fixes 1,413 vulnerabilities across Windows, Office, Exchange Server, SharePoint, .NET, Azure services, and developer tools. The total surpasses September’s Patch Tuesday (974 flaws) and sets a new monthly record for the second month in a row, a rise Microsoft has tied to AI-assisted vulnerability discovery. | OS Blog | SOCRADAR |
|
17.10.26 |
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks | Ivanti released fixes on October 13, 2026, for CVE-2026-104935, an Ivanti Connect Secure zero-day that attackers exploited before a patch existed. Volexity, which uncovered the activity during an incident investigation, tracks the attacker as UTA0576. According to the published analysis, the actor chained three vulnerabilities to move from an unauthenticated web request to root-level code execution on an ICS VPN appliance running version 22.8R2.4, which was fully patched at the time. | Exploit blog | SOCRADAR |
|
17.10.26 |
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site | A month after its first leak site postings, the n0n extortion group has turned its attention to global shipping. On October 12, 2026, the group added 38 organizations to its Dark Web leak site in one batch: container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, port IT providers in Kuwait, Indonesia and Germany, and a dense cluster of South Korean operators. | APT blog | SOCRADAR |
|
17.10.26 |
French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply | Supermarkets across France opened on Monday, October 12, to warm freezers and spoiled stock. Overnight, attackers had taken control of refrigeration controllers in hundreds of stores and forced them into defrost, heating equipment to as high as 50°C. Prosecutors confirmed fires, retailers estimated losses in the tens of millions of euros, and Coopérative U’s chief executive called the attack unprecedented. | BigBrother blog | SOCRADAR |
|
17.10.26 |
Iran War Cyber Threat Outlook: Conflict Phases and What Comes Next | Since the Iran War began on February 28, 2026, the conflict has moved through phases that most threat frameworks were not built to track. In cyberspace, SOCRadar tracked 1,357 incidents prominent in the first month that spanned 25+ countries, 15+ sectors, and 40+ distinct attack groups. That data does more than record what happened. It reveals a pattern | BigBrother blog | SOCRADAR |
|
17.10.26 |
Behind the scenes of a vishing operation | Okta Threat Intelligence recently obtained material from a sensitive source that provides an inside view of Work Panel, an operator console used by threat actors running vishing campaigns that target customers of multiple identity providers, including Okta. | Phishing blog | Okta Threat Intelligence |
|
17.10.26 |
October 2026 Microsoft Patch Tuesday | Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild. | Vulnerebility blog | Tenable® |
|
17.10.26 |
Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool | VulnCheck is disclosing CVE-2026-49950, a deserialization vulnerability in Xorbits Xoscar that allows for unauthenticated remote code execution. The bug is not in an application endpoint; it is in the transport layer of the actor framework itself. An actor pool is Xoscar's unit of concurrency: a process that hosts actors and exchanges messages with other pools over TCP. | Vulnerebility blog | VulnCheck |
|
17.10.26 |
Expanding Visibility Into Chinese Government-linked Cyber Threat Actors | Some of the joint advisory's IOCs are still live and repurposed. Three IPs were hitting VulnCheck Canaries as recently as May 2026, years after their advisory last-seen dates, but against entirely different vulnerabilities than the advisory lists. | APT blog | VulnCheck |
|
17.10.26 |
SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename | VulnCheck is disclosing CVE-2026-104085, an OS command injection in odt2spip, a document-import plugin for the SPIP CMS. The plugin lets an author import an office document (.odt, .doc, .docx, .html) into an article. It moves the uploaded file to a path built from the raw client-supplied filename, then hands that path to LibreOffice through a shell command. | Hacking blog | VulnCheck |
|
17.10.26 |
5 Key Takeaways From Censys’ State of the Internet Report | New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about where Internet infrastructure lives, how it changes, and what’s exposed. | Cyber blog | Censys |
|
17.10.26 |
The Ultimate Guide to Brand Protection with Censys - Censys Brand Protection & Fraud Takedowns: A Censys Guide | On August 23, 2026, a PowerShell dropper reached out to hxxp://binance-idexchange[.]com/333.mp4 for its next stage. Binance, the world’s largest cryptocurrency exchange with hundreds of millions of users, had nothing to do with it — duh! | Cryptocurrency blog | Censys |
|
17.10.26 |
Frostbitten in France: A Danfoss StoreView Internet Exposure Report | Attackers targeted refrigeration units at hundreds of supermarkets across France over the weekend of October 10, resulting in spoiled food and, in some cases, fires. | Incident blog | Censys |
|
17.10.26 |
Navigating the Waves of AI-Powered Identity Attacks | It’s one of the most famous lines in movie history. Chief Brody, chumming the water off the back of the Orca, a battle-hardened fishing boat, gets his first full look at the nemesis in Jaws. He backs slowly into the cabin in shock and says… | Incident blog | Flare |
|
17.10.26 |
Analysis After the Refrigeration System Attack in France | Overnight between October 11-12, 2026, refrigeration systems at several hundred grocery stores in France were driven into forced defrost. Temperatures in some cases reached 50 degrees Celsius, stock was destroyed, and equipment overheated. | Incident blog | Flare |
|
17.10.26 |
September 2026 Threat Trend Report on APT Groups | APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain. | APT blog | ASEC |
|
17.10.26 |
Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat | Since the original ARTEX GitHub repository disappeared, there has been an increase in independent distributions and customized instances based on the existing ARTEX codebase. These distributions are being redistributed with the product name, UI, filesystem structure, agent settings, and language modified, while retaining traces of ARTEX. | Cyber blog | ASEC |
|
17.10.26 |
ARTokens 5.1.2: Microsoft 365 Device Code Phishing | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | Phishing blog | ZeroBEC |
|
17.10.26 |
ARTEX Attacks on South Korean Financial Institutions | From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions were attacked one after another. | Attack blog | THREATBOOK |
|
17.10.26 |
RedAgents.Ai: The World's First Multi-Agent AI Pentest Platform | Recent news of multiple South Korean banks having their networks breached has once again deepened the industry's alarm over AI attacks. Even when attackers are not technically skilled, they can use AI agents to cause a major security impact. | Malware blog | THREATBOOK |
|
17.10.26 |
MSSP Growth: How to Scale Investigations Without Adding More Work | But growth also brings more alerts, suspicious files and URLs, investigations, escalations, reports, and SLA commitments. And if too much of that work still depends on manual analyst effort, those 10 new clients can put pressure on the SOC faster than expected. | Security blog | ANYRUN BLOG |
|
17.10.26 |
Fake AI Tools Target US Companies: Claude, ChatGPT & Copilot | ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after India. | AI blog | ANYRUN BLOG |
|
17.10.26 |
What Can ANY.RUN Reveal About Your Threat Landscape? | Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with ANY.RUN. Beyond individual investigations, this activity generates valuable data on emerging threats, industry trends, and SOC operational performance. | Security blog | ANYRUN BLOG |
|
17.10.26 |
DORA TLPT Requirements: Where Threat Intelligence Fits | The DORA TLPT requirements push selected EU financial entities beyond standard penetration testing. TLPT must be based on realistic threat scenarios, relevant threat actors, and current intelligence about how attacks are actually carried out. | Security blog | ANYRUN BLOG |
|
17.10.26 |
Russia Is Tightening Internet Controls, Leading to Operational Risks | Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. | BigBrother blog | RECORDEDFUTURE |
|
17.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | Disclosure note: Before publishing, we shared the new infrastructure identified in this research with the relevant national CERTs. This research did not recover victim data. | Cryptocurrency blog | HUNT.IO |
|
17.10.26 |
Inside a PaperCut Attacker’s AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries | Disclosure note: Before publishing this research, we shared our findings and the victim data we recovered with the national CERTs of the affected countries. The CERTs are handling notification of the affected organizations in their jurisdictions. | AI blog | HUNT.IO |
|
17.10.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Exploit blog | Proofpoint US |
|
17.10.26 |
Threat Actors Abuse AI Pentesting Framework | Zscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. | AI blog | ThreatLabz |
|
17.10.26 |
The patch tsunami: Microsoft addresses 1,415 CVEs in Patch Tuesday | For nearly 25 years, Patch Tuesday gave IT teams a predictable stream of patches to manage. In 2026, AI turned that stream into a tidal wave that threatens to overwhelm the organizations that can’t adapt. | OS Blog | ThreatDown |
|
17.10.26 |
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize | Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential theft, ransomware, and an unusual set of psychological harassment capabilities. | Malware blog | Group-IB Blog |
|
17.10.26 |
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling. | AI blog | CrowdStrike |
|
17.10.26 |
How Attackers Can Bypass LLM Safety Classifiers | The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. | AI blog | CrowdStrike |
|
17.10.26 |
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage | CrowdStrike joins Anthropic’s Critical Infrastructure Defense Program, bringing deep cybersecurity expertise in protecting IT and OT environments to help advance AI-powered defense for critical infrastructure. | AI blog | CrowdStrike |
|
17.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). Successful exploitation can cause a denial of service (DoS) condition, potentially disrupting authentication services and remote access functionality. | Vulnerebility blog | SOPHOS |
|
17.10.26 |
Intent-Based Access Control: AI, Risk and the Limits of Inference | In Minority Report, the Department of Precrime promised certainty. Three precognitives saw the future, the system picked the consensus, and police arrested people for murders they hadn't yet committed. The whole machine depended on one buried secret: sometimes the precogs disagreed, and the dissenting vision, the minority report, was quietly deleted. The system held together as long as the precogs agreed, but broke when it removed its own doubt. | AI blog | SOPHOS |
|
17.10.26 |
Vulnerability Discovery and Exploitation Trends in the AI Era | Google Threat Intelligence Group (GTIG) examines vulnerability disclosure and exploitation statistics to evaluate the impact of artificial intelligence (AI) on the vulnerability threat landscape. We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
ARMORY CASTLE Exploits BeyondTrust | On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
AI/ML-Driven Malware Analysis Platforms: Key Features | Malware is becoming increasingly sophisticated, making it difficult for organizations to detect emerging threats using traditional signature-based security tools alone. Attackers use techniques such as code obfuscation, polymorphism, and sandbox evasion to bypass conventional security measures. | AI blog | SEQRITE |
|
17.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | SEQRITE |
|
17.10.26 |
WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack | WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target application. | Exploit blog | SEQRITE |
|
17.10.26 |
Weekly Vulnerability Report: Langflow, N8n, And 54 ICS Flaws | This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS). | Cyber blog | CYBLE |
|
17.10.26 |
Don’t Get Played: TOKEN2049 Security Event Faces Scam Claims | A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded “Don’t Get Played,” was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names “Apex Accelerator” and “Stone Venture.” | Spam blog | CYBLE |
|
17.10.26 |
The GhostX Ecosystem: Forged In Transit, Licensed To Deceive | Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. | Malware blog | CYBLE |
|
17.10.26 |
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | Malware blog | Gen Blogs |
|
17.10.26 |
Aoki: Infostealer Targets AI Coding Assistant Credentials | Newer versions of a little-documented infostealer steal API keys and tokens from ever-growing number of AI coding assistants, including Claude, Codex, Cursor and Gemini. | Malware blog | SECURITY.COM |
|
17.10.26 |
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime | Over the past year, Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators, developers, and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide. | Phishing blog | Microsoft Security Blog |
|
17.10.26 |
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant | Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance. | APT blog | Palo Alto |
|
17.10.26 |
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk | When unusual activity was detected on a European bank’s central IT system, its internal security team quickly recognized that the incident warranted immediate response. They discovered unauthorized VPN-based access attempts that spanned several months. They then engaged Unit 42 to determine the full scope of the intrusion, identify any persistent footholds and secure the environment. | Hacking blog | Palo Alto |
|
17.10.26 |
AI-Powered Espionage Campaign Targets Government Linux Infrastructure | Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. | AI blog | Palo Alto |
|
17.10.26 |
When LLM Gateways Go Wrong: Findings from LiteLLM - Check Point Research | Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. | AI blog | Check Point Research |
|
17.10.26 |
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation | I've been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell (although I'm writing this with 1°C/34°F outside), Vulnpocalypse, Bugmageddon, Bugpocalypse, Breachpocalypse... | Vulnerebility blog | Check Point Research |
|
17.10.26 |
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. | APT blog | CISCO TALOS |
|
17.10.26 |
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware | “AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. | AI blog | CISCO TALOS |
|
17.10.26 |
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." | OS Blog | CISCO TALOS |
|
17.10.26 |
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations | Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war. | APT blog | CISCO TALOS |
|
17.10.26 |
Inbox flooded with sign-up messages? How to handle email bombing | If you’re suddenly being overwhelmed with sign-up emails, it could very well be a sign of something more serious | Spam blog | Eset |
|
17.10.26 |
Medicare Open Enrollment season is here, and so are the scams | Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safe | Spam blog | Eset |
|
17.10.26 |
What to do when a data breach notice tells you almost nothing | Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next. | Security blog | Eset |
|
17.10.26 |
The Unseen Credential Surface: How AI Agents Expose Secrets | There is a quiet assumption behind every AI agent: that when it "just runs a command for you," it handles your credentials as carefully as a good engineer would. It does not. This is not due to malicious intent. It is architectural. | AI blog | TRELLIX |
|
13.10.26 |
SOCRadar and Torq: Automate Threat Intelligence Response | Your Dark Web monitoring just flagged a set of employee credentials for sale. The alarm is accurate, it is timely, and it is now sitting in a queue. Someone has to read it, confirm the accounts are real, check whether the sessions are active, open a ticket and chase the identity team to rotate the password. | Security blog | SOCRADAR |
|
13.10.26 |
CVE-2026-102255: Critical SonicWall SMA1000 SSRF | SonicWall has patched CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting the WorkPlace interface of SMA1000 appliances. | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
Inside ICMacOS: From an Infostealer to a Persistent RAT | Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly one in three software developers works on macOS. | Malware blog | SOCRADAR |
|
13.10.26 |
Angi, Tour Guy, Healthcare, KPN and CafeMom Leaks | SOCRadar Dark Web Team identified several new underground posts, including an alleged Angi customer database sale, an alleged The Tour Guy breach exposing 3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China. | CyberCrime blog | SOCRADAR |
|
13.10.26 |
CVE-2026-85097: Bricksforge Flaw Exploited for Unauthenticated RCE | Threat actors are actively exploiting CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in the Bricksforge plugin for WordPress. The flaw lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites, resulting in remote code execution (RCE). | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
ARTEX Attacks on South Korean Financial Institutions | From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions were attacked one after another. | Attack blog | THREATBOOK |
|
13.10.26 |
Auditing the auditor: Unmasking Apex Accelerator | REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery. | Security blog | Elastic Security Labs |
|
10.10.26 |
Dire Wolf Ransomware Attacks: How to Test and Strengthen Your Defenses | Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. | Ransom blog | PICUSSECURITY |
|
10.10.26 |
CISA AA26-281A: How Chinese Government-Linked Actors Steal Sensitive Data | CISA published a joint cybersecurity advisory on October 8, 2026, which describes how Chinese government-linked threat actors combine automated reconnaissance with hands-on intrusion to steal sensitive data. | BigBrother blog | PICUSSECURITY |
|
10.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Malicious Crypto Shell Packages Target RubyGems | A threat actor calling themselves "Ghost Dev" published 42 malicious typo squat packages to the RubyGems registry targeting crypto and web3 packages | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
How to Investigate a GitHub Repo's Real History | Learn to reconstruct what actually happened to a compromised repo using timestamps and logs that the person doing the manipulation doesn't control. | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Novinarya: An Android stealer that hides its live C2 in a shop bio | Scan this sample for a command server and you find nothing: no URL, no IP, nothing to block. That is the whole idea. Behind a fake “Smart System Security” app, this Iranian banking and crypto stealer keeps its server out of the binary and reads it at run time from the bio of a seller’s profile on a legitimate marketplace, rotating it with a single edit no new sample needed. | Malware blog | STAR Labs |
|
10.10.26 |
Runtime AI Defense in a shared responsibility model | This last February, by their own account, an employee at Meta connected an open source agent to their inbox and told it to suggest which emails to archive or delete, and to confirm with them before acting. Despite the guardrails of the prompt, the agent started deleting. Their stop commands didn't work and they had to manually kill the process. | AI blog | Sysdig |
|
10.10.26 |
Spike in attacks targeting digital video recorders in Ukraine | GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. | BigBrother blog | GREYNOISE |
|
10.10.26 |
Why API Security Belongs in ECB Cyber Action Plans | An undocumented partner endpoint or an outdated mobile-banking API can expose customer information even after newer services receive stronger protections. As AI accelerates vulnerability discovery and exploitation, banks need a clearer view of these gaps and a practical way to reduce them. | Vulnerebility blog | Akamai |
|
10.10.26 |
CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | On October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. | Vulnerebility blog | Akamai |
|
10.10.26 |
How Akamai ExAR Contained a LATAM Supply Chain Attack | Akamai Guardicore Segmentation’s Exposure Analysis and Response (ExAR) detected and investigated a multistage intrusion affecting supply chain infrastructure in Latin America (LATAM). The complex intrusion was targeting Linux, OpenShift, and Windows DMZ workloads before significant operational disruption occurred. | Hacking blog | Akamai |
|
10.10.26 |
Open Enrollment Is Where Digital Strategy Gets Tested. Are You Ready? | Most retail purchases come with a return policy. If the sweater doesn't fit, you send it back. But health plan selections work differently. Once a member chooses a plan during open enrollment, they generally keep that plan for the year unless they qualify for a Special Enrollment Period or get coverage another way. | Cyber blog | Akamai |
|
10.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | In recent years, organizations have made real progress here. SBOMs (Software Bill of Materials) are now a standard deliverable. Software Composition Analysis (SCA) tools run in CI/CD. Vendor security questionnaires are longer and more rigorous than ever. | Security blog | JSCRAMBLE |
|
10.10.26 |
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain | A financial-document lure, reported to have arrived over WhatsApp, carried Statement.exe into a multi-stage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process. | Social blog | Morphisec Blog |
|
10.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The LevelBlue Operational Cyber Threat Intelligence (OpsCTI) Team recently observed a ClickFix campaign delivering Remus Stealer through compromised websites. | Malware blog | LEVELBLUE |
|
10.10.26 |
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials | Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces. | Cryptocurrency blog | Socket |
|
10.10.26 |
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack | Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware. | Malware blog | Socket |
|
10.10.26 |
Building an evidence-grounded agentic security operations harness on Cloudflare | Security alerts rarely arrive one at a time. A single alert can cause a spike across the environment, requiring a human analyst to decide which alerts are related and what they mean. When multiple arrive at the same time, it can quickly overwhelm even a seasoned security analyst. Enter the alert paradox. Now, our built-in, multi-AI-agent security operations harness can handle more of this work at Cloudflare scale. | AI blog | Cloudflare Blog |
|
10.10.26 |
Bridging technical depth and usability: The story behind Radar’s redesign | Radar provides a real-time view into global Internet trends, powered by Cloudflare’s global network. We support Cloudflare’s mission to help build a better Internet by making web data visible, clear, and actionable for everyone. Since launching in 2020, Radar has found a natural audience amongst expert users with technical backgrounds, such as network operators and academic researchers who rely on Radar data to observe industry trends and global events. | Security blog | Cloudflare Blog |
|
10.10.26 |
Meet AI Detection Engineer, the Newest Member of Your SOC | AI Detection Engineer investigates, builds, tests, and deploys a tuned detection for confirmed misjudgments your team reports, then shows the verifiable impact. | AI blog | Abnormal AI |
|
10.10.26 |
Four ways back in: the WordPress XSS campaign that hides its own admin account | Two unrelated WordPress plugins, two separate stored Cross-Site Scripting vulnerabilities, one payload. Over the past several days our telemetry has recorded exploitation attempts against both, and every attempt pulls the same JavaScript from imgcdn1.com. Two is what we have confirmed, not what we expect the final count to be. | Vulnerebility blog | Patchstack |
|
10.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
10.10.26 |
Inferno Drainer Is Burning Out | Inferno Drainer and its many derivatives constitute arguably the most notorious cryptodrainer-as-a-service ecosystem ever developed. After months spent reverse-engineering its newest payloads and monitoring the ecosystem in real time, one thing seems clear: the operation is in serious decline, and has been for quite some time. | Cryptocurrency blog | Ransom-ISAC |
|
10.10.26 |
Upcoming Next.js Security Update for Upstream Vulnerabilities | Next Wednesday, October 14, 2026, we plan to publish an out-of-band Next.js security update. It will address three vulnerabilities in upstream dependencies: two Critical and one High. Two of these fixes were postponed from the September security release due to upstream coordination. | Vulnerebility blog | Next.js |
|
10.10.26 |
Oh Noes! is updated and free for Cybersecurity Awareness Month | October means Cybersecurity Awareness Month, which for a lot of security teams means the same routine: send a fake phishing email, see who clicks, remind everyone not to click links from strangers. Again. | Cyber blog | Expel |
|
10.10.26 |
Earth Sirrush: A Russia-Aligned Intrusion Set With 4 Years of Evolving Espionage Tooling | Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns. | APT blog | TrendAI (US) |
|
10.10.26 |
AI and the Evolving Threat Landscape: What Public Sector CISOs Need to Know Now | Public sector CISOs need to grapple with challenges brought about by AI threats: up to 3,600 AI CVEs in 2026, autonomous ransomware, and critical infrastructure risk. | AI blog | TrendAI (US) |
|
10.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Malware blog | TrendAI (US) |
|
10.10.26 |
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It | tensorlake@0.5.144 on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes your home directory. | Malware blog | StepSecurity |
|
10.10.26 |
StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines | AI agent skills live in two places. Developers install them on their own machines, and teams commit them to repositories so everyone who works in the codebase gets them. A skill often travels between the two: a developer installs it, finds it useful, and commits it; everyone who clones the repository then has it. | AI blog | StepSecurity |
|
10.10.26 |
Hijacked TensorLake npm Turned Install Into Credential Risk | The affected npm release included a preinstall hook that starts an obfuscated JavaScript payload through Bun. The package can download Bun 1.3.13 if it is not already available. | Hacking blog | SONATYPE |
|
10.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
10.10.26 |
aws-auth ConfigMap Deprecated: What EKS Teams Need Now | If you’ve been running Amazon Web Services (AWS) Elastic Kubernetes Service (EKS) clusters for any length of time, you’ve probably had that moment. Staring at an aws-auth ConfigMap YAML file at 2 AM, trying to figure out why a new team member can’t access the cluster. | Hacking blog | GUIDESECURITY |
|
10.10.26 |
GRIT Q3 2026 Ransomware Report: Top Takeaways | GuidePoint’s Research and Intelligence Team (GRIT) just unveiled the Q3 GRIT Ransomware and Cyber Threat Insights Report. This quarter, they look at the so-called “vulnpocalypse,” shine a spotlight on the Education industry and ShinyHunters group, analyze the Clop syndicate’s latest activity and assess payment trends in the ransomware space. | Ransom blog | GUIDESECURITY |
|
10.10.26 |
AgentCorruption: One Role to Rule Them Al | Exploring what the agent's default execution role and stolen credentials can actually do, and how they became an entry point to the entire region - discovering and invoking other agents, reading, deleting and hijacking private conversations through chat history tampering, and more. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Credential Theft from AWS's Secrets Manager and More | Up to now, we showed how far we could get once we had the over-privileged role in hand: we were able to pull container images, talk to other agents that we were never allowed to, read private conversations, plant short- and long-term memories to control agents’ behavior and delete user data. All of this stays within the AWS region boundary. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Weaponizing Agent Memory for Persistent Hijacking | How access to AgentCore Memory let us plant instructions that survived beyond the initial compromise, turning an agent's remembered context into a channel for persistent command and control. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Initial IMDS Access | How a single prompt to a public-facing AgentCore agent exposed the instance metadata endpoint, the agent's cloud identity, and its container image: the foothold for everything that follows in this series. | Hacking blog | Zenity Labs |
|
10.10.26 |
DarkSword/Coruna Open Directory Finding Report | Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. | Exploit blog | Censys |
|
10.10.26 |
New on the Map — September 2026: 22 Protocol and Endpoint Scanners | Most organizations do not have a complete picture of what is reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. Attackers scan for these services systematically, every day. | Security blog | Censys |
|
10.10.26 |
Harbor SSRF Vulnerability Exposes Cloud Credentials | OX Research disclosed an SSRF vulnerability in Harbor, the CNCF open-source container registry. Any registered user who can create a project can point a webhook at the cloud metadata endpoint and walk away with the server’s IAM credentials. | Hacking blog | OX SECURITY |
|
10.10.26 |
Leaked AI & MCP Credentials: What They Expose | One record in the corpus carries the argument before we even start counting. It’s a project configuration file for an AI coding assistant that wires several named tool servers behind a single agent. | AI blog | FLARE.IO |
|
10.10.26 |
Healthcare: Cybercrime's Highest-Value Target | Various healthcare and public health reports like the one of IC3 (2025) report that healthcare organizations are among the most targeted critical infrastructure sectors for cyber incidents, with hundreds of reports of ransomware attacks and data breaches reported in a single year. | CyberCrime blog | FLARE.IO |
|
10.10.26 |
Email Security That Reasons About the Request and the Response | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | Phishing blog | ZEROBEC BLOG |
|
10.10.26 |
DDoS Readiness: Is Your Protection Actually On? | Most security controls tell you when they’re broken. A bad firewall rule lets traffic through that shouldn’t be there. An expired certificate generates alerts. A misconfigured WAF starts blocking legitimate users and someone notices pretty quickly. | Attack blog | Imperva |
|
10.10.26 |
From Threat Intelligence to SOC Action | So, what actually makes threat intelligence useful in daily SOC work? During our discussion, we narrowed it to three things: | Security blog | ANY.RUN & Elastic |
|
10.10.26 |
Critical N-able N-central Vulnerability and Active Exploitation | UPDATE 9/6/26: N-able issued [Hotfix 4 (2026.3 HF4)] to address CVE-2026-86218, an actively exploited pre-auth RCE zero-day with a 10.0 CVSS score that supersedes all prior hotfixes. On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw. Hosted (NCOD) instances have already been patched by N-able. | Exploit blog | Huntress |
|
10.10.26 |
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. | Vulnerebility blog | Huntress |
|
10.10.26 |
Japan Adopts Proactive Cyber Defense Strategy | Japan’s Active Cyber Defense (ACD) framework shifts the country from voluntary information sharing and post-incident investigation to mandatory reporting, preventive communications analysis, and limited disruption of attack infrastructure. | BigBrother blog | RECORDEDFUTURE |
|
10.10.26 |
AI SOC automation: Inbox zero for your alert queue | AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your priorities. Nothing changes in your environment without your approval. | AI blog | Elastic Security Labs |
|
10.10.26 |
Semantic Privilege Escalation: The AI Security Threat Your Access Controls Can't See | In 1988, Norm Hardy published a short paper about an incident at Tymshare roughly eleven years earlier. A Fortran compiler lived in a system directory called SYSX, and so it could record usage statistics there, administrators had granted it a "home files license" that let it write any file in that directory. | AI blog | Proofpoint US |
|
10.10.26 |
Trojanized Terraform Provider Campaign | In July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), an advanced persistent threat actor backed by the North Korean government that has targeted the cryptocurrency industry for years. | Malware blog | ThreatLabz |
|
10.10.26 |
Criminal AI, powered by OpenRouter | Kriminal, DadGPT, and WormGPT are three of the most recognizable tools in the criminal AI marketplace today. Kriminal and DadGPT sell themselves as unrestricted AI: no filters, no refusals, built specifically to say “yes” where a mainstream model would say “no.” WormGPT takes the opposite approach, marketing itself as an “Ethical Hacking AI” for “cybersecurity professionals” — camouflage that lets it hide in plain sight. | AI blog | THREATDOWN |
|
10.10.26 |
How Attackers Can Bypass LLM Safety Classifiers | The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. | AI blog | CROWDSTRIKE |
|
10.10.26 |
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage | CrowdStrike joins Anthropic’s Critical Infrastructure Defense Program, bringing deep cybersecurity expertise in protecting IT and OT environments to help advance AI-powered defense for critical infrastructure. | AI blog | CROWDSTRIKE |
|
10.10.26 |
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling. | AI blog | CROWDSTRIKE |
|
10.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). | Vulnerebility blog | SOPHOS |
|
10.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | Seqrite |
|
10.10.26 |
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | Malware blog | GENDIGITAL |
|
10.10.26 |
CVE-2025-7544: Attackers Weaponize Tenda AC1206 Router Vulnerability to Deploy Mirai-Related Malware | MLflow is one of the most widely deployed open-source platforms for managing the machine learning lifecycle, from experiment tracking and model versioning to deployment and registry management. | Vulnerebility blog | SonicWall |
|
10.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Adobe Commerce and Magento StyleSmuggler RCE - CVE-2026-75650 | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-75650, assessed its impact, and developed mitigation measures. The flaw, also known as StyleSmuggler, is a critical vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. It lets an unauthenticated attacker run arbitrary code on a store by smuggling a template directive through the styles parameters of the storefront API. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Blinder Tunnel Campaign Targets Iraqi Infrastructure | We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. Unit 42 tracks the activity as CL-STA-1178. This activity includes a campaign we call “Blinder Tunnel,” that targeted Iraqi critical infrastructure in March 2026, following infrastructure staging that was observed as early as November 2025. | Cyber blog | Palo Alto |
|
10.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
10.10.26 |
Evolution of Web3 in Cloud Supply Chain Attacks | Threat actors have systematically upgraded their command-and-control (C2) infrastructure to use Web3, also known as Web 3.0 or decentralized blockchain web architectures. This advancement goes from using static C2 endpoints hard coded in malware binaries to using Web3-powered smart contracts. Threat actors are then enabled to dynamically update entire botnets and worm network infrastructures with a single smart contract transaction. | Hacking blog | Palo Alto |
|
10.10.26 |
Making sure the checks get printed | My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and compliance, disaster recovery, and investigations. | Cyber blog | CISCO TALOS |
|
10.10.26 |
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware | Just as attackers are adding new capabilities into their toolkits with AI, they are consciously trying to evade the novel AI capabilities levied on them by defenders. In Cisco Talos' findings with CAIRN, we classify this archetype of malware as “A3: AI-Analysis Evasion” — that is, malware that embeds natural-language instructions to influence automated analysis. In line with the CAIRN philosophy, we treat this embedded language as a signal and actively seek it out to track and measure the progression of adversary techniques on this front. | AI blog | CISCO TALOS |
|
10.10.26 |
One breach, please, and make no mistakes | For some time now, the cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure (to name a few, Hugging Face, DSEWiki, and RubyGems). Of course, frontier labs have built-in security to prevent these attacks from occurring, but every now and then, the training or prompting appears to be insufficient — especially when the agents themselves attempt to use logic to probe and bypass the restrictions placed on them. | Incident blog | CISCO TALOS |
|
10.10.26 |
Microsoft, Adobe, Apple, and Foxit vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. | Vulnerebility blog | CISCO TALOS |
|
10.10.26 |
Give yourself room to be human | Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. | Cyber blog | CISCO TALOS |
|
10.10.26 |
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. | APT blog | CISCO TALOS |
|
10.10.26 |
MATCHBOIL: New tricks, same old evil intentions | ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026 | Malware blog | Eset |
|
10.10.26 |
Inside a brand deal scam targeting YouTube creators | A plausible-sounding sponsorship offer could mask an attempt to compromise your Google account | Phishing blog | Eset |
|
10.10.26 |
The quest for simplicity: Why SMBs want advanced protection without the complexity | The cybersecurity market is often making it tougher for SMBs to keep threats at bay | Cyber blog | Eset |
|
10.10.26 |
Windows Exploitation Techniques: Dangling COM Object Registrations | This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. | Vulnerebility blog | PROJECT ZERO |
|
8.10.26 |
Q3 2026 Open Source Malware Index: When Compromise Compounds | In the third quarter of 2026, Sonatype identified 149,329 malicious open source packages across ecosystems, bringing the total logged since tracking began in 2017 to 1,960,846. | Malware blog | SONETYPE |
|
8.10.26 |
CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD | NOTE: This is an analysis of the artifacts and samples found during the hunt of SLAPSHOT, WHIPSHOT which is a Python tunneler used to proxy traffic into internal networks. The analysis is done using various AI Models and if you find any irrelevancy, please do report directly. This article is intended for Network Defenders, Threat Analysts, SOC and IT Administrators. | Exploit blog | THE RAVEN FILE |
|
8.10.26 |
AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage | An AI tool that produces only text carries roughly the risk of a badly worded email. A tool that can reach into systems and change things carries the risk of whatever those systems hold. The security question is not how clever the model is. It is which systems and data the model is authorized to access. | AI blog | ACRONIS |
|
8.10.26 |
Caught in 4K: The Gentlemen Files | A Russian-speaking Gentlemen ransomware affiliate called Azazel robbed two dozen victims across six countries, then double-crossed his own gang by publishing the loot on a private leak site and pocketing every dollar. | APT blog | CloudSEK |
|
8.10.26 |
How AI Is Changing the Roles Required in the Security Operations Center | As AI takes on more of the enrichment, correlation, and initial assessment inside the SOC, roles, skills, and KPIs still require deliberate redesign. Security leaders need to decide where automation is dependable, where human judgment should remain decisive, and how teams should be measured when alert handling is no longer the center of the operating model | AI blog | RAPID7 |
|
8.10.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Security blog | RAPID7 |
|
8.10.26 |
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment | The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. | CyberCrime blog | RAPID7 |
|
8.10.26 |
SMTP is the key: BPFDoor and AVERAT hitting the network edge | Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese appliances. | Malware blog | RAPID7 |
|
8.10.26 |
Access Governance: Reducing Attacker Reach in the Age of AI-Accelerated Threats | AI is accelerating vulnerabilities and threats. Learn how to strengthen your organization's data security and access governance to reduce risks effectively with insights from Varonis and PwC. | AI blog | VARONIS |
|
8.10.26 |
Least Privilege for AI Agents: A Practical Guide for Security Leaders | Learn what it means to enforce least privilege for AI agents, and get practical with a six-step implementation plan. | AI blog | VARONIS |
|
8.10.26 |
Rogue AI Agents Abuse urlquery to extract Russian government data | We found additional activity and sandbox circumvention techniques used by rogue AI agent swarms. These include attempting to extract Russian government data, hijacking remote browser services and running Javascript in attempts to extend their capabilities, circumvent networking and sandbox restrictions, and complete their tasks. | AI blog | Zenity Labs |
|
8.10.26 |
How AI Agents Turned One Exposed Endpoint into a Server Takeover Threat Spotlight | ReliaQuest investigated an incident in which, for the first time, we identified an open-source AI agent orchestration platform running on the same IP address that launched the attack. We assess with high confidence that AI agents driven by large language models (LLMs) carried out substantial portions of it. | AI blog | RELIAQUEST |
|
8.10.26 |
5 SOC Pain Points Putting US Security Teams Under Pressure | US SOC teams are under pressure to detect and contain threats faster, but the real challenge is often not a lack of security solutions. It’s the growing amount of alerts, fragmented investigation data, evasive attack techniques, and the time analysts spend connecting the dots. | Security blog | ANYRUN BLOG |
|
8.10.26 |
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs | In September, Huntress observed a phishing campaign where threat actors abused legitimate Power BI domains to make their attack more convincing and evade security controls that trust the service. | Phishing blog | Huntress |
|
8.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | On 31 August 2026 Group-IB described BraZetsu, a Python framework for Windows compiled with Nuitka, and attributed it with high confidence to the Brazilian actor Exilware. The same paper ties the binary to the Infected Marketplace (Banco de Infects), a shop that inventories compromised Windows hosts and sells the access after a deposit of about $5.80 (BRL 30), settled through NowPayments. | Malware blog | HUNT.IO |
|
7.10.26 |
Identity-aware AI data agents with AWS Lake Formation and Trusted Identity Propagation | You’re building a data agent that lets business users ask questions about lakehouse data in natural language. You’ve already built governance policies that control who can access which datasets. The challenge is making the agent respect those rules without rebuilding them in your application code. | AI blog | AWS Security Blog |
|
7.10.26 |
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure | SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. | AI blog | SOCRADAR |
|
7.10.26 |
Investigate Threats Faster | Your SOC runs on Elastic. Detections, logs, cases and dashboards all live in Kibana, and your analysts have built their muscle memory around it. Then an impersonating domain, a leaked credential or a newly exposed asset shows up in a different console, and the investigation starts with a copy-paste. | Hacking blog | SOCRADAR |
|
7.10.26 |
How to mitigate shadow AI risks from employee citizen coders | AI tools let non-technical employees build workplace apps in minutes with natural language prompts. While these AI-generated apps boost productivity, they can create severe security and data risks. As Cybersecurity Awareness Month kicks off, we’re sharing how Tenable adopted a structured governance framework that allows our “citizen coders” to build secure and compliant apps with AI. | AI blog | Tenable® |
|
7.10.26 |
Claude Mythos: When Zero-Day Vulnerabilities Outpace Defenses | Advances in AI are reshaping the cybersecurity landscape in a fundamental way. Modern AI systems are no longer limited to detecting known threats. They are increasingly capable of uncovering previously unknown vulnerabilities buried deep within complex software and systems, including Zero Day vulnerabilities that can be found at lightning speed. | AI blog | FORESCOUT |
|
7.10.26 |
CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery | ClickFix campaigns have become one of the most effective ways to turn a browser session into code execution. The technique is simple: show the victim a fake verification page, place a command on the clipboard, and convince them to paste it into the Windows Run dialog. | Malware blog | Flare |
|
7.10.26 |
IronChain Ransomware Raises Business Data Loss Risk | During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of how a cyber incident can become a business continuity issue. IronChain shows why. It puts business-critical data at risk of permanent loss and can bring operations to a halt. | Ransom blog | ANYRUN BLOG |
|
7.10.26 |
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | In September, the Huntress agent was deployed on an organization that had been hit by an Akira ransomware attack. The post-compromise agent deployment limited Huntress visibility into critical pieces of evidence. | Ransom blog | Huntress |
|
7.10.26 |
Super Intelligence: The Rise of Super-Intelligent Threats | On September 29, 2026, the White House signed an executive order replacing the term "Artificial Intelligence" with "Super Intelligence" across the U.S. executive branch. The stated reasoning is that "Super Intelligence" better conveys "the true capabilities of the technologies being developed today", not merely imitating or automating human intelligence, but empowering citizens “to achieve what was previously impossible.” | AI blog | SEKOIA |
|
7.10.26 |
CVE-2026-88771: Citrix NetScaler Zero-Day Attack Clusters | As early as the beginning of September 2026, eSentire's Threat Response Unit (TRU) observed multiple threat actor clusters exploiting CVE-2026-88771, a zero-day vulnerability later disclosed in Citrix's September 27, 2026 security bulletin CTX697096. | Vulnerebility blog | eSentire |
|
6.10.26 |
47-Day TLS Certificates: 5 Steps to Prepare | Somewhere in your organization is a spreadsheet of certificate expiry dates, and someone who owns it. That is not a caricature. DigiCert’s 2026 research with Omdia surveyed more than 400 senior IT leaders and found that 47% still rely on manual tracking methods such as spreadsheets, and only 34% have a complete, current view of what they hold. | Security blog | Imperva |
|
6.10.26 |
Harvest Now, Decrypt Later: End-to-End PQC TLS | Somewhere, an attacker is recording your encrypted traffic. Not breaking it. Recording it. The bet is patient and simple: store ciphertext today, wait for quantum computers to mature, decrypt at leisure. The industry calls it harvest now, decrypt later (HNDL), and it is the rare security threat with a believable deadline attached: data with a ten-year shelf life, encrypted with algorithms on a countdown. | Security blog | Imperva |
|
6.10.26 |
New Remote DoS Attacks Against GraphQL Java | Imperva Threat Research identified a series of remote denial‑of‑service vulnerabilities in GraphQL Java, one of the most widely used libraries for GraphQL in the Java ecosystem. | Attack blog | Imperva |
|
6.10.26 |
The Hidden DoS Vector in SQL Parsers | SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. | Attack blog | Imperva |
|
6.10.26 |
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage | This article explains how Elastic SIEM uses a monthly automated telemetry pipeline to score prebuilt detection rules across noise, performance, threat, and profile dimensions, helping security teams decide which rules to enable first. | Spam blog | Elastic Security Labs |
|
6.10.26 |
Machine-speed attacks require machine-speed prevention and detection | Artificial intelligence (AI) is transforming the way cyberattacks are handled. Reconnaissance has become faster, phishing is more convincing, and vulnerabilities are identified and exploited sooner, and after initial access, automation can accelerate privilege escalation, lateral movement, and data theft. | Hacking blog | Threatlocker |
|
6.10.26 |
IQUALIF Leak, IUT Breach, SMTP Dump and Struts Exploit | SOCRadar Dark Web Team identified several new underground posts, including an alleged IQUALIF-based French residential data leak, an alleged breach affecting IUT Paris Seine, and an alleged initial access auction for a U.S. manufacturing company. Other posts advertised an alleged 19 million SMTP credential dump and access to servers reportedly compromised through CVE-2017-5638. | Exploit blog | SOCRADAR |
|
6.10.26 |
FortiMail Zero-Day Under Active Exploitation | Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live. | Exploit blog | SOCRADAR |
|
6.10.26 |
CVE-2026-90970: GitLab AI Gateway RCE | GitLab has patched CVE-2026-90970, a critical vulnerability in the Self-Hosted AI Gateway that can allow an authenticated user with Duo Agent Platform access to execute arbitrary commands on the gateway. | Vulnerebility blog | SOCRADAR |
|
6.10.26 |
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure | How ClingSTUN combines vulnerability exploitation, persistence, and STUN-assisted connectivity on Linux devices | Malware blog | FortiGuard Labs |
|
3.10.26 |
AI-Enabled Cyber Attacks: What They Are and How to Defend Against Them | AI-enabled cyber attacks are malicious operations in which adversaries use AI, most often large language models (LLMs), to plan, carry out, or scale any part of an attack. That includes writing phishing lures and deepfake pretexts, developing and debugging malware, discovering and exploiting vulnerabilities, and running intrusions end to end. | AI blog | PICUSSECURITY |
|
3.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | BotNet blog | CROWDSEC |
|
3.10.26 |
AI-Agentic attacks Optimized Operations | AI is changing cyberattacks from isolated activities into connected operations that require a new level of speed, context, and understanding. | AI blog | WatchGuard Blog |
|
3.10.26 |
PolinRider is A/B Testing its Way Past Your Detections | We've seen fa-solid-400.woff2 become 500 and 900, change from .woff2 to .llf files, move folders, and drop its whitespace padding. | Malware blog | OpenSource Malware Blog |
|
3.10.26 |
Prompt Forcing: The Scarier Sibling of Prompt Injection | Breaking down a newly discovered prompt attack technique that isn't prompt injection. | AI blog | Forever Security |
|
3.10.26 |
Introducing the SysQL Skill: Ask your security graph anything | Dashboards answer the questions someone already decided to build a screen for. Every other question — the one a new CVE just made urgent, or the one no vendor anticipated — waits until someone writes a report or files a ticket. | Vulnerebility blog | Sysdig |
|
3.10.26 |
Swarming Against Citrix 0-Day Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | AI blog | GREYNOISE |
|
3.10.26 |
Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets | GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. These forged automated scanners have been observed requesting files often exposed on misconfigured web servers and by other commonly leaked secret and credential methods. | AI blog | GREYNOISE |
|
3.10.26 |
Separating Signal from Slop: Triaging CVEs in the Age of… | Tools that can read a codebase, identify a vulnerability, and generate a working proof-of-concept have lowered the skill floor for vulnerability research. They also produce a wave of bugs that look terrifying on paper (remote code execution, popular software, no authentication,) yet they often depend on a configuration rarely enabled in real deployments. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
One Port to Root: Weaponizing Check Point Management… | The Check Point management server is the brain of a Check Point firewall estate: it holds the policy every gateway enforces, the administrator credentials, and the certificate authority the whole deployment trusts. A flaw already used in real attacks lets anyone who can reach that server take it over completely without logging in. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
AI-Assisted Attacks Still Leave a Behavioral Trace | AI is increasingly being used to accelerate cyber-attacks, but attackers still leave detectable behavioral traces. This blog explores how Darktrace identified suspicious file delivery, command-and-control communications, beaconing activity, and other anomalies linked to AI-assisted campaigns through behavioral analysis. | AI blog | DARKTRACE |
|
3.10.26 |
DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm - Real-time Open Source Software Supply Chain Security | Nine npm packages hide a self-spreading Linux worm. The npm account dirtyblanket published all nine on September 29, 2026, in 33 minutes. Eight of them copy the popular Express framework. One copies React. | Malware blog | SAFEDEP.IO |
|
3.10.26 |
PolinRider Switches to Ethereum C2 in 30+ Repositories - Real-time Open Source Software Supply Chain Security | The PolinRider loader family has a new way to find its command and control (C2) servers. It reads Ethereum mainnet and looks for small transactions from an operator wallet. The recipient address of each transaction holds the IP address of a C2 server. SafeDep found two operator wallets that use this method. One wallet has sent a transaction about every 51 minutes since 2026-06-23. | Cryptocurrency blog | NETCRAFT |
|
3.10.26 |
'Super Intelligence' Executive Order Fuels Nearly Hundredfold Increase in .si Domain Registrations | We previously reported that registrations of Slovenian .si domains overtook .ai in the 25 hours after President Trump told the UN General Assembly on September 22 that the U.S. would call AI “super intelligence” (SI). | AI blog | NETCRAFT |
|
3.10.26 |
FinCEN Moves to Cut the A7 Network's Sub-Agents Off From the US Financial System | FinCEN issued a finding and NPRM today identifying transactions involving any non-US company controlled by the A7 Network, which the agency calls "Sub-Agents," as a class of transactions of primary money laundering concern. The proposed rule would prohibit every covered US financial institution from sending or receiving funds or crypto involving a Sub-Agent. | AI blog | TRM Labs |
|
3.10.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | OS Blog | IDNSEC |
|
3.10.26 |
CVE-2026-86950: The Great Glyph Grift | Apple recently released iOS 26.7.1 to fix a bug in CoreGraphics (CVE-2026-86950). The security advisory stated that the vulnerability was reported by Meta Product Security and "may have been exploited in an extremely sophisticated attack against specific targeted individuals." For those who are unfamiliar with Apple’s English dialect, it means that the bug was actually exploited in the wild. | Vulnerebility blog | Calif |
|
3.10.26 |
Crypto Scam Extensions Masquerade as High-Profile Investors | LayerX security researchers (now part of Akamai) uncovered a campaign of nearly 30 malicious browser extensions designed to scam cryptocurrency investors by masquerading as legitimate, high-profile financial and/or cryptocurrency investors such as Warren Buffett, Andy Kreiger, Thomas Bulkowski, and others. | Spam blog | Akamai |
|
3.10.26 |
When Productivity Extensions Become Attack Platforms | LayerX Research (now part of Akamai) discovered a coordinated campaign of 32 malicious browser extensions across the Chrome Web Store and Microsoft Edge Add-ons Store, affecting more than 6,150 users. | Security blog | Akamai |
|
3.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | Software supply chain security has a well-defined starting line. It has no finish line, even though most programs are built as if it does. | Cyber blog | JSCRAMBLE |
|
3.10.26 |
Aligning AI Speed with AI Trust: AI Agent Security Insights for CISOs and Security Leaders | AI agent security is the practice of governing two separate things: what an autonomous AI system is allowed to reach, and what it is allowed to do. Most enterprises have built a program for the first one. Almost nobody has built one for the second, and that's where the losses are starting to show up. | AI blog | Morphisec Blog |
|
3.10.26 |
From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat | RATHat's Android malware remained largely static from late 2025 to September 2026, while its Command-and-Control (C2) panel was replaced entirely and went through three generations in six months, rebranded from BlackCat to Panda Workshop. | Malware blog | Cleafy |
|
3.10.26 |
TIKTOUK: Tracing a WordPress Credential Collection Toolkit | TIKTOUK brings together WordPress probing, collection of exposed configuration data, recovery of encrypted email credentials, and JavaScript secret scanning. Its two Python components and Go-based Linux crawler turn website responses into structured results for a central hub: an HTTP service that distributes target tasks and receives collected data and status reports. | Hacking blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators | CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Citrix and security researchers have already documented the vulnerability and its underlying exploitation mechanism. This analysis focuses instead on exploitation activity identified by LevelBlue's Threat Hunt Operations & Research (THOR) team while hunting across multiple customer environments. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler Zero-Day Exploited Globally | On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the Known Exploited Vulnerabilities (KEV) list. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Hackers exploit FortiMail zero-day before a patch exists | Fortinet says attackers are already exploiting a critical flaw in FortiMail, its email security gateway, and the fixed software has not shipped yet. The bug, tracked as CVE-2026-104286 and rated 9.8 on CVSS v3, lets an attacker with no login write arbitrary files to the appliance using crafted HTTP or HTTPS requests. Fortinet rates its impact as executing unauthorized code or commands. | Vulnerebility blog | IntelFusions |
|
3.10.26 |
Introducing Cloudflare Basin: an open, serverless data platform, now generally available | During Birthday Week 2025, we announced the Cloudflare Data Platform, a suite of products that ingest, store, and query your analytical data. Today, we’re announcing that the platform is generally available, and we’re giving it a new name: Cloudflare Basin. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Introducing Clef: our open-source decision models, and new RL fine-tuning platform | Over the last few weeks, there has been lots of buzz around decision models such as Typesafe AI’s Jev System One model. While classifier models have been around for some time, Jev introduces a new decision model concept into the world of AI — a model that produces bounded structured outputs cheaply, quickly and consistently that can be added into a workflow when a decision is required. | AI blog | CLOUDFLARE |
|
3.10.26 |
One year later: Sovereign AI and the fight for choice | It's Birthday Week, when we traditionally ship presents to the Internet. This year, two of them come from Europe: EuroLLM, which covers all 24 official EU languages, and Apertus, Switzerland's fully open model, trained on more than 1,500 languages. Both were built by public universities and research institutions. Both are coming to Workers AI, and you can request access today. | AI blog | CLOUDFLARE |
|
3.10.26 |
Introducing Workers KV Instant — powered by Quicksilver | Today, we’re introducing Workers KV Instant, a new mode for Workers KV that pushes your changes globally for instant availability without cold read penalties. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cloudflare OS: your company’s agent workspace, managed for you | Cloudflare OS gives everyone in your organization an agent workspace that knows how your company works and connects to its data and systems. Today, we're opening the waitlist for fully managed Cloudflare OS deployments. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Announcing Cloudflare K2: serverless event streams | With traditional Remote Procedure Call (RPC) architectures, there exists a core challenge: producers and consumers must align in scale and in time. If your producers send too much data for your consumers to handle or if your consumers or downstream services become unavailable, events are dropped. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
We want you to build the next Git platform on Cloudflare | GitHub was built for a world where humans write code, organize it into repositories, and collaborate through branches, commits, issues, and pull requests. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
AI Search is now generally available | Cloudflare’s AI Search combines Workers AI, Vectorize, R2, and Browser Run into a fully managed index and retrieval pipeline. Since we launched AI Search over a year ago, we’ve seen developers use it to power a wide range of search use cases, from searching internal documentation to powering search for their websites. We use AI Search ourselves to power search on our own blog and developer docs. | AI blog | CLOUDFLARE |
|
3.10.26 |
Support for modern cryptographic algorithms in Workers | Today, Cloudflare Workers is adding support for post-quantum-resistant algorithms within Web Crypto. These are defined in Modern Algorithms in the Web Cryptography API draft community group report, and include: | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cloudflare Impact reaches $100 million in donations | This week, Cloudflare's Impact programs will reach $100 million in donated services. It's a significant milestone, and one that we are proud of because it means that thousands of organizations, like journalism outlets, civil society, state and local governments, election management bodies, and public schools are being protected from cyberattacks. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cut your AI spend with AI Gateway's Auto Router | From our conversations with companies at every stage of their AI adoption journey, we've seen some common patterns. First, there is an exploration period as you bring on every new tool, dole out API keys freely, and let the tokens flow. Then, you converge on the canonical tools for your organization for agentic coding, for non-technical workflows, for running and deploying agents. | AI blog | CLOUDFLARE |
|
3.10.26 |
Detect and send production issues straight to your agent | As agents help us build more complex applications, both humans and agents need a better way to stay on top of what goes wrong in production. Coding agents can already query observability data, navigate a repository, change code, write tests, and open a pull request. | AI blog | CLOUDFLARE |
|
3.10.26 |
Simplifying domains for people and agents | You just thought of your next great idea, and buying the right domain feels like the easiest way to make that first bit of progress. Naturally, you open a new tab in your browser, only to find yourself face-to-face with an experience that feels like a budget airline peppering you with add-ons at checkout: Want security? How about a website? Do you want email? You’re just a few minutes into building your next idea, and it doesn’t feel fun anymore. | AI blog | CLOUDFLARE |
|
3.10.26 |
Monetization Gateway beta: charge AI agents for consumption with HTTP 402 | Today, we’re making the Cloudflare Monetization Gateway available as part of a closed beta, and showcasing four customer use cases that are in production today. Since we announced the plan three months ago, we have been working closely with our customers to make the Gateway fast, flexible, and easy to use. | AI blog | CLOUDFLARE |
|
3.10.26 |
Pay Per Use: when AI uses your work, you should get paid | AI answer engines read a publisher’s page and hand the reader a summary, so the visit, and the revenue that would come with it, never happens. Most publishers will never sign a licensing deal with the companies that use their work in AI products, and no company can negotiate with millions of sites. The web needs a way to say “yes, if you pay.” Pay Per Use is one way to say it, and it's now in beta. | AI blog | CLOUDFLARE |
|
3.10.26 |
Spetsvuzavtomatika Leak Exposes an SVR Cyber Development Ecosystem | The Spetsvuzavtomatika leak found on the darknet exposes a broad Russian cyber research and development program, with seven named projects defining its work. Two of the projects, Felix-23 and HAD, focus on target discovery, scanning, enrichment, and active testing. Another project, Putnik, supports internal-network access and credential theft. | CyberCrime blog | DomainTools Investigations |
|
3.10.26 |
AI Security Strategy: 6 Steps for CISOs | Security teams are used to vetting technology before it arrives. With AI, it was already everywhere before anyone asked them. | AI blog | Abnormal AI |
|
3.10.26 |
Signatures Are the Floor, Not the Ceiling | See why signature-based detection struggles against AI-generated attacks and how behavioral AI uses embeddings to detect novel threats without relying on known indicators. | AI blog | Abnormal AI |
|
3.10.26 |
How Behavioral AI Detects Threats That Look Normal | Attackers are no longer breaking in but blending in, mimicking normal behavior to breach organizations. A founding Abnormal AI engineer explains why we bet on behavioral AI to stop attackers walking through the front door. | AI blog | Abnormal AI |
|
3.10.26 |
XCTDH Adopts Hash Hiding | A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically encoded in Ethereum transaction destination addresses. | Cryptocurrency blog | Ransom-ISAC |
|
3.10.26 |
September 2026 Security Release | An attacker-controlled, allow-listed remote URL can lead to Server-Side Request Forgery (for example to private IP ranges) during Image Optimization. If no images.remotePatterns are configured, your application is not affected. | Security blog | Next.js |
|
3.10.26 |
Beyond Model Alignment: Securing Every Layer of the AI Agent | Alignment makes a model well-intentioned, but it can’t secure the harness, tools, and data an agent touches in production. Real agent security means governing every layer with enforcement the agent itself can’t switch off. | AI blog | Trend Micro |
|
3.10.26 |
ShinyHunters Returns to PeopleSoft With a One-Character WAF Bypass | ShinyHunters is once again exploiting a previously patched vulnerability in PeopleSoft, which we analyzed in June 2026. | Incident blog | Trend Micro |
|
3.10.26 |
Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes | Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise. | Malware blog | StepSecurity |
|
3.10.26 |
Managing Agentic AI: Why the Control Plane Problem Is an AI Problem | On one hand, it’s somewhat befuddling how often people may need that reminder. In reality, it is not that they don’t know that happy mantra, it’s that they struggle to gain the requisite visibility into … everything in their IT and OT environments. | AI blog | GUIDESECURITY |
|
3.10.26 |
Cloud Security Assessments: Set the Right Cadence | While cloud practitioners are accustomed to their fast-moving environments, it’s still common practice to move on to the next priority after the cloud assessment report is delivered and the major findings get remediated. | Cyber blog | GUIDESECURITY |
|
3.10.26 |
New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles | The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs. | Cyber blog | RAPID7 |
|
3.10.26 |
Why One-Time Approval Fails for AI Agent Skills | A review answers one question, once: is this skill, MCP server or plugin allowed in? It never asks again, whether it took six weeks in a ticket queue or six minutes in a governance tool. | AI blog | Manifold |
|
3.10.26 |
Spanish Carding Tutorial: How Fraudsters Think | A 2,200-word tutorial titled “Complete Guide to Carding in Spain (2026)” appeared on the Carder Market forum in April 2026. It is exactly what it sounds like: a beginner’s playbook for credit card fraud targeting the Spanish market, complete with entry fees, expected returns, and step-by-step operational workflows (we are holding back specific names and techniques to execute attacks to prevent these from falling into those with malicious intentions). | CyberCrime blog | FLARE.IO |
|
3.10.26 |
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) | On Wednesday, September 30, Cisco dropped an out-of-band security advisory highlighting CVE-2026-76504, a brand new critical authentication bypass in the SD-WAN vManage line of products that was disclosed as an exploited zero-day vulnerability. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
JCTables for Joomla: When "Already Escaped" Means Injectable | Today VulnCheck is disclosing CVE-2026-76570, an unauthenticated arbitrary SQL read and write in JCTables, the Joomla data-table component published by JoomCode, that chains to remote code execution as the web user. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
CVE-2026-86950: Apple CoreGraphics Zero-Day | Apple has issued an urgent security patch for CVE-2026-86950, a critical zero-day out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution via malicious files. Exploited in targeted, highly sophisticated attacks against specific individuals, this flaw presents an immediate threat across affected Apple platforms. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
CVE-2026-76504: Cisco SD-WAN Flaw Exploited | Cisco has disclosed CVE-2026-76504, a critical authentication bypass vulnerability in Catalyst SD-WAN Manager, formerly known as vManage. The flaw allows an unauthenticated remote attacker to access the management API with administrator privileges. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
TeamViewer Fixes Five Remote Access Flaws | TeamViewer has patched five high-severity vulnerabilities in its Full Client and Host applications for Windows, Linux, and macOS. The flaws include local privilege escalation, potential code execution, and remote session access control bypass. The company strongly recommends that all users update to the latest available version as soon as possible. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
Gotta Breach 'Em All! The Journey Of ShinyHunters | ShinyHunters has outlasted forum takedowns, multiple arrests, and its own founders' convictions. This report traces six years of activity and tactical evolution. From stolen S3 buckets to zero-day exploits, we attempted to explain why the brand keeps surviving what should have ended it. | Cyber blog | SEKOIA |
|
3.10.26 |
The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers | TL;DR: Frontier AI has collapsed the vulnerability exploit window from weeks to mere hours. Attackers now use advanced AI models to reverse-engineer published fixes and generate working exploits faster than human security teams can deploy updates. In the AI era, publishing a patch creates a blueprint for attackers. Surviving this threat requires vendors to tier sensitive disclosures and customers to treat patch application speed as a critical security metric. | AI blog | JFROG |
|
3.10.26 |
ANY.RUN's Threat Coverage Digest: September 2026 | September saw an expansion of detection coverage across network, file, and behavioral activity, providing analysts with additional visibility into suspicious activity. ANY.RUN added 76 behavior signatures, 16 YARA detections, and 1,098 Suricata rules, strengthening coverage across malware activity, suspicious files, and network communications. | Cyber blog | ANYRUN BLOG |
|
3.10.26 |
Copilot has the largest AI attack surface of any tool we tracked | Microsoft Copilot accounts for a disproportionate share of the AI footprint we track, and it’s barely being used. It’s a massive attack surface featuring a minuscule rate of activity. | AI blog | ThreatDown |
|
3.10.26 |
Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy | Milk Dragon, also known as NaiLong is an Adversary-in-the-Middle (AiTM) phishing kit active since October 2025. Unlike conventional phishing tactics that rely on fear and urgency, Milk Dragon lures victims with big discounts on consumer goods distributed via Facebook and TikTok marketplace advertisements. | Phishing blog | GROUP-IB |
|
3.10.26 |
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino | Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace clandestino único, mejorado con IA, para comercializar objetivos comprometidos en Iberoamérica y Latinoamérica. | Malware blog | GROUP-IB |
|
3.10.26 |
Your State’s Scam Reality: What New Research Reveals Across All 50 States | A package notification arrives, and we stop to check whether we actually ordered something. A recruiter reaches out about a job, but before replying, we research the person and the company. A bank alert appears, and instead of tapping the link, we open the banking app ourselves. | Spam blog | McAfee Blog |
|
3.10.26 |
ClickFix Attacks: How They Work and How CrowdStrike Stops Them | Consider this hypothetical scenario: An employee tries to join what looks like a routine video meeting. The page loads, but instead of the meeting, they see an error message along with a helpful fix: Copy the provided command, open the Windows Run dialog, paste it, and press Enter. | Hacking blog | CROWDSTRIKE |
|
3.10.26 |
CrowdStrike Expands Federal SOC Modernization via CISA-Funded SIEMaaS | Falcon Next-Gen SIEM is now part of CISA’s SIEMaaS technology stack, which gives eligible agencies a funded path to modernize security through the CDM DEFEND F shared service. | Cyber blog | CROWDSTRIKE |
|
3.10.26 |
CrowdStrike and NVIDIA Extend Security Across the AI Stack | CrowdStrike and NVIDIA are collaborating on the NVIDIA Open Agent Safety Platform, an open reference design to extend security deeper into the agentic stack and establish stronger boundaries for autonomous AI. | AI blog | CROWDSTRIKE |
|
3.10.26 |
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation | On September 27, 2026, Citrix disclosed eight vulnerabilities affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. Two of these vulnerabilities are critical (CVSS score of 9.5) and can allow an unauthenticated remote attacker to execute code: | Vulnerebility blog | SOPHOS |
|
3.10.26 |
TerminalFix and Lorem Ipsum Loader enable covert tunneling | The activity is linked to a broader campaign that previously used a different delivery mechanism | CyberCrime blog | SOPHOS |
|
3.10.26 |
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond. | AI blog | Google Cloud Blog |
|
3.10.26 |
NVIDIA and Eclypsium Partner for Trusted AI Infrastructure | AI agents are moving from answering questions to taking action. They can read sensitive data, call APIs, write and execute code, use external tools, and coordinate with other agents. In some environments, their decisions may affect physical systems. | AI blog | Trend Micro |
|
3.10.26 |
Inside DragonForce: How a Ransomware Cartel's Payload Actually Runs | DragonForce is a Ransomware-as-a-Service (RaaS) operation that first surfaced in mid-to-late 2023. It initially presented itself as a hacktivist collective before shifting to a profit-driven model. Early payloads were built on leaked LockBit 3.0 source code and later supplemented with code derived from the leaked Conti builder. | Ransom blog | Seqrite |
|
3.10.26 |
Telecom Attack Surface: SS7, BGP & Nation-State Intrusions | SS7 and BGP were built on trust. Here's how nation-state actors exploit that trust, and telecom routers, to stay inside carrier networks for years. | Hacking blog | Cyble |
|
3.10.26 |
Attack Surface Management 2026: Why Point-in-Time Scans Fail | Quarterly scans leave cloud exposures hidden for months. Learn why CISA and FBI data now make continuous attack surface management essential in 2026. | Cyber blog | Cyble |
|
3.10.26 |
Your IP, Their Traffic | You install an app that offers a reward, a premium feature or perhaps a little money in exchange for sharing some of your unused internet bandwidth. It sounds harmless enough. Your connection is idle most of the time anyway. | Cyber blog | GENDIGITAL |
|
3.10.26 |
Warlock Ransomware Attackers Hit Water and Telecom Operators | China-nexus group behind Warlock is still exploiting SharePoint vulnerabilities, attacking organizations in Portuguese and Spanish-speaking countries, hitting critical infrastructure, government, and education organizations. | Ransom blog | SECURITY.COM |
|
3.10.26 |
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 | Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled, without requiring authentication or user interaction. | Vulnerebility blog | Microsoft blog |
|
3.10.26 |
Phishing Abuses RMM Tools for Persistent Access | In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. | Phishing blog | Microsoft blog |
|
3.10.26 |
Safely Securing AI Agents | Learn of the benefits of safely securing AI agents. | AI blog | Trend Micro |
|
3.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
3.10.26 |
SmokeLoader Malware: A Modular Threat with Advanced Evasion and Persistence | This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of SmokeLoader malware. This is a modular program used by a variety of criminal and APT groups to gain a foothold on a system. It has vigorous anti-VM, anti-AV, and anti-analysis checks and capabilities. SmokeLoader can be used with RATs, ransomware, backdoors or botnets and uses both file and fileless methods of persistence. | Malware blog | SonicWall |
|
3.10.26 |
VioletRAT v6.5: From .NET Loader to In-Memory RAT — A Deep Dive into the Infection Chain | Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers VioletRAT v6.5 through a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, an obfuscated batch script, in-memory assembly loading, and process injection into Msbuild.exe before executing the final VioletRAT payload. | Malware blog | SonicWall |
|
3.10.26 |
OperTraitors: How Kubernetes Operators Betray Your Security Posture | Kubernetes operators are coded to drastically reduce operational toil by acting as automated site reliability engineers. However, their reliance on highly privileged service accounts introduces a severe, often overlooked security weak spot. | Hacking blog | Palo Alto |
|
3.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
3.10.26 |
The Fine Art of Frustrating the Adversary | For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation. | Cyber blog | CISCO TALOS |
|
3.10.26 |
Give yourself room to be human | Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. | Cyber blog | CISCO TALOS |
|
3.10.26 |
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor | Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts. | APT blog | CISCO TALOS |
|
3.10.26 |
Securing the keys to the kingdom: Announcing Executive Threat Detection | Attackers are using greater sophistication to gain access to high-yield targets like executives, and company-wide security measures can easily miss these subtle, personal attacks. | Cyber blog | CISCO TALOS |
|
3.10.26 |
Trust and the enticing consultancy offer | In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged access or knowledge of vulnerabilities in each employment or engagement. This trust is valued by those who require our services, but also by threat actors. | Vulnerebility blog | CISCO TALOS |
|
3.10.26 |
The Closed Quorum: Inside the first reported autonomous AI C2 implant | CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025. | AI blog | CISCO TALOS |
|
3.10.26 |
This month in security with Tony Anscombe – September 2026 edition | Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep pace | Cyber blog | Eset |
|
3.10.26 |
Timeshare exit scams: From fake buyers to recovery scams | Con artists are targeting timeshare owners who want out – and some victims are hit twice | Spam blog | Eset |
|
3.10.26 |
The devil is still in the email – but wearing a new mask | When phishing can increasingly pass familiar checks, avoiding or limiting the damage depends on how quickly your company can detect and contain the attack | Spam blog | Eset |
|
3.10.26 |
Is that new (vibe coded) app safe? 5 questions to ask first | As AI lets anyone build software, here’s how to vet that shiny new app before it exposes your data | Cyber blog | Eset |