A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t. ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to the October 8 arrest of a Canadian ransomware negotiator who now faces extortion charges. Reuters reported the arrest, citing court documents,…

Read more →

Sydney-based Magneto IT Solutions expands its Shopify Plus migration and multi-market ecommerce services as Australian retail brands look to replace legacy self-hosted…

Read more →

Norway’s Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. […]

Read more →

You want to set a cryptographic algorithm policy and stop non-compliant choices from being made in your Amazon Web Services (AWS) environment. This post shows you how. As you adopt post-quantum cryptography, one of the first decisions you face is which algorithms and parameter sets fit your business needs, balancing security against signature size, key…

Read more →

Software supply chain attacks have grown in both frequency and sophistication. Recent high-profile compromises of build systems and open source dependencies demonstrate that attackers increasingly target the trust mechanisms that verify software integrity. Those trust mechanisms rely on digital signature algorithms, and today many use traditional algorithms such as Rivest-Shamir-Adleman (RSA) and the Elliptic Curve…

Read more →

Canonical suffered its second DDoS attack this year, disrupting public websites for over four hours while Launchpad and the Snap Store remained online. Ubuntu’s parent company Canonical spent part of last week fighting off a sustained distributed denial of service (DDoS) attack, the second one to hit its infrastructure this year. The company revealed the…

Read more →

Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.

Read more →

OpenClaw is not a chatbot that waits for a prompt. It is an autonomous agent that runs real…

Read more →

Amazon is reportedly considering a roughly $7 billion acquisition of Decart, an AI startup whose software helps developers move workloads across different chips. The Seattle giant is in talks to acquire Decart, according to a Wall Street Journal report published Oct. 11. The San Francisco-based startup, founded in 2023 by Israeli engineers Dean Leitersdorf, Orian…

Read more →

Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. […]

Read more →

Anthropic announced that its internal AI models undergoing “high-risk and cybersecurity evaluations” no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. […]

Read more →

The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink.

Read more →

IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum computing company’s expanding cybersecurity business. Elisity, founded in 2019, sells a software policy layer that governs which users, devices, workloads and AI agents can…

Read more →

Models routinely take shortcuts to pass evaluations. Who gets to decide what incidents are innocuous?

Read more →

The new model, called Muse Wonder, arrives as global downloads of the company’s personal-assistant agent have slowed.

Read more →

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users’ cryptocurrency wallets. […]

Read more →

European food retailers have been affected by two separate disruptive cyberattacks: In France, several supermarket chains have had their freezers tampered with and chilled/frozen products destroyed, while in the Netherlands and Belgium workers at stores owned by Dutch multinational Ahold Delhaize have been dealing with disruption resulting from an unspecified “security issue”. Freezers turned into…

Read more →

Hackers targeted 300+ French supermarkets by manipulating refrigeration systems, causing food losses and exposing operational technology security risks.

Read more →

CyberXero used Claude Code in attacks exposing over 628,000 Ukrainian records. Learn how the campaign worked and what European security teams should check.

Read more →

EU agencies are evaluating Chinese AI models on secure infrastructure. Learn why local deployment still requires testing, access controls, and oversight.

Read more →

Researchers detected 135 exploitation attempts targeting critical SonicWall SMA1000 flaw CVE-2026-102255. See affected devices and security fixes.

Read more →

Hackers use Google ads, Bing redirects, and fake Claude Code pages to trick Mac users into running attacker-controlled terminal commands on company devices.

Read more →

P7 DarkSword can steal iPhone Keychain and crypto wallet data and accept remote commands. Learn what security teams should investigate and protect.

Read more →

Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. […]

Read more →

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That’s not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn’t always mean a safe…

Read more →

Leaked documents suggest a multi-pronged operation, with social engineering and more technical attackers working together to manipulate a single target

Read more →

CrowdStrike is best for advanced detection and broader security operations, while Bitdefender stands out for endpoint prevention and flexible security options.

Read more →

For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access provided to a private supplier. The incident reportedly exposed personal information, including names, addresses, and…

Read more →

TypeSafe AI has secured $870 million just weeks after launching Jev, an AI model designed to make decisions rather than hold conversations. The San Francisco-based startup announced its Series A funding round led by Andreessen Horowitz, with Sequoia Capital, existing investor DCVC, and several angel investors also participating. The financing values TypeSafe at $7.5 billion,…

Read more →

A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. […]

Read more →

Retail giant Ahold Delhaize, one of the world’s largest food retail chains, confirmed today that it had to take some systems offline in response to a “cybersecurity incident” affecting its network. […]

Read more →

Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure. Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after public disclosure. The vulnerability is a server-side request forgery (SSRF) flaw that requires no login.…

Read more →

IDC has bad news for enterprises upgrading PCs: don’t expect prices to come down any time soon. PC prices are already high due to constrained supplies and surging memory and component costs. Geopolitical tensions and an uncertain global economy won’t make the situation any better. “A weaker economy could soften demand further, and with prices…

Read more →

GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. […]

Read more →

Google’s watches are too dang chunky.

Read more →

Deeper Network Promo

Hackers reportedly heated supermarket fridges to 50°C in France, spoiling food stocks, while stores in the Netherlands and…

Read more →

Plus, the enterprise search for AI-fueled productivity continues

Read more →

An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse. The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to the…

Read more →

Fahmida Y Rashid will keep the momentum going as she leads Dark Reading.

Read more →

There’s an old leadership fantasy that goes something like this: The CISO surveys a sprawling technology estate, discovers 11 tools doing the work of four, calculates the licensing savings, selects a shiny new strategic platform and declares that consolidation has begun. Six months later, all 11 tools are still running. The new platform is now…

Read more →

Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the researchers call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft Agent Framework, Microsoft’s AutoGen, Google’s Agent Development Kit 2.0, AWS’ Strands Agents and CrewAI, according…

Read more →

Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. […]

Read more →

The CEO of Cooperative U confirmed a cyber-attack affected the food stock in several stores from October 11

Read more →

The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta’s Muse because it doesn’t identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities…

Read more →

Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via Cryptobilis following reports of stolen funds linked to devices sold by the reseller. On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have…

Read more →

Microsoft-Decision-1 is a small decision-scoring model. Given a situation, a question and a fixed set of answer options, it returns a calibrated probability for each option. “This model is designed for routing, classification, prioritization, verification, and workflow control, making it easier to incorporate decision intelligence into existing applications, agents, and workflows in a secure, trusted…

Read more →

Cisco disclosed seven Meraki vulnerabilities affecting six product families. Some firmware fixes are available, while others remain scheduled for October and November.

Read more →

You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender. Then you asked your AI assistant to summarize your inbox. Could the message you wisely avoided find its way back onto your to-do list—only this time presented as an urgent recommendation from a tool you trust? That’s…

Read more →

People who buy low-cost Android phones from online marketplaces may be carrying malware that was placed on the device before it reached them, Bitdefender has found. The campaign, dubbed Midnight Mimosa, runs on budget Android devices from different brands built on MediaTek platforms. The malware ships in the device firmware, is present before the owner…

Read more →

Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker “to direct the appliance to issue requests…

Read more →

Cisco has patched critical License On-Prem vulnerabilities, including a maximum-severity cryptographic signature flaw. Administrators must check two advisories for fixed releases.

Read more →

Raheim Hamilton, co-creator of the dark web marketplace Empire Market, was sentenced to 40 years for a platform…

Read more →

Strip away the model names and the headlines, and this year’s AI agent incidents share a feature that has little to do with how capable the models are. Nearly all of them ran through the software supply chain. Start with the case that set off the summer’s wave of disclosures. In July, two OpenAI models…

Read more →

The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHunters

Read more →

Three days after customers in Southeast Asia began reporting drained wallets, Ledger says the damage is limited. In its 72-hour update on X on October 11, the Paris-based hardware wallet maker said “all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis.” On-chain…

Read more →

Messaging on Android has come an impressively long way in a relatively short time. After years of comically extreme flipping and flopping and endless-seeming strategy shifts, Google’s been focused on its Google Messages Android app as the primary platform for Android messaging for a solid several years now. And that almost shockingly unusual (for Google!)…

Read more →

Fortinet FortiGate excels in integrated networking, while Check Point Force stands out for advanced threat prevention and centralized security management.

Read more →

CyberXero used 51 AI agents to support cyberattacks, stealing 628,000 Ukrainian records, including sensitive data from energy infrastructure. CyberXero is an operation that combines traditional hacking tools with AI agents to carry out cyberattacks. According to SOCRadar researchers, the attackers use the same infrastructure for two different campaigns: one targets WordPress websites and e-commerce platforms…

Read more →

ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May

Read more →

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

Read more →

Daiichi Kosho says a supply chain breach has exposed personal data on over eight million karaoke customers

Read more →

Year after year CISOs see the volume, velocity, and sophistication of attacks increase. They also see their attack surfaces expand and increase in complexity. Advances in artificial intelligence and the rapid growth of AI use in business are also impacting the security agenda, introducing novel attacks, broadening the attack surface to include AI infrastructure, and…

Read more →

TD SYNNEX wants resellers to spend less time searching for prices, inventory, and order details. Its latest PartnerFirst expansion brings AI agents into the applications partners already use, with a connector that gives those tools access to distributor data. At its Inspire conference in South Carolina on Oct. 8, the company unveiled the update for…

Read more →

Microsoft is advising users and businesses to update Windows devices before digital certificates used to verify Windows Update servers expire in May and June 2027. The certificates expire on May 17 or June 19, depending on the Windows version. Devices without replacement certificates will lose access to Windows Update, including security fixes delivered through the…

Read more →

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic’s Claude Code, has been attributed

Read more →

Websites that rely on Let’s Encrypt will soon have to renew their TLS certificates more often. Starting February 10, 2027, the certificate authority will issue certificates valid for 64 days by default, down from 90 days. Subscribers who already use Let’s Encrypt’s optional 45-day or 6-day certificates are not affected. The organization expects the last…

Read more →

Last week on Malwarebytes Labs: ASOS breach update: Hackers stole customer details and shopping searches Attackers hijack country-code domains to impersonate Google and other services Amazon has an uncomfortably personal profile on you Meta’s Muse AI files away your friendships, arguments, and secrets Google issues Android security updates: who can get them and how AI-powered…

Read more →

A vulnerability in Atlassian Data Center products could allow for arbitrary file access. Atlassian Data Center products are self-managed, enterprise-grade editions of Atlassian tools such as Jira, Confluence, Bitbucket, and Jira Service Management, which organizations host on their own infrastructure or private cloud and which offer clustering, high availability, and greater control over data, security,…

Read more →

Multiple vulnerabilities have been discovered in SonicWall SMA1000 Series Appliances, the most severe of which could allow for remote code execution. SonicWall Secure Mobile Access (SMA) 1000 Series appliances are enterprise-grade secure access and SSL VPN gateways. Successful exploitation of the most severe vulnerability could allow an unauthenticated, remote attacker to reach internal functionality and…

Read more →

Multiple vulnerabilities have been discovered in Dell System Update (DSU), the most severe of which could allow for remote code execution. Dell System Update (DSU) is a free Dell utility for Windows that scans your Dell computer and automatically finds, downloads, and installs the latest BIOS, driver, firmware, and application updates for it. Successful exploitation…

Read more →

Deeper Network Promo

In this Help Net Security interview, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum, talks about how AI, geopolitics and industrialized fraud are changing cyber risk. He discusses findings from the Global Cybersecurity Outlook 2026, including that CEOs now rank cyber-enabled fraud above ransomware as their top concern. Joshi explains…

Read more →

CyberLeek threatens to leak a playable GTA 6 build if its Solana meme coin hits a $30 million market cap, but the build remains unverified. CyberLeek, the anonymous figure behind this summer’s wave of GTA 6 leaks, just raised the stakes considerably. After dropping 25 minutes of gameplay footage earlier last week, including nudity and…

Read more →

AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned. If you run coding assistants, you’re familiar with…

Read more →

Researchers at Northwestern University tested AI coding agents on 112 real security bugs. They found that a patch which stops a crash often fails the checks the project’s maintainers wrote for the fix. With Claude Opus 4.7, third of the patches that made the crash go away still failed those maintainer tests. If you’re thinking…

Read more →

Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to Google’s case study, “How much does it cost to maintain a copy of an open source software package (at Google)?” Study suggests that most updates to its internal copies…

Read more →

New Iron Mountain research finds reclaimed IT spending enables enterprises to invest in AI technology and infrastructure as refresh cycles accelerate.

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

Fujitsu Limited has announced it will begin offering a trial environment for four AI agents and their execution platform on October 6, 2026. The AI agents are designed to…

Read more →

Indigenous-owned cybersecurity provider Baidam has closed out CEO Beau Hodge’s first year with a 61% increase in revenue and a 38% increase in gross profit for the 2026…

Read more →

OneAdvancedhttps://www.oneadvanced.com/en-au/, a leading provider of business software, has strengthened its marketing and go-to-market capabilities across Australia and New…

Read more →

For Australian technology leaders, the appeal of AI-powered software development is obvious: developers code more quickly, products get to market sooner, and faster innovation…

Read more →

Recognition highlights Atturra’s growing capability in helping Australian government organisations adopt AI securely, responsibly and within sovereign environments.

Read more →

Education remains the most targeted sector, while phishing, ransomware and GenAI-related data exposure intensify

Read more →

The Australian Signals Directorate ASD recently warned the public that Russian hackers are targeting critical industries, including defence, communications, energy and…

Read more →

The San Francisco company’s software makes it easier for developers to switch between different AI chips.

Read more →

Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At…

Read more →

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure   UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER MALFEX – A malicious npm postinstall no advisory has caught for fourteen months   Canto incognito: tracking the PoeLLM malware…

Read more →

Plus, wearables that track blood pressure, the co-founder combating Anthropic’s ‘woke’ reputation, when personal AI agents go off script and more.

Read more →

Bitdefender finds Midnight Mimosa, preinstalled Android malware on cheap MediaTek phones that fakes ad clicks, drops apps and builds a proxy botnet. Bitdefender researchers discovered a campaign called Midnight Mimosa involving preinstalled Android malware on low-cost phones from different brands that use MediaTek platforms. The malware is built into the device firmware and may be…

Read more →

Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. […]

Read more →

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Anthropic Restricts Live Internet Access After Claude Evaluation Failures Silent Ransom Group Allegedly Extorted $207 Million Without…

Read more →

Religious leaders are weighing in, creating a new political risk for the creators of the technology.

Read more →

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2015-3306 (CVSS score of 10.0) – An access control flaw in ProFTPD that could let…

Read more →

There are many ideas, opinions and potential solutions, but no single agreed-upon approach for managing nonhuman online identities.

Read more →

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Three questions a hospital CISO should ask a healthcare fintech vendor In this Help Net Security interview, Drew McCombs, CTO and CISO at Cylerity, explains how he balances both roles. Security work is scheduled into every sprint, and issues touching…

Read more →

Weak passwords, outdated software and poor Wi-Fi security can let strangers access your home camera.

Read more →

Anthropic’s models kept working around the rules on the live internet. The company published the cases. Anthropic released a report on unintended actions its Claude models took during evaluations and internal use. The cases involved real websites and real organizations outside the company. Anthropic says the impact was minimal, and it published them anyway. The…

Read more →

Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI’s ongoing crackdown on the ShinyHunters hacking group. […]

Read more →

Silent Ransom Group allegedly extorted $207 million from 27 law firms in six months using phone calls and social engineering, not encryption. Silent Ransom Group doesn’t rely on encryption. No malware payload, no locked files, just phone calls and social engineering aimed almost entirely at law firms, and apparently it works extraordinarily well. A new…

Read more →

The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. […]

Read more →