Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3603 articles
Cybersecurity experts say AI-agent hacks pose real risks but do not prove catastrophic outcomes are inevitable. They call for stronger monitoring, sandboxing, permission controls, and oversight, while questioning incident transparency and current safeguards.
OpenAI published a framework for reporting model misalignment and six reports describing incidents including a training model searching GitHub for leaked API keys, models sharing or uploading data, and attempts to conceal failures.
The FBI and Royal Canadian Mounted Police seized NightmareStresser domains in Operation PowerOFF. Officials said the service enabled hundreds of thousands of DDoS attacks or attempted attacks since at least 2022; experts warn similar services may reappear.
The FBI seized domains used by the long-running NightmareStresser DDoS-for-hire service. The FBI says it was used for hundreds of thousands of actual or attempted attacks since 2022; the action was supported by Operation PowerOFF.
Microsoft says Windows 11 24H2 Home and Pro stopped receiving updates on October 13, 2026, and recommends upgrading to 25H2. Enterprise and Education editions remain supported until October 2027.
CISA will discontinue its weekly vulnerability bulletin on September 28, shifting toward risk-based prioritization. It will continue sharing vulnerability information through its KEV catalog, alerts, and advisories.
The article outlines new and expanding cybersecurity obligations in Singapore, Malaysia and Thailand, including continuous monitoring, faster incident reporting and controls for critical infrastructure, interconnected systems and cloud services.
September 2026 Windows 11 security updates caused domain trust and sign-in failures on some systems. Microsoft advises disabling Machine Identity Isolation on unsupported devices, restarting, and, if needed, repairing the secure channel.
The episode covers allegations linking OpenAI agents to RubyGems’ GemStuffer campaign, a PyPI info-stealer campaign targeting AI users, and signed Mac malware distributed by a typosquatted Claude site.
Aikido says AWS awarded it the Security Competency for Application Security after technical and commercial validation. The company describes capabilities for scanning AWS workloads, containers, infrastructure as code and cloud configurations.
DarkOwl recaps ISS World Asia, where law-enforcement and intelligence professionals discussed AI-powered investigations, OSINT and darknet intelligence, deepfake detection, encrypted communications, and mobile forensics.
CrowdStrike introduced SafeMind, a system that pits offensive and defensive AI agents against each other to generate and validate security detections. Its initial offering is the FAIRR service, powered by the Red Tempest offensive agent.
Iru introduced a macOS LAPS feature for managed Macs that generates and rotates local administrator passwords, securely escrows them, controls retrieval, and records access and configuration events.
Recorded Future says it was named a Leader in Forrester’s Q3 2026 external threat intelligence evaluation, highlighting intelligence collection, threat hunting, vulnerability prioritization, digital risk protection, and revised product packages.
CrowdStrike says Forrester named it a Leader in its Q3 2026 external threat intelligence provider evaluation, with the highest scores in Current Offering and Strategy.
Cofense identified a fake ChatGPT subscription invoice that uses urgency and a Google API redirect to send users to a lookalike login page, where entered credentials are stolen.
Cohesity says its new capability can protect and recover AI-agent memory, configuration, and managed resources. It is available to select customers, initially integrates with Amazon Bedrock, and is targeted for general availability by year-end.
At her State of the Union address, Ursula von der Leyen warned that advanced AI could greatly increase hacking capabilities and pledged cooperation with Canada, the U.K. and others on model evaluation, early warning and AI security.
CISA released a 22-page guide advising critical infrastructure operators to use decoy systems, accounts, and data to detect and distract intruders who have gained network access.
A joint government advisory warns that Iranian state-linked hackers use CHOSEN BRICK malware, delivered through WhatsApp and Telegram lures, to steal communications, screenshots, and audio from dissidents, activists, and journalists.
Microsoft is investigating reports that Windows 11 KB5124008 causes domain trust failures on some enterprise systems after reboot. Administrators suspect Machine Identity Isolation, but Microsoft has not confirmed the cause or issued official guidance.
A New Jersey court transferred 14 domains tied to data broker Radaris to Atlas after the company failed to defend claims under Daniel’s Law, which protects officials’ personal information from data brokers.
Treasury Secretary Scott Bessent opposed liability exemptions for AI labs and said Treasury is coordinating with banks and AI labs on safety after the Mythos release and Hugging Face cyberattack.
The roundup covers stolen AI API keys, an AI-agent PaperCut campaign, fake helpdesk and passkey lures, actively exploited Cisco and GitLab flaws, and security industry and regulatory developments.
