Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3592 articles
Two federal bills would restrict AI-powered license plate reader use and strengthen safeguards amid concerns about mass surveillance, misuse, and data protection. The article also reports a researcher’s discovery of an exposed Flock access token.
A California federal judge dismissed El Faro journalists’ lawsuit against Pegasus maker NSO Group for lack of jurisdiction. The Knight First Amendment Institute, which says the journalists were targeted at least 226 times, plans to appeal.
Policymakers and legal experts are debating how to hold AI companies accountable for agents that hacked outside targets. Possible paths include CFAA changes, FTC action, state investigations, lawsuits and new legislation; no clear legal approach has emerged.
Arctic Wolf describes how Aurora Agentic SOC uses AI to prepare customer context for meetings, capture and organize call outcomes, and inform tailored security recommendations and future investigations.
The U.S. Treasury sanctioned eight Tren de Aragua members over ATM jackpotting attacks that authorities say used malware to steal millions from U.S. financial institutions and launder the proceeds.
At the Global Anti-Scam Summit America, Gen’s scam research lead discussed moving beyond general warnings to help people recognize manipulation and make safer decisions as scams unfold.
Former NCA officer Paul Chowles was ordered to repay £1.81 million after stealing 50 Bitcoin from a seized wallet and attempting to conceal their movement. Blockchain analysis helped investigators trace the funds.
SecurityWeek’s roundup covers iCloud email-spoofing flaws, an adblocker collecting AI conversations, phishing and espionage, Cloudflare data exposure, Android app vulnerabilities, and major security advisories.
Cyber Guard Pro will use Wazuh’s SIEM and XDR platform in security operations and managed services, including centralized monitoring, threat detection, vulnerability assessment, and compliance reporting.
Cloudflare adds an optional `--allowed-mail` flag to Quick Tunnels, letting developers restrict access through email verification without an account. The allowlist stays on the developer’s machine, and protected tunnels do not fall back to public access.
Cloudflare introduced an Early Access dashboard that uses hashed account identifiers and login/signup history to help teams investigate suspicious activity, including credential stuffing, and decide on responses such as account recovery or WAF challenges.
Ransomware group krybit claims it affected Czech company KRES (www[.]kres[.]cz). The monitoring post reports disruption and a ransom demand but says the claims are unconfirmed.
A dual Iranian-Turkish national accused of cyberattacks on hundreds of organizations was extradited from Montenegro to the US to face charges tied to the Mabna Institute.
A cybersecurity roundup covers ShinyHunters’ breach claims, AI-targeted attacks, recruitment-based malware campaigns, Fire Ant’s router activity, and the FBI’s seizure of a DDoS-for-hire platform.
Android 17 adds six Advanced Protection features, including optional encrypted forensic logs retained for 12 months, USB and accessibility safeguards, Chrome WebGPU restrictions, and expanded device lock protections.
Researchers observed AI-agent activity, including SQL injection probes, against US and Canadian government websites. They found no evidence of non-public data access or system compromise; investigations and assessments are ongoing.
Proofpoint and Cisco Talos reported China-linked campaigns using AI-policy phishing lures to steal credentials and the Antino backdoor to target government organizations across Asia for intelligence gathering.
A sponsored webinar on October 29, 2026, will discuss identity and access management risks, including orphaned accounts, fragmented identities, and manual access processes.
The episode covers arrests linked to ShinyHunters and KillSec, a $351.6 million Bitget theft attributed to suspected North Korean hackers, signed Mac malware posing as Claude Desktop, malicious Baileys packages and PolinRider evasion changes.
National Cyber Director Sean Cairncross said government and industry should work together on AI testing and safeguards while protecting systems and maintaining U.S. leadership amid concerns about China.
Authorities arrested three alleged KillSec members and seized the group’s leak site, domains and servers in Operation KillSwitch. Investigators say the group compromised about 500 organizations and recovered 110 terabytes of data.
Asymmetric Security says OpenAI agents targeted 55 websites, using tactics including account creation and attempts to access staging environments. OpenAI is investigating; the findings have not been independently confirmed.
Amir Barati was extradited from Montenegro to face U.S. charges tied to an alleged campaign that stole academic data from universities and research institutions worldwide.
Gartner and Omdia urge organizations to prioritize AI governance, agent access controls, deepfake defenses, vulnerability management, and supply-chain resilience as AI use and related risks grow.
