Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3578 articles
AWS says a 2026 exercise switched off the European Sovereign Cloud’s links to its global network and local operational-data system. Traffic rerouted over the public internet while workloads and customer access continued without reported service impact.
The FBI attributed the Oct. 29 Binance theft to North Korea’s TraderTraitor and urged crypto services to block listed addresses. Elliptic said funds had moved across thousands of wallets, with about 44% frozen or seized.
OpenAI and Anthropic describe improvements to AI agent monitoring, while acknowledging blind spots and false alarms. Anthropic reports 78% detection of potentially harmful conversations with a 1% false-positive rate.
Google researchers said Videostrong preinstalled malware on Android and IoT devices, enabling the XCPE botnet to support ad fraud, proxy services and data theft. Google and partners disrupted the botnet and restricted Videostrong’s access to Google apps.
Google says it disrupted the XCPE botnet, which it attributes to backdoors in Videostrong devices. The operation targeted control infrastructure and reportedly disrupted access to at least 10 million additional compromised devices.
Google and partners disrupted the XCPE botnet, which Google says was built into over 1.3 million Android TV boxes by Videostrong. Google revoked the maker’s certification, but infected devices still need clean firmware or internet disconnection.
CrowdStrike says Vapor Panda used ARTEX AI and language models to target over 200 organizations in 14 countries, compromising at least nine. Separately, DIVD attributed a September attack on its network to ARTEX AI.
Thirty-five business groups urged Congress to extend CISA 2015 for 10 years through the fiscal 2027 defense bill. The law, which provides legal protections for cyber threat-information sharing, is set to expire Dec. 11, 2026.
Reversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released.
Synology says attackers are exploiting an unidentified vulnerability patched in December 2024 to target outdated DSM devices with C3RB3R ransomware. It urges users to update DSM, enable automatic updates, and block internet access to management interfaces.
Microsoft says updates released October 28, 2026, and later fix an issue that prevented some Windows 11 24H2-and-later users from enabling Smart App Control after KB5127648. Registry and Group Policy workarounds are available.
A sponsored article explains how retained call metadata can expose relationships and routines, citing AT&T’s 2024 breach. Cape says it deletes different log types within 1–60 days; a Trail of Bits audit found no evidence that two stated retention claims were violated.
With no permanent CISA director nominee in sight, sources say the administration may be seeking ways to keep Nick Andersen in the acting role. Lawmakers and industry figures cited his leadership and the importance of continuity.
FortiGuard Labs attributes a South Asian campaign with high confidence to Bitter (TA397). Three Windows infection chains deploy PapRAT, whose Rust version adds capabilities; one chain also delivers WmRAT.
The agency says maintenance and checks initiated after a cyberattack on information systems may affect some services. It warns benefit recipients that staff will not request confidential information by phone or message.
This roundup covers new cybersecurity and privacy developments, including Norway’s HIGH national cyber risk level and recommended controls, NIST’s post-quantum migration deadlines, breach-risk guidance, AI-agent safeguards and data-protection policy changes.
Northstar Security raised $7 million to develop AI agents that connect security and IT data, identify risky combinations across systems, and help teams investigate and carry out supervised fixes.
The FBI attributed a record $6.43 billion cryptocurrency theft to North Korea-linked TraderTraitor. Binance has begun phased withdrawal resumption, while $2.85 billion in assets have reportedly been frozen on-chain.
Kaspersky disclosed NetamLoader activity targeting a government-use Windows 10 build in Asia. Telemetry identified one victim; the delivery method and any data theft remain unknown, and the activity has not been attributed.
Ahmad Umar Agha, a Syrian Electronic Army-linked hacker, was sentenced to 42 months in US prison. Prosecutors say he compromised about 47 targets, including the 2013 Associated Press Twitter account takeover that triggered a brief market flash crash.
CYFIRMA’s fortnightly roundup lists five vulnerabilities affecting products including Wasmtime, TOTOLINK A950RG and Signal K Server, reports a 13.69% increase over the prior two weeks, and provides prioritization and mitigation guidance.
Reddit plans to gradually limit logged-out access, starting with a pilot in selected markets outside the U.S., to curb scraping and unauthorized data access. The company has not set rollout details and says privacy options will remain.
Jamf says its ALME engine deploys and updates catalogued Mac apps through blueprints, checking checksums and developer signatures before installation. Jamf also describes its Full Disk Access requirement and related compatibility limits.
Silent Push says North Korean operations targeting crypto firms rely on staging domains and developer lures. It links bybit-assessment[.]com to an operator persona and reports 206 Binance-named domains scored 100, with at least 64 live in a recent scan.
