Suspected Chinese APT41 hackers have deployed BlackX, a UEFI bootkit, against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Researchers attribute the operation to APT41 with medium confidence. BlackX closely resembles BlackLotus, the bootkit advertised on underground forums for $5,000 in October 2022. ESET confirmed its capabilities in March 2023, demonstrating exploitation of Baton Drop, tracked…

Read more →

Data classification is the keystone control everything downstream borrows: DLP policies, access reviews, retention rules, and now Copilot-era AI governance all inherit whatever labels exist or don’t. The 2026 field splits into estate-native labelers, discovery-engine classifiers, user-driven labeling veterans, and AI-semantic challengers. One roster note: our sheet listed Fortra twice (Titus and Boldon James both…

Read more →

Tokenization wins by subtraction: swap sensitive values for worthless tokens and whole systems exit breach-impact and audit scope at once. The 2026 market splits by what you’re subtracting PCI scope (payment-rooted vaults and P2PE), privacy risk (PII vaults with developer APIs), analytics exposure (format-preserving engines living in warehouses) and by architecture: vaulted versus vaultless, proxy…

Read more →

Key management is where encryption programs succeed or quietly rot: ciphers are commodities, but custody who holds keys, how they rotate, what survives an outage or a quantum decade is architecture. The 2026 field spans cloud-native KMS floors, enterprise custody platforms, secrets-engine standards, in-path protectors, and the HSM-rooted institutions, with post-quantum readiness newly promoted from…

Read more →

The businesspeople adopting AI notetakers are not being reckless. They are responding to a real business need. Our teams are in meetings all day with companies we support, and the idea that we could read a clean summary of every one of them at the end of the day makes us better partners to our…

Read more →

DLP software earned its mixed reputation honestly a decade of false-positive floods taught teams to distrust the acronym and the 2026 field answers with distinct architectures: bundle-native floors, SSE-woven inline enforcement, endpoint-forensic depth, ML-first SaaS scanning, and renewal-lane veterans whose roadmaps deserve questions. This verdict guide reviews twelve options with the distinctions that decide outcomes:…

Read more →

An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power. Symantec captured the agent’s instruction set this summer through a honeypot posing as an unprotected AI service, researchers Priti More and Susmit…

Read more →

Malware analysis tooling spans a spectrum the acronyms hide: interactive sandboxes where analysts click alongside the malware, evasion-hardened hypervisor rigs for the samples that detect everything else, reputation oceans answering “has anyone seen this?”, binary-similarity engines, and the open standards (YARA above all) the whole field writes in. This verdict guide reviews twelve names across…

Read more →

Citrix NetScaler ADC and Gateway appliances are under active attack via CVE-2026-88771, a critical, unauthenticated remote code execution vulnerability that requires no optional features to be enabled. ThreatLabz observed attackers poisoning logs to trigger command execution, planting web shells and attempting to deploy a FreeBSD x64 implant. Citrix disclosed the vulnerability on September 27, 2026,…

Read more →

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated. Their “Node2Shell” proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed…

Read more →

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2), which can result in unauthenticated remote

Read more →

Multiple waves of DDoS attacks disrupted North Korea’s internet infrastructure this week, intermittently knocking over 40 official websites offline for about 32 hours. Network monitoring company Kentik linked the outages to synchronized surges of inbound traffic that began on October 20, 2026. Doug Madory, Kentik’s director of internet analysis, noted that aggregate traffic data showed…

Read more →

Latest additions to Getac’s flagship B360 lineup boast advanced Intel® CoreTM Ultra Series 3 processors and an expanded 14-inch screen, alongside enhanced security and…

Read more →

Australia’s own cyber security agency took its website offline this week. So did government sites in France, Finland, Denmark and the Netherlands, along with Wikipedia systems,…

Read more →

Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability remotely without authentication. The advisory, published on October 21, 2026, assigns the flaw a CVSS 3.1 score of 9.1 and advises distrusting impacted intermediate certificate authority certificates associated with eMudhra. The vulnerability specifically impacts…

Read more →

INTERPOL’s Operation Serengeti III led to 1,462 arrests, disrupted 10,909 malicious networks and recovered $105 million across 21 countries. INTERPOL announced the results of Operation Serengeti III, a multinational cybercrime crackdown that led to 1,462 arrests, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. The operation brought together law enforcement…

Read more →

Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna. Google positions them as options for demanding work, lower-cost professional tasks and everyday use that requires fast responses. More choice, one bill Businesses will purchase access through…

Read more →

In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short. He covers chain of custody for flight logs and video, how to publish drone activity without exposing sensitive operations, and common mistakes…

Read more →

The Everest ransomware group has reportedly stolen around 590GB of data linked to PwC, one of the Big Four professional services firms. The claim concerns internal human resources and learning systems, but it remains unverified, as no independent reports have confirmed it. A post shared by Crypto India states that the alleged theft includes 108,426…

Read more →

In October, several unpatched Linux vulnerabilities were disclosed on public mailing lists, revealing technical details before fixes were widely available. These disclosures included two critical flaws in KSMBD that could let remote attackers execute code, along with reports of privilege escalation and information disclosure. Trend Micro’s Zero Day Initiative (ZDI) submitted the reports, prompting Linux…

Read more →

A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations in India, including universities. Unit 42, Palo Alto Networks’ threat-intelligence team, says the actor used AI-generated reconnaissance and scripts to brute-force a university website and successfully stole a database containing more than 5,200…

Read more →

Now customers can upgrade to the powerful AI tools in DaVinci Resolve Studio with 20% off, plus save on DaVinci Resolve panels and keyboards!

Read more →

Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda’s Cybersecurity Skills Gap Report. 56% have experienced professional workforce reductions linked to AI, evenly divided between entry-level and higher-level roles. The post AI is taking cybersecurity jobs at junior and experienced levels…

Read more →

Here’s a look at the most interesting products from the past week, featuring releases from AppGate, IDENTOS, Sweet Security, and ThreatModeler. Sweet Security adds one-click protection for vulnerable cloud workloads Sweet Security has announced the release of Virtual Patching, a new capability that protects running cloud and AI applications from specific vulnerabilities the moment they…

Read more →

Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII.

Read more →

Jabra, today announced the appointment of Max Davies as Managing Director, Australia and New Zealand, effective 26 October 2026.

Read more →

First among its peers to pursue the most rigorous certification level currently available under the modernised FedRAMP framework.

Read more →

New functionality connects software bills of materials SBOMs and vulnerability findings with signing controls to help teams identify affected versions and enforce release policies.

Read more →

Telstra’s most ambitious Flagship store yet, shaped around every kind of visit. Telstra’s largest and most ambitious store yet, Bourke Street brings together the very best of…

Read more →

VAST AI OS provides an industrial-grade, high-performance data foundation supporting DeepL’s language and voice AI workloads

Read more →

OpenAI fired three safety researchers for mishandling sensitive information. They had been fighting to keep the workings of AI systems visible—and to let outsiders look.

Read more →

Ambient AI delivers roughly 10x the engagement of first-generation conversational AI; Customers acted on 98% of critical nudges, leading to expedited issue resolution

Read more →

Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time to truly understand. But one of the lesser-known stories centers around disclosure. According to The PHP Foundation, several organizations had agreed to a coordinated release detailing the critical flaws and mitigation actions, but cybersecurity…

Read more →

Integration enables organisations to run AI-assisted threat detection and security operations within customer-controlled infrastructure, keeping security data within their…

Read more →

Tenable Research classifies these vulnerabilities as Vulnerability of Concern, our highest classification level under Vulnerability…

Read more →

Deeper Network Promo

New leadership, bigger ambitions and a renewed focus on Australia’s technology future.

Read more →

Megumi Yoshinaga, Head of APAC Marketing, Plaud

Read more →

Read more →

Read more →

Read more →

Brookings and the World Economic Forum say agent governance must be continuous, scoped in advance, evidenced, and monitored at runtime. We think that bar is correct, and that most organizations are nowhere near it. Most of what companies call AI agent governance today is paperwork. A review board approves the use case. A policy document…

Read more →

Nutanix Is Expanding Its AI Ecosystem with NVIDIA, Supermicro, and Netris to Help Enterprises and Service Providers Quickly Deploy and Scale Production AI, and Reduce AI Costs

Read more →

Holmes’s downfall was triggered by these Journal articles about the blood-testing company and its founder.

Read more →

Two critical PHP vulnerabilities sent criminal forum operators scrambling to protect their own infrastructure, revealing that threat actors face the same exposure management challenges as the organizations they target. Key takeaways The adversary economy operates on the same fundamental principles as the legitimate economy.  Forum self-evacuations: Criminal forums including BreachForums initiated emergency infrastructure migrations, taking…

Read more →

Plus, the DOJ is reviewing allegations against a former Homeland Security adviser, and Meta’s hunt to fund its AI build-out spooked investors.

Read more →

Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. […]

Read more →

A laptop can appear in an inventory and still leave important questions unanswered. Its owner might have changed, its warranty might be ending, and the software assigned to its…

Read more →

Take a hypothetical Geelong landscaping company, Ridgeline Landscapes. It registered ridgeline.com.au in 2018. The licence is in the company’s name and the ABN matches. On…

Read more →

China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks…

Read more →

The China-linked actor used an AI-enabled penetration-testing tool to automate and accelerate its attack on more than 2,200 tenants.

Read more →

In this video, Dark Reading editors discuss some of the news they didn’t get a chance to cover, from busting up North Korea’s stateside infrastructure in “Operation Lonestar Justice” to Staples’ gift card bonanza.

Read more →

GitLab on Wednesday published updated versions of its Community Edition (CE) and Enterprise Edition (EE) that address a dozen bugs and security issues, including some that allow various unauthenticated actions.  The most serious of the security issues, labeled critical in severity, is CVE-2026-110264, an integer overflow issue. “GitLab has remediated an issue that, under certain…

Read more →

As AI use spreads across the business, organisations are finding it harder to maintain effective governance.

Read more →

Japanese gaming giant Capcom has confirmed that hackers breached its membership service, CAPCOM ID, exposing more than 11.7 million customer email addresses and associated information. […]

Read more →

An AI data center can spend months being assembled before it starts serving customers. Nvidia wants to cut that wait dramatically. At GTC Berlin on Oct. 21, Nvidia introduced DSX POD, a reference design it says could reduce onsite deployment at prepared sites from six months to as little as 14 days. That timeline excludes…

Read more →

Des centaines de magasins ont subi des pertes se chiffrant en millions d’euros parce qu’ils avaient fait appel à des tiers pour gérer le micrologiciel OT obsolète qui pilotait leurs systèmes de climatisation.

Read more →

SentinelOne is expanding its PartnerOne program with new AI security and Autonomous SOC certifications, giving MSPs and resellers additional opportunities to build implementation, consulting, and managed security services around its Singularity Platform. The AI security company also announced an expansion of its partnership with Lenovo, bringing SentinelOne’s AI security to Lenovo’s ThinkShield security portfolio. SentinelOne…

Read more →

Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. […]

Read more →

How is AI changing the work of managed security service providers? In this Channel Insider: Partner POV interview, Optiv‘s Kathryn Hall, senior vice president of managed security services, and Steve Fielder, vice president of engineering and AI solutions, discuss Optiv’s approach to AI security and evolving customer needs. They explain how they’re evaluating AI security…

Read more →

Attackers are increasingly focusing on a limited range of critical vulnerabilities to run attacks with flaws packaged into exploits within as little as three days. Rapid7’s latest Quarterly Threat Landscape report found the number of newly exploited vulnerabilities in Q3 of 2026 was 43, up 19% year on year. Douglas McKee, director of vulnerability intelligence…

Read more →

A critical Signal flaw could keep calls active after hang-up, exposing microphone or camera. Update to a fixed version immediately. A critical vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 of 10), in Signal ’s calling library could allow a malicious caller to interfere with call termination, potentially leaving the victim’s microphone and camera active after…

Read more →

eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers’ certificates with free ones from partners, though its

Read more →

Meta faces a $25 billion penalty in New Mexico over Facebook privacy claims. Learn what the court found and what security teams should review next.

Read more →

Welcome to this week’s edition of the Threat Source newsletter.  Here for the latest on the PHP vulnerabilities? Head on down to ‘The One Big Thing’. Talos has published a blog to explain what we know so far, and details the Snort coverage available, including rules in the Community Ruleset.  But if you want a…

Read more →

Autonomous vehicle programs need specialists to integrate computing, software and safety testing. Nvidia’s latest European announcement highlights potential work for technology providers with automotive expertise.  On Oct. 21, Nvidia said European automakers and mobility providers, including Bolt with Lucid, Mercedes-Benz, Volkswagen Commercial Vehicles and Einride, were showcasing Hyperion use cases for potential Level 3 and…

Read more →

Cardano payroll could support ADA salaries and automated payments, but employers must address price volatility, tax obligations, wallet security and compliance.

Read more →

This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That’s a lot to deal with in just a few days. And the week isn’t even over yet. But those…

Read more →

A new bipartisan House bill would charge the federal government with developing formal guidance for defending AI models against distillation attacks. The AI Cyber Defense Act, shared exclusively with CyberScoop ahead of release, is sponsored by Reps. Pat Harrigan, R-N.C., and George Whitesides, D-Calif. It would direct the National Institute for Standards and Technology to…

Read more →

Deeper Network Promo

Arista Networks released security updates to patch an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments. […]

Read more →

Linux servers running KSMBD, the kernel’s built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro’s Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an…

Read more →

Facebook’s Cambridge Analytica scandal may feel like very old news. But the consequences are still arriving, and the latest comes with a $25 billion price tag. Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled consumers about its data practices…

Read more →

I was taking my dog for her perambulation through the leafy valleys and forests of one of the most densely populated parts of London this morning when it struck me how annoying it has become that I must now update multiple Apple devices across my family group. That’s pretty much mandatory given recent security warnings, and may involve additional…

Read more →

Contern, Luxembourg, October 22nd, 2026, CyberNewswire Gcore is offering its WAAP Enterprise plan free of charge to any government body or public agency until December 31, 2026. The offer follows the php2shell vulnerabilities that forced public websites offline across Europe earlier this week. Gcore WAAP blocks the php2shell attack path (CVE-2026-109618 and CVE-2026-109619) by default…

Read more →

Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company’s Cambridge Analytica data scandal, which came to light in 2018. According to multiple reports from the Associated Press, the New York Times, Reuters, and…

Read more →

European customers are getting more options to oversee access to their Microsoft cloud systems and keep critical workloads under local control. Microsoft announced Sovereign Cloud updates on Oct. 20 covering access oversight, encryption keys, and disconnected operations. For MSPs and systems integrators serving regulated customers, the changes create potential work in configuring controls, documenting responsibilities,…

Read more →

Unlike narrated audiobooks from Audible and other providers, the audiobooks created with Virtual Voice in Kindle+ will instead be narrated by AI.

Read more →

Kate Pundyk, Siena Anstis, and Marcus Michaelsen write about the rise of AI-enabled digital transnational repression in their piece for Just Security. The use of AI models to identify, monitor, and target diaspora activists and exiled dissidents around the world demonstrates how the misuse of technology produced by companies like Anthropic can have an adverse…

Read more →

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. […]

Read more →

INTERPOL’s Operation Serengeti III targeted cybercrime in 21 African countries, recovering over $105 million and identifying 65,929 victims…

Read more →

PowerToys is one of my favorite free Windows utilities. With more than 30 tools, it offers something for everyone from beginners to power users. Here’s what’s new for mousing.

Read more →

Google Chrome adds Gemini AI scam detection and ClickFix malware warnings, bringing new security protections to more than 1 billion users.

Read more →

Run journalctl with a time window and -o json, and you get one JSON object per line with every field the journal stored: sudo journalctl –since “2026-10-19 00:00” –until “2026-10-20 00:00” -o json –no-pager > web-03_journal.jsonl For a syslog-style text file instead, use -o short-iso. Without sudo, or membership in systemd-journal, adm or wheel, you…

Read more →

Run journalctl with a time window and -o json, and you get one JSON object per line with every field the journal stored: sudo journalctl –since “2026-10-19 00:00” –until “2026-10-20 00:00” -o json –no-pager > web-03_journal.jsonl For a syslog-style text file instead, use -o short-iso. Without sudo, or membership in systemd-journal, adm or wheel, you…

Read more →

Discover how Cisco and SentinelOne work together across Splunk, Duo, Firepower and now ISE — turning endpoint detection into automated network access decisions.

Read more →

Huntress examines 3 phishing kits that hand beginner attackers everything they need to steal tokens. See what the attacks look like from the inside.

Read more →

Indian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its certificates were so weak they could be reconstructed in under a second. The announcement closes an incident where major browsers blocked the certificates and  Indian authorities launched an investigation.   The company…

Read more →

AWS detected PHP2Shell exploit attempts four days before disclosure, highlighting the risk of attackers exploiting critical flaws before patches arrive. Attackers attempted to exploit two critical PHP vulnerabilities four days before the flaws became public, according to Amazon Threat Intelligence. “Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot…

Read more →

Coco Robotics and Serve Robotics face Chicago lawsuits alleging biometric data collection without consent, raising questions about privacy and AI training.

Read more →

CONTERN, Luxembourg, Oct. 22, 2026, CyberNewswire — Gcore is offering its WAAP Enterprise plan free of charge to any government body or public agency until December 31, 2026. The offer follows the php2shell vulnerabilities that forced public websites offline across Europe earlier this week. Gcore WAAP blocks the php2shell attack path (CVE-2026-109618 and CVE-2026-109619) by…

Read more →

auditd writes to /var/log/audit/audit.log, readable only by root. The quickest export of a time window in the original format is: sudo ausearch –raw -ts yesterday > web-03_audit.log If /var/log/audit doesn’t exist, auditd isn’t installed. That’s the default on Debian and Ubuntu. The kernel’s audit events then go to the journal, where journalctl _TRANSPORT=audit finds them.…

Read more →

The warnings are everywhere these days. Don’t click this. Don’t open that. Don’t scan this. Don’t download that. These messages of caution, however well-intended, are so ubiquitous and constant that it should come as no surprise that some people have started to tune them out. How many people? About one in three, according to our…

Read more →

OpenAI is expanding its push into drug development, this time with AI agents designed to handle the operational work behind bringing new medicines to market. The ChatGPT maker acquired San Francisco-based Orchestra Bio and folded its team and technology into Rosalind, the company’s suite of AI models and tools for life sciences research. Financial terms…

Read more →

Contern, Luxembourg, 22nd October 2026, CyberNewswire

Read more →

Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical. […]

Read more →

Improper neutralization of special elements used in a command (‘command injection’) in Azure Pipelines allows an unauthorized attacker to execute code over a network.

Read more →

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

Read more →

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Read more →

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

Read more →