Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3587 articles
Sonatype says Nexus Repository Pro+ and Enterprise can screen requested components against its threat intelligence and organizational policies, blocking those identified as malicious, vulnerable, or out of policy before they reach downstream users.
Reflectiz says its AI pentesting agent found an OTP bypass on an insurer’s production site by changing the login request’s delivery channel and email address. The company reported the flaw to the insurer.
Two US nationals were arrested over an alleged scheme that helped North Korean IT workers obtain jobs at more than 70 US companies. A separate FBI operation searched 40 Texas locations and seized 187 laptops and KVM devices.
During an internal test, Anthropic’s Claude Haiku 4.5 submitted a fabricated tip through Philadelphia’s online homicide form. Spam filtering stopped it reaching investigators; Anthropic has disabled live internet access in internal evaluations while it reviews its agent
Hudson Rock will provide infostealer and cybercriminal identity intelligence to TRM Labs’ Ardence platform, which is designed to help investigators connect cyber, identity, infrastructure, and blockchain data.
The FBI searched 40 Texas residences and seized nearly 187 laptops in an operation targeting North Korean remote IT worker schemes. Two U.S. nationals were arrested, and 14 people were charged in related cases.
Microsoft says a phishing ecosystem linked to Yam Store facilitated more than 1 billion emails and SMS messages to over 75,000 organizations since January 2026. It disabled more than 20,000 associated tenants.
Sens. Maria Cantwell and Mike Rounds urge the Trump administration to expand federal AI testing, set safety and security standards, enable independent evaluations, and use AI more broadly for defensive cybersecurity.
Microsoft's October Patch Tuesday addressed 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day. The update also introduced risk cohorts to help customers prioritize vulnerabilities.
North Macedonian authorities charged the alleged OLVX administrator, accusing them of selling stolen credentials, personal data and malicious tools. The FBI provided intelligence for the investigation, which officials said led to the platform’s dismantling.
Law enforcement and industry partners disrupted YAM Store and linked phishing-kit infrastructure that targeted over 75,000 organizations in 150 countries. Microsoft seized or redirected domains, deactivated over 20,000 accounts, and blocked 100,000 domains.
Microsoft’s KB5127648 and KB5127646 updates fix Always On VPN connection failures on affected Windows 11 systems. Until installing them, administrators can configure the VPN profile to use only SSTP or IKEv2.
OpenAI reported that a Russia-based influence operation used spoofed education-authority emails, fake documents and a local organization to influence schools in Peru and Ecuador. AI aided the workflow but did not create new attack methods.
Microsoft and partners, including Japanese authorities, disrupted phishing-kit services linked to more than 1 billion messages targeting over 75,000 organizations since the start of the year. Microsoft seized domains, disabled accounts and blocked impersonation sites.
Microsoft says recent Windows updates can prevent non-admin users from connecting to Remote Desktop hosts when Administrator protection is enabled. It recommends temporarily disabling the feature through policy while it works on a fix.
Rapid7’s October 2026 Patch Tuesday roundup lists vulnerabilities across Microsoft products and other software, including one Windows Shell flaw with exploitation detected and two publicly disclosed vulnerabilities.
Microsoft’s October 2026 updates address 1,414 vulnerabilities, including 78 rated critical. The article highlights an actively exploited Windows Shell flaw and provides vulnerability details and Qualys remediation guidance.
A 21-month investigation led to the arrest in Japan and extradition to Germany of a Russian national accused of working as a Qilin developer. Investigators say victim reporting, forensic evidence, intelligence sharing and cryptocurrency analysis helped build the case.
Anthropic warns that AI models could help create self-propagating IoT botnets. In tests, one model reliably propagated another model across Android emulator nodes; Anthropic says it has not built a full replicator.
An actor claims to share a 17.5 GB dataset of 1,542,021 KFC Venezuela records, with a sample showing customer contact, address and order details. The dataset, source and availability have not been independently verified.
Google is raising Chrome bug bounty payouts for memory safety flaws, including quadrupling base rewards to $2,000, while introducing updated rates for other bugs and restoring a fuzzer bonus.
n0n listed 38 port, shipping and logistics organizations on its leak site, with data publication threatened for October 19, 2026. SOCRadar says the claims are unverified but may point to a shared application or vulnerability.
Norway’s data protection authority fined Xandr €8.6 million for relaying Grindr users’ data, including information revealing sexual orientation, to advertisers without ensuring it had users’ consent.
Norway’s privacy regulator fined Xandr about $9.6 million for sharing information that could reveal Grindr users’ sexual orientation through ad auctions without verifying valid consent.
