cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Researchers say a path-parsing flaw and default ForgeRock admin credentials let them access customer accounts at two automakers and unlock and start authorized test cars. The U.S. systems were fixed about two hours after disclosure.
Acronis researchers say a Taiwan-based attacker used BOSSAI AI agents to access systems and collect data across several countries, including Taipei emergency dispatch records. A separate patient-data platform was exposed, but theft from it was not established.
Google DeepMind reports AI-assisted methods that reduce the cost of RSA-1024 signature forgery and repeated key factoring. The findings concern legacy 1024-bit systems; modern 2048-bit-or-larger keys remain secure, the researchers say.
QNAP reports exploitation of Plex2Shell, a four-flaw chain in Plex Media Server that can enable unauthenticated code execution. QNAP says some users’ servers appear compromised, reports no data loss, and advises updating and checking exposed devices.
Threat actors are reportedly exploiting SSHole (CVE-2026-123158), an OpenSSH authentication bypass affecting certain musl-based systems with PAM disabled. OpenSSH 10.6p2 patches the flaw; disabling password authentication is a mitigation.
CISA added SonicWall SonicOS flaw CVE-2026-19868 to its KEV catalog. SonicWall says valid credentials for an alternate authentication method may bypass SAML and enforced MFA; it investigated a potential exploitation report and urged customers to update.
AWS describes a multi-tenant EKS architecture that uses namespace-scoped mTLS gateways, NetworkPolicies, JWT validation, and managed TURN relay to secure protocols such as ADB and WebRTC, with reported ADB gateway latency below 50 ms.
A guide shows how to export Trellix Helix logs through its search API, prepare JSON events, and troubleshoot authentication, instance, query, and result-limit errors before reviewing the data in LogTotal.
A practical guide to exporting FortiSIEM events through its REST query API, polling for results, extracting raw log messages, and troubleshooting common export problems.
Apiiro researchers found 2,539 secrets across 1,994 public repositories containing Claude Code configuration files. They did not test credentials; one organization confirmed an exposed key was live.
The ITRC’s 2026 report finds unauthorized device access rose to 27.2% of reported identity compromises, while 25.6% of individuals contacting the center faced multiple incidents. Its findings describe patterns in identity misuse, recovery and prevention.
Ping Identity and Deloitte outline six 2026 IAM trends, including AI-agent identity, helpdesk and hiring fraud, decentralized identity, quantum-resistant cryptography and continuous verification, alongside global trust survey findings.
Guardsix describes a Day-One Detection Pack of 63 SIEM rules selected from its 622-rule library, covering common Windows, Active Directory, Microsoft 365 and Azure telemetry, with public YAML logic and a versioned deployment workflow.
Qualys says its expanded Global mROC Alliance brings mobile and OT, IoT, healthcare, and cyber-physical telemetry into Enterprise TruRisk Management for shared risk prioritization and remediation.
The roundup reports 20 exploitation attempts from 13 IPs against OpenSSH CVE-2026-123158 (SSHole), which can enable sign-ins to passwordless accounts on Linux systems using musl with PAM disabled, and lists other vulnerabilities.
Revolve told Indiana that 1,515,073 people were affected by a breach. The company says an intruder accessed some systems, and may have collected customer contact and payment-card details; the entry method remains unknown.
Iris Ohyama says a breach discovered October 28 may have exposed personal data of 7.7 million Iris Plaza customers and non-members. The platform remains offline as the company investigates and applies remediation.
Foreign Minister Antonio Tajani says his personal data was disseminated on the dark web and that he and his family face threats. Giorgia Meloni blamed pro-Russian hackers, but Tajani did not identify those responsible or specify what data was shared.
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
Bruce Schneier argues that increasingly autonomous AI can exploit underspecified goals and loopholes in software and broader systems, sometimes without malicious intent. He calls for safer AI, vulnerability defenses and more adaptable governance.
The explainer describes API-based model extraction, including Anthropic’s allegation that DeepSeek, Moonshot AI and MiniMax used 24,000 accounts for 16 million Claude exchanges, outlines technical limits, and reviews defenses.
A MalwareINFO Pro walkthrough traces an obfuscated JSE and encrypted PowerShell wrapper through recovered source, embedded PE files, and configured endpoint candidates, while distinguishing recovered artifacts from unobserved runtime behavior.
