Windows Server 2025 Adds Quick Machine Recovery Support
Microsoft added quick machine recovery to Windows Server 2025 with the October 2026 security update, letting admins enable cloud-sourced fixes for critical boot failures through Group Policy.
Security News
Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3582 articles
Man Sentenced to Eight Years for Spearphishing Tax Firms and Stealing $3.3 Million
Chukwuemeka Amachukwu was sentenced to eight years in prison after pleading guilty to a scheme involving spearphishing attacks on U.S. tax preparation businesses and more than $3 million in fraudulent tax and loan proceeds.
DHS Orders Federal Civilian Agencies to Remove DeepSeek Products
DHS ordered federal civilian agencies to stop procuring and remove DeepSeek products and derivatives, citing risks including potential access to sensitive data. The order does not cover private or consumer use.
Iru Adds More Controls for Managing Apple OS Updates
Iru’s Managed OS updates add up to 90-day delays, phased rollouts, beta enforcement, separate schedules for minor and major updates, and hardware compatibility checks for Apple devices.
Colorado County Systems Disruption Threatens Services; Ransomware Link Unconfirmed
Colorado County warned that a disruption to government systems threatened essential services. A NightSpire listing for “Colorado Texas” on ransomware[.]live may be related, but officials have not confirmed a cyberattack or the connection.
Plex2Shell Exploitation Deploys Crypto Miners and a Linux Proxy Backdoor
Attackers reportedly exploited the Plex2Shell vulnerability chain to deploy a crypto miner and Linux proxy backdoor. Plex patched the flaws in August; exploitation attempts were observed after technical details went public in October.
Feds Suspect Ransom Negotiator Helped ShinyHunters Run Extortion Site
KrebsOnSecurity reports that investigators suspect a U.S. consulting executive helped ShinyHunters operate its extortion site. Messages from an arrested hacker allegedly linked ransomware negotiators to the group; the claims remain under investigation.
ConnectWise Suspends Cloud Backup After Unauthorized Access to Application Identities
ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors gained unauthorized access and compromised Microsoft 365 tenants. The weekly recap also lists numerous trending CVEs, but gives little detail on them.
Microsoft Announces New Controls to Secure AI Agents
Microsoft announced agent discovery, identity, task-scoped permissions, dynamic risk controls, and Guardian Agents to help organizations monitor and contain AI agents as their behavior and risk change.
Fake Web3 Accelerator Uses npm Packages to Deliver Malware and Hijack AI-Agent Traffic
A fake Web3 accelerator used malicious npm packages to deliver Windows and macOS malware and redirect AI-agent traffic, exposing prompts, conversation history, code, and tool outputs to attacker-controlled services.
MITRE ATT&CK v20 Adds AI Abuse, MFA Bypass and Water Utility Attacks
MITRE ATT&CK v20 adds coverage of AI abuse, MFA bypass, attacks on water utilities, threat actors and mobile malware, alongside 15 new detection strategies backed by 38 analytics.
Anthropic Acquires Confidential AI Startup Opaque Systems
Anthropic acquired Opaque Systems, whose technology supports confidential and verifiable AI. Opaque says its team is joining Anthropic and its operations are winding down; it has not explained what this means for existing customers.
Drata and Aikido Add AI Pentesting to Compliance Workflows
Drata and Aikido announced an offer giving eligible new Drata customers up to $4,000 in Aikido AI Pentest credits. Findings sync to Drata, and the pentest includes six months of unlimited retesting.
RemControl Expands Android Banking Fraud Capabilities
Zimperium reports that its investigation uncovered RemControl, an Android banking trojan with remote-control, credential-theft and information-interception capabilities that can support financial fraud.
BigBear 2.0 PhaaS Operation Targeted Organizations in More Than 40 Countries
CloudSEK identified a Microsoft 365 phishing operation targeting organizations in more than 40 countries. An infrastructure analysis linked its indicators to additional domains and IPs, while researchers caution that some flagged entities may be benign.
DHS Orders Federal Civilian Agencies to Remove DeepSeek Products
DHS ordered federal civilian agencies to remove DeepSeek products and barred the company and affiliates from agency contracts, citing potential risks to sensitive data and agency networks. Agencies have 60 days to request exceptions.
Transmit Security Names Matt Thompson CEO to Lead Agent-Trust Push
Transmit Security appointed Matt Thompson as CEO to expand its identity platform toward agent-trust infrastructure, including distinguishing human from agent traffic and governing agent authorization. Thompson says the technology is deployed at major financial firms.
Citizen Lab Reports Spyware Delivered Through Targeted Online Ads Without User Interaction
Citizen Lab says Discover-Tech’s targeted ads helped Candiru spyware reach at least 45 Al-Jazeera devices. The researchers describe a zero-click ad-delivery technique and report that several ad platforms cut off Discover-Tech.
Wyden Urges Federal Agencies to Adopt Encryption to Protect Sensitive Website Visits
Sen. Ron Wyden urged CISA and OMB to require Encrypted Client Hello for federal websites and certain contractors, saying at least 350 agency sites lack the protection for sensitive web traffic.
Copyright Takedown Data May Reveal Compromised Websites
UpGuard’s Greg Pollock says copyright takedown notices can provide a historical signal of websites manipulated to promote adult content. The notices are not real-time detection, but may help investigate past compromises across vendors.
DHS Orders Civilian Agencies to Remove DeepSeek Products Over Security Concerns
DHS ordered civilian federal agencies to stop procuring DeepSeek products and remove existing deployments, citing risks including data collection and potential exposure of sensitive information to China. Agencies are encouraged to monitor traffic and strengthen controls
Microsoft Says October Windows Server Updates Can Disrupt Exchange Sign-In and Email
Microsoft says October 2026 Windows Server security updates can disrupt Exchange sign-in, email delivery, and mailbox replication on some systems. It advises against uninstalling the updates and provides a registry workaround while developing a fix.
Underground Sellers Offer Deepfakes and Support to Bypass KYC Checks
Flare reports that underground sellers advertise fake identity packages, altered images and videos, live verification help, and account-recovery support to bypass KYC checks. The article outlines detection measures recommended by FinCEN and NIST.
October Briefing Covers AI Security, Privacy Rules and FCC Supply-Chain Controls
The roundup covers new EU AI quality-management standards, European privacy guidance, U.S. FCC supply-chain and marketplace rules, financial-sector AI practices, neurodata governance, and Anthropic tests of AI-model replication on IoT devices.