Proofpoint agreed Thursday to acquire Varonis Systems in a cash transaction valued at approximately $6.3 billion, combining two companies that have positioned themselves around a shared bet: that securing data has become the central problem of the AI era. The acquisition pairs two distinct approaches to security. Varonis specializes in data security, mapping where sensitive…

Read more →

Don’t buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it.

Read more →

Citizen Lab found targeted ads delivered Candiru spyware to Al Jazeera devices without clicks, while the same ad…

Read more →

Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud. […]

Read more →

A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel’s live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel’s networking code,…

Read more →

European researchers need computing resources as well as scientific expertise to advance AI-assisted research. For cloud partners supporting those institutions, access to models is only part of the deployment challenge. Google announced Oct. 14 that it will provide $3 million in compute credits and access to frontier models for up to 200 European researchers. Through…

Read more →

Most enterprises don’t have a monitoring problem. They have too many monitors. Riverbed’s CIO told iTWire TV that the average enterprise runs 12 observability tools across…

Read more →

Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. […]

Read more →

Election influence campaigns, particularly ones playing out over social media, are a dime a dozen. Such campaigns – sometimes devised by foreign powers, other times by domestic groups – are often designed to influence the U.S. electorate. Fake accounts and online personas are created, networks of propaganda are disseminated and the campaign seeks to nudge…

Read more →

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability  CVE-2026-76519 Cisco Secure Email…

Read more →

Hyperscalers are still searching for the right tone to drum up support.

Read more →

Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week’s security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong…

Read more →

Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia. The targets include the…

Read more →

A proxyjacking campaign has impacted devices in 34 countries, monetizing victims’ internet connections through a commercial residential proxy network. […]

Read more →

Welcome to this week’s edition of the Threat Source newsletter.  I’ve been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell (although I’m writing this with 1°C/34°F outside), Vulnpocalypse, Bugmageddon, Bugpocalypse, Breachpocalypse…  Let’s look at some numbers: We crossed the…

Read more →

AI-powered security tools promise to make MSP operations more efficient, but new research from N-able suggests they may be creating additional challenges for providers already struggling with security alert fatigue. According to N-able’s AI Fog Report: When the Signal Becomes the Noise, released October 15, 61% of MSP respondents said security alert noise disrupts incident…

Read more →

Chasing overdue invoices can tie up finance teams for weeks, particularly when payment disputes and missing records slow the process. Genpact made its Accounts Receivable (AR) Suite generally available on Oct. 14 for manufacturers and mining companies, where complex contracts, payment disputes and fragmented financial processes can delay cash collection. The suite includes three modules:…

Read more →

A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. […]

Read more →

Watch how this $9 million robotics project could revolutionize how we survey and protect our sewage systems.

Read more →

The partnership gives developers a new way to run sophisticated AI without renting computing power from the cloud.

Read more →

OpenAI says AI helped investigate a hidden recording device. The case highlights insider threats and why sensitive meetings need physical security checks.

Read more →

A researcher found 13.7 million previously leaked records in an unsecured database linked to Vibetech, highlighting risks from exposed and reused passwords.

Read more →

Eyeing Apple’s new Home Collection products? Renters should check their lease agreement before installing.

Read more →

Apple reportedly set a date to unveil its new touchscreen MacBooks. Here’s what else we expect.

Read more →

We applied AWS Security Agent (now part of AWS Continuum), our autonomous penetration-testing agent, to 37 real, recently disclosed Common Vulnerabilities and Exposures (CVEs), each packaged as a live, containerized target with a flag hidden at the vulnerability’s intended sink. Starting from an unauthenticated or low-privilege position (an endpoint URL and a one-line hint, no…

Read more →

Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases…

Read more →

The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives

Read more →

The best endpoint security solutions for small businesses include Bitdefender, ESET, Sophos, Avast, ThreatDown, and Acronis for protecting business devices.

Read more →

DSPM helps CISOs move beyond data visibility to prioritize meaningful exposures, drive remediation, and measure whether material data risk is actually declining.

Read more →

An misconfigured Vibetech database exposed 13.7 million records from previous breaches, including AT&T, Casio and FBI data, passwords and bank details.

Read more →

Welcome to the PCI Security Standards Council’s blog series, The Quantum Leap: Preparing for Post Quantum Cryptography. This special, ongoing feature of our PCI Perspectives blog offers a resource for payment security industry stakeholders to share information about how they are taking steps to ensure their systems are crypto-agile into the future.

Read more →

Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.

Read more →

Zoom Communications, Inc. has appointed Andrew Hindmarch as head of channel for Asia Pacific (APAC), tasking the executive with leading its regional partner strategy across distributors, resellers, systems integrators, and service providers. Announced Oct. 12, the appointment puts Hindmarch in charge of expanding market reach and strengthening partner capabilities across Zoom’s portfolio, including ZoomMate, Zoom…

Read more →

Boca Raton, Florida, October 14th, 2026, TechnologyWire Collaboration combines INmune Bio’s clinical research with QCi’s Dirac-3S quantum optimization machine to identify potential new treatment indications and biomarkers for XPro Initial engagement marks QCi’s first commercial customer in pharmaceutical and biotechnology markets, expanding the application of quantum computing to drug development INmune Bio Inc. (Nasdaq: INMB)…

Read more →

Nvidia’s new models join a wave of open-weight releases from US labs on the heels of the Hugging Face hack.

Read more →

Deeper Network Promo

ASOS reveals that hackers used compromised employee credentials to access customer data following an earlier breach that affected 138,828 people.

Read more →

Enterprise customers are rethinking how they buy, manage, and maintain IT hardware. Instead of large upfront investments, more organizations are turning to Hardware-as-a-Service (HaaS) models that offer predictable monthly costs, ongoing support, and simplified technology upgrades. In this Channel Insider interview, Greg LaBrie, Vice President and General Manager of WEI Connect at WEI, joins Victoria…

Read more →

Read more →

Spyware vendors use online ad infrastructure to profile targets and deliver exploits without requiring users to click anything. The investigation links Discover-Tech to Candiru, an Israeli spyware vendor that the US government placed on its Entity List in 2021. Candiru has since used the name Integrity Labs. Citizen Lab also identified links involving other surveillance…

Read more →

Researchers tracked more than 2,600 AI agent attempts targeting Alibaba’s Amap from Tencent-linked infrastructure, raising concerns about agent security controls.

Read more →

On October 13 and 14, Google issued several Chrome updates. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux. The update includes 37 security fixes, including seven rated Critical. On the same day, Google released version 155.0.8059.79 for Android. It may not be available on Google…

Read more →

A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites…

Read more →

South Korea confirms breaches at 16 financial firms, exposing about 100,000 personal records as regulators investigate attack methods and security gaps.

Read more →

ServiceNow is giving its AI Control Tower new features to make AI agents more governable — and a new name, Super Intelligence Control Tower (SICT), to please the US President. It is also updating EmployeeWorks to make building AI agents easier. AI Passport, a new component of SICT, gives every agent, whether from ServiceNow or…

Read more →

AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing. […]

Read more →

ServiceNow has announced a new AI Passport solution and significant advances in AI governance to help ensure AI agents are production-ready by combining runtime governance, platform integration, and comprehensive oversight, all inside ServiceNow’s operational AI harness. Specifically, AI Passport is a new authority layer that gives enterprises runtime control over what AI agents and Model…

Read more →

A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the screen. The malware, called KGB RAT, was analyzed by Group-IB malware…

Read more →

France-based operators of Danfoss refrigeration controllers have sharply reduced their internet exposure after the October 11 cyber-attack

Read more →

Nvidia is committing $250 million in computing resources to UK researchers working to make increasingly autonomous AI systems safer and more secure. Announced Oct. 14, the five-year initiative will provide approximately $50 million annually in computing access for research into AI agent security, open-model vulnerabilities, and real-world threats. The commitment involves computing resources rather than…

Read more →

Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, malicious browser notifications, and commands that victims are tricked into running themselves, according to Barracuda. The company found CAPTCHA abuse in 43% of the phishing-kit attacks it…

Read more →

If your business has lots of Macs, what do you do with them at night? And how much money do you spend on AI inferencing? What if the computational power of those Macs could be used to handle some inferencing tasks? A new white paper from Apple’s machine learning team tells us it’s possible. Apple’s teams have developed…

Read more →

Plus: Trump’s diesel deal with Russia, America’s quietly improving EV charging network and tips from a climate expert on weatherproofing your home.

Read more →

Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. […]

Read more →

Read more →

Plus, the insider threat worrying the top AI labs

Read more →

Google unveiled two new shopping tools ahead of the holiday buying season. Here’s what to know.

Read more →

New research from cybersecurity services firm Cyber Defense Group reveals a gap in organizations’ confidence in their ability to contain cyberattacks and preserve critical evidence.  While 60% of IT leaders are very confident they could contain a security incident within 24 hours, just 37% express the same level of confidence in their ability to preserve…

Read more →

Symantec warned that Aoki can steal API keys and tokens from a number of popular AI coding assistants, including Claude and Gemini

Read more →

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth…

Read more →

Maybe it’s a text saying your package couldn’t be delivered, with a link to reschedule. Or an email from your bank asking you to verify your account. Or perhaps it’s an invitation from someone you know to view a document.  The message looks real enough, but something about the link feels fishy. Do you click…

Read more →

Allowing users to add their own information to the company’s generative AI-based ASKB interface will feed the system with a new level of context.

Read more →

Weekly summary of Cybersecurity Insider newsletters

Read more →

The drugmaker will pay AI therapeutics company Insitro $40 million upfront and up to $1.46 billion subject to meeting targets.

Read more →

A critical vulnerability affecting Cisco’s Secure Email Gateway product is allowing attackers towrite arbitrary files on the underlying operating system. In an advisory issued on Wednesday, the company urged customers to apply available fixes after confirming that the flaw is being exploited in the wild. The flaw affects the product’s Advanced Malware Protection (AMP) feature…

Read more →

Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in

Read more →

Anthropic finds small AI models can set up inference servers across different hardware, raising concerns about future AI…

Read more →

Optro has expanded its global Partner Connect program with new tracks for technology partners and distributors, alongside growth funding and a planned awards program, as the GRC software provider looks to help partners build and scale their practices. “Our partners are fundamental to our ability to solve complex GRC challenges for enterprises across the globe,”…

Read more →

Every SOC analyst knows the feeling. A new threat report lands in your queue, dozens of pages long, packed with techniques, tools, and timelines. Somewhere inside is the information your team needs to defend better, but finding it takes time you rarely have. Prime Architect removes that bottleneck.  Prime Architect is SOC Prime’s AI-powered workspace…

Read more →

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site’s server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist…

Read more →

Ninety-two days, 588 incidents, one attack roughly every four hours. This infographic distils the Q3 2026 cyber attacks statistics into the numbers that matter: motivations, top techniques, initial access, targeted sectors and geography.

Read more →

Deeper Network Promo

In the third quarter of 2026, I recorded 588 cyber incidents. Cyber Crime accounted for 77.1% of motivations, Malware was the most common attack technique at 31.9%, and Exploit Public-Facing Application (T1190) led initial access at 30.4%. Information and Communication was the hardest-hit sector.

Read more →

Attackers are exploiting a newly disclosed flaw in Palo Alto Networks’ PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17. Palo Alto Networks disclosed the vulnerability, tracked as CVE-2026-0322, in a security advisory published October 14. The flaw…

Read more →

Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. […]

Read more →

Every day, threat intelligence teams read reports describing new attacker campaigns, and every day detection engineers face the same question: how do we turn this into detection content before the threat reaches our environment? Reading a long report, spotting the behaviors that matter, and writing a correct rule by hand takes time that most SOC…

Read more →

The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation of exploiting people already targeted by sextortionists. We have talked about sextortion and recovery scams in the past, but we never looked specifically at the combination. Apparently, there is a lot of money to be made for those ruthless enough to take…

Read more →

Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026.  The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets.  Similar attacks

Read more →

Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. “A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS…

Read more →

Ransomware attackers are expanding their tactics beyond encrypting corporate systems and threatening to leak stolen data. They are increasingly using AI in attacks, exploiting organizations’ own AI systems and even using physical intimidation by threatening employees and their families to pressure companies into paying ransoms. The Semperis’ 2026 Ransomware Risk Report found that 84% of…

Read more →

CVE-2026-35029 and CVE-2026-59823 affect LiteLLM, which is commonly used by enterprises to connect their AI applications to providers like OpenAI and Anthropic

Read more →

Plus: OpenAI alleges an ex-employee took confidential files to Apple and two cargo ships sink near the Strait of Hormuz.

Read more →

Cisco has patched CVE-2026-76519, a critical zero-day vulnerability affecting Cisco Secure Email Gateway (SEG) that is already being exploited in real-world attacks. The flaw carries a CVSS score of 9.8 and enables an unauthenticated remote attacker to write arbitrary files and execute commands with root privileges on vulnerable appliances. The vulnerability resides in the Advanced…

Read more →

Palo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS. The flaw carries a CVSS 4.0 score of 8.6 and enables an authenticated attacker with network access to execute arbitrary code with root privileges on a vulnerable appliance/system. Palo Alto Networks disclosed the issue…

Read more →

Photos you take with your phone and some digital cameras can contain hidden information, including where they were taken. You can strip that data out before sharing a photo with someone, which would help to protect your location. But the image itself may still give you away. A company called Graylark says its Raven AI…

Read more →

AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and validation standards in place, that gap…

Read more →

A Delaware jury found that Arm breached its licensing agreement with Qualcomm but awarded the chipmaker just $2 in damages, leaving a potentially multibillion-dollar dispute over royalty payments unresolved. The jury ruled on October 13 that Arm had failed to provide software patches and development tools required under its agreement with Qualcomm. It also found…

Read more →

As Microsoft adds more advanced agentic capabilities to Copilot, such as Cowork and Autopilot, usage-based pricing is becoming an increasingly important part of its business model. But for customers used to predictable, fixed pricing, the addition of pay-as-you-go billing can be a significant change, creating new challenges around managing and predicting costs. Questions about the…

Read more →

Plus, the AI boom is supercharging Wall Street profits.

Read more →

The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-0322, a high-severity remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS CVE-2026-76519, a critical relative path traversal vulnerability in Cisco Secure Email Gateway (SEG) CVE-2026-105133, a medium-severity improper authentication…

Read more →

The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers’ registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls. To that end, the Department of Telecommunications has issued…

Read more →

Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI and Iron Man, services that enabled over 1…

Read more →

DayOne has secured another $3.67 billion to expand its data center operations in Malaysia, bringing its total Malaysian financing platform to approximately $7.2 billion. The Singapore-based developer announced an additional 15 billion Malaysian ringgit in financing from seven banks to support its expansion in Johor, a growing hub for cloud and AI infrastructure. The new…

Read more →

Microsoft uncovered a criminal marketplace supplying tools and accounts used in phishing scams worldwide. Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India. Phishing kits and cloud accounts for sale Working with Resecurity, Microsoft identified three phishing kits sold through YAM…

Read more →

That online ad you saw for earbuds, a drone or bubble gum-scented car air freshener may have been a gateway for mercenary spyware that can infect your device without you ever having to click on it. The Citizen Lab at the University of Toronto on Thursday said it was revealing the first details of zero-click…

Read more →

Microsoft and partners reveal a major Chinese-language phishing network centered around the Yam Store marketplace

Read more →

Plus, suspicions mount over restrictions on Ukraine’s Starlink access, and UBS prepares for a once unimaginable move.

Read more →

Adding 10 new clients sounds like exactly the kind of problem an MSSP wants to have. More revenue, more accounts, more room to grow. But growth also brings more alerts, suspicious files and URLs, investigations, escalations, reports, and SLA commitments. And if too much of that work still depends on manual analyst effort, those 10…

Read more →

Abdulrahman Alfozan kept ties in Saudi Arabia while he rose in Silicon Valley, until federal agents accused him of hiding a recorder behind a conference-room television.

Read more →

New medications are showing promise in going after a certain kind of hard-to-target protein in diseased cells.

Read more →

Abdulrahman Alfozan kept ties in Saudi Arabia while he rose in Silicon Valley, until federal agents accused him of hiding a recorder behind a conference-room television.

Read more →

Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. An attacker can exploit the flaw…

Read more →