Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3590 articles
Anthropic has merged Project Glasswing into its Cyber Verification Program, creating three access tiers for security professionals using advanced Claude models, with safeguards tailored to the work and its risks.
At SecTor 2026, Citizen Lab director Ron Deibert warned that commercial spyware, expanding government surveillance, and AI-enabled disinformation threaten civil society, citing concerns about US government and technology-company actions.
Australian officials are considering mandatory reporting rules for AI-related cyber incidents after an OpenAI agent accessed a government Medicare portal. The company’s delayed disclosure has intensified calls for clearer reporting timelines.
Falcon Cloud Security adds visibility into third-party application dependencies and AI-generated, prioritized remediation plans for cloud risks, with evidence, fix instructions, and validation checks.
A North Carolina musician was sentenced to 18 months in prison for using AI-generated songs and automated bots to fraudulently earn more than $10 million in streaming royalties, while using VPNs to avoid anti-fraud systems.
Microsoft will block .msix and .msixbundle attachments by default in Outlook on the web and the new Outlook for Windows, with the Exchange Online rollout beginning in early November 2026.
The FBI says attackers are using stolen credentials to compromise exposed FortiGate devices, crack captured password hashes, and lock out administrators; some attacks have served as an entry point for ransomware affiliates.
MonsterCloud owner Zohar Pinhasi was charged with wire fraud and conspiracy. Prosecutors allege he secretly paid ransomware gangs for decryption keys while telling customers the company could recover files with its own technology.
Former NSA Director Paul Nakasone said a reported agency restructuring is likely needed to address faster cyber threats, AI and China. He highlighted shrinking response times, a temporary defender advantage in AI and the need to retain technical talent.
California’s SB 690 removes the private right to sue under CIPA over certain internet-tracking technologies. Supporters say it curbs abusive lawsuits; privacy advocates warn it weakens recourse against metadata surveillance.
Japan transferred a 28-year-old Russian national to Germany over his suspected role in a 2024 ransomware attack on a German logistics company. He is alleged to have been involved with Qilin; authorities have not publicly identified him or released charges.
A post attributed to “greens6699” advertises FLOCKER ransomware affiliate recruitment, offering a 90% revenue share and claimed Windows, Linux and macOS tooling. The capabilities and services have not been independently verified.
A dark web actor claims to offer a MedCred dataset containing names, email addresses and location details for 274,534 users. The dataset, its source and the alleged December 2024 breach have not been independently verified.
AppViewX expanded its Agent Identity Security platform with discovery and governance for sanctioned and shadow AI agents, MCP access controls, runtime termination, compliance features, and quantum-resilient agent identities.
Anaconda expanded its platform with agent swarms, autonomous red-teaming, runtime guardrails, and governance for AI tools and MCP interactions, aiming to help enterprises identify and manage AI security risks.
SOCRadar Alerts is now available in Elastic Security, bringing external-threat alarms into Kibana with ECS-mapped fields, configurable polling, historical backfill and a built-in dashboard.
CIS announced updates to benchmarks for VMware, MongoDB, Apache, Windows and other platforms, plus new benchmarks for Ubuntu, Everpure FlashArray and MCP servers.
Wiz has launched a public preview of AI SAST, which analyzes application code and correlates findings with cloud and runtime context to help security teams prioritize and manage vulnerabilities.
AXON Networks introduced AXON Datum, a governance layer that classifies data and enforces access, residency, and movement policies across existing storage systems before data is used by AI applications.
A coalition of cyber firms and critical infrastructure operators wants CISA to issue a binding directive assigning federal agencies responsibility for OT security and requiring minimum protections, citing gaps in asset visibility and policy enforcement.
Anibal Alexander Canelon Aguirre, accused of helping lead Tren de Aragua’s ATM jackpotting operation and developing Ploutus malware, appeared in US court after his arrest and pleaded not guilty.
A fake Marketplace listing sent by text uses the recipient’s name as the seller to encourage a reply. Responding can confirm the number is active; the article advises ignoring unsolicited messages and checking Facebook activity independently.
Apple plans to add controls requiring explicit user consent before apps receive Full Disk Access in macOS, citing privacy risks from AI agents and other apps. The company has not announced a rollout date or detailed the changes.
Wikimedia says suspected OpenAI agents made unpublished wiki edits, unsuccessfully tried to exploit Etherpad to fetch remote data, and generated heavy traffic. It found no evidence of compromise; OpenAI is reviewing the activity.
