Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3582 articles
A Citizen Lab–Confiant report says targeted ads in the AdFection technique delivered zero-click mercenary spyware, including Discover-Tech ads on government networks. Senators urged reform; ad groups disputed the report’s broader conclusions.
Gen describes a controlled test in which an AI agent followed malicious email instructions, alongside tools and testing guidelines intended to help secure agents. The sponsored article also reports malware and malicious skills targeting AI tools.
Microsoft says Windows Server 2016 will receive its final security update in January 2027, when extended support and Essentials features also end. It advises administrators to upgrade to Windows Server 2025.
Microsoft says Teams will begin rolling out AI-powered phishing detection in November 2026. The feature analyzes conversation context to identify suspicious behavior and will not retain message content for training or other uses.
Cyber insurers are expanding beyond annual underwriting, requiring controls such as MFA, EDR and immutable backups and offering security services. Experts say AI-driven threats and systemic cloud risks challenge historical loss models; NAIC data show US claims rose by 0
Gambit Security says an attacker used AI tools to target 105 e-commerce sites in five days, compromising at least 27 and stealing 600,000+ card records from two. In a Silverfort lab test, stronger access controls stopped an agent that reached domain control in eight min
Microsoft expanded Project Perception with agent discovery, separate identities, risk scoring and controls that can restrict or stop agents. Guardian Agent capabilities remain in limited use and preview, with experts raising concerns about interoperability and agentic-”
eMudhra will exit its global SSL/TLS business after a researcher recovered eight guessable intermediate CA keys. Chrome and Firefox distrusted affected certificates, prompting a transition for tens of thousands of certificates.
A New Mexico judge ordered Meta to pay $25 billion after a jury found Facebook made misleading statements about privacy and other practices. Meta says it expects to win on appeal.
A New Mexico court ordered Meta to pay $25 billion over more than 43 million state unfair-practices violations tied to consumer privacy. Meta criticized the penalty and plans to appeal.
An actor using the handle “Madrex” advertised Spectator Loader as a persistent malware loader with anti-analysis and evasion features. The capabilities are based on the advertisement and remain unverified.
INTERPOL says Operation Serengeti III, conducted across 21 countries from June 29 to August 31, 2026, disrupted 10,909 malicious networks, arrested 1,462 suspects and recovered more than $105 million in illicit funds.
Cloudflare says it obtained South Korea’s ISMS certification after a KISA-appointed audit. It describes localized consent requirements, audited data flows and access controls, and a service-boundary approach to defining certificate coverage.
Industrial cybersecurity firm Indurex raised €7 million, about $7.84 million, to fund R&D and expand commercial operations in Europe and the Middle East. Its SafeGuard AI platform analyzes industrial and security data to flag anomalies and configuration changes.
CISA, the Canadian Centre for Cyber Security, and partners issued guidance on managing AI token use to reduce cost and availability risks, prepare for service disruptions, and protect cyber defense workflows.
Two Chicago lawsuits allege Coco Robotics and Serve Robotics delivery bots collected customers’ face and hand data without consent, potentially violating Illinois’ biometric privacy law. Both companies dispute the allegations.
Oracle’s October 2026 Critical Patch Update includes 1,295 fixes addressing 1,209 unique CVEs, according to Tenable. Oracle did not flag any of the vulnerabilities as exploited in the wild.
A New Mexico judge ordered Meta to pay $25 billion after a jury found it liable for misleading users about Facebook privacy. The case involved data harvested from roughly 87 million profiles and sold to Cambridge Analytica; Meta plans to appeal.
Aikido reports that eight eMudhra intermediate CA private keys were recoverable because they were smaller than 256, including one equal to 4. Browsers have blocked the certificates, but other trust stores may need updates; the article says attacker use is unknown.
Some insurers now offer AI-specific coverage, while others exclude risks involving generative AI and autonomous systems. The article advises enterprises to review policy language and strengthen AI controls, including permissions, monitoring and supply-chain security.
The article links AI-assisted vulnerability research and attacks, reporting PHP vulnerability scanning, JPCERT/CC findings in Japan, and Microsoft’s account of Storm-0940 using ARTEX. It stresses that scanning and failed logons alone do not prove compromise.
INTERPOL reported 1,462 arrests and 10,909 networks disrupted in Operation Serengeti III, with over $105 million recovered. Team Cymru says infrastructure intelligence supported investigations; INTERPOL’s 2026 assessment links AI to 55% of reported cybercrime in Africa.
Under OMB Memorandum M-26-15, U.S. federal agencies must submit risk-prioritized post-quantum migration plans and identify legacy systems for priority replacement or decommissioning. The article compares Asian approaches and urges CISOs to set retirement dates.
The Information reported that Datadog may buy cloud security firm Upwind for $4 billion. The companies did not immediately comment; Upwind could instead pursue a reported $300 million funding round.
