Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3574 articles
Qualys has released its Cloud Agent as a container image for Kubernetes, deployed as a DaemonSet to provide host vulnerability management and policy auditing across supported Linux nodes, including immutable operating systems.
Sysdig announced AI Defense, a product it says monitors AI agents at runtime, can flag, hold for review or block risky actions, and records agent activity and policy decisions for auditing.
Sekoia attributes the Poisoned Source campaign to an APT29-linked actor, reporting that hijacked Plerdy SEO Tracker code profiled visitors and delivered iOS and Android exploits targeting cookies, Wi-Fi passwords, and device data.
The article explains CISA BOD 26-04’s risk-based remediation tiers, including three-day deadlines for certain vulnerabilities and concurrent forensic triage for Tier 1. It also maps Rapid7 tools and recommendations to the directive.
Sentra raised $150 million in a Series C led by Capital One Ventures. The data security firm says it will use the funding to expand capabilities for monitoring and controlling data access by AI agents and other identities.
Cloudflare announced analytics to identify personal-agent traffic and controls to allow or block supported agents. Account Abuse Protection users can associate agents with accounts and investigate suspicious logins.
A series of attacks on AI developer platforms appears aimed at monetizing stolen AI credentials. Chainstack and WorkOS disclosed separate incidents involving customer information; Chainstack urged customers to rotate potentially exposed node credentials.
Ryan James Roach was extradited to the U.S. after a federal indictment alleged that he and Mathiew James Stubbings hijacked university systems from 2016 to 2019 to mine Electroneum and steal login credentials.
A CERT-AGID paper reports that a model can be fine-tuned to make an HTTPS request to a learned URL when a specific MCP server becomes available, even if the user's prompt is unrelated.
Meta says it paid about $1.2 million for Muse AI agent bug reports. A pre-launch flaw exposed data on internal test systems; Meta took the service offline, fixed the bug and described additional findings and defenses.
Russian authorities say they arrested three suspected VasyGrek (Fluffy Wolf) members and dismantled their infrastructure. Kaspersky reported 100+ attempted attacks on organizations in Russia, Belarus and Kazakhstan from January–September 2026.
Google's November Android bulletin includes CVE-2026-58868, a critical flaw affecting Android 14–17. Patch level 2026-11-01 or later addresses it; Google reported no known exploitation as of November 4.
Canada extradited Ryan James Roach to the U.S. to face charges over alleged university supercomputer hacks and cryptocurrency mining. A second Canadian defendant, Mathiew James Stubbings, remains subject to ongoing extradition proceedings.
SANS honeypots observed renewed scans for email scripts, possibly targeting forms that let users set arbitrary recipients. The author warns that leftover test scripts can expose server configuration and recommends removing development artifacts before deployment.
EU agencies say a new wave of refrigeration-system cyber incidents occurred on November 1–2. Member States are investigating, while EU bodies coordinate information-sharing and response; the article also outlines Cyber Resilience Act reporting requirements and dates.
Canada extradited Ryan James Roach to face U.S. charges over an alleged scheme to hack university supercomputers, steal credentials and mine cryptocurrency. A second suspect's extradition proceedings are ongoing.
Canada’s Cyber Centre says Android published its November 2026 security bulletin on November 2 to address vulnerabilities affecting Android devices and advises users and administrators to apply updates as they become available.
Symantec says Incident Prediction analyzes behavioral patterns from 500,000 attack chains to anticipate attackers’ next steps. The company claims it identifies high-confidence sequences in 80% of real-world incidents and can support early disruption.
Infisical raised $40 million in a Series B at a $600 million valuation. CEO Vlad Matsiiako says the company is focusing R&D on AI-agent security, including isolated or ephemeral credentials, approval workflows and access management.
Canada extradited one of two nationals charged in the U.S. over alleged hacks of university networks and supercomputers. The indictment alleges credential theft, data exfiltration and cryptocurrency mining that rendered one research supercomputer unavailable.
Lawmakers expect a Democratic-led Congress to focus on restoring CISA capacity, renewing CISA 2015, funding state and local cyber grants, and overseeing AI security and federal system access.
Vercel is gradually rolling out device-bound session credentials that use a TPM-stored key to prevent stolen cookies from being reused on another device. It also launched a beta code-review feature that flags security issues.
A federal judge certified four classes in a lawsuit alleging Meta Pixel and other tracking tools collected patients’ sensitive healthcare information from websites, portals and apps. The ruling does not decide whether Meta violated the law; Meta plans to appeal.
A Canadian man was extradited to the U.S. to face charges over an alleged scheme with another Canadian to breach at least four university networks, steal credentials and use compromised computers for cryptocurrency mining.
