https://csoh.org/news.html Latest cloud security news curated by Cloud Security Office Hours. Covers AWS, Azure, GCP, Kubernetes vulnerabilities, breaches, and more. en-us admin@csoh.org (CSOH) admin@csoh.org (CSOH) Fri, 30 Oct 2026 00:35:52 +0000 720 https://csoh.org/favicon.png https://csoh.org/news.html https://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments This blog discusses the general trend of Clipbanker malware, why they can be successful, what specific samples look like, and how to avoid them. ReversingLabs Blog https://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments Fri, 30 Oct 2026 00:35:52 +0000 Threat Research https://joho-todai.com/en/internet-outage-single-technology-failure Unauthenticated remote code execution vulnerabilities have been found in PHP, which powers roughly 70% of the web, prompting the FBI to recommend taking unpatched sites offline. The internet may stay up while a flaw i... Joho no Todai https://joho-todai.com/en/internet-outage-single-technology-failure Thu, 29 Oct 2026 23:57:27 +0000 Cloud Security https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508 Embedded browsers are at the heart of the problem The Register - Security https://www.theregister.com/security/2026/10/29/researchers-find-bugs-in-5-ai-developer-tools-with-openai-and-microsoft-flaws-still-unpatched/5306508 Fri, 30 Oct 2026 00:12:26 +0100 Azure AI https://joho-todai.com/en/jal-ana-amadeus-breach-customer-data-exposed JAL and ANA have separately announced evidence that customer data was accessed externally following unauthorized access to their reservation system provider, Amadeus. About 92,000 JAL customers are affected, with evid... Joho no Todai https://joho-todai.com/en/jal-ana-amadeus-breach-customer-data-exposed Thu, 29 Oct 2026 22:56:40 +0000 Breach https://securityaffairs.com/202089/hacking/binance-investigates-suspicious-crypto-transfers-worth-up-to-5-8-billion.html Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity. Binance is investigating a potential security incident after billion... Security Affairs https://securityaffairs.com/202089/hacking/binance-investigates-suspicious-crypto-transfers-worth-up-to-5-8-billion.html Thu, 29 Oct 2026 22:53:27 +0000 Cloud Security https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on Gi... BleepingComputer https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining Thu, 29 Oct 2026 18:09:24 -0400 Threat Research https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers. [...] BleepingComputer https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info Thu, 29 Oct 2026 18:08:04 -0400 Breach https://www.bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in asse... BleepingComputer https://www.bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced Thu, 29 Oct 2026 17:47:25 -0400 Breach https://www.darkreading.com/cyberattacks-data-breaches/anthropic-phishing-emails-bypass-security-tools Obvious phishing emails with numerous red flags are somehow getting past some of the industry-leading secure email gateway (SEG) products. Dark Reading https://www.darkreading.com/cyberattacks-data-breaches/anthropic-phishing-emails-bypass-security-tools Thu, 29 Oct 2026 21:21:56 +0000 Phishing https://cyberscoop.com/dhs-employee-breach-icepick-database-takedown A DHS contractor requested its removal, while a social media site blocked links to it. It was offline for a spell before finding a new home. The post Leaked DHS employee archive, Icepick, faces challenges to stay onli... CyberScoop https://cyberscoop.com/dhs-employee-breach-icepick-database-takedown Thu, 29 Oct 2026 20:58:28 +0000 Cloud Security https://www.darkreading.com/cyber-risk/rethinking-cybersecurity-awareness-ai-era This installment of the Reporters' Notebook video series discusses some of the trends and topics from Cybersecurity Awareness Month, from using AI for better training to educating next-generation workforces on modern... Dark Reading https://www.darkreading.com/cyber-risk/rethinking-cybersecurity-awareness-ai-era Thu, 29 Oct 2026 20:15:37 +0000 AI https://therecord.media/php2shell-successful-exploitation-reports-emerge One cyber firm listed a half-dozen exploitations of the PHP2Shell bugs, and another identified a well targeted, suspected Chinese campaign that breached U.S. "government affiliated" servers. The Record https://therecord.media/php2shell-successful-exploitation-reports-emerge Thu, 29 Oct 2026 20:01:25 +0000 Vulnerability Breach Threat Research https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange m... The Hacker News https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html Fri, 30 Oct 2026 00:41:58 +0530 Vulnerability Breach https://securityaffairs.com/202055/security/484142-exposed-cloud-buckets-contain-18-billion-files.html 42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups. The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in Octobe... Security Affairs https://securityaffairs.com/202055/security/484142-exposed-cloud-buckets-contain-18-billion-files.html Thu, 29 Oct 2026 18:43:01 +0000 Breach Scam https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware fra... BleepingComputer https://www.bleepingcomputer.com/news/security/hackers-exploit-cisco-sd-wan-flaw-to-deploy-custom-keydrift-malware Thu, 29 Oct 2026 14:38:26 -0400 Vulnerability Threat Research https://www.darkreading.com/application-security/claude-model-exploits-major-browsers-oses An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says. Dark Reading https://www.darkreading.com/application-security/claude-model-exploits-major-browsers-oses Thu, 29 Oct 2026 18:15:59 +0000 Vulnerability AI https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619 CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE... Palo Alto Networks Unit 42 https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619 Thu, 29 Oct 2026 18:00:34 +0000 Vulnerability https://www.helpnetsecurity.com/2026/10/29/fake-chatgpt-claude-apps-github-yoba-malware-cryptominer Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campa... Help Net Security https://www.helpnetsecurity.com/2026/10/29/fake-chatgpt-claude-apps-github-yoba-malware-cryptominer Thu, 29 Oct 2026 14:49:11 +0000 Cloud Security https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.... BleepingComputer https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks Thu, 29 Oct 2026 09:59:48 -0400 CISA https://thehackernews.com/2026/10/googles-gemini-4-carbon-leads.html Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well... The Hacker News https://thehackernews.com/2026/10/googles-gemini-4-carbon-leads.html Thu, 29 Oct 2026 19:12:40 +0530 Vulnerability https://thehackernews.com/2026/08/learn-how-to-build-security-operations.html Security teams have spent years trying to detect threats faster. AI is changing the harder part: how much time defenders have left to act. Advanced AI models can now help attackers discover vulnerabilities, generate e... The Hacker News https://thehackernews.com/2026/08/learn-how-to-build-security-operations.html Thu, 29 Oct 2026 17:09:41 +0530 AI https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it... Security Affairs https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html Thu, 29 Oct 2026 10:34:54 +0000 Vulnerability https://www.darkreading.com/threat-intelligence/ai-relay-service-openai-codex-claude-code-sandboxes The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale - but with key security features turned off. Dark Reading https://www.darkreading.com/threat-intelligence/ai-relay-service-openai-codex-claude-code-sandboxes Thu, 29 Oct 2026 10:00:00 +0000 AI https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload. The post Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August appeared... SecurityWeek https://www.securityweek.com/attackers-exploit-second-cisco-firewall-vpn-zero-day-since-august Thu, 29 Oct 2026 09:47:10 +0000 Vulnerability https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 1... The Hacker News https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html Thu, 29 Oct 2026 14:35:39 +0530 Vulnerability https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign CrowdStrike Blog https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign Thu, 29 Oct 2026 00:00:00 -0500 AI Threat Research https://blog.talosintelligence.com/a-quiet-week-in-infosec In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node.js has joined in, but underneath it all, there are still good people doing good work. Cisco Talos https://blog.talosintelligence.com/a-quiet-week-in-infosec Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://aws.amazon.com/security/security-bulletins/2026-156-aws Bulletin ID: 2026-156-AWS Publication Date: 10/29/2026 09:30 AM PDT Description: We are aware of CVE-2026-119115, an incorrect authorization issue in the issuer resolution logic. In affected versions, under certain co... AWS Security Bulletins https://aws.amazon.com/security/security-bulletins/2026-156-aws Thu, 29 Oct 2026 00:00:00 +0000 AWS Kubernetes Vulnerability https://www.securityweek.com/when-risk-becomes-personal-what-security-leaders-can-learn-from-a-cancer-diagnosis Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you. The post When... SecurityWeek https://www.securityweek.com/when-risk-becomes-personal-what-security-leaders-can-learn-from-a-cancer-diagnosis Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-introducing-new-tier-for-google-cloud-vrp Welcome to the second Cloud CISO Perspectives for October 2026. Today, Chris Betz talks with Michael Cote, our vulnerability rewards program lead, about the new tier of our Cloud VRP program and the current state of v... Google Cloud Blog https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-introducing-new-tier-for-google-cloud-vrp Thu, 29 Oct 2026 00:00:00 +0000 GCP Vulnerability https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean threat actors expanding their use of AI with varyi... Microsoft Security Blog https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft Thu, 29 Oct 2026 00:00:00 +0000 Azure AI Threat Research https://www.microsoft.com/en-us/security/blog/2026/10/29/idc-marketscape-names-microsoft-a-leader-in-the-2026-worldwide-modern-endpoint-security-for-enterprises-vendor-assessment IDC has named Microsoft a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises. The post IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for... Microsoft Security Blog https://www.microsoft.com/en-us/security/blog/2026/10/29/idc-marketscape-names-microsoft-a-leader-in-the-2026-worldwide-modern-endpoint-security-for-enterprises-vendor-assessment Thu, 29 Oct 2026 00:00:00 +0000 Azure https://www.darkreading.com/cyber-risk/threat-modeling-4-simple-questions A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend. Dark Reading https://www.darkreading.com/cyber-risk/threat-modeling-4-simple-questions Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.securityweek.com/how-secure-are-us-elections-voting-machine-risks-and-the-growing-threat-of-ai Unpatched voting machines, unverifiable QR-coded ballots, and AI-driven influence campaigns leave US elections short of secure. The post How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI a... SecurityWeek https://www.securityweek.com/how-secure-are-us-elections-voting-machine-risks-and-the-growing-threat-of-ai Thu, 29 Oct 2026 00:00:00 +0000 AI Threat Research https://www.infosecurity-magazine.com/news/nik-c2-malware-victims-openai-keys NIK C2 malware can fall back on victims’ OpenAI API keys to run AI queries Infosecurity Magazine https://www.infosecurity-magazine.com/news/nik-c2-malware-victims-openai-keys Thu, 29 Oct 2026 00:00:00 +0000 AI https://blog.gitguardian.com/github-octoverse-2026 GitHub’s Octoverse 2026 counted 34.3 billion commits, and over 40% of pull requests now start with an AI agent. Read to learn what the State of the Octoverse 2026 Report reveals about AI, citizen developers, and our n... GitGuardian Blog https://blog.gitguardian.com/github-octoverse-2026 Thu, 29 Oct 2026 00:00:00 +0000 AI https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-remote-desktop-failures-caused-by-recent-windows-updates Microsoft has resolved a known issue that prevents non-admin users from connecting to devices via Remote Desktop when the "Administrator protection" security feature is enabled. [...] BleepingComputer https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-remote-desktop-failures-caused-by-recent-windows-updates Thu, 29 Oct 2026 00:00:00 +0000 Azure https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions. The post Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless St... SecurityWeek https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps Thu, 29 Oct 2026 00:00:00 +0000 AI https://research.checkpoint.com/2026/coheres-qwen-story-looks-more-like-model-jaggedness Key findings On October 26, Cohere reported a puzzling incident involving Qwen3.8-Flash-Next, an open-weight model from Alibaba. The task was straightforward: write a detection rule for suspicious curl downloads follo... Check Point Research https://research.checkpoint.com/2026/coheres-qwen-story-looks-more-like-model-jaggedness Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.bleepingcomputer.com/news/security/3-ways-ai-agents-already-operate-in-your-browser AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browse... BleepingComputer https://www.bleepingcomputer.com/news/security/3-ways-ai-agents-already-operate-in-your-browser Thu, 29 Oct 2026 00:00:00 +0000 AI https://blog.talosintelligence.com/ir-trends-q3-2026 Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries. Cisco Talos https://blog.talosintelligence.com/ir-trends-q3-2026 Thu, 29 Oct 2026 00:00:00 +0000 Ransomware Phishing https://www.securityweek.com/adobe-veeam-juniper-networks-patch-critical-vulnerabilities The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation. The post Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek . SecurityWeek https://www.securityweek.com/adobe-veeam-juniper-networks-patch-critical-vulnerabilities Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.securityweek.com/bae-says-no-data-extracted-in-incident-hitting-bankruptcy-courts BAE Systems says no data was extracted and no PII was breached in the incident that disrupted US bankruptcy court notices for weeks. The post BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts appeared f... SecurityWeek https://www.securityweek.com/bae-says-no-data-extracted-in-incident-hitting-bankruptcy-courts Thu, 29 Oct 2026 00:00:00 +0000 Breach https://www.aquasec.com/blog/integrate-aquasec-and-prometheus-for-greater-visibility-into-runtime-security-operations TL;DR: Maintaining runtime protection across cloud native environments requires visibility into the health of security controls and the activity they detect. Aquasec protects running workloads through local enforcemen... Aqua Security Blog https://www.aquasec.com/blog/integrate-aquasec-and-prometheus-for-greater-visibility-into-runtime-security-operations Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.helpnetsecurity.com/2026/10/29/oracle-e-business-suite-cve-2026-101767-exploitation Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthen... Help Net Security https://www.helpnetsecurity.com/2026/10/29/oracle-e-business-suite-cve-2026-101767-exploitation Thu, 29 Oct 2026 00:00:00 +0000 Vulnerability https://blog.cloudflare.com/ddos-threat-report-2026-q3 Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. Explore the latest threat data, including the collapse of CLDAP vectors and the impact of recen... Cloudflare Blog https://blog.cloudflare.com/ddos-threat-report-2026-q3 Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.helpnetsecurity.com/2026/10/29/canonical-ubuntu-core-desktop Canonical has restarted work on Ubuntu Core Desktop, the immutable and attestable version of Ubuntu that the company says will over time become the default Ubuntu desktop. Jon Seager, Canonical’s VP of engineering, la... Help Net Security https://www.helpnetsecurity.com/2026/10/29/canonical-ubuntu-core-desktop Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5127936-update-released-with-41-changes-and-fixes Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements. [...] BleepingComputer https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5127936-update-released-with-41-changes-and-fixes Thu, 29 Oct 2026 00:00:00 +0000 Azure https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153 'The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully' The Register - Security https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153 Thu, 29 Oct 2026 00:00:00 +0000 Supply Chain Threat Research https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html A flaw in Telegram for Android allowed an attacker to run code on a victim's phone via a voice call once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram accoun... The Hacker News https://thehackernews.com/2026/10/telegram-android-flaw-lets-attackers.html Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html 26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researc... The Hacker News https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html Thu, 29 Oct 2026 00:00:00 +0000 Breach AI Scam https://www.infosecurity-magazine.com/news/online-scam-volumes-double Akamai research reveals that scam detections topped six million in Q2 2026 Infosecurity Magazine https://www.infosecurity-magazine.com/news/online-scam-volumes-double Thu, 29 Oct 2026 00:00:00 +0000 Phishing Scam https://www.malwarebytes.com/blog/bugs/2026/10/have-an-older-iphone-or-ipad-apple-has-a-security-update-for-you Apple has backported a fix for a CoreGraphics flaw reportedly exploited in targeted attacks to the iPhone XS, XS Max and XR, and seventh-generation iPad. Malwarebytes Labs https://www.malwarebytes.com/blog/bugs/2026/10/have-an-older-iphone-or-ipad-apple-has-a-security-update-for-you Thu, 29 Oct 2026 00:00:00 +0000 Vulnerability https://www.securityweek.com/hackers-steal-2-6-million-records-from-sonys-japanese-isp-so-net The data of So-net and Plala customers in Japan was exposed, along with 54,401 email account passwords and 16 bank account records. The post Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net appeared f... SecurityWeek https://www.securityweek.com/hackers-steal-2-6-million-records-from-sonys-japanese-isp-so-net Thu, 29 Oct 2026 00:00:00 +0000 Breach https://www.infosecurity-magazine.com/news/ico-reprimand-staffordshire-police The UK’s privacy regulator has issued a reprimand to Staffordshire Police following a serious breach of personal information Infosecurity Magazine https://www.infosecurity-magazine.com/news/ico-reprimand-staffordshire-police Thu, 29 Oct 2026 00:00:00 +0000 Breach https://www.helpnetsecurity.com/2026/10/29/icepick-dhs-leak-ice-undercover-agents Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace. The group handed... Help Net Security https://www.helpnetsecurity.com/2026/10/29/icepick-dhs-leak-ice-undercover-agents Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.” Cisco Talos https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework Thu, 29 Oct 2026 00:00:00 +0000 AI https://securityaffairs.com/201967/security/election-website-security-42-of-us-county-sites-still-lack-gov-domains.html US election websites show improved security, but weak email protection, non-.gov domains and third-party tracking still expose voters to risks. Millions of Americans will use websites to check their registration, find... Security Affairs https://securityaffairs.com/201967/security/election-website-security-42-of-us-county-sites-still-lack-gov-domains.html Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://joho-todai.com/en/pf81966c4 A report says a Windows 11 VM with Secure Boot and SMM enabled hung at the UEFI screen after a Fedora 44 KVM host was updated to Linux 6.18.58. KVM maintainers requested further tests to investigate a possible connect... Joho no Todai https://joho-todai.com/en/pf81966c4 Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers MR ROBOT Android malware rents banking trojans that steal one-time passwords and card data Infosecurity Magazine https://www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.theregister.com/security/2026/10/29/admin-dropped-the-f-bomb-in-a-password-to-show-hackers-who-was-really-1337/5306139 Cursing in login credentials can help keep the bad guys out, but not when the rest of your security is BS The Register - Security https://www.theregister.com/security/2026/10/29/admin-dropped-the-f-bomb-in-a-password-to-show-hackers-who-was-really-1337/5306139 Thu, 29 Oct 2026 00:00:00 +0000 Scam https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html ENGIE says attackers accessed French customers’ contact and energy contract data through a partner sales tool. Banking data was not affected. French multinational energy company ENGIE warned customers in France that a... Security Affairs https://securityaffairs.com/201985/data-breach/engie-data-breach-exposes-customer-details-and-energy-contracts.html Thu, 29 Oct 2026 00:00:00 +0000 Breach https://www.darkreading.com/cybersecurity-analytics/cyber-vulnerabilities-besiege-italy Researchers can't quite explain why cyber threats look so different in Italy compared to everywhere else. Dark Reading https://www.darkreading.com/cybersecurity-analytics/cyber-vulnerabilities-besiege-italy Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.helpnetsecurity.com/2026/10/29/nathan-smolenski-qualys-ai-vulnerability-management In this Help Net Security interview, Nathan Smolenski, CISO at Qualys, talks about how security teams can handle the growing volume of AI-discovered vulnerabilities. He explains why CISOs should track the average wind... Help Net Security https://www.helpnetsecurity.com/2026/10/29/nathan-smolenski-qualys-ai-vulnerability-management Thu, 29 Oct 2026 00:00:00 +0000 Vulnerability AI Threat Research https://isc.sans.edu/diary/rss/33470 Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new investigation from a clean sna... SANS ISC https://isc.sans.edu/diary/rss/33470 Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://www.helpnetsecurity.com/2026/10/29/tls-certificate-automation-report Forty percent of 500 senior IT and security leaders surveyed for certificate authority Sectigo said they are very prepared for monthly TLS certificate renewals because automated systems are already in place. Their mor... Help Net Security https://www.helpnetsecurity.com/2026/10/29/tls-certificate-automation-report Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeti... The Hacker News https://thehackernews.com/2026/10/attackers-exploit-php2shell-flaws-in.html Thu, 29 Oct 2026 00:00:00 +0000 Vulnerability Breach Threat Research https://www.helpnetsecurity.com/2026/10/29/itrc-identity-theft-recovery-report Scams and identity theft hurt people in different ways, and recovering involves much more than getting money back, according to ITRC’s 2026 Consumer Impact Report. Scam victims often struggle with shame and self-blame... Help Net Security https://www.helpnetsecurity.com/2026/10/29/itrc-identity-theft-recovery-report Thu, 29 Oct 2026 00:00:00 +0000 Identity Scam https://www.helpnetsecurity.com/2026/10/29/cis-k-12-cybersecurity Last school year, 808 K-12 school organizations got some unwelcome news. The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or credentials were circulating on underground... Help Net Security https://www.helpnetsecurity.com/2026/10/29/cis-k-12-cybersecurity Thu, 29 Oct 2026 00:00:00 +0000 Scam https://news.risky.biz/srsly-risky-biz-chinese-ai-can-learn-to-love-the-west Your weekly dose of Seriously Risky Business news is written by Tom Uren and edited by Patrick Gray and Amberleigh Jack. This week's edition is sponsored by Nebulock . You can hear a podcast discussion of this newslet... Risky Business News https://news.risky.biz/srsly-risky-biz-chinese-ai-can-learn-to-love-the-west Thu, 29 Oct 2026 00:00:00 +0000 AI https://joho-todai.com/en/aws-brotli-codebuild-nodejs-18-20-lambda-fix AWS's response to Brotli vulnerability CVE-2026-111497 uses different delivery mechanisms across Lambda, CodeBuild, App Runner, and other services. Whether a fix arrives depends on packaging, update mode, and language... Joho no Todai https://joho-todai.com/en/aws-brotli-codebuild-nodejs-18-20-lambda-fix Thu, 29 Oct 2026 00:00:00 +0000 AWS Vulnerability https://cyberscoop.com/virtualine-bulletproof-hosting-provider-seized The Russian-speaking cybercrime storefront was among the most active bulletproof hosting providers this year to date, receiving almost one-fifth of all illicit-attributed inflow tracked by researchers. The post Offici... CyberScoop https://cyberscoop.com/virtualine-bulletproof-hosting-provider-seized Thu, 29 Oct 2026 00:00:00 +0000 Cloud Security https://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it. Datadog Security Labs https://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder Thu, 29 Oct 2026 00:00:00 +0000 Vulnerability https://www.recordedfuture.com/research/prediction-markets-traffer-teams Discover how Russian traffer teams use turnkey fraud infrastructure to exploit prediction markets. Recorded Future https://www.recordedfuture.com/research/prediction-markets-traffer-teams Thu, 29 Oct 2026 00:00:00 +0000 Vulnerability Scam https://www.chainguard.dev/unchained/rebuild-the-planet Patching can't keep pace with AI-discovered vulnerabilities. See how Chainguard plans to eliminate entire classes of security bugs by design. Chainguard Unchained https://www.chainguard.dev/unchained/rebuild-the-planet Thu, 29 Oct 2026 00:00:00 +0000 AI https://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.html A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE publis... The Hacker News https://thehackernews.com/2026/10/researcher-reveals-how-logic-bugs-alone.html Wed, 28 Oct 2026 21:53:34 +0530 Azure https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. The post Researchers uncover... CyberScoop https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs Wed, 28 Oct 2026 16:00:00 +0000 Cloud Security https://www.theregister.com/cyber-crime/2026/10/28/serial-ransomware-crook-gets-70-months-behind-bars-for-nefilim-hive-roles/5306050 Artem Stryzhak joined both gangs, which targeted businesses and a hospital during the pandemic The Register - Security https://www.theregister.com/cyber-crime/2026/10/28/serial-ransomware-crook-gets-70-months-behind-bars-for-nefilim-hive-roles/5306050 Wed, 28 Oct 2026 16:52:17 +0100 Ransomware https://thehackernews.com/2026/10/wazuh-and-ai-for-enhanced-soc-workflows.html Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncov... The Hacker News https://thehackernews.com/2026/10/wazuh-and-ai-for-enhanced-soc-workflows.html Wed, 28 Oct 2026 17:00:00 +0530 AI https://thehackernews.com/2026/10/japans-gmo-offers-1-million-bounty-to.html Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand. The reward program... The Hacker News https://thehackernews.com/2026/10/japans-gmo-offers-1-million-bounty-to.html Wed, 28 Oct 2026 12:43:21 +0530 Breach https://www.infosecurity-magazine.com/news/ai-is-turning-cisos-into Nvidia’s Mark Weatherford says CISOs must translate AI cybersecurity risks into business priorities, clarify risk ownership and balance innovation with security controls Infosecurity Magazine https://www.infosecurity-magazine.com/news/ai-is-turning-cisos-into Wed, 28 Oct 2026 00:00:00 +0000 AI https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch. The flaws are in how... The Hacker News https://thehackernews.com/2026/10/tailscale-patches-ssh-flaws-that-could.html Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week. Oracle patched all three under a single identifi... The Hacker News https://thehackernews.com/2026/10/shinyhunters-exploited-oracle.html Wed, 28 Oct 2026 00:00:00 +0000 Vulnerability https://fortiguard.fortinet.com/threat-signal-report/6551 What is the Vulnerability? The vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP's internal request-processing and memory-man... FortiGuard Labs https://fortiguard.fortinet.com/threat-signal-report/6551 Wed, 28 Oct 2026 00:00:00 +0000 Vulnerability https://www.securityweek.com/upwind-security-raises-400-million-at-3-8-billion-valuation The massive funding round comes just days after reports emerged that Upwind had attracted acquisition interest from several companies, including Datadog The post Upwind Security Raises $400 Million at $3.8 Billion Val... SecurityWeek https://www.securityweek.com/upwind-security-raises-400-million-at-3-8-billion-valuation Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://www.welivesecurity.com/en/business-security/lessons-cybersecurity-black-week A critical PHP flaw, leaked Linux kernel reports, a poisoned LiteLLM release, and more, all in seven days. Which threats called for immediate action, and which generated more noise than real danger? ESET WeLiveSecurity https://www.welivesecurity.com/en/business-security/lessons-cybersecurity-black-week Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026 An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2026 and Q3 2026 ESET WeLiveSecurity https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2026-q3-2026 Wed, 28 Oct 2026 00:00:00 +0000 Threat Research https://joho-todai.com/en/chinese-shenlong-orbital-imagery-x37b-comparison A Defense Intelligence Agency (DIA) space security report includes commercial satellite imagery of China's reusable Shenlong spaceplane in orbit. The high-resolution image reveals an outline closely resembling the US... Joho no Todai https://joho-todai.com/en/chinese-shenlong-orbital-imagery-x37b-comparison Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit. Dark Reading https://www.darkreading.com/application-security/ghostaction-hacking-wave-fizzles-attackers-github Wed, 28 Oct 2026 00:00:00 +0000 Supply Chain Threat Research https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121 Attackers probe another EBS bug, and ShinyHunters' PeopleSoft 0-day turns out to involve three vulns The Register - Security https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121 Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://therecord.media/noyb-sues-scale-ai-for-worker-surveillance Noyb alleges the platform in some cases records freelancers’ mouse clicks and keystrokes every few seconds and claims the collected information can be used to generate video documenting freelancers’ entire workday. The Record https://therecord.media/noyb-sues-scale-ai-for-worker-surveillance Wed, 28 Oct 2026 00:00:00 +0000 AI https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared firs... Palo Alto Networks Unit 42 https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats Wed, 28 Oct 2026 00:00:00 +0000 Ransomware AI https://www.helpnetsecurity.com/2026/10/28/github-package-firewall-npm GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it... Help Net Security https://www.helpnetsecurity.com/2026/10/28/github-package-firewall-npm Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://therecord.media/moldova-investigates-possible-foreign-involvement-cyberattacks Prime Minister Vasile Tofan said the incident may be part of a broader campaign targeting both citizens' personal data and government digital infrastructure, according to local media reports. The Record https://therecord.media/moldova-investigates-possible-foreign-involvement-cyberattacks Wed, 28 Oct 2026 00:00:00 +0000 Threat Research https://blog.gitguardian.com/rotating-1-000-service-account-passwords-with-zero-outages-why-the-inventory-comes-first Rotating 1,000+ service credentials across 150+ applications with zero outages took one lesson: rotation is the last step. Here’s the six-stage SCALER method, from inventory to rotation, and why a revert path made it... GitGuardian Blog https://blog.gitguardian.com/rotating-1-000-service-account-passwords-with-zero-outages-why-the-inventory-comes-first Wed, 28 Oct 2026 00:00:00 +0000 Scam https://www.infosecurity-magazine.com/news/japan-gmo-internet-disconnect GMO Internet has told customers to unplug their PCs in advance of a possible ransomware attack Infosecurity Magazine https://www.infosecurity-magazine.com/news/japan-gmo-internet-disconnect Wed, 28 Oct 2026 00:00:00 +0000 Ransomware https://therecord.media/uk-budget-proposal-software-companies-liable-cyber-breaches The new U.K. budget says the government will "consider where liability for cyber breaches should sit," potentially a landmark shift for a country that has relied on voluntary codes to encourage software vendors to imp... The Record https://therecord.media/uk-budget-proposal-software-companies-liable-cyber-breaches Wed, 28 Oct 2026 00:00:00 +0000 Breach https://cyberscoop.com/madagascar-nft-dating-scam-charges The scammers affected approximately 800 victims and led to losses of more than half a million dollars, the Justice Department said. The post Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake... CyberScoop https://cyberscoop.com/madagascar-nft-dating-scam-charges Wed, 28 Oct 2026 00:00:00 +0000 Scam https://www.helpnetsecurity.com/2026/10/28/exaforce-trust-in-ai-security For most of my career, I have watched new security platforms work through enterprise programs at a slow pace, so when AI began showing up in security operations tools, I assumed it would follow the same path. I expect... Help Net Security https://www.helpnetsecurity.com/2026/10/28/exaforce-trust-in-ai-security Wed, 28 Oct 2026 00:00:00 +0000 AI Jobs https://therecord.media/belarus-russia-hackers-ukraine-war Belarus-linked hackers are increasingly aligning their cyber operations with Russia's interests in Ukraine, researchers said Wednesday. The Record https://therecord.media/belarus-russia-hackers-ukraine-war Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. [...] BleepingComputer https://www.bleepingcomputer.com/news/microsoft/microsoft-reminds-entra-id-admins-to-migrate-users-to-passkeys Wed, 28 Oct 2026 00:00:00 +0000 Azure Phishing https://joho-todai.com/en/postgresql-anonymizer-3-3-cve-2026-110183-statistical-disclosure-fix PostgreSQL Anonymizer 3.3 fixes issues including original values remaining in statistics after a table is anonymized. It attempts to refresh statistics after static masking, but insufficient privileges produce only a... Joho no Todai https://joho-todai.com/en/postgresql-anonymizer-3-3-cve-2026-110183-statistical-disclosure-fix Wed, 28 Oct 2026 00:00:00 +0000 Vulnerability https://www.darkreading.com/cyber-risk/attacker-impersonates-ai-bots-scans-credentials The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data. Dark Reading https://www.darkreading.com/cyber-risk/attacker-impersonates-ai-bots-scans-credentials Wed, 28 Oct 2026 00:00:00 +0000 Breach AI Scam https://securityaffairs.com/201947/intelligence/ads-or-surveillance-researchers-flag-suspicious-targeting-of-starlink-users.html Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report. Digital defense firm TrendAI found that an Israeli ad tech company was hea... Security Affairs https://securityaffairs.com/201947/intelligence/ads-or-surveillance-researchers-flag-suspicious-targeting-of-starlink-users.html Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://jfrog.com/blog/jfrog-names-winners-of-software-supply-chain-excellence-awards JFrog announced completion of the first-ever Software Supply Chain Excellence Awards, recognizing the teams who have turned their software supply chain into a competitive advantage - unifying development, security and... JFrog Security Research https://jfrog.com/blog/jfrog-names-winners-of-software-supply-chain-excellence-awards Wed, 28 Oct 2026 00:00:00 +0000 Supply Chain https://www.securityweek.com/chrome-and-firefox-updates-patch-over-200-vulnerabilities The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches. The post Chrome and Firefox Updates Patch Over 200 Vulnerabilities appeared first on SecurityWeek . SecurityWeek https://www.securityweek.com/chrome-and-firefox-updates-patch-over-200-vulnerabilities Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://www.malwarebytes.com/blog/ai/2026/10/banks-are-blocking-ai-agents-from-customer-accounts Banks say third-party AI agents put customer accounts at risk. Is security the only concern? Malwarebytes Labs https://www.malwarebytes.com/blog/ai/2026/10/banks-are-blocking-ai-agents-from-customer-accounts Wed, 28 Oct 2026 00:00:00 +0000 AI https://www.securityweek.com/tls-flaws-found-in-goahead-web-server-used-in-hundreds-of-millions-of-devices FoxIO disclosed three GoAhead TLS bugs that can let revoked certificates through or expose some encrypted sessions to eavesdroppers. The post TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devic... SecurityWeek https://www.securityweek.com/tls-flaws-found-in-goahead-web-server-used-in-hundreds-of-millions-of-devices Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://www.sentinelone.com/labs/labscon26-replay-keynote-a-sober-analysis-of-ai-impact Harvard Professor James Mickens weighs the promises of AI against its potential harms, arguing for hardware-based mechanisms to isolate frontier models. SentinelLabs https://www.sentinelone.com/labs/labscon26-replay-keynote-a-sober-analysis-of-ai-impact Wed, 28 Oct 2026 00:00:00 +0000 AI https://joho-todai.com/en/vmware-sddc-manager-cve-2026-111497-critical A Brotli decompression vulnerability has been identified in SDDC Manager, which manages VMware virtual infrastructure, with a CVSS score of 9.8 for the 9.1.1 series and 7.5 for older versions. As of October 28, 2026,... Joho no Todai https://joho-todai.com/en/vmware-sddc-manager-cve-2026-111497-critical Wed, 28 Oct 2026 00:00:00 +0000 Vulnerability https://www.crowdstrike.com/en-us/blog/when-ai-guardrails-expose-vulnerabilities CrowdStrike Blog https://www.crowdstrike.com/en-us/blog/when-ai-guardrails-expose-vulnerabilities Wed, 28 Oct 2026 00:00:00 +0000 AI https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936 Company chiefs believe the attackers could be the same as those who used ARTEX to breach South Korea’s financial giants The Register - Security https://www.theregister.com/cyber-crime/2026/10/28/123-reg-discloses-ai-cyberattack-on-customer-data-suspects-china-nexus/5305936 Wed, 28 Oct 2026 00:00:00 +0000 Breach AI https://securityaffairs.com/201928/security/cve-2026-97631-16-year-old-uefi-flaw-threatens-servers.html CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) enables pre-OS code execution. Exposed servers need firmware patches and checks. A critical flaw, tracked as CVE-2026-97631 (CVSS score of 9.5), in the fi... Security Affairs https://securityaffairs.com/201928/security/cve-2026-97631-16-year-old-uefi-flaw-threatens-servers.html Wed, 28 Oct 2026 00:00:00 +0000 Vulnerability Breach https://www.malwarebytes.com/blog/ai/2026/10/chrome-and-firefox-updates-fix-serious-security-flaws-install-them-now Google and Mozilla released security updates for Chrome and Firefox on October 27. Update your browser as soon as you can. Malwarebytes Labs https://www.malwarebytes.com/blog/ai/2026/10/chrome-and-firefox-updates-fix-serious-security-flaws-install-them-now Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://www.schneier.com/blog/archives/2026/10/studying-fraudulent-north-korean-it-workers.html Researchers set up a fake start-up company to study fraudulent North Korean IT workers. Schneier on Security https://www.schneier.com/blog/archives/2026/10/studying-fraudulent-north-korean-it-workers.html Wed, 28 Oct 2026 00:00:00 +0000 Scam https://www.securityweek.com/long-hidden-flaws-patched-in-epics-research-facility-control-software Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs. The post Long-Hidden Flaws Patched in EPICS Research Facility Control Software appeared... SecurityWeek https://www.securityweek.com/long-hidden-flaws-patched-in-epics-research-facility-control-software Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security https://securityaffairs.com/201913/ai/three-japan-focused-cyberattacks-show-how-hackers-use-ai.html Three Japan-focused cyberattacks show how AI helps hackers scale operations, while exploiting old systems and weak security remains key. In autumn 2026, Japanese companies and other organizations reported a series of... Security Affairs https://securityaffairs.com/201913/ai/three-japan-focused-cyberattacks-show-how-hackers-use-ai.html Wed, 28 Oct 2026 00:00:00 +0000 Vulnerability AI https://blog.qualys.com/product-tech/2026/10/27/cant-patch-node-js-yet-build-a-stopgap-with-the-controls-you-own Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of r... Qualys Blog https://blog.qualys.com/product-tech/2026/10/27/cant-patch-node-js-yet-build-a-stopgap-with-the-controls-you-own Wed, 28 Oct 2026 00:00:00 +0000 Vulnerability https://news.risky.biz/risky-bulletin-moldova-takes-down-80-public-services-after-cyberattack In other news: White House launches second cybersecurity pilot program; South Korea arrests AI-assisted cybercrime ring; Electrum wallet patches crypto-stealing bug. Risky Business News https://news.risky.biz/risky-bulletin-moldova-takes-down-80-public-services-after-cyberattack Wed, 28 Oct 2026 00:00:00 +0000 AI https://joho-todai.com/en/gmo-desktop-cloud-attack-domain-suspended The attacker site's domain has been suspended following unauthorized access to Onamae.com Desktop Cloud, potentially affecting 26,739 servers, with unauthorized FX trades reported. GMO rejected a $50 million demand an... Joho no Todai https://joho-todai.com/en/gmo-desktop-cloud-attack-domain-suspended Wed, 28 Oct 2026 00:00:00 +0000 Cloud Security