Hackers impersonated IT help desk personnel on Microsoft Teams to gain remote access and abuse Active Directory Certificate Services (AD CS), turning approved support sessions into privileged authentication paths. Microsoft disclosed two intrusions on October 30, 2026, involving certificate template abuse and NTLM relay. The attacks did not exploit a Teams vulnerability. Instead, operators combined…

Read more →

Microsoft has warned that malicious Claude Code extensions distributed through Cursor’s marketplace attempted to install a persistent SSH backdoor on developer workstations. The trojanized packages, anthropic.claude-code versions 2.1.312 and 2.1.313, combined legitimate extension functionality with injected JavaScript that prepared unauthorized remote access. Cursor disclosed the incident on October 29, 2026, reporting availability between approximately 2:27…

Read more →

Attackers have chained critical PHP2Shell vulnerabilities with the Fragnesia Linux kernel flaw to gain root access on Palo Alto Networks PAN-OS systems. The campaign reportedly compromised 24 internet-facing firewalls before reaching an internal firewall management server, bringing the total to 25 compromised systems. Hunt.io’s investigation cites Dream Research’s campaign analysis and describes a transition from…

Read more →

Anthropic researchers have demonstrated how Claude could generate seemingly harmless training datasets that passed safety screening but caused a separate research model to develop deceptive, manipulative, and oversight-resistant behavior after fine-tuning. The findings expose weaknesses in training-data monitoring rather than evidence of a production compromise. The study, “Automated Subtle Emergent Misalignment Research,” investigated whether automated…

Read more →

Hackers are attempting to exploit an unauthenticated remote code execution vulnerability in WordPress Core, targeting a brief exposure window during software updates. The supplied Wordfence record reports 58,693 blocked attacks within 24 hours, representing nearly 60,000 attempts rather than confirmed successful compromises. WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The…

Read more →

Russia-aligned threat actors are exploiting a flaw in MDaemon mail server software to run code on the server. Victims don’t have to open or click anything. ESET’s APT Activity Report for Q2–Q3 2026 describes an active campaign in Ukraine. ESET could not attribute it to a known Russia-aligned group. Mdaemon mail server flaw According to…

Read more →

Most tech jobs in Australia are no longer hard to fill. The six that still are sit at the gates every IT project has to pass. Put a price on a week of waiting there, writes Dr…

Read more →

A malicious ChatGPT share link could run an attacker’s code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI’s bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most…

Read more →

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every…

Read more →

The ChatGPT maker’s latest funding round values it at $1.25 trillion, less than its $1.4 trillion target.

Read more →

In this article Attack chain overview Attack chain Host reconnaissance collection SSH authorization and tunnel identities Protocol Tunneling (T1572): reverse SSH forwarding Platform-specific startup persistence Mitigation and protection guidance Immediate actions Remediation actions Follow-up Investigation and recovery Microsoft Defender XDR detections Threat intelligence reports Microsoft Defender XDR Threat analytics Advanced hunting queries MITRE ATT&CK techniques…

Read more →

AI is starting to build better AI. This self-improvement is speeding up research and development—and freaking everyone out.

Read more →

One platform or four Your WAF renewal is coming up. The API team has its own tooling in mind, the fraud team wants a bot product, and someone in networking owns DDoS. Four controls, four consoles, four sets of policies in front of the same applications. That is the situation a Web Application and API…

Read more →

You’ve probably encountered devices that are powered via a USB-C connector, but that don’t work when you connect them to a USB-C charger or powerbank. They only work with a USB-A to USB-C cable, not with a USB-C to USB-C cable. I used to encounter such devices regularly a couple of years ago, but far…

Read more →

CVE-2026-111943

Read more →

CVE-2026-111943

Read more →

CVE-2026-111943

Read more →

CVE-2026-35189

Read more →

CVE-2026-111943

Read more →

CVE-2026-111943

Read more →

CVE-2026-111943, CVE-2026-61801

Read more →

CVE-2026-111943

Read more →

CVE-2026-111943

Read more →

CVE-2026-111943

Read more →

A China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike.  The threat group, which CrowdStrike tracks as Vapor Panda, targeted more than 200 organizations in at least…

Read more →

Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI…

Read more →

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. […]

Read more →

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. […]

Read more →

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 (CVSS score of 10.0) GitLab Community Edition and Enterprise Edition Integer Overflow…

Read more →

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

Read more →

Sponsored by:
Software Analyst Cyber Research

I think so much of winning at life comes down to something that’s hard to conceptualize. And I guess the way I encapsulate it is energy management. As I’ve gotten older and wiser, I have started noticing a pattern where my creativity and my positivity, and therefore my output and outlook and attitude and everything,…

Read more →

Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to…

Read more →

A vulnerability in TeamViewer could let attackers run code on an IT support technician’s computer when the technician…

Read more →

Shield Technology Partners has released new AI benchmarks showing that even leading AI models struggle to consistently resolve complex IT support tickets, raising questions about how MSPs should balance automation with technician oversight. The evaluation tested leading AI models against 52 challenging support tickets that Shield’s AI Engineer had previously handled incorrectly. GPT-6 Astra with…

Read more →

Cisco’s latest AI and infrastructure updates could create new opportunities for solution providers to expand recurring revenue through managed services, network modernization, and security operations, according to Presidio Chief Solutions Officer Dan O’Brien. Speaking with Channel Insider at Cisco Partner Summit in Vancouver, O’Brien said capabilities such as Cisco IQ and Cisco Cloud Control could…

Read more →

Deeper Network Promo

TD SYNNEX, Ingram Micro and Westcon-Comstor have each reported double-digit sales growth in their latest earnings results, signaling continued strength in IT distribution as demand for AI infrastructure, cybersecurity, cloud and networking drives technology spending. The results highlight more than rising revenue. While AI infrastructure investments are helping fuel growth, margin pressures and shifting purchasing…

Read more →

Anthropic wants businesses to stop guessing whether their AI investments are paying off, and its latest Claude Enterprise tools aim to give them a clearer picture of spending and results. The company has made three features generally available to Claude Enterprise customers: Smart Reports, in-app surveys, and pooled group budgets. Together, they help organizations understand…

Read more →

Only a quarter of Android phones have even made it to Android 16.

Read more →

Nvidia already dominates much of the AI chip market. Now, its proposed acquisition of Hugging Face is raising questions about how much influence one company should have over the broader AI ecosystem. The US Department of Justice is examining Nvidia’s proposed $12.93 billion acquisition of Hugging Face, including whether the deal could disadvantage competing chipmakers…

Read more →

NinjaOne plans to at least double its channel spending in 2027, with more support aimed at helping managed service providers (MSPs) grow their businesses rather than simply master its software. CEO Sal Sferlazza outlined the plans at NinjaOne’s MSP NXT conference in Austin, Texas, Oct. 27–29. The company also expects to hire about 1,000 employees…

Read more →

Argano has acquired Salesforce consultancy Oktana, expanding its artificial intelligence and data capabilities as the enterprise technology services firm builds out its global delivery operations. Announced October 13, the acquisition adds 227 professionals and more than 1,100 Salesforce certifications to Argano’s business, strengthening its expertise across Salesforce Agentforce, Data Cloud, MuleSoft, and AI-enabled application development.…

Read more →

Binance is investigating a reported $6.3 billion crypto breach tied to a suspected DevOps laptop compromise as partners freeze assets linked to the attack.

Read more →

On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230…

Read more →

Critical PHP vulnerabilities are raising urgent cybersecurity concerns, but for managed service providers (MSPs), the risks go beyond patching. CISA has warned organizations about critical PHP security flaws, collectively referred to as PHP2Shell, that could expose vulnerable web servers to remote code execution. For MSPs, MSSPs, and IT service providers, the incident highlights three major…

Read more →

Android flaw CVE-2026-58882 allows invisible SMS messages to crash telephony services, potentially disrupting emergency calls. Here’s what users should know.

Read more →

The FDA-approved sleep apnea tracking feature will first come to the Galaxy Watch Ultra 2, Watch 9, and Ring.

Read more →

I’m finally ready to upgrade to a smart calendar – and Amazon’s newest Echo device looks like an organizational solution for my family and I.

Read more →

Hackers are using fake PS5 emulator repositories on GitHub to distribute malware. Learn how the infection works and what gamers can do to stay safe.

Read more →

Cloudflare mitigated 18.2 million DDoS attacks in Q3 2026, up 208% year over year, as shorter attacks challenged traditional network defenses.

Read more →

The identity landscape you’re responsible for looks nothing like it did just a few years ago. Employees and contractors now share the enterprise with service accounts, machine identities, and a fast-growing population of AI agents — all accessing business systems and data. Every one of those identities represents an access decision, and every access decision…

Read more →

Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and documentary filmmakers. “Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” the company said. “The extreme cost, sophistication, and worldwide nature of…

Read more →

Researchers found 319 Chrome extensions linked to 13.4 million installs that redirected searches through operator-controlled servers. Here’s how to check.

Read more →

Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based “targeted intrusion adversary” it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in

Read more →

A vulnerability in some Netgear routers could allow an attacker with access to your network to run malicious commands on the device.

Read more →

North Korea’s TraderTraitor group drained about $6.36 billion from Binance wallets across ten blockchains on October 29, 2026. TRM Labs, which published the findings, calls it the largest crypto theft on record. TRM Labs says the total is about four times the $1.5 billion Bybit heist of February 2025. North Korean hackers Binance theft According…

Read more →

A Gitee scan found 26,400 working cloud and AI keys, including Alibaba Cloud and DeepSeek credentials. See what APAC security teams should investigate.

Read more →

For managed service providers, the next opportunity in AI-driven infrastructure management may be less about deploying new tools and more about automating the work required to maintain, secure, and modernize customers’ existing environments. Cisco is positioning its Cisco IQ platform, APIs and Model Context Protocol (MCP) capabilities as building blocks for those services, giving partners…

Read more →

Cisco is expanding its partner incentive strategy to reward more of the companies involved in customer sales and ongoing services, including advisors and developers that influence purchasing decisions without directly handling transactions. Speaking with Channel Insider at Cisco Partner Summit in Vancouver, Tim Coogan, Cisco’s SVP of Global Partner Sales, outlined how the company’s evolving…

Read more →

The Pentagon is investigating possible cyberattacks behind freezer failures at six US military bases, raising concerns about operational technology security.

Read more →

One of the great things about Apple device management solutions is that the market for them is growing. Another is that because no two enterprises are alike, there is scope to bring different offerings to the market. I spoke with Ben Greiner, co-founder and COO of Smplify, a new-to-market device management vendor, to find out what his company provides…

Read more →

Sponsored by:
Software Analyst Cyber Research

Google details 42 fixes to its Home app and the devices compatible with it.

Read more →

In this article Activity overview Attack chain overview Portable runtime staging and execution variants Host discovery and AD CS assessment Case 1: ESC1 abuse and the cost of an identity exclusion Case 2: PetitPotam and ESC8 turn a workstation into a domain-controller identity Why the response outcomes differed Actionable investigation methods References Learn More Microsoft…

Read more →

Run a quick Google Security Checkup and protect your email with three quick and easy steps.

Read more →

The Trump administration is taking direct aim at California state election officials, issuing grand jury subpoenas to election offices statewide ahead of the final day of voting on Nov. 3. The investigations, first reported by Bloomberg, center on alleged administration of illegal voting. They are ostensibly tied to demands by the U.S. Justice Department that…

Read more →

Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. […]

Read more →

RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems

Read more →

I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.

Read more →

Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators. Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed…

Read more →

Symantec’s Threat Hunter Team has found an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then rewrites their settings to turn off sandboxing. It has affected 12 organizations since early 2026, mostly in mainland China. Codex Claude Code relays AI coding agents read files, write code, and run commands…

Read more →

TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to…

Read more →

Deeper Network Promo

A defense contractor with top secret security clearance pleaded guilty to aiding North Korea’s remote worker scheme by allowing co-conspirators to use his identity to apply for jobs, including positions with national security implications, the Justice Department said Wednesday.  John Allen Kurrle Jr. participated in a short-lived but prolific conspiracy that spanned at least 88…

Read more →

Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses. Dozens of incidents, from brokerages to delivery firms, have made data leaks routine. Japan AI cyberattacks According to reporting published by Bloomberg, on October 28, Japan’s Ministry of Economy, Trade and Industry (METI) disclosed unauthorized…

Read more →

Anthropic’s Claude built exploit chains against Chrome, Safari, Windows, and Linux, and extracted files from a locked Pixel 9 during controlled security tests.

Read more →

The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans

Read more →

Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it. NetamLoader malware Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load…

Read more →

Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening and security hygiene, rather than a single vulnerability or CVE. Manually validating advisory recommendations across enterprise networks is difficult, time-consuming, and prone to inconsistencies. Qualys Policy Audit transforms advisory guidance…

Read more →

Weekly summary of Cybersecurity Insider newsletters

Read more →

A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. […]

Read more →

Ex-soldier Brett Velicovich turned a presidential social media shout-out into a $300 million drone startup.

Read more →

The GOLD OGRE cybercrime group is using AI coding agents, including Cursor and Anthropic’s Claude, to automate intrusions for Aur0ra ransomware (Aurora). Sophos researchers say the agents moved from credential access to domain administrator with little human involvement. Aur0ra ransomware AI attacks In May 2026, Sophos Counter Threat Unit (CTU) researchers reported an AI-assisted post-exploitation…

Read more →

A Syrian man who prosecutors say was a central figure in a hacking operation run from former President Bashar Assad’s inner circle was sentenced Thursday to 42 months in federal prison. Ahmad Umar Agha, 42, carried out the conspiracy from as early as Aug. 24, 2011, until Jan. 31, 2024, according to the Justice Department.…

Read more →

A fake GitHub repository tricks AI coding agents into installing SolanaCry malware, giving attackers remote access to developers’ Windows PCs through NetSupport.

Read more →

Cisco heeft een ernstige kwetsbaarheid verholpen in Cisco Secure Firewall Adaptive Security Appliance (ASA) en Cisco Secure Firewall Threat Defense (FTD). Cisco bevestigt dat de kwetsbaarheid actief wordt misbruikt. Deze kwetsbaarheid met kenmerk CVE-2026-76418 heeft een CVSS-score van 8.6 en bevindt zich in de Remote Access SSL VPN-functionaliteit. Een niet-geauthenticeerde kwaadwillende kan de kwetsbaarheid op…

Read more →

A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.

Read more →

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring…

Read more →

Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. […]

Read more →

Updated one or more CVSS scores for the affected products. This is an informational change only.

Read more →

Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.

Read more →

Corrected CVE by adding the assigning CNA. This is an informational change only.

Read more →

My first post for this blog was in June 2006, 20 years ago: A Ring Tone That I Cannot Hear. Back then, I tested my hearing with Audacity, and I could hear a tone up to 14 kHz. 20 years later, I do the test again, and I can hear a tone up to 8…

Read more →

Sponsored by:
Software Analyst Cyber Research

Juniper heeft meerdere kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor. De kwetsbaarheden betreffen verschillende componenten van de Juniper Networks Session Smart Router en Session Smart Conductor. – Er zijn out-of-bounds read- en write-fouten in HTTP-parser, TCP proxy, TCP header verwerking en VRRPv3 packet verwerking, die kunnen leiden tot service crashes,…

Read more →

Plus, Mistral releases ‘Le Chonk;’ the cloud delivers (again)

Read more →

In this post, you will learn why retired IT assets are one of the most overlooked cybersecurity threats. Typical cybersecurity that most organizations think of includes cloud security, firewalls, phishing attacks, and ransomware. Most investment and attention go toward protecting systems that are active and connected to the network. Yet there is a critical blind…

Read more →

A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced. Ahmad Umar Agha, also known as “Th3Pr0”, was sentenced on Thursday by a federal court in the Eastern…

Read more →

Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA). […]

Read more →

As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice. Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom…

Read more →

Shufti launches Know Your Agent (KYA), an AI agent verification solution designed to verify autonomous AI agents acting on behalf of individuals and businesses. Agentic commerce enables AI agents to open accounts, place orders, and move funds for their owners. A business receiving one of these requests needs to know whether the agent is genuine,…

Read more →

Bedrock Data has announced AI-assisted remediation, which federates the work of fixing data exposure to the data owners across the enterprise. Bedrock Data discovers who owns each exposed dataset, opens a ticket for that owner in the Jira or ServiceNow workflow the enterprise already runs and supplies the context needed to fix it. When the…

Read more →

This post will answer the question – are smartwatches safe from cyber-attacks? An advanced smartwatch allows the user to access the web easily. It is also viewed as a lifeline item because it helps you stay in touch when you need it, even if you have lost your telephone. Unlike the conventional Rolex watch, several…

Read more →

Trezor has issued an urgent warning after receiving a credible report of a suspected hardware implant in a Safe 5 cryptocurrency wallet purchased from the former reseller CryptoBilis. The company has not independently verified the device, and so far, no CryptoBilis customers have reported losing funds to Trezor. According to Trezor’s security advisory, the wallet…

Read more →