Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3578 articles
ESET reports Russia-aligned Gorbag has targeted Ukrainian organizations since at least February 2025 using infostealers and reverse shells. Trend Micro linked the actor to attacks exploiting patched WinRAR vulnerability CVE-2025-8088.
Intrinsec introduced OrcDecryptNet, a .NET 8 command-line tool for decrypting DFIR-ORC .p7b archives on Windows and Linux, with optional Windows DPAPI credential storage.
Kaspersky’s MLEP in KICS for Networks 5.0 uses recurring network behavior to refine OT device categories and alert on anomalies. Its aggregated events cannot reconstruct packet order or command contents, and results depend on traffic visibility.
The UK cyber chief warns that AI-enabled attacks on critical infrastructure are likely by 2028, as states and criminals scale cyber operations. The NCSC urges organizations to update devices, restrict admin access and back up data.
Google says it disrupted the XCPE botnet, which affected more than 1.3 million Android devices, and took legal action against its domains and servers. Google attributes the operation to Videostrong, which allegedly used devices for ad fraud, data exfiltration and proxy,
Crossed Swords 2026 brings more than 250 participants from over 40 countries to train in cyber operations coordinated with kinetic and special operations. A new track lets participants build, deploy and assess AI agents.
Synology says ransomware actors are exploiting a flaw patched in December 2024 to target NAS devices running outdated DSM. The company urges users to update; customers have reported C3RB3R ransomware infections.
Google says it worked with industry partners to disrupt the XCPE botnet, which GTIG linked to malware on more than 1.3 million Android TV boxes. GTIG estimates the action may sever access to over 10 million additional compromised devices.
The US is considering restrictions on Chinese optical transceivers over security concerns, while China has proposed export controls on some AI technologies. The changes could affect supply chains and access to models, but the proposals are not final.
The article examines proposed US restrictions on Chinese data-center optical transceivers and China’s proposed controls on AI technology transfers, including possible effects on model access, supply chains and AI security.
Sysdig’s October 2026 briefing summarizes ransomware and grocery-sector disruptions, rapidly exploited PHP and Node.js flaws, Linux and Microsoft patches, a reported AI-agent-assisted breach of DIVD, and pickle-based model-loading bypasses.
Validin added an Open Directories API in beta, file-level search results and downloads, OR and cross-source Advanced Search, and a host-response timeline and table presets for tracking infrastructure changes.
StepSecurity launched a beta GitHub scanner for campaign-planted files across repository history and renamed its Dev Machine Guard feature Malicious Files, adding rule management and device-level findings.
The Office of the National Cyber Director told Protect Democracy it would withhold 60 pages, including the White House’s frontier AI review framework, citing national security and confidential commercial information exemptions.
athenahealth launched a connector allowing patients to share medical records with Claude. Experts say HIPAA may not cover patient-directed transfers to consumer AI services, raising questions about privacy protections and applicable laws.
CrowdStrike agreed to acquire Fiddler AI for about $400 million and Dreadnode for $95 million, adding AI agent monitoring and automated security testing capabilities to its Falcon platform. The deals are expected to close by Jan. 31, 2027.
Business groups are urging congressional leaders to renew the Cybersecurity Information Sharing Act of 2015 before its Dec. 11 expiration. The House-backed defense bill includes a 10-year extension; the Senate version does not.
ILC agreed to pay $13 million to resolve government allegations that it failed to meet cybersecurity requirements on federal contracts from 2018 to 2024. Its parent said it addressed the issues; the settlement includes no admission of liability.
Authorities in seven countries disrupted an investment fraud operation allegedly supplying criminal groups with fake trading platforms and victim leads. Investigators searched 17 locations, seized 100 servers and arrested seven suspects.
A second wave of attacks reportedly manipulated supermarket refrigeration controllers across Europe, causing spoilage. Retailers confirmed limited impacts; authorities are investigating. Experts warn exposed, poorly secured cold-chain and other OT systems face similar.
Hudu’s beta integration with Huntress brings organization, agent, membership, and identity data into client records, allowing technicians to check Huntress coverage and access from their documentation.
Google GTIG and Mandiant report LLMjacking incidents that drove cloud AI charges above $100,000 per day and up to $1 million at some organizations, using exposed endpoints or stolen credentials and API keys to resell access.
CrowdStrike says Falcon Guardian will monitor process, package and network activity inside Claude Cowork’s VM. The integration is in beta on macOS; Windows support is expected later in November 2026.
CrowdStrike’s AI Kill Switch, available in Falcon Guardian, directs connected AI gateways to block agents’ access to AI models. The company plans to expand containment across endpoints, cloud, identities, SaaS and browsers.
