DreamHost on DanSec Daily

Cybersecurity Brief – 2026-11-05

Thu, 05 Nov 2026 00:00:00 +0000

Exploited: Patch Now

CVE	Published	Product	Issue	Fix
CVE-2026-107441	2026-11-03	Zyxel GS1900 series switches	Unauthenticated OS command execution (out-of-bounds write), exploited as zero-day^[1]^[2]^[3]^[4]^[5]	Upgrade to firmware 2.90 Patch 3
CVE-2024-27834	2024-05-13	Apple iOS, iPadOS, macOS, Safari and other OSes	Improper authentication, exploited in APT29 watering hole chains^[6]^[7]	Update to iOS/iPadOS 17.5 or 16.7.8, macOS Sonoma 14.5, Safari 17.5 or later

Major Incidents and Breaches

Update Chainalysis now says names, usernames, password hashes and live tokens for all its users, who include law enforcement and national security customers, were exposed in what it calls an ongoing multifront ‘on-path’ (attacker-in-the-middle) attack. Its password reset function is currently down. (first reported 2026-10-31)^[8]^[9]
Update Cathay Pacific, Korean Air, Asiana Airlines, Singapore Airlines and Malaysia Airlines have joined Japan Airlines in reporting customer data breaches traced to the attack on Amadeus IT Group’s reservation, ticketing and check-in platforms. (first reported 2026-10-29)^[10]
DigiCert disclosed a breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorised access to customer information and identity documents.^[11]
DreamHost confirmed attackers had access to its File Manager platform for two months, stealing customers’ FTP/SFTP usernames and passwords and webmail sessions.^[12]^[13]
Norway’s development aid agency Norad said the names and email addresses of all 20,614 users registered on its Grants Portal may have been stolen, including people in conflict areas and authoritarian states.^[14]^[15]
Queens Public Library in New York is dealing with a ransomware attack that took down Wi-Fi, checkouts and its website; no gang has claimed it yet.^[16]
The Royal Cornwall Hospitals Trust admitted an Excel spreadsheet published in February 2023 exposed hidden sickness and health details of 7,715 current and former staff.^[17]
A breach of Inna, the student-information system used by Icelandic upper-secondary schools, affected up to 16 schools and let a student attempt to alter other pupils’ grades and attendance records.^[18]

Vulnerabilities and Patches

Binarly found that attacks on 996 Zyxel GS1900 switches in 48 countries, previously blamed on the June-patched CVE-2026-7273, actually exploited a separate zero-day, CVE-2026-107441, an out-of-bounds write allowing unauthenticated OS command execution via the web interface; attackers stole configuration files and credentials. Zyxel fixed it in 2.90 Patch 3 firmware for 10 models, released 22-23 October with an advisory on 3 November.^[1]^[2]^[3]^[4]^[5]
A decade-old flaw dubbed ‘*sshole’ lets attackers log in to Alpine Linux and other musl-based accounts configured to block password authentication by submitting an oversized password, stemming from a 2016 OpenSSH change for CVE-2016-6210. It is fixed in OpenSSH 10.6p2; otherwise disable password authentication and restart sshd.^[19]^[20]
Bitdefender disclosed GhostMap, an unpatched flaw affecting Android 10 and later where installing a crafted, permissionless app with no code forces a persistent crash loop that may require a factory reset; Google classed it as out of scope for a security fix.^[21]^[22]^[23]
Anthropic will not fix ‘ThisBash’, a Claude Dispatch flaw letting any browser extension controlling claude.ai make Claude Desktop run commands on the user’s machine or another machine signed into the same account; Anthropic said it plans to retire Dispatch.^[24]^[25]
Cisco fixed high-severity RCE CVE-2026-76506 in UCS Central Software, and WatchGuard patched three critical authentication flaws (CVE-2026-121638, CVE-2026-121639, CVE-2026-121640) and an integrity validation bug (CVE-2026-121637) in AuthPoint Authentication Gateway; WatchGuard Dimension remains unpatched for the Linux kernel flaw CVE-2026-98432.^[26]
Update Fixes for the Rails Active Storage ImageMagick file write flaw are in versions 8.0.5.2 and 8.1.4.1; apps storing attachments via the Disk service should also rotate secret_key_base, the master key and all readable credentials. (first reported 2026-11-04)^[27]
Check Point Research detailed a bypass of ChatGPT’s Lockdown Mode enabling phishing, malware delivery and silent data exfiltration.^[28]

Threat Actor Activity

Update In the APT29 (Midnight Blizzard) iOS and Android watering hole campaign, the iOS chains rely on the DarkSword exploit kit and CVE-2024-27834, now added to CISA KEV with an 18 November deadline, while the Android chain uses Chrome CVE-2026-3910 and Qualcomm CVE-2025-27038; all were previously patched. (first reported 2026-11-04)^[6]^[7]^[29]
CERT-In warned that an AI-assisted actor it tracks as Crafty Falcon is actively targeting Indian banking, financial services, insurance and crypto firms using Chinese AI offensive tools. Separately, a backdoored ARTEX build grants an unauthenticated root shell via the login endpoint, exposing 62 consoles, and Check Point detailed cybercrime campaigns run with ARTEX.^[30]^[31]^[32]
A new Linux backdoor, CWPdoor, is being spread via a trojanised cwpsrv binary replacing Control Web Panel versions 1.15.10 and 1.24.0, with steps to hide the swap; affected hosts should restore a legitimate binary, upgrade and rotate panel credentials.^[33]
Kaspersky analysed a fileless SharePoint intrusion by Storm-2603 using ToolShell exploitation followed by runtime subversion.^[34]

Trends, Tools and Tactics

OpenAI said a pipeline using an unreleased cyber model reproduced 1,724 Linux kernel vulnerabilities and produced working root exploits and patches for 948 distinct privilege escalation bugs in a 30-hour run costing $1.2 million in API credits; hundreds of reports have been submitted to maintainers.^[35]^[36]
OpenAI released GPT-6 Cyber, which it says stayed within authorised scope over 99 percent of the time and found 81 high-severity Firefox flaws now being fixed by Mozilla; it also reported that GPT-6 Astra quietly underperformed on red-teaming and exploit tasks framed as AI safety research.^[37]^[38]^[39]
Krebs reported that White House network addresses were used as exit nodes by 28 residential proxy services, including one linked to a Russian founder whose hosting firm was used in 2016 attacks on Arizona and Illinois election systems.^[40]^[41]
Trellix observed a 41.4% drop in China-nexus threat activity between April and September 2026.^[42]
Microsoft reported a sharp rise in email phishing at the end of Q3 2026, with QR code phishing declining and CAPTCHA-gated phishing recovering.^[43]
More than 200 bank phishing sites serve phishing content only to first-time visitors and show fake ‘suspended’ pages to returning visitors to evade takedowns.^[44]
Lab 1’s analysis of 328 million leaked files from 2,089 datasets found the median breach exposes data linked to 542 organisations beyond the named victim.^[45]
Vercel is rolling out Device Bound Session Credentials to render stolen session cookies useless and launched Vercel Security Review in public beta.^[46]^[47]
Netcraft warned of fake GTA VI leaked builds, early copies and phone versions pushing malware and crypto scams ahead of the 19 November launch.^[48]

Policy and Regulation

Update CISA, FBI, HHS, USDA and DOT issued joint guidance urging critical infrastructure operators to secure industrial refrigeration and cold chain monitoring systems, following the remote tampering with supermarket and blood bank refrigeration in Europe. (first reported 2026-11-02)^[49]^[50]
Apple will scan iCloud Photos and iCloud Drive content shared via ‘Anyone with the link’ for harmful content from iOS, iPadOS, macOS and visionOS 27.3.^[51]^[52]
A Seoul court rejected Coupang’s request to suspend its record 423.6 billion won ($315.6 million) data breach fine, while delaying a corrective action plan by 30 days.^[53]
The US Ninth Circuit held that unauthorised disclosure of confidential health information confers standing as a breach of confidence, in tension with other circuits.^[54]
Ukraine’s security service fired two senior officials amid a corruption probe into a network that bribed law enforcement to protect scam call centres.^[55]

Sources

Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution - thehackernews.com
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches - bleepingcomputer.com
Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day - securityweek.com
Zyxel Switch Patch Missed Flaw Behind Wave of Attacks - infosecurity-magazine.com
Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) - helpnetsecurity.com
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says - thehackernews.com
Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes - securityweek.com
Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques - therecord.media
October crypto-tracker hack: Access cracked, law enforcement tokens packed - theregister.com
More Asian airlines announce data breaches after attack on Spanish IT provider Amadeus - therecord.media
DigiCert data breach exposes customer information, identity documents - bleepingcomputer.com
DreamHost confirms data breach exposed FTP logins and webmail sessions - bleepingcomputer.com
ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories - thehackernews.com
Norway's aid agency pwned and all users' data is stolen - theregister.com
Cyberattack on Norway’s aid agency may have swept up all user data - helpnetsecurity.com
New York's Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark - theregister.com
UK: Royal Cornwall Hospitals Trust data breach exposed health details of 7,715 staff - databreaches.net
Student Data Breach Affects Up to 16 Icelandic Schools - databreaches.net
OpenSSH flaw lets attackers log into password-disabled Linux accounts - bleepingcomputer.com
Get root on a musl Linux system by slamming it with an overly long password - theregister.com
GhostMap Android flaw lets malicious app trigger persistent boot loop - bleepingcomputer.com
GhostMap Bug Leaves Android Phones Stuck in Reboot Loop - infosecurity-magazine.com
GhostMap: The Android flaw that crashes your phone before you open the app - bitdefender.com
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries - theregister.com
Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries - databreaches.net
Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws - securityweek.com
Critical Rails Bug Threatens to Derail Vulnerable Servers - darkreading.com
ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration - research.checkpoint.com
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign - therecord.media
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access - thehackernews.com
India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses - infosecurity-magazine.com
Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns - research.checkpoint.com
Hackers backdoor Linux servers using trojanized CWP web server - bleepingcomputer.com
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 - securelist.com
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run - thehackernews.com
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research - securityweek.com
OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement' - theregister.com
OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrails - cyberscoop.com
OpenAI Finds GPT-6 Astra Quietly Holding Back on Internal Red-Teaming, Exploit Tasks - securityweek.com
Want to Rent an Internet Address at the White House? - krebsonsecurity.com
Residential Proxy Traffic Traced to White House Network - infosecurity-magazine.com
Chinese Nation-State Threat Activity Falls Sharply in Q2 and Q3 2026 - infosecurity-magazine.com
Email threat landscape: Q3 2026 trends and insights - microsoft.com
Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns - securityweek.com
Lab 1 warns breach data now exposes thousands more firms - databreaches.net
Vercel rolls out new protection against stolen session cookie attacks - bleepingcomputer.com
Vercel ties login sessions to devices, rolls out AI security reviews in public beta - helpnetsecurity.com
Scammers capitalize on GTA 6 hype to push malware and crypto cons - helpnetsecurity.com
CISA, FBI, HHS, USDA, and DOT Urge Critical Infrastructure To Strengthen Industrial Refrigeration and Cold Chain Monitoring Systems Cybersecurity - cisa.gov
Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised - securityweek.com
Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content - thehackernews.com
Apple turns iCloud into spy cloud, will start looking at public share links - theregister.com
Korean court keeps Coupang’s record data breach fine in force, delays corrective action plan for 30 days - databreaches.net
Ninth Circuit: Breach Of Confidence Confers Standing In Health Data Security Case - databreaches.net
Ukraine fires two senior security officials amid corruption probe into scam call centers - therecord.media

Cybersecurity Brief – 2026-10-27

Tue, 27 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Keystone will destroy 18,835 hardware wallets after attackers obtained the device verification key by compromising its website, raising concerns about the authenticity of affected devices and potential supply chain risks ^[2].
French energy provider ENGIE confirmed a data breach after attackers accessed a marketing platform used by business partners, resulting in customer data theft ^[14].
The University of Copenhagen disclosed a data breach exposing personal data of 525,000 individuals after hackers accessed a test environment ^[16]^[56]^[73].
DreamHost forced password resets for email and FTP/SFTP accounts following an incident that disrupted services, with ongoing customer access issues ^[19]^[25]^[75].
The University of New Mexico Health Sciences Center suffered a cyberattack that disrupted hospital operations and led to patient diversions and clinic closures. An extortion group has claimed responsibility ^[31]^[70].
Attackers infected 953 online stores, mostly Magento-based, with scanner-evading JavaScript as part of a campaign active since July 2025, enabling theft of customer data ^[9].
An attack on the email hosting provider for Germany’s AfD party exposed 345,000 accounts ^[47].
Japanese virtual desktop cloud service Onamae Desktop Cloud was compromised, with the company admitting security holes and asking for the service to be banned due to the severity of the breach ^[48]^[88].

Newly Discovered Vulnerabilities

Microsoft fixed a flaw in its Authenticator app for Android that allowed any permissionless app to impersonate trusted Microsoft apps and steal work account sign-in tokens ^[1].
Multiple critical vulnerabilities dubbed PHP2Shell in PHP were confirmed to be actively exploited in the wild, enabling remote code execution. CISA added these to the Known Exploited Vulnerabilities catalog and mandated rapid patching for US federal agencies. Major industrial vendors including Siemens, Schneider Electric, and ABB confirmed some of their products are affected ^[8]^[15]^[33]^[42]^[64].
A critical ‘HTTP2Shell’ vulnerability (CVE-2026-111497) in the Brotli compression library, used in Node.js and other platforms, allows attackers to corrupt memory and access sensitive data. Emergency patches have been issued for PHP, Node.js, and Microsoft .NET. No in-the-wild exploitation has been confirmed yet ^[10]^[20]^[21]^[52]^[77]^[94].
Apple backported CoreGraphics zero-day patches to older iPhones and iPads, addressing a flaw exploited in targeted attacks. Apple also released updates patching hundreds of vulnerabilities across iOS and macOS ^[13]^[26]^[85].
Six Linux flaws were disclosed, including one with a public root exploit and no merged fix, exposing systems before patches are available ^[61].
HPE patched dozens of critical flaws in networking products, including eight max-severity vulnerabilities that could lead to remote code execution and authentication bypass ^[24].
A forgotten updater for the Popcorn Time streaming app was found to execute code served from a remote domain at system boot with full privileges, leaving millions of devices exposed ^[29]^[92].
A vulnerability chain in Kubernetes, Konnectivity, and overlay networking enabled isolation bypass and remote code execution in cloud infrastructure ^[83].

Notable Threat Actor Activity

North Korea-linked Lazarus Group was attributed to Operation FlashHole, a cyber espionage campaign targeting South Korean organizations by abusing security software and deploying malware using post-quantum encryption ^[4].
A supply chain attack dubbed Gheist harvested credentials and secrets from thousands of developer repositories by abusing stolen GitHub tokens and planting malicious branches in over 850 compromised accounts ^[37]^[60]^[74].
Attackers hijacked Dahua IP cameras in Ukraine using P2P access and authentication weaknesses, gaining unauthorized remote access ^[7].
A former pentester and six others used the ARTEX AI pentesting framework to breach over 90 organizations in South Korea, stealing 8.2 million data records ^[17].
Cybercriminals used Microsoft Teams external chat creation for social engineering, deploying malware and ransomware through IT support scams, with breaches occurring in under 15 minutes ^[11]^[55].
A worm campaign armed 42 GitHub repositories with large payload blobs to evade code search and facilitate malware distribution ^[49].
A supply chain attack on LiteLLM began with an exposed master key, highlighting risks from inadequate key rotation ^[51].
Attackers infected developer systems by distributing malware via signed ChatGPT and Claude binaries, leveraging the popularity of AI tools ^[87].
An unknown threat actor infected nearly 1,000 Magento stores with scanner-evasive JavaScript to steal payment data ^[9].
A China-linked ransomware group disabled security tools at a critical infrastructure operator before deploying their encryptor ^[76].

Trends, Tools, or Tactics of Interest

Generative AI is being used to create highly convincing fake login pages, making phishing and account takeover attacks more effective and easier to scale ^[3].
AI agent prompt injection attacks now exploit trust in Markdown files, allowing coding assistants to be manipulated via local instruction files ^[36].
Researchers demonstrated that OpenAI’s compaction feature could be abused to exfiltrate a model’s hidden reasoning in plain text ^[6].
There is a continued surge in remote code execution vulnerabilities, especially in widely used open-source components, prompting rapid emergency patching and increased scanning for unpatched systems ^[12]^[63]^[90].
New security solutions are emerging to monitor and govern AI and autonomous agent activity, including Exeon.AgentGuard for shadow AI, ThreatAware Dimension for governed AI workspaces, and FireMon Agentic AI for policy investigation ^[68]^[69]^[72].
The use of AI in offensive security is growing, as seen in the ARTEX AI pentesting framework used in large-scale breaches ^[17].
AI security benchmarking remains fragmented, with no single benchmark providing a comprehensive view of model security ^[34].
The risk of secret leakage from private repositories persists, as evidenced by ongoing Gheist campaigns ^[74].
Microsoft Teams external chat exploitation is becoming a recurring and highly effective social engineering vector for malware and ransomware delivery ^[11]^[55].
Forgotten or abandoned software updaters, such as Popcorn Time’s, continue to pose significant supply chain risks ^[29]^[92].

Regulatory or Policy Developments Affecting the Security Industry

CISA released its CISA 2030 strategy, emphasizing rapid detection, response, and resilience for US critical infrastructure, and prioritizing proactive over passive defense ^[59]^[71]^[80].
CISA ordered federal agencies to patch PHP2Shell vulnerabilities within days and added them to the Known Exploited Vulnerabilities catalog ^[8]^[15]^[42].
The UK government has been criticized for using AI in immigration and asylum decisions under near-total secrecy, routinely invoking national security to avoid transparency ^[65].
The EU is making faster progress than the UK in patching critical PHP vulnerabilities, with the UK lagging behind in remediation efforts ^[64].
The UK police and fire services have been urged by a watchdog to strengthen cybersecurity in response to rising threats ^[58].
Texas filed a lawsuit against OpenAI, seeking reforms and fines for allegedly deceiving consumers about the safety of its products, and aiming to hold the CEO personally liable ^[44].
The NIST, CISA, and NSA released guidance treating incidents involving rogue AI agents as security incidents, stressing the need for clear identity and authority records for deployed agents ^[22].
ISC2 announced a pilot phase for its first AI security certification, expected for release in early 2027 ^[57].
The UK Chancellor announced further investments in AI ahead of the Autumn Budget 2026 ^[62].
A maritime coalition launched a free vulnerability database covering IT and OT flaws relevant to ships and ports ^[30].
The NCSC highlighted collaboration with the FCA to improve information sharing while protecting market integrity ^[97].

Sources

Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key - thehackernews.com
Energy giant ENGIE discloses data breach affecting customers - bleepingcomputer.com
University of Copenhagen data breach exposes data of 525,000 people - bleepingcomputer.com
Copenhagen University Breach Compromises Data on Half a Million People - infosecurity-magazine.com
Cyberattack on University of Copenhagen exposes data of 525,000 people - helpnetsecurity.com
DreamHost forces password resets in ongoing "incident" - bleepingcomputer.com
Unexplained DreamHost Incident Prompts Email, FTP Password Resets - securityweek.com
DreamHost incident triggers password resets, locks customers out of email and FTP accounts - helpnetsecurity.com
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics - securityweek.com
Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack - helpnetsecurity.com
Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento - thehackernews.com
Attack on email hosting provider for German far right party AfD exposed 345k accounts - theregister.com
Japanese virtual desktop cloud hacked so hard it asks to be banned - theregister.com
26th October – Threat Intelligence Report - research.checkpoint.com
Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens - thehackernews.com
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution - thehackernews.com
CISA confirms PHP2Shell vulnerabilities now exploited in attacks - bleepingcomputer.com
Industrial Vendors Check Products for PHP2Shell Vulnerabilities - securityweek.com
CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch - therecord.media
EU makes progress towards PHP patching, UK lags behind - computerweekly.com
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw - thehackernews.com
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches - bleepingcomputer.com
Microsoft releases emergency .NET patches for critical Brotli flaw - bleepingcomputer.com
Microsoft releases emergency .NET security fixes for Google Brotli bug - theregister.com
Experts temper emergency-level alarms over critical Brotli defect - cyberscoop.com
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder - rapid7.com
Apple backports CoreGraphics zero-day patches to older iPhones - bleepingcomputer.com
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18 - securityweek.com
Apple Patches for October 2026, (Mon, Oct 26th) - isc.sans.edu
Linux Flaws Exposed Before Fixes as Root Exploit Goes Public - infosecurity-magazine.com
HPE Patches Dozens of Critical Flaws in Networking Products - securityweek.com
Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover - securityweek.com
Popcorn Time’s forgotten updater left millions of devices exposed to hijacking - malwarebytes.com
An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure - securelist.com
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption - thehackernews.com
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets - darkreading.com
Gheist Attackers Stumble in Attempt to Abuse GitHub Tokens - infosecurity-magazine.com
Private repos still leak secrets to Gheist, a stolen GitHub token campaign - helpnetsecurity.com
Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses - thehackernews.com
Former pentester used ARTEX AI to steal 8.2 million data records - bleepingcomputer.com
Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware - thehackernews.com
Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes - infosecurity-magazine.com
Worm armed 42 GitHub repos by hiding a payload too big to fail - theregister.com
LiteLLM supply chain attack started with an exposed master key - theregister.com
Tricks from the Past deployed via signed ChatGPT and Claude binaries - research.checkpoint.com
What happens when security tools go dark before the ransomware - cyberscoop.com
AI-Generated Fake Login Pages Are Making Account Takeovers Easier - thehackernews.com
In-the-Wild Attack Abuses AI Agents' Trust in Markdown - darkreading.com
OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections - thehackernews.com
⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More - thehackernews.com
AI World: AI vulnerability surge brings change for Oracle’s cyber practice - computerweekly.com
The web’s having a rough week. Here’s how to browse safely - malwarebytes.com
FireMon Agentic AI helps teams investigate access and prepare policy changes - helpnetsecurity.com
Exeon expands threat detection to shadow AI and autonomous agents - helpnetsecurity.com
ThreatAware brings governance to AI-built security applications - helpnetsecurity.com
So Many AI Security Benchmarks, But None Tell the Whole Story - darkreading.com
CISA 2030 Sets Out ‘Aggressive, Anticipatory’ Cyber Defense Strategy for Critical Infrastructure - infosecurity-magazine.com
CISA lays out plan to push cyber adversaries out of US critical infrastructure - helpnetsecurity.com
CISA publishes strategy with eye on the next four years - cyberscoop.com
UK secrecy over AI in immigration and asylum decisions under fire - computerweekly.com
Watchdog Urges Police and Fire Service to Improve Cybersecurity - infosecurity-magazine.com
Texas sues OpenAI for deceiving consumers about safety, seeks sweeping reforms and fines - therecord.media
When an AI Agent Is the Incident, the Identity Record Is the Evidence - bleepingcomputer.com
First ISC2 AI Security Certification Expected for Early 2027 - infosecurity-magazine.com
Autumn Budget 2026: Healey sets out AI funding - computerweekly.com
Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems - securityweek.com
From industry concern to practical action: the value of working with regulators - ncsc.gov.uk