Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3578 articles
CrowdStrike says Vapor Panda used AI-powered ARTEX against more than 200 organizations from Oct. 17, 2026. Post-exploitation was confirmed at nine, where attackers deployed BLOODALCHEMY; the article also describes other China-linked groups.
Socket identified 319 Chrome extensions with an estimated 13.4 million installs that routed users’ searches through operator-controlled servers, exposing queries and generating referral payments. Researchers found no evidence the extensions redirected users to phishing-
South Africa’s State Information Technology Agency says it is using Wazuh for SOC monitoring under a new partnership, citing the platform’s security monitoring, threat detection and incident response capabilities.
Qualys says its Policy Audit includes an out-of-the-box policy to assess Cisco router configurations against CISA AA26-194A, covering SNMP, management access, authentication, software lifecycle and other hardening practices.
SecurityWeek’s roundup covers an Anthropic intrusion dispute, a UEFI flaw affecting network-boot systems, a Cloudflare AI data leak, and reported breaches, bot scanning for secrets, North Korean IT-worker enforcement and security product updates.
The FBI seized virtualine[.]net, used by Russian-speaking bulletproof host Virtualine, which court documents say supported illicit services. TRM Labs linked the provider to cybercrime payments and cautioned that the seizure alone does not show operations have stopped.
Ofcom outlined four age-check methods for the UK’s planned social media ban. The article weighs privacy and security risks of ID, bank, facial-age and digital-ID checks, and warns that workarounds may limit effectiveness.
Hornetsecurity’s October report reviews the EvilTokens disruption, active exploitation of SharePoint and Atlassian flaws, and a Proofpoint-tracked M365 password-spraying campaign, with guidance on service accounts, device-code phishing and patching.
SOC Prime says Prime Detect applies Sigma rules to event streams before SIEM ingestion, tags matches with severity and ATT&CK techniques, links them into attack chains, and lets MSSPs route events. Vendor-reported testing tagged about 7% of telemetry.
SOC Prime says Prime Detect applies Sigma rules to events in Kafka streams before SIEM ingestion, tagging matches with severity and ATT&CK techniques and linking attack chains. In client testing, it tagged about 7% of telemetry; it does not replace SIEM logging.
Ahmad Umar Agha, known as Th3Pr0, was sentenced to 42 months for his role in a Syrian Electronic Army hacking conspiracy. DOJ tied him to the 2013 AP tweet hack and said the campaign targeted about 47 organizations; earlier records differ on Syrian officials’ role.
DarkOwl’s 2026 roundup describes reused infostealer credentials, splintering ransomware crews, a reportedly marketed deepfake KYC kit, resilient criminal Telegram channels and identity-led SaaS data theft, with mitigation advice.
Cursor confirmed malicious Claude Code extension 2.1.313 was available in its marketplace on October 29. Socket found no matching Open VSX or npm publication records; Cursor says it removed the extension and is contacting potentially affected users.
Alice & Bob estimates its cat-qubit architecture could factor RSA-2048 in three days with fewer than 23,000 physical qubits. The preprint is not peer-reviewed, and real-world performance and scalability remain uncertain.
Sondera won the DataTribe Challenge with an approach to agentic AI guardrails and controls. Cyber insurer Navasana reached the top five for the first time, reflecting investor interest in risks emerging from AI adoption.
Binance estimates its Oct. 29 incident affected about $6.3 billion; its investigation cited a possible DevOps laptop compromise and later additional breach points. Researchers reported Ethereum signing-infrastructure activity; Binance said it found no evidence of a key-
Symantec describes deploying its Distributed Detection Service (DDS) on Kubernetes to inspect cloud and AI traffic, storage, and databases, citing autoscaling, rolling updates, persistent identity, and cloud-vault integrations.
Cursor reported that malicious Claude Code extension version 2.1.313 was available in its marketplace for about 11 hours. Phorion found it attempted to install an SSH backdoor; Cursor estimated up to 5,000 users were affected.
CrowdStrike says Agent Graph connects AI-agent prompts, tools and sessions to endpoint processes, files and network activity in Falcon Guardian, with risk scoring and policy enforcement hooks for supported agents.
CrowdStrike says Falcon Next-Gen SIEM’s new feature lets teams ingest, manage and correlate third-party indicators with security telemetry for detection and investigation workflows.
CrowdStrike announced 24/7 threat hunting for AI applications and agents, plus telemetry-driven hunting for Google Cloud. Its Falcon Complete service also adds expert-led detection and response for AI-related threats.
Cyber incidents disrupted services at health systems in New Mexico and Ohio, prompting scam warnings and proposed litigation. The article also covers an $800,000 federal settlement tied to a 2023 ransomware attack at Lehigh Valley Health Network.
Banks including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo reportedly restricted AI agents or limited them to read-only access after unauthorized account access, amid concerns about agent identity and authorization.
Alice & Bob estimates its cat-qubit architecture could factor RSA-2048 in three days with fewer than 23,000 physical qubits. The preprint is not yet peer-reviewed, and real-world performance and scaling remain uncertain.
