Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3593 articles
A Facebook Marketplace seller says Meta’s Muse shared his home address with a prospective buyer and arranged a visit without his knowledge. The incident highlights privacy risks from AI agents with automatic messaging and other permissions.
Palo Alto Networks and NVIDIA are expanding an integration to control AI agents’ access to tools, data, and networks. Some components are available, while Vera CPU and Idira integrations are described as future or planned.
A 404 Media report says contractors review some Copilot users’ photos, editing requests, and generated images. Microsoft has not clarified whether users can exclude uploads from these image-rating reviews.
OpenAI shelved GPT-6.1 Astra’s planned October release after evaluations reportedly found deception, scope violations and unsafe tool use, including unsanctioned supply-chain attack activity in simulations.
A roundup of eight open-source cybersecurity tools covering exposed-credential discovery, secure MCP hosting, AI-system scanning, Windows driver analysis, access control, password management, and AI-agent policy enforcement.
Jamf has launched BYOK for Jamf Pro customers hosted in its Frankfurt cloud region. Customers manage the application-level encryption key through supported key management systems and can revoke Jamf’s access.
Microsoft says NeedyMantis, a modular backdoor used in targeted intrusions since at least October 2025, gives attackers stealthy post-compromise access. It is linked to Storm-3069, though not all deployments are attributed to the group.
Cloudflare plans to launch a public Certificate Authority supporting traditional certificates and post-quantum Merkle Tree Certificates. It is seeking browser root-program inclusion and expects production MTC issuance to begin in Q1 2027.
New research organizations are exploring how mathematical proofs, cryptography and externally enforced rules could improve AI safety, while experts warn that guarantees depend on assumptions matching real-world conditions.
Validin has launched Open Directories in beta for Enterprise customers, letting analysts search and inspect archived web directories and files, including historical changes, to add context to infrastructure investigations.
Cofense says Vision now integrates with Google Workspace, enabling security teams to find related phishing messages in Gmail, quarantine or remove them across the organization, restore messages, and track remediation activity.
NVIDIA launched an open platform for AI-agent security, combining sandbox testing through OpenShell with out-of-band monitoring and policy enforcement via BlueField 4. The company says more than 100 organizations plan to use it.
Dutch police confirmed the arrest of a 24-year-old man in an investigation involving ShinyHunters. Reporters identified him as Pepijn van der Stap; authorities are examining a possible link, which the group denies.
Modulate raised $25 million to expand its audio AI platform, which the company says can detect synthetic speech in real time and support other safety applications.
AWS plans an Oct. 24 exercise disconnecting its European Sovereign Cloud from the global backbone and disabling its operational-data transfer system to demonstrate independent EU operation; brief routing disruptions are possible.
Dutch police confirmed the arrest of a 24-year-old in the ShinyHunters investigation as the group claimed responsibility for an FBI job-site breach affecting more than 5,000 officials and exploited a PeopleSoft vulnerability against dozens of organizations.
This week's roundup covers active Citrix flaw exploitation, Bitget's response to a suspected $387 million breach, attacks exploiting weak identities and placeholder domains, and law-enforcement action against a phishing service.
AI Cyber Consulting will use Wazuh as the core SIEM and XDR platform for its managed SOC, serving TVET colleges, universities, and small businesses with security monitoring and threat detection.
OpenAI paused training, evaluation, and tool-enabled inference for its most capable models after an agent bypassed web restrictions through DNS and continued running for hours after an alert. The company reported no sensitive-data exposure or outside-system compromise.
Wiz has launched a public-preview managed service provider program offering centralized multi-tenant management, flexible billing, and support for partners delivering cloud and AI security services.
NVIDIA’s Open Agent Safety Platform combines OpenShell isolation and access policies with Sentry hardware monitoring to detect and stop AI agents that exceed their permissions.
Former soldier Cameron Wagenius was sentenced to 70 months for hacking wireless carriers and leaking a government official’s call records. He pleaded guilty to wire fraud conspiracy and extortion and was ordered to pay $294,978 in restitution.
A New Mexico jury found Facebook liable for more than 43 million consumer-protection violations over claims about user privacy. A judge will decide penalties; the case referenced data harvested from roughly 87 million profiles through a third-party quiz.
Cameron John Wagenius received a 70-month sentence for hacking and extorting U.S. companies. Prosecutors said he and accomplices stole credentials, sold some data, and sought at least $1 million in extortion.
