# Geek Guy > Everything is ideas, the rest is nature. Language: en URL: https://www.geek-guy.com/ All pages on this site are available as clean Markdown by adding the header `Accept: text/markdown` to any HTTP request, or via the REST API: REST API: https://www.geek-guy.com/wp-json/mescio-for-agents/v1/markdown?url={page_url} REST API (by id): https://www.geek-guy.com/wp-json/mescio-for-agents/v1/markdown?id={post_id} ## Pages - [Threat Actor Dossier: APT38 (Lazarus Group)](https://www.geek-guy.com/2026-threat-intel-report/threat-actor-dossier-apt38-lazarus-group/): THREAT ACTOR DOSSIER ==================== BASIC INFORMATION Name: APT38 (Lazarus Group)  Aliases: APT38, HIDDEN COBRA, DHARMA, DPRK THREAT ACTOR, NORTH KOREAN CYBER WARFARE, G0032  MITRE ATT&CK Group ID: G0032  Country of Origin: North Korea (DPRK)  Affiliation: North Korean state-sponsored cyber warfare unit  Type: State-sponsored cyber warfare - [Tokenization](https://www.geek-guy.com/glossary-of-sec-and-it-terms/tokenization/): Tokenization. Replacing sensitive data with non-sensitive tokens that have no value if stolen, commonly used in PCI-DSS compliance. - [Shadow AI](https://www.geek-guy.com/glossary-of-sec-and-it-terms/shadow-ai/): Shadow AI. The use of unapproved AI tools by employees, which risks the leakage of proprietary code or PII into public LLM training sets. - [DLP](https://www.geek-guy.com/glossary-of-sec-and-it-terms/dlp/): Data Loss Prevention is a set of tools that inspects data in use, in transit, and at rest to prevent unauthorized transmission of sensitive info. - [DDR](https://www.geek-guy.com/glossary-of-sec-and-it-terms/ddr/): Data Detection and Response provides real-time monitoring of data access and movement to stop exfiltration across Cloud and SaaS apps. - [Data Sovereignty](https://www.geek-guy.com/glossary-of-sec-and-it-terms/data-sovereignty/): Data Sovereignty. The principle that data is subject to the laws of the country where it is physically stored (e.g., GDPR requirements for data residency). - [AI-BOM](https://www.geek-guy.com/glossary-of-sec-and-it-terms/ai-bom/): An AI Bill of Materials (AIBOM) is a comprehensive, machine-readable inventory of the components required to develop, train, and run an AI model. It is the AI-specific evolution of the traditional Software Bill of Materials (SBOM). - [SBOM](https://www.geek-guy.com/glossary-of-sec-and-it-terms/sbom/): Software Bill of Materials is a machine-readable ingredient list for software, used to track vulnerabilities in open-source dependencies. - [Supply Chain Risk Management](https://www.geek-guy.com/supply-chain-risk-management/): Supply Chain Risk Management focuses on the security of third-party vendors, from hardware manufacturing (silicon root of trust) to software libraries. - [CIA Triad](https://www.geek-guy.com/glossary-of-sec-and-it-terms/cia-triad/): The CIA Triad (Confidentiality, Integrity, Availability), expanded to include Authenticity and Non-repudiation. - [Exposure Management](https://www.geek-guy.com/glossary-of-sec-and-it-terms/exposure-management/): Exposure Management. Is a shift from finding CVEs to analyzing the exploitability of an entire attack surface, including misconfigurations and risky behaviors. - [AI-SPM](https://www.geek-guy.com/glossary-of-sec-and-it-terms/ai-spm/): AI Security Posture Management secures the AI stack, detecting Shadow AI and protecting models from prompt injection or data poisoning. - [Zero Trust](https://www.geek-guy.com/glossary-of-sec-and-it-terms/zero-trust/): Zero Trust. An architecture based on the principle of never trust, always verify, removing the concept of a trusted internal network. - [TEE](https://www.geek-guy.com/glossary-of-sec-and-it-terms/tee/): Trusted Execution Environment is a secure enclave in a processor that protects data and code even if the host OS is compromised. - [Threat Actor Dossier: APT41 (BARIUM/BRASS TYPHOON/WICKED PANDA)](https://www.geek-guy.com/2026-threat-intel-report/threat-actor-dossier-apt41-barium-brass-typhoon-wicked-panda/): THREAT ACTOR DOSSIER ==================== BASIC INFORMATION Name: APT41 (Advanced Persistent Threat 41)  Aliases: BARIUM, BRASS TYPHOON, WICKED PANDA, Double Dragon  MITRE ATT&CK Group ID: G0096  Country of Origin: People's Republic of China  Affiliation: Chinese state-sponsored espionage group  Type: Dual-purpose (state-sponsored espionage + financially motivated cybercrime) - [2026 Threat Intel Report](https://www.geek-guy.com/2026-threat-intel-report/): THREAT ACTOR INTELLIGENCE REPORT Comprehensive Analysis of Major Threat Actors (2026) Classification: Unclassified - Intelligence gathered from open and public sources Executive Summary This report provides a comprehensive analysis of ALL major global threat actors, focusing on their recent operations, - [CyberSec Product Reviews](https://www.geek-guy.com/cybersecurity-product-reviews/): The ideal resource for cybersecurity professionals, Chief Information Security Officers and Security Operations professionals. -=-=-=- Coming Soon -=-=-=-= Cybersecurity Products by Category Cybersecurity Products (Alphabetically) Products by Category - [Shop](https://www.geek-guy.com/shop/) - [A Beginner’s Guide to Malware Detection](https://www.geek-guy.com/beginners-guide-to-malware-detection/): Discover essential insights on malware detection, learn to identify threats, and protect your devices with this beginner-friendly guide. - [Penetration Testing](https://www.geek-guy.com/glossary-of-sec-and-it-terms/penetration-testing/): Penetration Testing. A structured, authorized attempt to exploit vulnerabilities in a system to evaluate the security of that system. - [IAST](https://www.geek-guy.com/glossary-of-sec-and-it-terms/iast/): Interactive Application Security Testing uses agents inside the app to find vulnerabilities during runtime with high accuracy. - [Breach and Attack Simulation](https://www.geek-guy.com/glossary-of-sec-and-it-terms/breach-and-attack-simulation-2/): Breach and Attack Simulation tools that automate the execution of threat actor TTPs to continuously validate security controls. - [Breach and Attack Simulation](https://www.geek-guy.com/glossary-of-sec-and-it-terms/breach-and-attack-simulation/): Breach and Attack Simulation tools that automate the execution of threat actor TTPs to continuously validate security controls. - [Adversarial ML](https://www.geek-guy.com/glossary-of-sec-and-it-terms/adversarial-ml/): Adversarial ML. Testing AI models by attempting to trick them with adversarial inputs to bypass security filters or extract training data. - [Due Diligence](https://www.geek-guy.com/glossary-of-sec-and-it-terms/due-diligence/): The investigative process of verifying that the necessary Due Care is actually being implemented and remains effective over time. - [Due Care](https://www.geek-guy.com/glossary-of-sec-and-it-terms/due-care/): Due Care. The legal standard of reasonableness that an organization must meet to protect its assets and data; often described as what a prudent person would do. - [CTEM](https://www.geek-guy.com/glossary-of-sec-and-it-terms/ctem/): Continuous Threat Exposure Management is a 5-stage framework (Scoping, Discovery, Prioritization, Validation, Mobilization) that replaces static vulnerability scanning. - [Contact us](https://www.geek-guy.com/contact-us/): Contact the Geek Use this page to contact us. - [List of Top Regulations/Frameworks in Cybersecurity](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/list-of-top-regulations-frameworks-in-cybersecurity/) - [Book: Managers Guide to Becoming Great – Graphics](https://www.geek-guy.com/about-geek-guy/managers-guide-to-becoming-great-graphics/): If you are interested in purchasing the book, it can be purchased on Amazon at "Managers Guide to becoming Great" If you are interested in purchasing the book, it can be purchased on Amazon at "Managers Guide to becoming Great" - [Malware Reversing](https://www.geek-guy.com/malware-reversing/): Here's a list of some of the best malware reversing tools from Geek-Guy.com: Based on the most complete archives of the Malware Reversing resource page from Geek-Guy.com, here are the extracted tools and their current, functional links organized by category: - [CISSP Domains and Guidance](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/): The ISC2 (International Information System Security Certification Consortium) has several certifications, each with its own domains of knowledge. To give you the most relevant information, I need to know which certification you're interested in. However, since the CISSP (Certified Information - [Glossary of Cybersecurity and Market Terms](https://www.geek-guy.com/glossary-of-sec-and-it-terms/): A comprehensive glossary explaining common cybersecurity and IT terms in simple language. Generative AI can easily compile and define such terms, making complex topics accessible to a wider audience. Glossary Traditional Security Concepts 2026 relevant terminology and structured strictly by - [Top ~100 Open Source Security Tools](https://www.geek-guy.com/top-100-open-source-security-tools/): 1. Network Discovery & Scanning Tool NameOfficial URLPurposeNmaphttps://nmap.org/Network exploration and security auditingZMaphttps://zmap.io/Fast internet-wide network scannerMasscanhttps://github.com/robertdavidgraham/masscanTCP port scanner, spews SYN packetsNetcat (ncat)https://nmap.org/ncat/The "Swiss-army knife" for TCP/IPScapyhttps://scapy.net/Packet manipulation and sniffing 2. Vulnerability Scanning & Management Tool NameOfficial URLPurposeOpenVAS (GVM)https://www.openvas.org/Full-featured vulnerability scannerNiktohttps://github.com/sullo/niktoWeb server - [Level Up Your Security Game with Geek-Guy Resources](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/): Dive into our comprehensive collection of cybersecurity resources, designed to empower both seasoned professionals and curious newcomers. Explore a vast library of tools, knowledge, and community-driven insights. Resource Pages at Geek-Guy.com - [Largest Threat Intelligence (OSINT) MEGA LIST in the World](https://www.geek-guy.com/largest-threat-intelligence-osint-mega-list-in-the-world/): Below is the extracted list of OSINT and Threat Intelligence resources from that page, organized into a table with their respective categories and URLs. OSINT & Threat Intelligence Mega List Resource NameURLCategoryAbuse.chhttps://abuse.ch/Malware & Ransomware TrackerAbuseIPDBhttps://www.abuseipdb.com/IP Reputation & ReportingAlienVault OTXhttps://otx.alienvault.com/Open Threat - [Privacy Policy](https://www.geek-guy.com/privacy-policy-2/) - [Private Search Engine](https://www.geek-guy.com/private-search-engine/): Bookmark this Geek-Guy Search Engine: Search multiple search engines with proxied results. Search You can also go directly to the search engine by going to https://search.geek-guy.com - [Our Dev Projects](https://www.geek-guy.com/our-projects/):   Our Github https://github.com/lpingree Popular repositories Loading Virustotal-Netstat-lookup-Tool-for-Linux Public Virustotal netstat output lookup tool Python amy---Active-Malware-Yield Public Automated script to lookup virustotal hashes from running processes on linux. Python traceroutemap Public A tool to trace to all the main webs - [Top Topics](https://www.geek-guy.com/top-topics/) - [BCS](https://www.geek-guy.com/glossary-of-sec-and-it-terms/bcs/): Business Continuity Steering is the leadership committee that oversees the strategic alignment of recovery efforts with business objectives. - [Cybersecurity Culture and Music](https://www.geek-guy.com/cybersecurity-culture-and-music/): Here is the updated table with direct links to the songs or the albums where they are hosted. Most of the tracks come from their specialized AI-generated album, Sounds of Security, which is a fantastic resource for awareness training. Cybersecurity - [Domain 8: Software Development Security](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-8-software-development-security/): Exam Weight: 10% Domain 8 focuses on integrating security into the Software Development Life Cycle (SDLC). As a security researcher and analyst, this domain likely resonates with your work in threat actor analysis and data security. The key takeaway for - [Domain 7: Security Operations](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-7-security-operations/): Exam Weight: 13% Domain 7 is where "the rubber meets the road." It focuses on the day-to-day practicalities of running a security program, responding to incidents, and ensuring the business stays afloat during a disaster. It is heavily focused on - [Domain 6: Security Assessment and Testing](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-6-security-assessment-and-testing/): Exam Weight: 12% Domain 6 is about verifying the truth. While other domains focus on building and operating security, this domain focuses on proving that those controls actually work. It bridges the gap between technical testing and management-level auditing. 1. - [Domain 5: Identity and Access Management (IAM)](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-5-identity-and-access-management-iam/): Exam Weight: 13% Domain 5 focuses on the "Who" and "How" of access. It covers the systems used to identify, authenticate, and authorize users and devices. In the modern era of Zero Trust and Agentic Identity, this domain has become - [Domain 4: Communication and Network Security](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-4-communication-and-network-security/): Exam Weight: 13% Domain 4 is the plumbing of the digital world. It focuses on the secure design and protection of network architectures, ensuring data remains confidential and available while moving across wires, airwaves, or fiber. 1. The OSI and - [Domain 3: Security Architecture and Engineering](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-3-security-architecture-and-engineering/): Exam Weight: 13% Domain 3 is the most technical and broad domain. It covers everything from hardware architecture and the "Ring Model" to cryptography and physical site security. To master this domain, you must understand how secure systems are built - [Domain 2: Asset Security](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-2-asset-security/): Exam Weight: 10% Domain 2 is often considered one of the easier domains, but its importance is massive because it defines what we are protecting. If you don't classify and inventory your assets correctly, your security controls in the other - [Domain 1: Security and Risk Management](https://www.geek-guy.com/level-up-your-security-game-with-geek-guy-resources/cissp-domains-and-guidance/domain-1-security-and-risk-management/): Exam Weight: 16% (Highest weighted domain) This domain serves as the brain of the CISSP. It focuses on how security supports the business through governance, risk analysis, and legal compliance. As a CISSP candidate, you must think like a manager: ## Blog Posts - [NCSC-2026-0464 [1.00] [M/H] Kwetsbaarheid verholpen in LXD van Canonical](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0464) (2026-11-02): Canonical heeft een kwetsbaarheid verholpen in LXD. De kwetsbaarheid (CVE-2026-112816) wordt veroorzaakt door onjuiste validatie van certificaatketens binnen de HTTPS API van Canonical LXD. De kwetsbaarheid treft LXD-versies vóór 4.0.15, 5.0.11, 5.21.9 en 6.10.1 binnen de betreffende releasebranches. Hierdoor kunnen - [Who approves the files that control your AI coding assistant?](https://www.csoonline.com/article/4242707/who-approves-the-files-that-control-your-ai-coding-assistant.html) (2026-11-02): A pull request adds a helpful setup step for an AI coding assistant. No application source changes. The description calls it a developer-experience improvement, and the reviewer sees a short configuration file beside some Markdown instructions. Before approving it, the - [Chainalysis Investigates Security Incident Involving AI-Driven Attack Techniques](https://securityaffairs.com/202241/ai/chainalysis-investigates-security-incident-involving-ai-driven-attack-techniques.html) (2026-11-02): Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe. Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident. A threat actor accessed its systems and internal tools - [What a security strategy that survives 2027 looks like](https://www.csoonline.com/article/4240618/what-a-security-strategy-that-survives-2027-looks-like.html) (2026-11-02): Equifax CISO Jeremy Koppen sees the same dynamics most security chiefs are facing: hackers on the one side using AI to perform more sophisticated attacks at unprecedented speed, and defenders on the other adopting AI to match that volume and - [Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys](https://gbhackers.com/ai-bots-impersonation/) (2026-11-02): Attackers are impersonating trusted AI bots to scan enterprise websites for exposed passwords, API keys, and cloud credentials. The company tracked a single actor rotating through approximately 32 bot identities, including ChatGPT, Claude, and Perplexity, to probe organizations across multiple - [A week in security (October 26 – November 1)](https://www.malwarebytes.com/blog/news/2026/11/a-week-in-security-october-26-november-1-2) (2026-11-02): Last week on Malwarebytes Labs: Fake PDF and search tools hijacked searches for 13.4 million Chrome users Photo ID, bank checks, face scan? The UK’s age-check options Binance hit by largest-ever crypto theft, with $6.3 billion stolen Hackers steal and - [DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work](https://www.helpnetsecurity.com/2026/11/02/deepseek-dsh-superagent/) (2026-11-02): Deepseek released a research prototype of dsh-superagent, a coding agent that does work on a GitHub repository for you. Who can ask for work The agent gets to work in two situations: an allowed user asks for something, or a - [The first ten lines of a command policy for AI coding agents](https://www.helpnetsecurity.com/2026/11/02/vinay-thakker-kloudstax-ai-agent-access-control/) (2026-11-02): In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person’s identity attached when acting - [Hackers Gain Unauthorized Access to WS Audiology CRM Environment and Operational IT Systems](https://gbhackers.com/ws-audiology-systems/) (2026-11-02): WS Audiology (WSA), the parent company of Widex and Signia, is investigating unauthorized access to its internal IT infrastructure after taking selected systems offline to contain a cybersecurity incident. The disruption affected customer applications and professional services, although the company - [AI-driven data centre growth demands a new approach to environmental monitoring](https://itwire.com/guest-articles/guest-opinion/ai-driven-data-centre-growth-demands-a-new-approach-to-environmental-monitoring) (2026-11-02): AI is changing the demands placed on data centres. Greater computing density generates more heat, while operators face pressure to expand capacity quickly. As facilities grow,... - [Operation Blackout: A Tactical Success Against Scam Centers](https://www.geek-guy.com/operation-blackout-tactical-success-against-scam-centers/) (2026-11-02): Learn how a coordinated FBI-led operation dismantled scam centers in the US and abroad, tackling fraud networks that prey on vulnerable people. - [Byoky: Open-source wallet for AI API keys](https://www.helpnetsecurity.com/2026/11/02/byoky-open-source-ai-api-key-wallet/) (2026-11-02): Byoky is an open-source wallet for AI API keys, available as a Chrome and Firefox extension and as iOS and Android apps. Users store their keys for OpenAI, Anthropic, Google Gemini and other providers in it, encrypted on their own - [New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value](https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html) (2026-11-01): Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped - [Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS](https://gbhackers.com/malicious-claude-code-extensions-in-cursor-marketplace/) (2026-11-01): Malicious Claude Code extensions distributed through Cursor’s VS Code The Extension Marketplace tried to create persistent SSH backdoors on Windows and macOS developer systems. The affected packages were the Anthropic.claude-code versions 2.1.312 and 2.1.313, which were available on October 29, - [Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data](https://gbhackers.com/artex-ai-agents/) (2026-11-01): Threat actors are weaponizing ARTEX, an autonomous penetration-testing framework, to accelerate network intrusions, escalate privileges, and steal sensitive information. Google Threat Intelligence Group and Mandiant investigations described in the supplied report show attackers delegating substantial portions of post-compromise operations to - [Product showcase: Trust Onion uses rotating codewords to verify callers](https://www.helpnetsecurity.com/2026/11/02/product-showcase-trust-onion/) (2026-11-01): Trust Onion is a free app that gives trusted groups three rotating codewords to check who they are communicating with. It also includes signed selfies, message checks, and callback requests. It is available for macOS, iOS, and Android. I tested - [Hacktober 2026: Major Cyberattacks Hit Binance, PHP, Node.js, LiteLLM, and Pentagon](https://gbhackers.com/hacktober-2026-major-cyberattacks/) (2026-11-01): October’s cybersecurity disclosures spanned cryptocurrency platforms, developer infrastructure, certificate authorities, government records, gaming accounts, and retail operations. Dubbed Hacktober, the wave included unrelated incidents rather than a single coordinated campaign. Confirmed breaches, malicious releases, vulnerable configurations, and possible credential exposure - [New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data](https://gbhackers.com/volta-infostealer/) (2026-11-01): A self-deleting Windows infostealer named VOLTA uses commercial AI models to turn stolen credentials, sessions, and cryptocurrency data into prioritized victim assessments. The malware, self-named “VOLTA-AUTODOXER,” combines extensive collection capabilities with automated identity enrichment. Its distinguishing feature is analytical outsourcing: - [FBI Confirms North Korean Hackers Stole Over $6 Billion From Binance in Massive Crypto Attack](https://gbhackers.com/fbi-confirms-north-korean-hackers-stole-over-6-billion-from-binance/) (2026-11-01): The Federal Bureau of Investigation (FBI) has linked the theft of over $6 billion in virtual assets from Binance to North Korean hackers, labeling the operation as “TraderTraitor.” In an advisory released on October 31, the FBI reported that the - [Ransomware gang talked AI agents into doing much of its dirty work](https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/) (2026-11-01): The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, according to Sophos. AI-assisted intrusion workflow (Source: Sophos) The company, which tracks the - [Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access](https://gbhackers.com/critical-incus-and-lxd-vulnerabilities/) (2026-11-01): Critical certificate-validation vulnerabilities have been identified in Incus and Canonical LXD, allowing unauthenticated attackers to impersonate trusted identities and compromise management infrastructure. Exploitation of these vulnerabilities requires network access to the HTTPS listener but does not require valid credentials or - [xTool Officially Launches X1: An Upgradeable Multi-Laser Platform Engineered for Speed, Versatility, and Business Growth](https://itwire.com/business-it-news/print-solutions/xtool-officially-launches-x1-an-upgradeable-multi-laser-platform-engineered-for-speed-versatility-and-business-growth) (2026-11-01): Moving beyond traditional wattage wars, xTool’s new flagship platform combines high-speed Galvo with large-format Gantry motion, introducing modular LaserSwap technology and... - [Gigamon appoints Caerl Murray as ANZ Country Manager to accelerate regional growth](https://itwire.com/it-people-news/people-moves/gigamon-appoints-caerl-murray-as-anz-country-manager-to-accelerate-regional-growth) (2026-11-01): Technology industry veteran to strengthen customer and partner relationships as demand for deep observability grows across Australia and New Zealand - [Inside a successful AWS European Sovereign Cloud exercise to demonstrate independent operation](https://aws.amazon.com/blogs/security/inside-a-successful-aws-european-sovereign-cloud-exercise-to-demonstrate-independent-operation/) (2026-11-01): On Saturday, October 24, 2026 we conducted a successful exercise demonstrating that the AWS European Sovereign Cloud can operate without depending on any infrastructure outside the European Union (EU). This was the first public technical exercise demonstrating the independence of - [Kudosity Opens RCS Agent Registration To Help Australian Businesses Get Ready For Rich Messaging](https://itwire.com/guest-articles/company-news/kudosity-opens-rcs-agent-registration-to-help-australian-businesses-get-ready-for-rich-messaging) (2026-11-01): Already supporting RCS messaging across international markets, Kudosity is helping Australian brands prepare for the next generation of business messaging ahead of broader... - [ISC Stormcast For Monday, November 2nd, 2026 https://isc.sans.edu/podcastdetail/10160, (Mon, Nov 2nd)](https://isc.sans.edu/diary/rss/33480) (2026-11-01): (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. - [Zip to launch ZMobile to all Australians](https://itwire.com/it-industry-news/telecoms-and-nbn/zip-to-launch-zmobile-to-all-australians) (2026-11-01): Zip Co ASX: ZIP, the digital financial services company offering innovative, people-centred products, has today announced that its mobile product, ZMobile, is now available to... - [To Tame the Fastest Drivers, States Deploy Speed-Limiting Devices on Cars](https://www.wsj.com/lifestyle/cars/to-tame-the-fastest-drivers-states-deploy-speed-limiting-devices-on-cars-4eafe66d?mod=rss_Technology) (2026-11-01): Virginia and other states are trying to slow “super speeders” with GPS technology that prevents their cars from blowing the speed limit. - [The National Energy PKI Selects DigiCert to Secure Australia’s Growing Energy Network](https://itwire.com/guest-articles/company-news/the-national-energy-pki-selects-digicert-to-secure-australia-s-growing-energy-network) (2026-11-01): Rooftop solar and battery systems will prove their identity to the grid and communicate securely through the National Energy PKI, with DigiCert providing the digital... - [Ping Identity Recognised as a Leader in 2026 Gartner Magic Quadrant for Customer Identity and Access Management](https://itwire.com/guest-articles/company-news/ping-identity-recognised-as-a-leader-in-2026-gartner-magic-quadrant-for-customer-identity-and-access-management) (2026-11-01): Ping positioned highest in Ability to Execute - [Dayforce Unveils the Agentic HCM Platform](https://itwire.com/business-it-news/data/dayforce-unveils-the-agentic-hcm-platform) (2026-11-01): Native AI woven across a more open, connected platform helps organisations get answers, take action, complete work, and build what’s next — with the trust, compliance, and... - [Cloudera Expands Enterprise AI Ecosystem to Power AI Factories Anywhere](https://itwire.com/guest-articles/company-news/cloudera-expands-enterprise-ai-ecosystem-to-power-ai-factories-anywhere) (2026-11-01): Neo4j and Cartesia join an expanding ecosystem alongside Mistral AI and VAST Data, bringing greater choice across enterprise knowledge, models, voice, and infrastructure - [IDeaS Expands Strategic Relationship with Accor Through Selection of Optix Business Intelligence](https://itwire.com/it-industry-news/strategy/ideas-expands-strategic-relationship-with-accor-through-selection-of-optix-business-intelligence) (2026-11-01): Optix solution will help Accor hotels streamline commercial reporting, accelerate decision-making, and strengthen revenue strategy across individual properties and portfolios - [F5 and Oracle collaborate to strengthen application security in the AI era](https://itwire.com/it-industry-news/strategy/f5-and-oracle-collaborate-to-strengthen-application-security-in-the-ai-era) (2026-11-01): Collaboration is intended to help secure web applications and APIs against evolving cyber threats - [How open source AI agents, skills, and MCP servers are reshaping cybersecurity defense](https://itwire.com/business-it-news/business-intelligence/how-open-source-ai-agents-skills-and-mcp-servers-are-reshaping-cybersecurity-defense) (2026-11-01): The model is the easy part of an AI agent - [Federal court tosses Trump lawsuit challenging Alaska Senate certification](https://cyberscoop.com/judge-dismisses-alaska-senate-lawsuit-peltola-sullivan/) (2026-11-01): A federal judge dismissed a lawsuit from the federal government seeking to preemptively block Democratic Senate candidate Mary Peltola from assuming office if she wins her race. The Department of Justice sued Alaska last month, arguing that an alleged scheme - [The Post-AI Security Floor](https://danielmiessler.com/blog/post-ai-security-floor?utm_source=rss&utm_medium=feed&utm_campaign=website) (2026-11-01): Cybersecurity recommendations during The Hackening. In 2023 I guessed that AI would help attackers before it helped defenders, and that their lead would last three to five years. We're inside that window now.As I wrote in Attacker vs. Defender AI - [FBI links $6.3 billion Binance crypto heist to North Korean hackers](https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/) (2026-11-01): The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record. - [FBI Blames North Korea for $6 Billion Binance Crypto Theft](https://securityaffairs.com/202221/apt/fbi-blames-north-korea-for-6-billion-binance-crypto-theft.html) (2026-11-01): The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds. The FBI has named North Korea as the party behind the theft of more than $6 billion - [SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 6](https://securityaffairs.com/202216/ai/security-affairs-ai-cybersecurity-newsletter-round-6.html) (2026-11-01): Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents - [SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 121](https://securityaffairs.com/202209/malware/security-affairs-malware-newsletter-round-121.html) (2026-11-01): Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps   deepveindrilling.com: Magento CMS block loader hits 953 - [AI Spenders Get Spooked](https://www.wsj.com/tech/ai/ai-spenders-get-spooked-80534757?mod=rss_Technology) (2026-11-01): Plus, Anthropic’s mind-boggling $40 trillion market opportunity, we tried Apple’s first touch-screen MacBook, Silicon Valley takes on the Pentagon’s explosives shortage and more. - [Alpine Linux rebuilds GitLab after attempted RCE attack](https://www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack/) (2026-11-01): Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. - [OpenAI says it’s doubling Pro usage limits and bringing Work features to Chat](https://www.bleepingcomputer.com/news/artificial-intelligence/openai-says-its-doubling-pro-usage-limits-and-bringing-work-features-to-chat/) (2026-11-01): OpenAI has just confirmed that it's rolling out ChatGPT Work capabilities directly into regular Chat, while also combining usage allowances across ChatGPT and Codex. - [Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION](https://securityaffairs.com/202200/breaking-news/security-affairs-newsletter-round-602-by-pierluigi-paganini-international-edition.html) (2026-11-01): A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. U.S. CISA - [SMS of Death: Android under attack, an invisible SMS can block calls and emergency services](https://securityaffairs.com/202184/security/sms-of-death-android-under-attack-an-invisible-sms-can-block-calls-and-emergency-services.html) (2026-11-01): SMS of Death lets attackers crash Android call services with a hidden, zero-click message, blocking phone calls, even emergency calls too. A specially manipulated SMS message is enough to crash Android’s phone service, interrupt ongoing calls, and temporarily render the - [Investors Are Hedging Against the Risks of the AI Boom](https://www.wsj.com/articles/investors-are-hedging-against-the-risks-of-the-ai-boom-603203d5?mod=rss_Technology) (2026-11-01): Plus, inside the final days of Darline Graham’s reluctant Senate run, and two owners claim to have the same legendary Porsche. - [FBI Links 628 Crypto Wallet Addresses to North Korea’s Binance Hack](https://hackread.com/fbi-crypto-wallet-addresses-north-korea-binance-hack/) (2026-11-01): FBI links 628 crypto wallet addresses to North Korea’s TraderTraitor after the $6.3 billion Binance hack, asking services to block transfers involving stolen funds. - [The Tangled Web of AI Bets Is Reason to Fear Tech Stocks](https://www.wsj.com/tech/the-tangled-web-of-ai-bets-is-reason-to-fear-tech-stocks-905bde86?mod=rss_Technology) (2026-11-01): Vendor financing is back in a new form and it magnifies the AI trade on the way up—and down. - [The Shopping Bots Are Coming for Amazon](https://www.wsj.com/tech/the-shopping-bots-are-coming-for-amazon-701caa57?mod=rss_Technology) (2026-11-01): The biggest U.S. company by revenue has dominated e-commerce, but a potential rival is emerging. --- # Full Content --- title: "NCSC-2026-0464 [1.00] [M/H] Kwetsbaarheid verholpen in LXD van Canonical" url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0464" lang: "en-US" type: "post" description: "Canonical heeft een kwetsbaarheid verholpen in LXD. De kwetsbaarheid (CVE-2026-112816) wordt veroorzaakt door onjuiste validatie van certificaatketens binnen de HTTPS API van Canonical LXD. De kwetsbaarheid treft LXD-versies vóór 4.0.15, 5.0.11, 5.21.9 en 6.10.1 binnen de betreffende releasebranches. Hierdoor kunnen" last_modified: "2026-11-02T09:17:50+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://advisories.ncsc.nl/rss/advisories" wpe_sourcepermalink: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0464" --- # NCSC-2026-0464 [1.00] [M/H] Kwetsbaarheid verholpen in LXD van Canonical Canonical heeft een kwetsbaarheid verholpen in LXD. De kwetsbaarheid (CVE-2026-112816) wordt veroorzaakt door onjuiste validatie van certificaatketens binnen de HTTPS API van Canonical LXD. De kwetsbaarheid treft LXD-versies vóór 4.0.15, 5.0.11, 5.21.9 en 6.10.1 binnen de betreffende releasebranches. Hierdoor kunnen niet-geauthenticeerde aanvallers die netwerktoegang hebben tot de HTTPS API en beschikken over het publieke certificaat van een vertrouwde client, zich voordoen als die client. Dit is mogelijk doordat LXD ten onrechte alle certificaten in de aangeboden certificaatketen controleert tegen de trust store, terwijl alleen het leaf-certificaat cryptografisch aan het bezit van de bijbehorende private key is gekoppeld. Succesvolle exploitatie kan leiden tot ongeautoriseerde toegang tot de LXD-cluster en de beheerde virtuele machines, met privileges gelijk aan die van de geïmiteerde client. Wanneer deze client over voldoende beheerdersrechten beschikt, kan dit uiteindelijk leiden tot root-toegang op de onderliggende host. De kwetsbaarheid heeft een CVSS 4.0-score van 10.0 (Critical) en treft meerdere ondersteunde LXD-releasebranches en MicroCloud-omgevingen. --- --- title: "Who approves the files that control your AI coding assistant?" url: "https://www.csoonline.com/article/4242707/who-approves-the-files-that-control-your-ai-coding-assistant.html" lang: "en-US" type: "post" description: "A pull request adds a helpful setup step for an AI coding assistant. No application source changes. The description calls it a developer-experience improvement, and the reviewer sees a short configuration file beside some Markdown instructions. Before approving it, the" last_modified: "2026-11-02T09:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.csoonline.com/feed/" wpe_sourcepermalink: "https://www.csoonline.com/article/4242707/who-approves-the-files-that-control-your-ai-coding-assistant.html" --- # Who approves the files that control your AI coding assistant? A pull request adds a helpful setup step for an AI coding assistant. No application source changes. The description calls it a developer-experience improvement, and the reviewer sees a short configuration file beside some Markdown instructions. Before approving it, the reviewer needs to answer a different question: what will this change allow to run on a colleague’s machine? The issue has moved beyond hypothetical repository poisoning. In an [October 8 analysis of agent-skill distribution](https://www.stepsecurity.io/blog/stepsecurity-now-inventories-ai-agent-skills-in-your-github-repositories-and-on-developer-machines), StepSecurity revisited the June Miasma campaign, which planted AI-tool and editor configuration in a Microsoft repository without modifying application source. The configuration was intended to trigger credential harvesting through developer tooling. The October publication describes an inventory product, but the underlying campaign illustrates a wider operational problem: merging a configuration change can distribute execution instructions to the people working in that repository. StepSecurity also reports that the commit carried a skip-CI flag and a backdated timestamp, and that it moved code execution from package install to folder open. A control that runs only in the build pipeline never sees that path. The first reliable checkpoint is the pull request, and it needs a person who knows what the file can trigger. I recommend giving these changes a named owner and an enforceable review path. An organization should be able to identify who approved a hook, what the approval covered and where the approved version is allowed to run. ## Review the behavior behind the filename A repository file can serve several purposes. It may describe a coding convention, direct an agent toward a script, register a tool or arrange for a command to run at a lifecycle event. Those differences matter more than the extension. A Markdown instruction is not automatically executable code. It can nevertheless influence an agent that has permission to execute commands. A JSON setting may directly register a shell command. Review should establish the mechanism, the trigger and the authority available when it fires. Skills show why the filename is a poor guide. StepSecurity notes that a skill’s allowed-tools field can let the agent use listed tools without a permission prompt during the turn that invokes the skill, and that Claude Code’s documentation says workspace trust does not gate that field. A SKILL.md file is Markdown, so in a pull request it tends to be reviewed like a README. Anthropic’s [current hooks reference](https://code.claude.com/docs/en/hooks) states that command hooks run with the user’s permissions. It also distinguishes interactive workspace trust from noninteractive operation: settings-file hooks in a repository can run in a noninteractive session without the trust dialog shown to an interactive user. The exact behavior depends on the configuration surface and session type. A control tested at a developer’s terminal should therefore be retested in the automated workflow that uses the same repository. The same page names practical mitigations. Before scripting a noninteractive run over a repository nobody on the team wrote, review its .claude settings files, start the run in bare mode or turn hooks off for that run. Administrators can also use the managed-hooks-only setting so that user, project, local and plugin hooks are blocked. Which of these fits depends on the organization’s tooling, and each should be tested rather than assumed. For a proposed setup hook, the reviewer should be able to trace the command to its script and dependencies. If the script downloads another program, determine how that program is selected and verified. If it reads credentials or accesses the network, ask why the setup step needs those capabilities. These questions should accompany the change while its author can explain the intent. Discovering them after distribution leaves every affected developer to make an individual trust decision. ## Make ownership enforceable Engineering productivity teams are often best placed to maintain shared coding-assistant configuration. Security should define the conditions that require a second reviewer, such as adding executable hooks, broadening network access or invoking a new external tool. The application team remains responsible for whether the integration belongs in its workflow. This need not create an approval queue for every formatting preference. Define the behavioral changes that warrant scrutiny and route those changes to people who understand the tooling. GitHub’s [code-owner documentation](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners) explains how ownership rules work with required reviews. A CODEOWNERS file alone does not make its approval mandatory; the corresponding branch protection must require it. GitHub also recommends protecting the ownership file itself. Apply the chosen mechanism to the agent configuration and the scripts it invokes. Protecting a settings file while leaving its referenced helper script outside the review rule creates an obvious gap. Check the effective rule with a sample pull request rather than relying on the presence of a policy file. Allow legitimate changes to move quickly through a known path. The reviewer should receive a concise explanation of the trigger, required access and expected side effects. A hook that formats changed files should not need the same justification as one that contacts an external service or modifies a user’s global configuration. ## Check what the developer environment actually loads Repository review covers only part of the environment. Developers can also install shared skills, plugins and user-level configuration outside a project. An approved repository may therefore run alongside additional instructions that its maintainers have never reviewed. Establish a baseline for the supported tools and launch methods. Record the origins and versions of approved additions, and provide a way to inspect the effective configuration. When local copies differ, compare the content before deciding that the difference is malicious or harmless. Microsoft’s [Workspace Trust guidance for Visual Studio Code](https://code.visualstudio.com/docs/editing/workspaces/workspace-trust) describes Restricted Mode, which limits features that can execute workspace content. It also warns that a malicious extension can ignore that boundary. Workspace trust is a useful control within its documented scope; it should be paired with a deliberate extension policy and an environment appropriate to the repository being inspected. Use unfamiliar repositories in an isolated environment without routinely mounted production credentials. Avoid treating a container as sufficient isolation if it inherits the developer’s secrets or access to the host. Review those connections explicitly. For approved daily work, make the safe setup practical. Publish maintained configurations, explain how to request an addition and provide a clean inspection workflow. If compliance requires developers to reconstruct their environment manually every morning, it will be difficult to sustain. ## Test the approval path before trusting it Run a benign exercise in a disposable repository and isolated environment. Add a hook that writes a harmless marker file. Check whether the pull request reaches the intended owner, whether an unapproved change can merge and whether the installed tool permits the marker action under the documented launch conditions. Repeat the exercise through the noninteractive route if the organization uses one. Then change only the referenced helper script. That second change tests whether the review boundary covers behavior as well as configuration. The result should identify which controls prevented execution and which merely recorded it. A scanner alert, required review and runtime restriction perform different jobs. Record the gaps without presenting one as a substitute for all the others. Three questions make a workable first review. Who can merge a change to the files that steer our coding assistants? Does that rule also cover every script those files call? Which of our automated jobs run the assistant over code we did not write, and do they apply the same trust checks as a developer’s terminal? For security leadership, the useful measure is whether changes capable of altering execution reach the right reviewer before distribution, and whether the working environment matches the approved scope. Start with one supported coding tool and one engineering team. Ask them to demonstrate who can change its behavior, how that change is approved and what happens when someone tries to bypass the process. --- --- title: "Chainalysis Investigates Security Incident Involving AI-Driven Attack Techniques" url: "https://securityaffairs.com/202241/ai/chainalysis-investigates-security-incident-involving-ai-driven-attack-techniques.html" lang: "en-US" type: "post" description: "Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe. Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident. A threat actor accessed its systems and internal tools" last_modified: "2026-11-02T08:25:46+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202241/ai/chainalysis-investigates-security-incident-involving-ai-driven-attack-techniques.html" --- # Chainalysis Investigates Security Incident Involving AI-Driven Attack Techniques ## Chainalysis suffered a cyberattack exposing customer names, emails and user IDs, while investigation data and passwords remain safe. Blockchain analytics firm Chainalysis says it was the target of a cybersecurity incident. A threat actor accessed its systems and internal tools and stole some non-sensitive customer data. _“This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools.” reads the [statement](https://www.chainalysis.com/blog/security-incident-october-30/) published by the company, which also includes the full email sent to affected customers._ Chainalysis says it discovered the attacker this month and described the methods used as offensive techniques involving AI agents. However, it did not explain how the attack was carried out. The company also warned that AI-powered attacks are becoming more common across the industry and said it is taking a company-wide approach to dealing with this growing threat. The data the attacker reached matters most. According to Chainalysis, attackers gained access to user IDs, full names, email addresses and organization role labels for users on the platform. The company is still working out which records belong to which customer and promises a detailed breakdown when it finishes. What the attacker didn’t reach is just as important. So far, Chainalysis has found no sign of access to investigation content such as graphs, notes or cases, or to transaction and query results. It also found no clear-text passwords, MFA secrets or user session tokens in the attacker’s hands. _“Based on the evidence available to date, we have found no indication that these incidents resulted in the unauthorized access of investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, MFA secrets, or user session tokens.” continues the press release. _ _Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users. We are in the process of determining the records for your organization that were accessed and will provide a detailed breakdown as soon as that analysis is complete._“ The company says it’s patching vulnerabilities and hardening its systems around the clock. It has hired outside cybersecurity experts and is using large language models to support a wider review that goes beyond the flaws the attacker used. It has already told all its customers and will keep them updated. Chainalysis advises customers to watch out for unexpected password reset requests or login approval prompts. The company also strongly recommends enabling two-factor authentication (2FA) for all organizations that have not already done so. Since the exposed data includes names and email addresses, attackers could use it to launch phishing campaigns. The company also clarified that the security incident has nothing to do with the recent theft of more than [$6 billion from Binance](https://securityaffairs.com/202221/apt/fbi-blames-north-korea-for-6-billion-binance-crypto-theft.html). **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs)**** [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, Chainalysis)** --- --- title: "What a security strategy that survives 2027 looks like" url: "https://www.csoonline.com/article/4240618/what-a-security-strategy-that-survives-2027-looks-like.html" lang: "en-US" type: "post" description: "Equifax CISO Jeremy Koppen sees the same dynamics most security chiefs are facing: hackers on the one side using AI to perform more sophisticated attacks at unprecedented speed, and defenders on the other adopting AI to match that volume and" last_modified: "2026-11-02T08:25:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.csoonline.com/feed/" wpe_sourcepermalink: "https://www.csoonline.com/article/4240618/what-a-security-strategy-that-survives-2027-looks-like.html" --- # What a security strategy that survives 2027 looks like Equifax CISO Jeremy Koppen sees the same dynamics most security chiefs are facing: hackers on the one side using AI to perform more sophisticated attacks at unprecedented speed, and defenders on the other adopting AI to match that volume and velocity. “AI is changing the pace on both sides,” he says. “Attackers are using it to operate at greater scale, and Equifax is using it to innovate more quickly.” In the next year, Koppen will continue to evolve Equifax’s security strategy to keep with an accelerating threat environment. “That means building on the security already embedded across our design and development process, so checks run early and automatically,” he says. “It also means expanding how we use AI in our own security operations to handle routine work, so our experts can focus on the threats and initiatives that matter most. Done well, security becomes one of the reasons a product can launch sooner.” As for the rising tide of AI agents entering enterprise workflows, Koppen says that “identity controls are central” to his 2027 security strategy. “Across the industry, more activity on enterprise networks now comes from AI agents, bots, and automated workflows, and most traditional security controls were designed with a human user in mind,” he explains. “That’s why we’re applying the same rigorous verification to these identities that we apply to people.” Of course, Koppen, like other seasoned security leaders, knows his IT security strategy must evolve to address more than just AI. Geopolitics, the anticipated arrival of quantum computing, and increasingly interconnected systems, are also changing the threat landscape and attack surface — sometimes in radical ways — and should prompt strategic changes, too. That in turn is putting pressure on CISOs to rethink their practices, policies, and approaches as we head toward a new year likely to be at least as wild of a ride as 2026 has been. “CISOs realize they need to transform, because their current state isn’t working. And it’s going to be a pretty significant transformation over the next few years for CISOs to be successful,” says Omar Khawaja, a CISO, a faculty member at Carnegie Mellon University’s CISO program, and a board member at HITRUST and FAIR Institute. Of course, transformation, as always, is a work in progress, Khawaja says; as a result many security execs are still working out what needs to change in 2027 and how to make those changes happen. Still, Khawaja, Koppen, and others stress that transformation is not an option; the safety of the organization depends on strategic evolution from its cybersecurity teams. So what exactly needs to change? Security leaders point to specific elements that won’t work as well in the year ahead and what needs to be in place instead to more adequately secure the organization in 2027 and beyond. ## Static credentials need to go Koppen believes static credentials are on their way out. “No matter how strict the policy, passwords still end up looking like a favorite sports team or the current season with an exclamation point at the end. That makes them trivial targets for brute-force attacks,” he says, noting that his company eliminated passwords across its 22,000 employees and contractors and is now extending its [passwordless](https://www.csoonline.com/article/4126694/zero-trust-in-practice-a-deep-technical-dive-into-going-fully-passwordless-in-hybrid-enterprise-environments.html) standard to its B2B customers. ## More manual SOC work must be automated The new command for security teams is to move at machine speed. “We’re not able to deal with attacks and vulnerabilities manually anymore. AI is making that impossible,” says Florida State University CISO Bill Hunkapiller. His security strategy reflects this new reality. He has been implementing [autonomous agents](https://www.csoonline.com/article/4140208/4-ways-to-prepare-your-soc-for-agentic-ai.html) to replace routine security operations tasks, and his 2027 plans call for expanding the number of tasks handled by machines. Most CISOs are on this path. [The State of Incident Response Readiness](https://www.sygnia.co/guides-and-tools/ciso-survey-2026/) from Sygnia found that 32% of organizations have extensive AI use across most or all threat detection and incident response (IR) activities, up from 25% in 2025. And 63% expect to have extensive AI use in place for threat detection and IR activities in 2027. ## Generic severity scores are out, risk ratings tailored to the organization are in Equifax’s Koppen declares that generic severity scores are no longer effective. “A vendor’s ‘critical’ rating doesn’t know if a system holds sensitive data, is externally facing, or sits behind other controls,” he says, noting that [Equifax has its own quantitative risk engine](https://www.csoonline.com/article/4213266/how-equifax-is-using-ai-to-elevate-its-cybersecurity.html) that factors in that context so its teams “can focus on issues that pose real risk to the business.” Hunkapiller, who is also chief privacy officer and an adjunct professor at FSU, also sees a need to understand how common vulnerabilities and exposures pose a risk to his organization in particular, rather than relying on ratings. To that end, he’s exploring services that could create a digital twin of his environment to simulate how hackers could exploit vulnerabilities in his organization. This service would give Hunkapiller near-real-time information on which vulnerabilities pose the most significant risks to FSU, allowing him to accurately prioritize fixing those quickly, he says. Thus far, he’s impressed with the capability, saying it’s like “attack surface management on steroids.” ## Continuous patching is now the goal Security used to have Patch Tuesday, a moniker that reflected the regularly scheduled work of applying newly released fixes to software flaws. Although security teams today may not adhere to Tuesday specifically for the work, many still patch on a set schedule — and many still take weeks to patch. [Verizon’s 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) puts the median time to remediate known exploited vulnerabilities at 43 days, up from 32 days in 2025. [That won’t fly in 2027](https://www.csoonline.com/article/4196435/flaw-surge-fuels-need-for-cisos-to-rethink-vulnerability-management.html), says Hugh Thompson, program chair for the RSA Conference. “We used to do patching very methodically. If a patch came out for a system, we didn’t want to roll it out right away [for fear] it could break something. So we took time and tested it out and scheduled the work. That’s not going to work now, because the speed at which these AI attackers can take advantage of vulnerabilities or discover new ones is greater than ever,” he says. “We need automation in patching.” Jason Rader, CISO for technology solutions and systems integrator Insight, has been accelerating his company’s patching program, bringing patch windows down to seven days for its most critical components — a significant accomplishment given the size of the IT environment and the number of patches being released. Still, he wants to do better, saying he’s aiming to increase speed for patching in all areas of the IT environment in 2027 and noting that he’d like to eventually get to continuous patching. ## Different treatment for agent and NHIs needs to end With AI agents doing more work that was, until recently, performed by humans, it’s becoming increasingly clear that security can’t treat machine identities — whether agents or systems or [APIs](https://www.csoonline.com/article/4148315/apis-are-the-new-perimeter-heres-how-cisos-are-securing-them.html) — differently than humans, Rader says. To that end, he’s already “managing agents like people,” applying equally diligent attention to managing identity and associated permissions — and, thus, access to data and systems — to ensure that each entity can access only what is appropriate for its role. This includes managing machine identities throughout the lifecycle of those machines, just as security should for human workers, and applying proper governance, Rader adds. ## Agility and adaptability must be part of the 2027 strategy Some CISOs still take a set-and-forget approach to policies, procedures, and standards, says Prakash Venkata, a cyber, data, and tech risk partner at PWC and the firm’s security, risk, and engineering practice leader. That approach never worked well, as there has always been a need to improve and evolve policies, procedures, and standards as the threat landscape and the attack surface changed, Venkata explains. But the pace of change now is so fast that CISOs need to build agility and adaptability into their strategies simply to keep up and meet industry standards. Thompson likewise preaches the need for more agility in security strategies and advises security leaders to “be prepared for agility more than we had to or could stomach in the past because problems will emerge that you can’t anticipate.” He notes, too, that CISOs need to work with other departments, such as procurement, to bring that needed agility to security. For example, if the CISO needs to quickly buy and implement new technology to reduce a recently identified risk or defend against an emerging threat, CISOs will need procurement procedures to move as fast as security must move. ## Detached AI security and governance strategies become obsolete There has been a rise of [AI governance](https://www.cio.com/article/3984527/how-to-establish-an-effective-ai-grc-framework.html) and security strategies that are detached from the organization’s overall governance and security strategy, says James Lyne, CEO of SANS, a security training and certification organization. Lyne believes that the attention on AI governance and security is critical. However, he thinks having fully segregated AI governance and security strategies will be increasingly detrimental in 2027 and beyond. That’s because they’re not different and separate from enterprise governance and security. “An AI app exposed to malicious inputs is an app security problem,” he says. “AI agents accessing unauthorized things is a privilege management and operation security issue [no less than] if people had unauthorized access.” To ensure organizations have an effective, coordinated approach to governance and security capable of protecting the entire organization, where elements work together with no siloes or redundancies, CISOs and their organizations need a unified security strategy that addresses all actors — “whether they’re human, software services, or AI agents, or automated workflows,” he says. --- --- title: "Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys" url: "https://gbhackers.com/ai-bots-impersonation/" lang: "en-US" type: "post" description: "Attackers are impersonating trusted AI bots to scan enterprise websites for exposed passwords, API keys, and cloud credentials. The company tracked a single actor rotating through approximately 32 bot identities, including ChatGPT, Claude, and Perplexity, to probe organizations across multiple" last_modified: "2026-11-02T08:13:35+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/ai-bots-impersonation/" --- # Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys Attackers are impersonating trusted AI bots to scan enterprise websites for exposed passwords, API keys, and cloud credentials. The company tracked a single actor rotating through approximately 32 bot identities, including ChatGPT, Claude, and Perplexity, to probe organizations across multiple industries. On one October day, the campaign reached 48% of Cequence-protected organizations that received any […] The post [Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys](https://gbhackers.com/ai-bots-impersonation/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "A week in security (October 26 – November 1)" url: "https://www.malwarebytes.com/blog/news/2026/11/a-week-in-security-october-26-november-1-2" lang: "en-US" type: "post" description: "Last week on Malwarebytes Labs: Fake PDF and search tools hijacked searches for 13.4 million Chrome users Photo ID, bank checks, face scan? The UK’s age-check options Binance hit by largest-ever crypto theft, with $6.3 billion stolen Hackers steal and" last_modified: "2026-11-02T08:01:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.malwarebytes.com/blog/feed/index.xml" wpe_sourcepermalink: "https://www.malwarebytes.com/blog/news/2026/11/a-week-in-security-october-26-november-1-2" --- # A week in security (October 26 – November 1) Last week on Malwarebytes Labs: - [Fake PDF and search tools hijacked searches for 13.4 million Chrome users](https://www.malwarebytes.com/blog/news/2026/10/fake-pdf-and-search-tools-hijacked-searches-for-13-4-million-chrome-users) - [Photo ID, bank checks, face scan? The UK’s age-check options](https://www.malwarebytes.com/blog/news/2026/10/photo-id-bank-checks-face-scan-the-uks-age-check-options) - [Binance hit by largest-ever crypto theft, with $6.3 billion stolen](https://www.malwarebytes.com/blog/news/2026/10/binance-hit-by-largest-ever-crypto-theft-with-6-3-billion-stolen) - [Hackers steal and publish data on 41,000 Homeland Security workers](https://www.malwarebytes.com/blog/data-breaches/2026/10/hackers-steal-and-publish-data-on-41000-homeland-security-workers) - [Malicious Firefox extensions impersonate popular crypto wallets](https://www.malwarebytes.com/blog/news/2026/10/malicious-firefox-extensions-impersonate-popular-crypto-wallets) - [Have an older iPhone or iPad? Apple has a security update for you](https://www.malwarebytes.com/blog/bugs/2026/10/have-an-older-iphone-or-ipad-apple-has-a-security-update-for-you) - [Banks are blocking AI agents from customer accounts](https://www.malwarebytes.com/blog/ai/2026/10/banks-are-blocking-ai-agents-from-customer-accounts) - [Chrome and Firefox updates fix serious security flaws. Install now](https://www.malwarebytes.com/blog/ai/2026/10/chrome-and-firefox-updates-fix-serious-security-flaws-install-them-now) - [Five election scams to watch out for](https://www.malwarebytes.com/blog/scams/2026/10/five-election-scams-to-watch-out-for) - [Artificial Intimacy: Love and lies in the age of AI](https://www.malwarebytes.com/blog/ai/2026/10/artificial-intimacy-love-and-lies-in-the-age-of-ai) - [The web’s having a rough week. Here’s how to browse safely](https://www.malwarebytes.com/blog/news/2026/10/the-webs-having-a-rough-week-heres-how-to-browse-safely) - [Samsung TVs without mics may listen through soundbars, researcher says](https://www.malwarebytes.com/blog/privacy/2026/10/samsung-tvs-without-mics-may-listen-through-soundbars-researcher-says) - [Popcorn Time’s forgotten updater left millions of devices exposed to hijacking](https://www.malwarebytes.com/blog/news/2026/10/popcorn-times-forgotten-updater-left-millions-of-devices-exposed-to-hijacking) - [AI Halloween videos: Who’s getting your photos?](https://www.malwarebytes.com/blog/ai/2026/10/ai-halloween-videos-whos-getting-your-photos) - [Patient records exposed in Quest breach: What you need to know](https://www.malwarebytes.com/blog/data-breaches/2026/10/patient-records-exposed-in-quest-breach-what-you-need-to-know) Stay safe! **Stop threats before they can do any harm.** Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. [Add it to your browser →](https://www.malwarebytes.com/browserguard) --- --- title: "DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work" url: "https://www.helpnetsecurity.com/2026/11/02/deepseek-dsh-superagent/" lang: "en-US" type: "post" description: "Deepseek released a research prototype of dsh-superagent, a coding agent that does work on a GitHub repository for you. Who can ask for work The agent gets to work in two situations: an allowed user asks for something, or a" last_modified: "2026-11-02T07:09:55+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/11/02/deepseek-dsh-superagent/" --- # DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work Deepseek released a research prototype of dsh-superagent, a coding agent that does work on a GitHub repository for you. Who can ask for work The agent gets to work in two situations: an allowed user asks for something, or a rule your team wrote covers it. You can also open up a chat or GitHub scope, and then anyone in it can request work just by mentioning the agent. A message, comment or quoted document … [More →](https://www.helpnetsecurity.com/2026/11/02/deepseek-dsh-superagent/) The post [DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work](https://www.helpnetsecurity.com/2026/11/02/deepseek-dsh-superagent/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "The first ten lines of a command policy for AI coding agents" url: "https://www.helpnetsecurity.com/2026/11/02/vinay-thakker-kloudstax-ai-agent-access-control/" lang: "en-US" type: "post" description: "In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person’s identity attached when acting" last_modified: "2026-11-02T06:30:36+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/11/02/vinay-thakker-kloudstax-ai-agent-access-control/" --- # The first ten lines of a command policy for AI coding agents In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person’s identity attached when acting on someone’s behalf. He covers where credential proxies go wrong, what the first ten lines of a command policy for a coding agent should say, and how to stop data from leaving through package installs … [More →](https://www.helpnetsecurity.com/2026/11/02/vinay-thakker-kloudstax-ai-agent-access-control/) The post [The first ten lines of a command policy for AI coding agents](https://www.helpnetsecurity.com/2026/11/02/vinay-thakker-kloudstax-ai-agent-access-control/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "Hackers Gain Unauthorized Access to WS Audiology CRM Environment and Operational IT Systems" url: "https://gbhackers.com/ws-audiology-systems/" lang: "en-US" type: "post" description: "WS Audiology (WSA), the parent company of Widex and Signia, is investigating unauthorized access to its internal IT infrastructure after taking selected systems offline to contain a cybersecurity incident. The disruption affected customer applications and professional services, although the company" last_modified: "2026-11-02T06:19:13+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/ws-audiology-systems/" --- # Hackers Gain Unauthorized Access to WS Audiology CRM Environment and Operational IT Systems WS Audiology (WSA), the parent company of Widex and Signia, is investigating unauthorized access to its internal IT infrastructure after taking selected systems offline to contain a cybersecurity incident. The disruption affected customer applications and professional services, although the company said hearing aids themselves remained unaffected. Its October 30 update described a phased restoration coordinated […] The post [Hackers Gain Unauthorized Access to WS Audiology CRM Environment and Operational IT Systems](https://gbhackers.com/ws-audiology-systems/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "AI-driven data centre growth demands a new approach to environmental monitoring" url: "https://itwire.com/guest-articles/guest-opinion/ai-driven-data-centre-growth-demands-a-new-approach-to-environmental-monitoring" lang: "en-US" type: "post" description: "AI is changing the demands placed on data centres. Greater computing density generates more heat, while operators face pressure to expand capacity quickly. As facilities grow,..." last_modified: "2026-11-02T06:07:05+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/guest-articles/guest-opinion/ai-driven-data-centre-growth-demands-a-new-approach-to-environmental-monitoring" --- # AI-driven data centre growth demands a new approach to environmental monitoring AI is changing the demands placed on data centres. Greater computing density generates more heat, while operators face pressure to expand capacity quickly. As facilities grow,… --- --- title: "Operation Blackout: A Tactical Success Against Scam Centers" url: "https://www.geek-guy.com/operation-blackout-tactical-success-against-scam-centers/" lang: "en-US" type: "post" description: "Learn how a coordinated FBI-led operation dismantled scam centers in the US and abroad, tackling fraud networks that prey on vulnerable people." last_modified: "2026-11-02T06:02:30+00:00" categories: [GeekGuyBlog] tags: [cybersecurity, fraud prevention, law enforcement, Operation Blackout, scam centers, threat intelligence] custom_fields: botwriter_image_prompt_last: "law enforcement raid scam center" botwriter_stockphoto_prompt: "law enforcement raid scam center" botwriter_image_prompt_last_provider: "stockphoto" --- # Operation Blackout: A Tactical Success Against Scam Centers On October 10, 2023, a coordinated law enforcement operation known as Operation Blackout successfully dismantled numerous scam centers across the United States and abroad. This multi-agency initiative targeted fraudulent operations that exploited vulnerable citizens through deceptive practices. The operation was primarily spearheaded by the Federal Bureau of Investigation (FBI) in collaboration with international law enforcement agencies, highlighting the global nature of the scam problem. ## Context: Understanding the Scamming Landscape Scam operations have proliferated in recent years, fueled by advancements in technology and an increase in online fraud. According to the Federal Trade Commission (FTC), Americans lost approximately $5.8 billion to fraud in 2022 alone. Scam centers typically engage in various fraudulent activities, including tech support scams, lottery scams, and impersonation schemes. These operations disproportionately affect the elderly and other vulnerable populations, making their dismantling a priority for law enforcement. ## Operation Blackout: A Tactical Overview Operation Blackout began as a localized initiative but quickly expanded into a nationwide crackdown. Law enforcement agencies executed search warrants in various locations, leading to the arrest of over 100 suspects believed to be operating scam centers. According to FBI spokesperson, Special Agent Sarah Thompson, --- --- title: "Byoky: Open-source wallet for AI API keys" url: "https://www.helpnetsecurity.com/2026/11/02/byoky-open-source-ai-api-key-wallet/" lang: "en-US" type: "post" description: "Byoky is an open-source wallet for AI API keys, available as a Chrome and Firefox extension and as iOS and Android apps. Users store their keys for OpenAI, Anthropic, Google Gemini and other providers in it, encrypted on their own" last_modified: "2026-11-02T06:00:33+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/11/02/byoky-open-source-ai-api-key-wallet/" --- # Byoky: Open-source wallet for AI API keys Byoky is an open-source wallet for AI API keys, available as a Chrome and Firefox extension and as iOS and Android apps. Users store their keys for OpenAI, Anthropic, Google Gemini and other providers in it, encrypted on their own device. Apps that want those keys ask the wallet for access, and the wallet sends each request to the provider itself. The app gets a session token. The key stays in the wallet. Byoky goes … [More →](https://www.helpnetsecurity.com/2026/11/02/byoky-open-source-ai-api-key-wallet/) The post [Byoky: Open-source wallet for AI API keys](https://www.helpnetsecurity.com/2026/11/02/byoky-open-source-ai-api-key-wallet/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value" url: "https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html" lang: "en-US" type: "post" description: "Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped" last_modified: "2026-11-02T05:51:07+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html" --- # New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim’s stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces; --- --- title: "Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS" url: "https://gbhackers.com/malicious-claude-code-extensions-in-cursor-marketplace/" lang: "en-US" type: "post" description: "Malicious Claude Code extensions distributed through Cursor’s VS Code The Extension Marketplace tried to create persistent SSH backdoors on Windows and macOS developer systems. The affected packages were the Anthropic.claude-code versions 2.1.312 and 2.1.313, which were available on October 29," last_modified: "2026-11-02T05:45:51+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/malicious-claude-code-extensions-in-cursor-marketplace/" --- # Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS Malicious Claude Code extensions distributed through Cursor’s VS Code The Extension Marketplace tried to create persistent SSH backdoors on Windows and macOS developer systems. The affected packages were the Anthropic.claude-code versions 2.1.312 and 2.1.313, which were available on October 29, 2026, between approximately 2:27 a.m. and 1:35 p.m. Cursor stated that Anthropic did not develop […] The post [Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS](https://gbhackers.com/malicious-claude-code-extensions-in-cursor-marketplace/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data" url: "https://gbhackers.com/artex-ai-agents/" lang: "en-US" type: "post" description: "Threat actors are weaponizing ARTEX, an autonomous penetration-testing framework, to accelerate network intrusions, escalate privileges, and steal sensitive information. Google Threat Intelligence Group and Mandiant investigations described in the supplied report show attackers delegating substantial portions of post-compromise operations to" last_modified: "2026-11-02T05:32:37+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/artex-ai-agents/" --- # Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data Threat actors are weaponizing ARTEX, an autonomous penetration-testing framework, to accelerate network intrusions, escalate privileges, and steal sensitive information. Google Threat Intelligence Group and Mandiant investigations described in the supplied report show attackers delegating substantial portions of post-compromise operations to coordinated AI agents, compressing execution sequences into seconds. Observed since late August 2026, the activity […] The post [Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data](https://gbhackers.com/artex-ai-agents/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Product showcase: Trust Onion uses rotating codewords to verify callers" url: "https://www.helpnetsecurity.com/2026/11/02/product-showcase-trust-onion/" lang: "en-US" type: "post" description: "Trust Onion is a free app that gives trusted groups three rotating codewords to check who they are communicating with. It also includes signed selfies, message checks, and callback requests. It is available for macOS, iOS, and Android. I tested" last_modified: "2026-11-02T05:30:38+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/11/02/product-showcase-trust-onion/" --- # Product showcase: Trust Onion uses rotating codewords to verify callers Trust Onion is a free app that gives trusted groups three rotating codewords to check who they are communicating with. It also includes signed selfies, message checks, and callback requests. It is available for macOS, iOS, and Android. I tested the iPhone app with an older person, exploring setup and the tools available when a call or message raises concerns. Verification matters when someone asks for money, access, or information. Cisco Talos documented attackers posing … [More →](https://www.helpnetsecurity.com/2026/11/02/product-showcase-trust-onion/) The post [Product showcase: Trust Onion uses rotating codewords to verify callers](https://www.helpnetsecurity.com/2026/11/02/product-showcase-trust-onion/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "Hacktober 2026: Major Cyberattacks Hit Binance, PHP, Node.js, LiteLLM, and Pentagon" url: "https://gbhackers.com/hacktober-2026-major-cyberattacks/" lang: "en-US" type: "post" description: "October’s cybersecurity disclosures spanned cryptocurrency platforms, developer infrastructure, certificate authorities, government records, gaming accounts, and retail operations. Dubbed Hacktober, the wave included unrelated incidents rather than a single coordinated campaign. Confirmed breaches, malicious releases, vulnerable configurations, and possible credential exposure" last_modified: "2026-11-02T05:25:03+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/hacktober-2026-major-cyberattacks/" --- # Hacktober 2026: Major Cyberattacks Hit Binance, PHP, Node.js, LiteLLM, and Pentagon October’s cybersecurity disclosures spanned cryptocurrency platforms, developer infrastructure, certificate authorities, government records, gaming accounts, and retail operations. Dubbed Hacktober, the wave included unrelated incidents rather than a single coordinated campaign. Confirmed breaches, malicious releases, vulnerable configurations, and possible credential exposure require separate treatment, particularly where discovery dates differ from intrusion timelines. Cryptocurrency Platforms Face Different […] The post [Hacktober 2026: Major Cyberattacks Hit Binance, PHP, Node.js, LiteLLM, and Pentagon](https://gbhackers.com/hacktober-2026-major-cyberattacks/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data" url: "https://gbhackers.com/volta-infostealer/" lang: "en-US" type: "post" description: "A self-deleting Windows infostealer named VOLTA uses commercial AI models to turn stolen credentials, sessions, and cryptocurrency data into prioritized victim assessments. The malware, self-named “VOLTA-AUTODOXER,” combines extensive collection capabilities with automated identity enrichment. Its distinguishing feature is analytical outsourcing:" last_modified: "2026-11-02T05:08:58+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/volta-infostealer/" --- # New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data A self-deleting Windows infostealer named VOLTA uses commercial AI models to turn stolen credentials, sessions, and cryptocurrency data into prioritized victim assessments. The malware, self-named “VOLTA-AUTODOXER,” combines extensive collection capabilities with automated identity enrichment. Its distinguishing feature is analytical outsourcing: after harvesting information, it asks a large language model to determine who the victim is, […] The post [New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data](https://gbhackers.com/volta-infostealer/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "FBI Confirms North Korean Hackers Stole Over $6 Billion From Binance in Massive Crypto Attack" url: "https://gbhackers.com/fbi-confirms-north-korean-hackers-stole-over-6-billion-from-binance/" lang: "en-US" type: "post" description: "The Federal Bureau of Investigation (FBI) has linked the theft of over $6 billion in virtual assets from Binance to North Korean hackers, labeling the operation as “TraderTraitor.” In an advisory released on October 31, the FBI reported that the" last_modified: "2026-11-02T05:08:20+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/fbi-confirms-north-korean-hackers-stole-over-6-billion-from-binance/" --- # FBI Confirms North Korean Hackers Stole Over $6 Billion From Binance in Massive Crypto Attack The Federal Bureau of Investigation (FBI) has linked the theft of over $6 billion in virtual assets from Binance to North Korean hackers, labeling the operation as “TraderTraitor.” In an advisory released on October 31, the FBI reported that the cryptocurrency exchange was targeted around October 29, 2026. This announcement marks an official attribution but […] The post [FBI Confirms North Korean Hackers Stole Over $6 Billion From Binance in Massive Crypto Attack](https://gbhackers.com/fbi-confirms-north-korean-hackers-stole-over-6-billion-from-binance/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "Ransomware gang talked AI agents into doing much of its dirty work" url: "https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/" lang: "en-US" type: "post" description: "The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, according to Sophos. AI-assisted intrusion workflow (Source: Sophos) The company, which tracks the" last_modified: "2026-11-02T05:00:46+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/" --- # Ransomware gang talked AI agents into doing much of its dirty work The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, according to Sophos. AI-assisted intrusion workflow (Source: Sophos) The company, which tracks the group as GOLD OGRE, recovered artifacts from the Cursor AI coding assistant in late August that show the attackers handing the agents VPN logins, proxy access, targets and objectives. The agents then mapped the network … [More →](https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/) The post [Ransomware gang talked AI agents into doing much of its dirty work](https://www.helpnetsecurity.com/2026/11/02/aur0ra-ransomware-ai-agents/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access" url: "https://gbhackers.com/critical-incus-and-lxd-vulnerabilities/" lang: "en-US" type: "post" description: "Critical certificate-validation vulnerabilities have been identified in Incus and Canonical LXD, allowing unauthenticated attackers to impersonate trusted identities and compromise management infrastructure. Exploitation of these vulnerabilities requires network access to the HTTPS listener but does not require valid credentials or" last_modified: "2026-11-02T04:58:43+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://gbhackers.com/feed/" wpe_sourcepermalink: "https://gbhackers.com/critical-incus-and-lxd-vulnerabilities/" --- # Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access Critical certificate-validation vulnerabilities have been identified in Incus and Canonical LXD, allowing unauthenticated attackers to impersonate trusted identities and compromise management infrastructure. Exploitation of these vulnerabilities requires network access to the HTTPS listener but does not require valid credentials or the private key for a trusted certificate. This LXD vulnerability may expose entire clusters and […] The post [Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access](https://gbhackers.com/critical-incus-and-lxd-vulnerabilities/) appeared first on [GBHackers Security | #1 Globally Trusted Cyber Security News Platform](https://gbhackers.com/). --- --- title: "xTool Officially Launches X1: An Upgradeable Multi-Laser Platform Engineered for Speed, Versatility, and Business Growth" url: "https://itwire.com/business-it-news/print-solutions/xtool-officially-launches-x1-an-upgradeable-multi-laser-platform-engineered-for-speed-versatility-and-business-growth" lang: "en-US" type: "post" description: "Moving beyond traditional wattage wars, xTool’s new flagship platform combines high-speed Galvo with large-format Gantry motion, introducing modular LaserSwap technology and..." last_modified: "2026-11-02T04:06:58+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/business-it-news/print-solutions/xtool-officially-launches-x1-an-upgradeable-multi-laser-platform-engineered-for-speed-versatility-and-business-growth" --- # xTool Officially Launches X1: An Upgradeable Multi-Laser Platform Engineered for Speed, Versatility, and Business Growth Moving beyond traditional wattage wars, xTool’s new flagship platform combines high-speed Galvo with large-format Gantry motion, introducing modular LaserSwap technology and… --- --- title: "Gigamon appoints Caerl Murray as ANZ Country Manager to accelerate regional growth" url: "https://itwire.com/it-people-news/people-moves/gigamon-appoints-caerl-murray-as-anz-country-manager-to-accelerate-regional-growth" lang: "en-US" type: "post" description: "Technology industry veteran to strengthen customer and partner relationships as demand for deep observability grows across Australia and New Zealand" last_modified: "2026-11-02T03:56:02+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/it-people-news/people-moves/gigamon-appoints-caerl-murray-as-anz-country-manager-to-accelerate-regional-growth" --- # Gigamon appoints Caerl Murray as ANZ Country Manager to accelerate regional growth Technology industry veteran to strengthen customer and partner relationships as demand for deep observability grows across Australia and New Zealand --- --- title: "Inside a successful AWS European Sovereign Cloud exercise to demonstrate independent operation" url: "https://aws.amazon.com/blogs/security/inside-a-successful-aws-european-sovereign-cloud-exercise-to-demonstrate-independent-operation/" lang: "en-US" type: "post" description: "On Saturday, October 24, 2026 we conducted a successful exercise demonstrating that the AWS European Sovereign Cloud can operate without depending on any infrastructure outside the European Union (EU). This was the first public technical exercise demonstrating the independence of" last_modified: "2026-11-02T03:37:30+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://aws.amazon.com/blogs/security/feed/" wpe_sourcepermalink: "https://aws.amazon.com/blogs/security/inside-a-successful-aws-european-sovereign-cloud-exercise-to-demonstrate-independent-operation/" --- # Inside a successful AWS European Sovereign Cloud exercise to demonstrate independent operation On Saturday, October 24, 2026 we conducted a successful exercise demonstrating that the [AWS European Sovereign Cloud](https://www.aws.eu/european-sovereign-cloud/) can operate without depending on any infrastructure outside the European Union (EU). This was the first public technical exercise demonstrating the independence of a sovereign cloud Region. The AWS European Sovereign Cloud is [a new, independent cloud partition for Europe](https://aws.amazon.com/blogs/aws/opening-the-aws-european-sovereign-cloud/) that became generally available in January 2026, with its first AWS Region in Brandenburg, Germany. It is physically and logically separate from other [AWS Regions](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/), with no critical dependencies on non-EU infrastructure, and all customer content and customer-created metadata remains in the EU. The AWS European Sovereign Cloud is managed through dedicated European legal entities established under German law and operated entirely within Europe. My fellow Managing Director, Stefan Hoechbauer, and I called for the exercise. We are EU citizens residing in the EU, responsible for its management and operations, including its infrastructure, technology, and services. Only EU residents located in the EU control its operations and support, and AWS is gradually transitioning the AWS European Sovereign Cloud to be operated exclusively by EU citizens located in the EU. ## **What we did** In standard operations, the AWS European Sovereign Cloud uses two global systems: the [AWS Global Network](https://aws.amazon.com/about-aws/global-infrastructure/global-network/) backbone, and a dedicated system operated by the local EU team to manage limited, controlled transfers of operational AWS data. As we [explained ahead of the exercise](https://aws.amazon.com/blogs/security/aws-european-sovereign-cloud-demonstrating-an-independent-operation/), neither is critical to running the AWS European Sovereign Cloud. During the exercise, the team switched off both systems, and traffic that normally travels across the AWS Global Network backbone rerouted securely over the public internet. The AWS European Sovereign Cloud can operate independently at any time, and for several hours on October 24 the team showed exactly that, running it on only its own software and hardware resources, operated by EU-resident staff within the EU. Workloads continued running, and customers could still access their data. The exercise did not affect service availability within the AWS European Sovereign Cloud, other AWS Regions, or private connectivity through [AWS Direct Connect](https://aws.amazon.com/directconnect/). When the exercise finished, traffic returned to its normal path. ## **Why we ran it** Transparency is at the core of our digital sovereignty commitment, so we ran the AWS European Sovereign Cloud exercise openly and reported back on the outcome. The exercise produced verifiable technical and operational evidence that the AWS European Sovereign Cloud can continue to operate independently within the EU. It turns a design claim into a verified result. Organizations in regulated industries and the public sector can take this result to regulators and their boards as evidence for their compliance and assurance documents. ## **What customers and partners are saying** > “Digital sovereignty is ultimately about trust and safeguarding business continuity. The successful demonstration of the AWS European Sovereign Cloud’s operational independence is an important proof point for European organizations with the most stringent sovereignty requirements. Combined with Capgemini’s European heritage, presence and AWS capabilities, we can deliver a sovereign proposition in Europe, for Europe, by Europeans, enabling clients to accelerate secure and resilient cloud and AI transformation at scale whilst assuring business continuity.” – **Fernando Alvarez, Chief Strategy and Development Officer and Group Executive Board Member, Capgemini** > “Autonomy, resilience and operational control are foundations driving digital sovereignty concerns across the public sector and regulated industries. Achieving sovereignty requires more than a sound and consistent architecture; it demands operational evidence to build trust. The AWS European Sovereign Cloud team has provided evidence, supporting organizations on the transformation of their critical data and digital assets toward greater sovereign control. Having engaged with this team since the inception of the project, and as a Launch Partner of the AWS Digital Sovereignty Competency, Atos helps customers define their sovereignty roadmaps, adopt the appropriate graduated solutions, and confidently operate and govern their target sovereignty posture.” – **Michael Kollar, Digital Sovereignty Leader and Head of Cloud & Modern Infrastructure and Digital Workplace, Atos Group ** > “For organizations in regulated industries, meeting strict data and operational requirements cannot come at the cost of a great customer experience. Running on the AWS European Sovereign Cloud, Genesys can help European organizations deliver exactly that, with their data and operations kept in the EU. Seeing the AWS European Sovereign Cloud operate independently under real conditions helps give our shared customers added confidence to move their most sensitive workloads to the cloud.” – **Daniel Karadza, Senior Director, Partners and Alliances, EMEA Central and Benelux, Genesys** > “Operational independence is a defining pillar of digital sovereignty, and the AWS European Sovereign Cloud has shown what that means in practice. It runs without reliance on any infrastructure outside the EU and is operated entirely by EU residents, which makes it a strong fit for Europe’s regulated industries and public sector. As an early collaborator with the AWS European Sovereign Cloud team before its launch, Accenture is uniquely positioned to help clients navigate sovereignty requirements and scale with greater confidence and control.” – **Emanuele Baldassarre, Managing Director, Accenture** ## **Learn more** To learn more about the design and digital sovereignty controls of the AWS European Sovereign Cloud, visit [aws.eu](https://aws.eu/). If you have questions about this exercise or want to discuss your workloads, reach out to AWS Support or contact your AWS Account team. ![Stephane Israel](https://d2908q01vomqb2.cloudfront.net/22d200f8670dbdb3e253a90eee5098477c95c23d/2026/05/11/Stephane-Israel-Headshot.jpg) ### Stéphane Israël Stéphane is the leader and Managing Director of the AWS European Sovereign Cloud. He is responsible for the management and operations of the AWS European Sovereign Cloud, including infrastructure, technology, and services, in addition to broader digital sovereignty efforts at AWS. Prior to AWS, he was the CEO of Arianespace, where he oversaw numerous successful space missions, including the launch of the James Webb Space Telescope. --- --- title: "Kudosity Opens RCS Agent Registration To Help Australian Businesses Get Ready For Rich Messaging" url: "https://itwire.com/guest-articles/company-news/kudosity-opens-rcs-agent-registration-to-help-australian-businesses-get-ready-for-rich-messaging" lang: "en-US" type: "post" description: "Already supporting RCS messaging across international markets, Kudosity is helping Australian brands prepare for the next generation of business messaging ahead of broader..." last_modified: "2026-11-02T02:55:24+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/guest-articles/company-news/kudosity-opens-rcs-agent-registration-to-help-australian-businesses-get-ready-for-rich-messaging" --- # Kudosity Opens RCS Agent Registration To Help Australian Businesses Get Ready For Rich Messaging Already supporting RCS messaging across international markets, Kudosity is helping Australian brands prepare for the next generation of business messaging ahead of broader… --- --- title: "ISC Stormcast For Monday, November 2nd, 2026 https://isc.sans.edu/podcastdetail/10160, (Mon, Nov 2nd)" url: "https://isc.sans.edu/diary/rss/33480" lang: "en-US" type: "post" description: "(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License." last_modified: "2026-11-02T02:00:03+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://isc.sans.edu/rssfeed_full.xml" wpe_sourcepermalink: "https://isc.sans.edu/diary/rss/33480" --- # ISC Stormcast For Monday, November 2nd, 2026 https://isc.sans.edu/podcastdetail/10160, (Mon, Nov 2nd) (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --- --- title: "Zip to launch ZMobile to all Australians" url: "https://itwire.com/it-industry-news/telecoms-and-nbn/zip-to-launch-zmobile-to-all-australians" lang: "en-US" type: "post" description: "Zip Co ASX: ZIP, the digital financial services company offering innovative, people-centred products, has today announced that its mobile product, ZMobile, is now available to..." last_modified: "2026-11-02T01:57:20+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/it-industry-news/telecoms-and-nbn/zip-to-launch-zmobile-to-all-australians" --- # Zip to launch ZMobile to all Australians Zip Co ASX: ZIP, the digital financial services company offering innovative, people-centred products, has today announced that its mobile product, ZMobile, is now available to… --- --- title: "To Tame the Fastest Drivers, States Deploy Speed-Limiting Devices on Cars" url: "https://www.wsj.com/lifestyle/cars/to-tame-the-fastest-drivers-states-deploy-speed-limiting-devices-on-cars-4eafe66d?mod=rss_Technology" lang: "en-US" type: "post" description: "Virginia and other states are trying to slow “super speeders” with GPS technology that prevents their cars from blowing the speed limit." last_modified: "2026-11-02T01:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/lifestyle/cars/to-tame-the-fastest-drivers-states-deploy-speed-limiting-devices-on-cars-4eafe66d?mod=rss_Technology" --- # To Tame the Fastest Drivers, States Deploy Speed-Limiting Devices on Cars Virginia and other states are trying to slow “super speeders” with GPS technology that prevents their cars from blowing the speed limit. --- --- title: "The National Energy PKI Selects DigiCert to Secure Australia’s Growing Energy Network" url: "https://itwire.com/guest-articles/company-news/the-national-energy-pki-selects-digicert-to-secure-australia-s-growing-energy-network" lang: "en-US" type: "post" description: "Rooftop solar and battery systems will prove their identity to the grid and communicate securely through the National Energy PKI, with DigiCert providing the digital..." last_modified: "2026-11-02T00:59:32+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/guest-articles/company-news/the-national-energy-pki-selects-digicert-to-secure-australia-s-growing-energy-network" --- # The National Energy PKI Selects DigiCert to Secure Australia’s Growing Energy Network Rooftop solar and battery systems will prove their identity to the grid and communicate securely through the National Energy PKI, with DigiCert providing the digital… --- --- title: "Ping Identity Recognised as a Leader in 2026 Gartner Magic Quadrant for Customer Identity and Access Management" url: "https://itwire.com/guest-articles/company-news/ping-identity-recognised-as-a-leader-in-2026-gartner-magic-quadrant-for-customer-identity-and-access-management" lang: "en-US" type: "post" description: "Ping positioned highest in Ability to Execute" last_modified: "2026-11-02T00:09:10+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/guest-articles/company-news/ping-identity-recognised-as-a-leader-in-2026-gartner-magic-quadrant-for-customer-identity-and-access-management" --- # Ping Identity Recognised as a Leader in 2026 Gartner Magic Quadrant for Customer Identity and Access Management Ping positioned highest in Ability to Execute --- --- title: "Dayforce Unveils the Agentic HCM Platform" url: "https://itwire.com/business-it-news/data/dayforce-unveils-the-agentic-hcm-platform" lang: "en-US" type: "post" description: "Native AI woven across a more open, connected platform helps organisations get answers, take action, complete work, and build what’s next — with the trust, compliance, and..." last_modified: "2026-11-01T23:33:19+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/business-it-news/data/dayforce-unveils-the-agentic-hcm-platform" --- # Dayforce Unveils the Agentic HCM Platform Native AI woven across a more open, connected platform helps organisations get answers, take action, complete work, and build what’s next — with the trust, compliance, and… --- --- title: "Cloudera Expands Enterprise AI Ecosystem to Power AI Factories Anywhere" url: "https://itwire.com/guest-articles/company-news/cloudera-expands-enterprise-ai-ecosystem-to-power-ai-factories-anywhere" lang: "en-US" type: "post" description: "Neo4j and Cartesia join an expanding ecosystem alongside Mistral AI and VAST Data, bringing greater choice across enterprise knowledge, models, voice, and infrastructure" last_modified: "2026-11-01T23:27:42+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/guest-articles/company-news/cloudera-expands-enterprise-ai-ecosystem-to-power-ai-factories-anywhere" --- # Cloudera Expands Enterprise AI Ecosystem to Power AI Factories Anywhere Neo4j and Cartesia join an expanding ecosystem alongside Mistral AI and VAST Data, bringing greater choice across enterprise knowledge, models, voice, and infrastructure --- --- title: "IDeaS Expands Strategic Relationship with Accor Through Selection of Optix Business Intelligence" url: "https://itwire.com/it-industry-news/strategy/ideas-expands-strategic-relationship-with-accor-through-selection-of-optix-business-intelligence" lang: "en-US" type: "post" description: "Optix solution will help Accor hotels streamline commercial reporting, accelerate decision-making, and strengthen revenue strategy across individual properties and portfolios" last_modified: "2026-11-01T23:10:27+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/it-industry-news/strategy/ideas-expands-strategic-relationship-with-accor-through-selection-of-optix-business-intelligence" --- # IDeaS Expands Strategic Relationship with Accor Through Selection of Optix Business Intelligence Optix solution will help Accor hotels streamline commercial reporting, accelerate decision-making, and strengthen revenue strategy across individual properties and portfolios --- --- title: "F5 and Oracle collaborate to strengthen application security in the AI era" url: "https://itwire.com/it-industry-news/strategy/f5-and-oracle-collaborate-to-strengthen-application-security-in-the-ai-era" lang: "en-US" type: "post" description: "Collaboration is intended to help secure web applications and APIs against evolving cyber threats" last_modified: "2026-11-01T23:06:59+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/it-industry-news/strategy/f5-and-oracle-collaborate-to-strengthen-application-security-in-the-ai-era" --- # F5 and Oracle collaborate to strengthen application security in the AI era Collaboration is intended to help secure web applications and APIs against evolving cyber threats --- --- title: "How open source AI agents, skills, and MCP servers are reshaping cybersecurity defense" url: "https://itwire.com/business-it-news/business-intelligence/how-open-source-ai-agents-skills-and-mcp-servers-are-reshaping-cybersecurity-defense" lang: "en-US" type: "post" description: "The model is the easy part of an AI agent" last_modified: "2026-11-01T22:53:36+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://itwire.com/feed.xml" wpe_sourcepermalink: "https://itwire.com/business-it-news/business-intelligence/how-open-source-ai-agents-skills-and-mcp-servers-are-reshaping-cybersecurity-defense" --- # How open source AI agents, skills, and MCP servers are reshaping cybersecurity defense The model is the easy part of an AI agent --- --- title: "Federal court tosses Trump lawsuit challenging Alaska Senate certification" url: "https://cyberscoop.com/judge-dismisses-alaska-senate-lawsuit-peltola-sullivan/" lang: "en-US" type: "post" description: "A federal judge dismissed a lawsuit from the federal government seeking to preemptively block Democratic Senate candidate Mary Peltola from assuming office if she wins her race. The Department of Justice sued Alaska last month, arguing that an alleged scheme" last_modified: "2026-11-01T22:47:26+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://cyberscoop.com/feed/" wpe_sourcepermalink: "https://cyberscoop.com/judge-dismisses-alaska-senate-lawsuit-peltola-sullivan/" --- # Federal court tosses Trump lawsuit challenging Alaska Senate certification A federal judge dismissed a lawsuit from the federal government seeking to preemptively block Democratic Senate candidate Mary Peltola from assuming office if she wins her race. The Department of Justice sued Alaska last month, arguing that an alleged scheme by Peltola to recruit Daniel J. Sullivan, an independent candidate who shares a name with incumbent Republican Sen. Dan S. Sullivan, would confuse voters. Peltola’s campaign, the Democratic Senate Campaign Committee and civic groups including the League of Women Voters of Alaska and Common Cause all filed motions to dismiss the lawsuit, arguing the federal government lacks standing and constitutional authority to weigh in on Alaska’s elections. They also said the court cannot grant relief because there is no legal way to determine whether a voter mistakenly voted for one Sullivan over the other without violating the secret ballot. U.S. District Judge Sharon Gleason reached the same conclusion, noting in an [order](https://www.documentcloud.org/documents/28861793-order-dismissing-action-us-vs-alaska/) “the absence of any explanation from the United States as to how its requested relief could redress its alleged injury while simultaneously maintaining the secrecy of the ballot.” She also wrote that she “cannot grant the United States the relief it seeks because the United States has failed to establish the redressability prerequisite for Article III standing.” Gleason’s opinion recounts Daniel J. Sullivan’s independent candidacy. Alaska Director of Elections Carol Beecher decertified it in June, later testifying that she did not believe he was running in good faith. State courts disagreed and restored his candidacy, and the Alaska Supreme Court upheld that ruling.  Alaskan election officials still took steps to distinguish the two candidates, listing their full names and labeling them “Incumbent,” “Republican candidate” and “Independent.” Alaska’s ranked-choice system lets voters rank both Sullivans, so they are not limited to a single candidate. State officials and election experts also noted that nearly 60,000 Alaskan voters [have already cast early or mail ballots](https://www.chilkatvalleynews.com/2026/10/30/alaska-is-on-pace-to-match-2024s-record-high-early-voting-numbers/), and there is no feasible way to reissue them. The government’s one-sentence response said the state could segregate ballots and asked the court to allow a federal investigation into whether any voters were deceived. Gleason rejected that approach, saying the government offered no explanation of how ballot segregation or a law enforcement inquiry into voters’ intent could be carried out while preserving ballot secrecy. Gleason also questioned the government’s constitutional basis, writing that the executive branch has no legitimate role in determining which candidates appear on Alaska’s ballots. The government said it was not seeking to change the time, place or manner of the election, but Gleason noted that its requests, including limits on certification, ballot segregation and an investigation of voters’ intent, all concern those matters, which are the state’s responsibility. The lawsuit drew heavy media attention and concern from democracy advocates, but legal experts widely viewed it as exceptionally weak. “Today’s ruling marks a victory for Alaska state sovereignty and Alaskan voters,” said David Becker, executive director of the nonprofit Center for Election Innovation and Research and a former voting rights attorney at DOJ. “By soundly rejecting the administration’s unlawful and now unsuccessful attempt to interfere, the court concurred with the State of Alaska that this is purely a matter of state law and that, under the U.S. Constitution, the federal government has no role in determining how Alaska certifies its Senate election.” The post [Federal court tosses Trump lawsuit challenging Alaska Senate certification](https://cyberscoop.com/judge-dismisses-alaska-senate-lawsuit-peltola-sullivan/) appeared first on [CyberScoop](https://cyberscoop.com/). --- --- title: "The Post-AI Security Floor" url: "https://danielmiessler.com/blog/post-ai-security-floor?utm_source=rss&utm_medium=feed&utm_campaign=website" lang: "en-US" type: "post" description: "Cybersecurity recommendations during The Hackening. In 2023 I guessed that AI would help attackers before it helped defenders, and that their lead would last three to five years. We're inside that window now.As I wrote in Attacker vs. Defender AI" last_modified: "2026-11-01T20:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://danielmiessler.com/feed.rss" wpe_sourcepermalink: "https://danielmiessler.com/blog/post-ai-security-floor?utm_source=rss&utm_medium=feed&utm_campaign=website" --- # The Post-AI Security Floor [![Hand-drawn diagram titled The Post-AI Security Floor with three numbered steps: know everything you have shipped, get it off the open internet, and lean on big vendors instead of small ones](https://danielmiessler.com/images/post-ai-security-floor-diagram.webp)](https://danielmiessler.com/images/post-ai-security-floor-diagram.webp) Cybersecurity recommendations during The Hackening. In 2023 I guessed that [AI would help attackers before it helped defenders](https://danielmiessler.com/blog/will-ai-help-moreattackers-defenders), and that their lead would last three to five years. We’re inside that window now. > As I wrote in [Attacker vs. Defender AI Advantage](https://danielmiessler.com/blog/attacker-defender-ai-advantage), attackers can go from learning something to using it **in minutes or hours, while most companies still need weeks or months**. So this list is about the things you can do quickly, without waiting on a big program. ## 1. Have a full list of everything you have shipped online Every website, every app, every API, every database, every container, etc. Don’t worry about a fancy database if you don’t have one already. Just get the stuff in a **Markdown file**. Or a spreadsheet. Whatever you’re most comfortable with. I’ve been saying some version of this [since 2007](https://danielmiessler.com/blog/vulnerability-management-without-asset-management-isnt): “you can’t hope to manage what you don’t know about.” What’s different now is that the attacker is building this list too, with [AI doing 24/7 recon to enumerate all your systems](https://www.youtube.com/watch?v=N3J5_JxJRic). **If their list is better than yours, they find your forgotten stuff before you do.** Those forgotten pieces are usually the ones that get popped, like the staging server from a weekend project, or the old API you replaced but never turned off. > 💡 In 2018 I proposed grading security teams on this list: an A meant 90% accurate, or no more than a week old. [![A charcoal firestorm of purple flame burns exposed server cabinets on the left, while on the right a person hauls a heavy stone vault door shut, their own server rack safe inside](https://danielmiessler.com/images/post-ai-security-floor.webp)](https://danielmiessler.com/images/post-ai-security-floor.webp) This matters more now because the attacker works around the clock. An AI that scans everything forever will eventually find whatever is listening, so the goal is to **leave only what must be public on the open internet**. 🔌 Tailscale builds a private network between your own devices, so a service only answers machines you’ve added. Two solutions I really like for this are **[Tailscale](https://tailscale.com/)**, and **[Cloudflare Tunnels](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)**. Can they be hacked too? Sure they can, but it’s likely that many people would know very quickly if they were, and in the meantime you won’t have all your apps and APIs and services flapping in the internet wind while this fire is blazing. ☁️ A Cloudflare Tunnel connects outward to Cloudflare, so your server keeps every inbound port closed. That “people would know very quickly” point is the same logic I use for vendors in the next section. A big, heavily watched provider can still get popped, but it would likely be loud, and that makes it hard to keep secret for long. ## 3. Reduce your reliance on small security vendors with tons of people’s credentials They are the dangerous combination of being too small and underfunded to counter agentic and nation state attackers + being extremely **juicy as targets**. That is not the place to be right now. > With AI, an attacker can afford to work on one small vendor for months, while that vendor usually has a small security team that’s already stretched thin. And when that vendor holds credentials for thousands of customers, **one break gives the attacker all of them**. Big vendors get hacked too. The difference is that **they have giant security teams with tens of millions of dollars they can put into action the instant something happens**, and that response is the defense you should be depending on. [1](https://danielmiessler.com/blog/post-ai-security-floor?utm_source=rss&utm_medium=feed&utm_campaign=website#note-1) In [Vendor Security 2.0](https://danielmiessler.com/blog/its-time-for-vendor-security-2-0) I said to **assume your vendors are compromised**, then work out what you’d lose and how to shrink it. Go down the vendor column from step 1 and ask what happens to you if each one gets popped tomorrow. Where you can, **move those credentials to the big platforms you already depend on**, like your OS or your cloud provider. Where you can’t, cut the vendor’s access down to the minimum it needs, and rotate whatever it holds. 📚 This is also why I think [good app features become OS features](https://danielmiessler.com/blog/good-app-features-become-os-features). Core security belongs with the platform. ## Summary - Make a list of everything you’ve shipped online, even if it’s just a Markdown file - Take as much of it off the open internet as you can, with something like Tailscale or Cloudflare Tunnels - Get your most sensitive credentials away from small vendors that are juicy targets and badly outmatched - I’ll keep adding to this list as the fire keeps burning #### Notes --- --- title: "FBI links $6.3 billion Binance crypto heist to North Korean hackers" url: "https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/" lang: "en-US" type: "post" description: "The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record." last_modified: "2026-11-01T19:57:53+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/" --- # FBI links $6.3 billion Binance crypto heist to North Korean hackers The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record. […] --- --- title: "FBI Blames North Korea for $6 Billion Binance Crypto Theft" url: "https://securityaffairs.com/202221/apt/fbi-blames-north-korea-for-6-billion-binance-crypto-theft.html" lang: "en-US" type: "post" description: "The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds. The FBI has named North Korea as the party behind the theft of more than $6 billion" last_modified: "2026-11-01T19:23:14+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202221/apt/fbi-blames-north-korea-for-6-billion-binance-crypto-theft.html" --- # FBI Blames North Korea for $6 Billion Binance Crypto Theft ## The FBI blames North Korea for stealing $6 billion from Binance and urges crypto firms to block transactions linked to the stolen funds. The FBI has named North Korea as the party behind the [theft of more than $6 billion](https://securityaffairs.com/202119/cyber-crime/6-3-billion-stolen-from-binance-in-attack-attributed-to-north-korea.html) in virtual assets from the crypto exchange Binance, on or about October 29, 2026. The bureau published its findings in a [public alert](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack). The FBI specifically blames the North Korea-linked APT “[TraderTraitor](https://securityaffairs.com/tag/tradertraitor),” also tracked as [Lazarus Group](https://securityaffairs.com/tag/lazarus-group) and [APT38](https://securityaffairs.com/tag/apt38). Binance hasn’t named a culprit, but the blockchain analysis firm TRM has. It was the first to attribute the attack to [TraderTraitor](https://securityaffairs.com/tag/tradertraitor), and Chainalysis also said it’s highly confident in that finding. _“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.”” [reads the FBI’s statement](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack)._ _“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”_ Attackers used access from an engineer’s laptop to reach a service container and send unauthorized withdrawal requests. Binance says it has found no evidence that attackers stole any wallet private keys. The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), has spotted TraderTraitor actors turning the stolen assets mostly into Ethereum (ETH). The agencies expect the next step to be more laundering, by swapping the funds through DeFi and instant swap services as the actors prepare them for later stages. Instant swap services are aptly named. The alert is aimed at private companies as well as law enforcement agencies. The FBI, USSS and IRS-CI are asking several types of businesses to help stop the money laundering. These include THORNode operators, who support the THORChain network, RPC node operators, who provide apps with access to blockchains, instant crypto exchanges, DeFi platforms, blockchain analytics companies and other crypto service providers. The request is clear: these companies should block any transactions involving the wallet addresses used by TraderTraitor, including funds that can be traced back to them. According to the FBI, these addresses have received stolen funds and are controlled by North Korean attackers or are closely linked to them. The full list of addresses is included in the alert. If you run any of these services, the first job is to check your blocklists against that list. The second is to look at transaction flows that touch those addresses indirectly, since the FBI says to block anything “derived from” them, not just direct transfers. Blockchain analytics firms are named for a reason, because tracing derived funds is their work. The FBI says it’s committed to protecting the virtual asset community by identifying, mitigating and disrupting North Korea’s illicit cybercrime and virtual asset theft. _“The FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea’s illicit cybercrime and virtual asset theft activities.” concludes the report. “If you have any information to provide, please contact your local [FBI field office](https://www.fbi.gov/contact-us/field-offices) or FBI’s Internet Crime Complaint Center at [ic3.gov](http://www.ic3.gov/).”_ TRM says the attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it in roughly 20 minutes starting at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. _“On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That makes this the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025. Binance has confirmed a security incident and suspended withdrawals on several networks.” [TRM said](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history). “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence. TRM is tracking the funds and alerting partners through the Beacon Network.”_ Freezing the money only went partway. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for roughly $2.7 billion in all. But the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach. The early freeze numbers were messy too, Tether and Circle froze approximately $1.79 billion in stablecoins associated with the suspicious transfers in the initial reports. Those amounts describe different moments, and you shouldn’t add them without checking whether they cover distinct assets. A freeze works on tokens that have an issuer to call, and Ether and Bitcoin don’t. Below is the link to my interview regarding the Binance case for Italian state television. [**https://www.youtube.com/watch?v=DtvhBA9TdPo**](https://www.youtube.com/watch?v=DtvhBA9TdPo) **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs)**** [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, Binance)** --- --- title: "SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 6" url: "https://securityaffairs.com/202216/ai/security-affairs-ai-cybersecurity-newsletter-round-6.html" lang: "en-US" type: "post" description: "Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents" last_modified: "2026-11-01T18:02:24+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202216/ai/security-affairs-ai-cybersecurity-newsletter-round-6.html" --- # SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 6 ## Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity. [Investigating alignment failures in AISI’s incident](https://www.aisi.gov.uk/blog/investigating-alignment-failures-in-aisis-incident) [An alignment assessment of the UK AISI cybertesting incident](https://www.anthropic.com/research/alignment-assessment-ukaisi)   [Improving our alignment and security efforts](https://www.anthropic.com/news/improving-alignment-security-efforts)       [Will AI expose the rickety infrastructure of the internet?](https://techcrunch.com/2026/10/24/will-ai-expose-the-rickety-infrastructure-of-the-internet/)   [Anthropic’s IPO filing reveals its strategy for keeping enterprise customers hooked](https://techcrunch.com/2026/10/26/anthropics-ipo-filing-reveals-its-strategy-for-keeping-enterprise-customers-hooked/)[](https://www.theregister.com/ai-and-ml/2026/10/26/alibabas-qwen-ai-caught-trying-to-contact-server-in-china/5305561) [Alibaba’s Qwen AI caught trying to contact server in China](https://www.theregister.com/ai-and-ml/2026/10/26/alibabas-qwen-ai-caught-trying-to-contact-server-in-china/5305561) [Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan](https://www.trendaisecurity.com/en-us/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan) [Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says](https://www.abc.net.au/news/2026-10-27/australian-signals-directorate-ai-cybersecurity-hacking-threats/107309858)   [CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC](https://x.com/starmexxx/status/2114351627247243564) [Discovering and exploiting vulnerabilities in critical, real-world software with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)   [Invasive Ads: The Unconventional Cyber Surveillance Attack Surface](https://www.trendaisecurity.com/en-us/resources-insights/deep-research/invasive-ads-the-unconventional-cyber-surveillance-attack-surface)   [Early progress on accelerating drug development with Claude](https://www.anthropic.com/research/early-progress-drug-development)   [Putting Claude Code in a box: a sandboxed dev container for Zed](https://hnsecurity.it/blog/putting-claude-code-in-a-box-a-sandboxed-dev-container-for-zed/)   [How AI tools are used for doxing](https://www.kaspersky.com/blog/ai-tools-doxing/56578/?kaspr=u5hm)   [Gemini 4 Carbon: our next frontier model](https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/?utm_source=chatgpt.com)   [Tricks from the Past deployed via signed ChatGPT and Claude binaries](https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/)  [AI models may be capable of self-replicating without access to a datacenter](https://www.anthropic.com/research/self-replicating-ai)   [Load/Mine: A Hugging Face Malware Campaign Returns After Takedown](https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs)**** [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, [newsletter](https://securityaffairs.com/tag/newsletter))** --- --- title: "SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 121" url: "https://securityaffairs.com/202209/malware/security-affairs-malware-newsletter-round-121.html" lang: "en-US" type: "post" description: "Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps   deepveindrilling.com: Magento CMS block loader hits 953" last_modified: "2026-11-01T17:25:24+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202209/malware/security-affairs-malware-newsletter-round-121.html" --- # SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 121 ## Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter [uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps](https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/)   [deepveindrilling.com: Magento CMS block loader hits 953 stores](https://sansec.io/research/magento-cms-block-loader-deepveindrilling)   [CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC](https://x.com/starmexxx/status/2114351627247243564) [Operation FlashHole: Lazarus breaks security, defies control](https://securelist.com/lazarus-operation-flashhole/121541/)   [Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace](https://cursor.com/blog/claude-code-extension-security-notice)   [Tricks from the Past deployed via signed ChatGPT and Claude binaries](https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/) [Trezor warns of suspected crypto-theft implant in hardware wallet](https://www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet/) [Load/Mine: A Hugging Face Malware Campaign Returns After Takedown](https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) [Decoding Maliciousness: LLM-Assisted Semantic Filtering for Scalable Malicious PyPI Package Detection](https://www.mdpi.com/2079-9292/15/21/5021) [A Two-Stage Selective Deep Learning Framework for Malware Family Classification in Encrypted Network Traffic](https://www.mdpi.com/2079-9292/15/21/5013) [Silent Blindness: Fault Vulnerability of Hardware Malware Detectors](https://arxiv.org/abs/2610.36612) [Measuring Duplication, Leakage, and Rendering Dependence in Malware-as-Image Benchmarks](https://arxiv.org/abs/2610.39351) **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs) [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, [newsletter](https://securityaffairs.com/200354/security/security-affairs-malware-newsletter-round-117.html))** --- --- title: "AI Spenders Get Spooked" url: "https://www.wsj.com/tech/ai/ai-spenders-get-spooked-80534757?mod=rss_Technology" lang: "en-US" type: "post" description: "Plus, Anthropic’s mind-boggling $40 trillion market opportunity, we tried Apple’s first touch-screen MacBook, Silicon Valley takes on the Pentagon’s explosives shortage and more." last_modified: "2026-11-01T15:55:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/tech/ai/ai-spenders-get-spooked-80534757?mod=rss_Technology" --- # AI Spenders Get Spooked Plus, Anthropic’s mind-boggling $40 trillion market opportunity, we tried Apple’s first touch-screen MacBook, Silicon Valley takes on the Pentagon’s explosives shortage and more. --- --- title: "Alpine Linux rebuilds GitLab after attempted RCE attack" url: "https://www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack/" lang: "en-US" type: "post" description: "Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise." last_modified: "2026-11-01T15:11:21+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack/" --- # Alpine Linux rebuilds GitLab after attempted RCE attack Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux’s development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. […] --- --- title: "OpenAI says it’s doubling Pro usage limits and bringing Work features to Chat" url: "https://www.bleepingcomputer.com/news/artificial-intelligence/openai-says-its-doubling-pro-usage-limits-and-bringing-work-features-to-chat/" lang: "en-US" type: "post" description: "OpenAI has just confirmed that it's rolling out ChatGPT Work capabilities directly into regular Chat, while also combining usage allowances across ChatGPT and Codex." last_modified: "2026-11-01T13:53:11+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/artificial-intelligence/openai-says-its-doubling-pro-usage-limits-and-bringing-work-features-to-chat/" --- # OpenAI says it’s doubling Pro usage limits and bringing Work features to Chat OpenAI has just confirmed that it’s rolling out ChatGPT Work capabilities directly into regular Chat, while also combining usage allowances across ChatGPT and Codex. […] --- --- title: "Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION" url: "https://securityaffairs.com/202200/breaking-news/security-affairs-newsletter-round-602-by-pierluigi-paganini-international-edition.html" lang: "en-US" type: "post" description: "A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. U.S. CISA" last_modified: "2026-11-01T13:22:58+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202200/breaking-news/security-affairs-newsletter-round-602-by-pierluigi-paganini-international-edition.html" --- # Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION ## A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. | U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog | | --- | | Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539 | | Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries | | U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog | | $6.3 Billion Stolen from Binance in Attack Attributed to North Korea | | How to prioritize remediation after a pentest: a practitioner workflow | | Hacker leaks data on more than 40,000 Homeland Security employees | | Binance Investigates Suspicious Crypto Transfers Worth Up to $5.8 Billion | | US Probes Suspected Hack Behind Military Base Freezer Failures | | 484,142 Exposed Cloud Buckets Contain 18 Billion Files | | U.S. CISA adds Linux Kernel and Broadcom VMWare ESX  flaws to its Known Exploited Vulnerabilities catalog | | Volt Typhoon Used Silent Train to Hide Zero-Day Attacks | | Election Website Security: 42% of US County Sites Still Lack .gov Domains | | ENGIE Data Breach Exposes Customer Details and Energy Contracts | | Virtualine Domain Seized, but Allegedly Abusive Website Remains Online | | Hive and Nefilim Ransomware Affiliate Gets 70 Months In Jail | | Ads or Surveillance? Researchers Flag Suspicious Targeting of Starlink Users | | CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers | | U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog | | Three Japan-Focused Cyberattacks Show How Hackers Use AI | | Italy ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber Matters | | Australia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates Hacking | | U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog | | Attackers Take Control of Dahua Cameras and Video Recorders Via Easy4IP | | Cohere Finds Qwen AI Model Contacting a Server in China | | Magento Campaign Infects 953 Online Stores Across Five Domains | | AI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police Say | | Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram | | PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts | | Anthropic reveals how Claude Mythos 5 crossed security testing boundaries | | OpenAI Paused Frontier AI Training After a Security Incident | **International Press – Newsletter** **Cybercrime** [Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets](https://finance.yahoo.com/markets/crypto/articles/binance-says-user-funds-completely-214417766.html)   [Police arrest two suspects in AI-powered bank fraud that cost victims €380,000](https://nltimes.nl/2026/10/21/police-arrest-two-suspects-ai-powered-bank-fraud-cost-victims-eu380000)    [M365 Token Spray and Replay Campaign Compromises Business Email Accounts](https://www.huntress.com/blog/token-replay-spray)  [Chinese National Extradited for Alleged Role in Multimillion-Dollar Cryptocurrency Scam Targeting U.S. Citizens](https://www.justice.gov/opa/pr/chinese-national-extradited-alleged-role-multimillion-dollar-cryptocurrency-scam-targeting)   [Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies](https://www.justice.gov/usao-edny/pr/ukrainian-national-sentenced-70-months-prison-multi-million-dollar-ransomware)   [Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents](https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents/)  [deepveindrilling.com: Magento CMS block loader hits 953 stores](https://sansec.io/research/magento-cms-block-loader-deepveindrilling) [“Bulletproof” website domain seized in international law enforcement operation](https://www.justice.gov/usao-edva/pr/bulletproof-website-domain-seized-international-law-enforcement-operation)   [Trezor warns of suspected crypto-theft implant in hardware wallet](https://www.bleepingcomputer.com/news/security/trezor-warns-of-suspected-crypto-theft-implant-in-hardware-wallet/) [Polymarket halts trading after crypto-draining script breach, $2.5M traced](https://www.bleepingcomputer.com/news/security/polymarket-halts-trading-after-crypto-draining-script-breach-25m-traced/) **Malware****** [uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps](https://www.0x0v1.com/ucreator-virtualization-based-android-spyware-platform-targeting-wechat-telegram-and-other-messaging-apps/)   [CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC](https://x.com/starmexxx/status/2114351627247243564) [Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace](https://cursor.com/blog/claude-code-extension-security-notice)   [Tricks from the Past deployed via signed ChatGPT and Claude binaries](https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/) **Hacking** [PHP2Shell exploitation observed: packet-to-process RCE evidence](https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md)   [CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure](https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure/)   [Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access](https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/)   [Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan](https://www.trendaisecurity.com/en-us/resources-insights/deep-research/not-only-artex-the-different-levels-ai-is-used-in-attacks-targeting-japan)   [Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability](https://www.wiz.io/blog/cve-2026-111497-brotli-rce-node-js)   [Discovering and exploiting vulnerabilities in critical, real-world software with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude) [Putting Claude Code in a box: a sandboxed dev container for Zed](https://hnsecurity.it/blog/putting-claude-code-in-a-box-a-sandboxed-dev-container-for-zed/) [Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch](https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html) [The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!](https://blog.orange.tw/posts/2026-10-the-last-proof-of-human-craft-browser-full-chain/)   [Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say](https://www.reuters.com/technology/pentagon-treating-military-base-freezer-malfunctions-suspected-cyberattack-2026-10-29/)   [GitLab security incident: attempted exploitation of CVE-2026-97229](https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html)   **Intelligence and Information Warfare**  [](https://www.theregister.com/ai-and-ml/2026/10/26/alibabas-qwen-ai-caught-trying-to-contact-server-in-china/5305561) [Alibaba’s Qwen AI caught trying to contact server in China](https://www.theregister.com/ai-and-ml/2026/10/26/alibabas-qwen-ai-caught-trying-to-contact-server-in-china/5305561) [Hackers can gain control of cameras and DVRs through cloud access](https://cip.gov.ua/ua/news/khakeri-mozhut-otrimati-kontrol-nad-kamerami-ta-videoreyestratorami-cherez-khmarnii-dostup)       [Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says](https://www.abc.net.au/news/2026-10-27/australian-signals-directorate-ai-cybersecurity-hacking-threats/107309858) [Operation FlashHole: Lazarus breaks security, defies control](https://securelist.com/lazarus-operation-flashhole/121541/)  [Hackers Sympathetic to Russia Are Hitting Utilities and Factories](https://www.bloomberg.com/news/features/2026-10-27/russia-linked-hackers-are-turning-cyberattacks-into-a-physical-threat)   [Alleged Israeli spy company heavily targeted Starlink users, sources say](https://www.reuters.com/business/media-telecom/alleged-israeli-spy-company-heavily-targeted-starlink-users-sources-say-2026-10-27/) [Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access](https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework)   [North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history)   [Mapping the Political Influencer Industry and the Problems it Causes for Democracy](https://www.techpolicy.press/mapping-the-political-influencer-industry-and-the-problems-it-causes-for-democracy/)   **Cybersecurity****** [NIS 2 Italy: Key Deadlines, Board Duties and What ACN Expects From Companies](https://www.linkedin.com/pulse/nis-2-italy-key-deadlines-board-duties-what-acn-expects-coraggio-ndotf/)   [The Two Things CISOs Should Be Thinking About In The Wake Of The PHP Nightmare](https://www.linkedin.com/pulse/two-things-cisos-should-thinking-wake-php-nightmare-geoff-white-s833e/) [Code-execution flaw in UEFI firmware affects most servers on planet Earth](https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/)      [2026 County Election Website Security Census: Key Findings](https://www.mysteriumvpn.com/blog/data-and-research/voting-websites-gov)   [Cloud Exposure Index 2026: 484,142 open buckets mapped](https://ransomnews.com/cloud-exposure-index-2026/)   [ENGIE: Data leak via a tool belonging to its business partners](https://fuitesinfos.fr/article/2026-10-23-engie)  [Beyond Framework Signatures: Understanding AI-Driven Intrusions](https://www.nextron-systems.com/2026/10/29/beyond-framework-signatures-understanding-ai-driven-intrusions/)  [I Think The Military Commissary’s Freezers Were Hacked](https://signalandsilence.substack.com/p/i-think-someone-hacked-the-commissary)   [Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning](https://www.404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning/)  [](https://www.securityweek.com/passkeys-are-better-than-passwords-but-they-are-not-enough/) [Passkeys Are Better Than Passwords. But They Are Not Enough](https://www.securityweek.com/passkeys-are-better-than-passwords-but-they-are-not-enough/) **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs)**** [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, [newsletter](https://securityaffairs.com/tag/newsletter))** --- --- title: "SMS of Death: Android under attack, an invisible SMS can block calls and emergency services" url: "https://securityaffairs.com/202184/security/sms-of-death-android-under-attack-an-invisible-sms-can-block-calls-and-emergency-services.html" lang: "en-US" type: "post" description: "SMS of Death lets attackers crash Android call services with a hidden, zero-click message, blocking phone calls, even emergency calls too. A specially manipulated SMS message is enough to crash Android’s phone service, interrupt ongoing calls, and temporarily render the" last_modified: "2026-11-01T12:16:50+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202184/security/sms-of-death-android-under-attack-an-invisible-sms-can-block-calls-and-emergency-services.html" --- # SMS of Death: Android under attack, an invisible SMS can block calls and emergency services ## SMS of Death lets attackers crash Android call services with a hidden, zero-click message, blocking phone calls, even emergency calls too. A specially manipulated SMS message is enough to crash Android’s phone service, interrupt ongoing calls, and temporarily render the smartphone unusable. The attack requires no interaction from the victim and can even compromise the ability to contact emergency services. The vulnerability, dubbed the SMS of Death, is bringing renewed attention to the security of the messaging system in Android smartphones. The issue, [documented](https://smsofdeath.com/) by independent researcher Mark Blaszczyk, allows a remote attacker to cause a disruption in phone service by sending a single, specially crafted WAP Push message. WAP Push (Wireless Application Protocol Push) is a particular message transmitted over the mobile network, generally in the form of a binary SMS, which contains structured data and is processed automatically by the smartphone without requiring user intervention. Unlike a traditional SMS, it can carry notifications, links to Internet resources, and configurations for mobile services. The most worrying aspect is the execution method. It’s a zero-click attack, in which the recipient doesn’t have to open the message, select a link, or authorize any action. The content is automatically processed by the operating system and can cause the process responsible for phone functionality to crash. The vulnerability affects _“WapPushOverSms_“, an Android framework component located in the _“frameworks/opt/telephony_” path, responsible for interpreting and managing WAP Push messages received by the device. The technical cause lies in the incorrect handling of a numeric value used during message interpretation. Specifically, the _“decodeWapPdu()_” function, the researcher explains, reads the length of the WSP header through a value encoded as _“uintvar_” , initially returned as a 64-bit number. The value is subsequently converted to a 32-bit integer without prior range checking. This operation can transform a seemingly valid number into a negative value, which is then used to determine the size of an array. The consequence of this is a _“NegativeArraySizeException_” exception, thrown when Android attempts to allocate a negative-sized array. The exception is not handled correctly in the processing path and causes the _“com.android.phone_” process, responsible for telephony functions, to terminate. The researcher demonstrated that a five-byte WSP header can generate the value _“-2147483648_“, which is sufficient to trigger the issue. Therefore, it is not necessary to transmit particularly large amounts of content to cause the issue. _“A 5-byte uintvar of `88 80 80 80 00` decodes to `0x80000000`. Cast to a signed 32-bit `int`, that is `-2147483648`. Allocating `new byte[-2147483648]` throws an uncaught `NegativeArraySizeException` on the telephony main thread, killing `com.android.phone`:” [reads the analysis](https://smsofdeath.com/)._ **An invisible attack that also interrupts emergency calls** The message is transmitted as a data SMS via the WAP Push channel on port 2948. Unlike a regular SMS, it isn’t displayed in the message inbox and doesn’t generate a user-recognizable notification. The sender’s number isn’t normally visible in the conversation, and when the device receives the message, Android automatically starts processing it. A crash in the phone process causes a temporary loss of connectivity and interrupts active voice calls, including those to emergency services. According to the researcher’s published evidence, each message processing can cause a disruption in telephone service lasting about one to two seconds, during which the component is rebooted. However, the problem can become much more serious if the message is processed repeatedly. One of the most significant aspects of SMS of Death is the ability to transform a simple crash into a persistent Denial of Service condition. The malicious message can remain in the incoming SMS queue and be reprocessed during subsequent delivery attempts. The telephone operator’s retransmission mechanism can also contribute to a repeat of the event, causing further service disruptions. The researcher reports observing intermittent crashes for up to a week after receiving a single message. Sending around twenty specially crafted messages can render the device unusable for an extended period. In more severe cases, the phone process can continue to crash during system startup, triggering a condition similar to a boot loop. Recovery may require using the Android Debug Bridge (ADB) on a computer, directly intervening in the queue of messages waiting to be processed. For a typical user, this is far from a simple procedure. **A threat to communications availability** SMS of Death demonstrates how a cyberattack doesn’t necessarily have to involve information theft, code execution, or device control to have significant consequences. In this case, the target is phone service availability, a crucial feature especially when contacting emergency services. The ability to interrupt communications without any user interaction makes this vulnerability particularly sensitive. To reduce exposure, it’s important to check the Android security patch level installed and apply available updates, paying particular attention to devices no longer receiving manufacturer support. Testing [conducted](https://smsofdeath.com/) by Mark Blah has shown that the issue is reproducible on several devices, including the Google Pixel 9 and Samsung smartphones from the Galaxy and Galaxy A families. The vulnerable code appears to be present on Android versions ranging from Android 12 to Android 17. However, the availability of the fix is ​​not uniform across all generations of the operating system. According to documentation published by the researcher, Google has distributed a fix via the October 2026 security update for Android 14, 15, 16, and 17. Older devices, such as those running Android 12 and 13, may remain exposed if they do not receive corrective updates. > It’s assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We’ve had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:[https://t.co/tBoWBpALw1](https://t.co/tBoWBpALw1) — GrapheneOS (@GrapheneOS) [October 29, 2026](https://x.com/GrapheneOS/status/2115862510373126280?ref_src=twsrc%5Etfw) **About the author: Salvatore Lombardo** (**X [@Slvlombardo](https://twitter.com/Slvlombardo)**) Electronics engineer and Clusit member, for some time now, espousing the principle of conscious education, he has been writing for several online magazine on information security. He is also the author of the book “La Gestione della Cyber Security nella Pubblica Amministrazione”. “Education improves awareness” is his slogan. **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs)**** [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559)**** **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, SMS of Death)** --- --- title: "Investors Are Hedging Against the Risks of the AI Boom" url: "https://www.wsj.com/articles/investors-are-hedging-against-the-risks-of-the-ai-boom-603203d5?mod=rss_Technology" lang: "en-US" type: "post" description: "Plus, inside the final days of Darline Graham’s reluctant Senate run, and two owners claim to have the same legendary Porsche." last_modified: "2026-11-01T12:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/articles/investors-are-hedging-against-the-risks-of-the-ai-boom-603203d5?mod=rss_Technology" --- # Investors Are Hedging Against the Risks of the AI Boom Plus, inside the final days of Darline Graham’s reluctant Senate run, and two owners claim to have the same legendary Porsche. --- --- title: "FBI Links 628 Crypto Wallet Addresses to North Korea’s Binance Hack" url: "https://hackread.com/fbi-crypto-wallet-addresses-north-korea-binance-hack/" lang: "en-US" type: "post" description: "FBI links 628 crypto wallet addresses to North Korea’s TraderTraitor after the $6.3 billion Binance hack, asking services to block transfers involving stolen funds." last_modified: "2026-11-01T11:11:45+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://hackread.com/feed/" wpe_sourcepermalink: "https://hackread.com/fbi-crypto-wallet-addresses-north-korea-binance-hack/" --- # FBI Links 628 Crypto Wallet Addresses to North Korea’s Binance Hack FBI links 628 crypto wallet addresses to North Korea’s TraderTraitor after the $6.3 billion Binance hack, asking services to block transfers involving stolen funds. --- --- title: "The Shopping Bots Are Coming for Amazon" url: "https://www.wsj.com/tech/the-shopping-bots-are-coming-for-amazon-701caa57?mod=rss_Technology" lang: "en-US" type: "post" description: "The biggest U.S. company by revenue has dominated e-commerce, but a potential rival is emerging." last_modified: "2026-11-01T10:30:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/tech/the-shopping-bots-are-coming-for-amazon-701caa57?mod=rss_Technology" --- # The Shopping Bots Are Coming for Amazon The biggest U.S. company by revenue has dominated e-commerce, but a potential rival is emerging. --- --- title: "The Tangled Web of AI Bets Is Reason to Fear Tech Stocks" url: "https://www.wsj.com/tech/the-tangled-web-of-ai-bets-is-reason-to-fear-tech-stocks-905bde86?mod=rss_Technology" lang: "en-US" type: "post" description: "Vendor financing is back in a new form and it magnifies the AI trade on the way up—and down." last_modified: "2026-11-01T10:30:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/tech/the-tangled-web-of-ai-bets-is-reason-to-fear-tech-stocks-905bde86?mod=rss_Technology" --- # The Tangled Web of AI Bets Is Reason to Fear Tech Stocks Vendor financing is back in a new form and it magnifies the AI trade on the way up—and down. --- --- title: "How Can Organizations Combat the AI-Enhanced Threat Actor?" url: "https://www.govtech.com/blogs/lohrmann-on-cybersecurity/how-can-organizations-combat-the-ai-enhanced-threat-actor" lang: "en-US" type: "post" description: "Lessons for government and higher education from the Secure Delaware conference on speed, scale and defense when faced with AI cyber attacks." last_modified: "2026-11-01T10:03:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "http://feeds.feedburner.com/govtech/blogs/lohrmann_on_infrastructure" wpe_sourcepermalink: "https://www.govtech.com/blogs/lohrmann-on-cybersecurity/how-can-organizations-combat-the-ai-enhanced-threat-actor" --- # How Can Organizations Combat the AI-Enhanced Threat Actor? Lessons for government and higher education from the Secure Delaware conference on speed, scale and defense when faced with AI cyber attacks. --- --- title: "OneNote File Extraction, (Sun, Nov 1st)" url: "https://isc.sans.edu/diary/rss/33478" lang: "en-US" type: "post" description: "Recently, I had to extract embedded files from a set of OneNote files (extension .one). My onedump.py tool can extract individual files, so I would have to run this many times. To avoid this, I added a new feature to" last_modified: "2026-11-01T09:12:23+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://isc.sans.edu/rssfeed_full.xml" wpe_sourcepermalink: "https://isc.sans.edu/diary/rss/33478" --- # OneNote File Extraction, (Sun, Nov 1st) Recently, I had to extract embedded files from a set of OneNote files (extension .one). My [onedump.py](https://github.com/DidierStevens/Beta/blob/master/onedump.py) tool can extract individual files, so I would have to run this many times. To avoid this, I added a new feature to my onedump.py tool: producing JSON data. [Several of my tools already have such a feature](https://isc.sans.edu/diary/Overview+of+My+Tools+That+Handle+JSON+Data/31012): they produce JSON data with the content of their analysis results. onedump’s option –jsonoutput produces JSON output with the content of each embedded file found inside the OneNote file. And it can do this for many .one files in one go: > onedump.py –jsonoutput *.one To write these files to disk you can use my [myjson-filter.py](https://github.com/DidierStevens/DidierStevensSuite/blob/master/myjson-filter.py) tool, like this: > onedump.py –jsonoutput *.one | myjson-filter.py -W hashvir This will write all the embedded files to disk, their name will be the sha256 hash of their content plus extension .vir (hashvir).   Didier Stevens Senior handler [blog.DidierStevens.com](http://blog.didierstevens.com/) (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --- --- title: "Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability" url: "https://www.helpnetsecurity.com/2026/11/01/week-in-review-binance-hit-by-6-3-billion-theft-impact-of-brotli-vulnerability/" lang: "en-US" type: "post" description: "Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down with them Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project" last_modified: "2026-11-01T09:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.helpnetsecurity.com/feed/" wpe_sourcepermalink: "https://www.helpnetsecurity.com/2026/11/01/week-in-review-binance-hit-by-6-3-billion-theft-impact-of-brotli-vulnerability/" --- # Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down with them Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or is intended for AI.” Moderator Wolvereness announced the rules in a post over the weekend. AI slop is piling up highest on the biggest open-source projects The … [More →](https://www.helpnetsecurity.com/2026/11/01/week-in-review-binance-hit-by-6-3-billion-theft-impact-of-brotli-vulnerability/) The post [Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability](https://www.helpnetsecurity.com/2026/11/01/week-in-review-binance-hit-by-6-3-billion-theft-impact-of-brotli-vulnerability/) appeared first on [Help Net Security](https://www.helpnetsecurity.com/). --- --- title: "CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key" url: "https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html" lang: "en-US" type: "post" description: "A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the" last_modified: "2026-11-01T08:51:31+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/11/critical-lxd-and-microcloud-flaw-cvss.html" --- # CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key A critical flaw in Canonical’s LXD and MicroCloud let an attacker log in as a trusted client without holding that client’s private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client’s public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is --- --- title: "Weekly Update 528: Reading AI-generated Code & the Economics of Solar" url: "https://www.troyhunt.com/weekly-update-528/" lang: "en-US" type: "post" description: "By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of people up the wrong" last_modified: "2026-11-01T06:35:23+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.troyhunt.com/rss/" wpe_sourcepermalink: "https://www.troyhunt.com/weekly-update-528/" --- # Weekly Update 528: Reading AI-generated Code & the Economics of Solar ![Weekly Update 528: Reading AI-generated Code & the Economics of Solar](https://storage.ghost.io/c/fb/33/fb3391dc-723d-4e74-b95a-d641b5feb38e/content/images/2026/11/dK01FOVwq4A-HD--1-.jpg) By pure timing coincidence, [the Proton CEO’s AI @ Proton, Engineering Manifesto](https://x.com/josephfcox/status/2115814382001172714?ref=troyhunt.com) made headlines around the same time as this week’s video. The guy’s management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO. However… this section of his screed really resonated with me: > Your job has fundamentally changed. It is no longer to write code, and LLMs are not here to help you write better code faster. Your job is to help the LLM write better code faster. Dev jobs as we know them are gone. Dead. And if you disagree, you’re in for a shock in the very near future. But at the same time: > I don’t remember the last time tech has been this exciting. It’s white hot right now. Anyone who loves technology and computers is probably having a great time right now. — Jack Rhysider 🏴‍☠️ (@JackRhysider) [October 30, 2026](https://x.com/JackRhysider/status/2116291909228634498?ref_src=twsrc%5Etfw&ref=troyhunt.com) Yes! _This!_ Not handwriting code “old school” isn’t something to lament; rather, our unprecedented ability to innovate, create and build things that are meaningful to us is something to be enormously excited about. Anyway, on that topic: [![Weekly Update 528: Reading AI-generated Code & the Economics of Solar](https://storage.ghost.io/c/fb/33/fb3391dc-723d-4e74-b95a-d641b5feb38e/content/images/2018/05/Listen-on-Apple-Podcasts.svg)](https://itunes.apple.com/au/podcast/troy-hunts-weekly-update-podcast/id1176454699?ref=troy-hunt) [![Weekly Update 528: Reading AI-generated Code & the Economics of Solar](https://storage.ghost.io/c/fb/33/fb3391dc-723d-4e74-b95a-d641b5feb38e/content/images/2024/09/Watch-and-Listen-on-YouTube.svg)](https://www.youtube.com/playlist?list=PL7LAAxaabizMAXnJe0s3xjQ30q12EVmjt&ref=troyhunt.com) [![Weekly Update 528: Reading AI-generated Code & the Economics of Solar](https://storage.ghost.io/c/fb/33/fb3391dc-723d-4e74-b95a-d641b5feb38e/content/images/2019/10/spotify.svg)](https://open.spotify.com/show/7jMtKFohdrw6qmz8AkLqit?ref=troy-hunt) [![Weekly Update 528: Reading AI-generated Code & the Economics of Solar](https://storage.ghost.io/c/fb/33/fb3391dc-723d-4e74-b95a-d641b5feb38e/content/images/2018/07/Download-via-RSS.svg)](https://omny.fm/shows/troy-hunt-weekly-update/playlists/podcast.rss?ref=troy-hunt) --- --- title: "Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script" url: "https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html" lang: "en-US" type: "post" description: "Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket" last_modified: "2026-11-01T06:25:40+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/11/hackers-steal-about-27-million-from.html" --- # Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script Malicious code on the website of prediction market Polymarket sold some signed-in traders’ positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached --- --- title: "NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection" url: "https://thehackernews.com/2026/11/netamloader-malware-targets-government.html" lang: "en-US" type: "post" description: "Cybersecurity researchers have disclosed details of what has been described as a \"highly sophisticated infection chain\" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in" last_modified: "2026-11-01T06:02:58+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/11/netamloader-malware-targets-government.html" --- # NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection Cybersecurity researchers have disclosed details of what has been described as a “highly sophisticated infection chain” targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed --- --- title: "FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist" url: "https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html" lang: "en-US" type: "post" description: "The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899." last_modified: "2026-11-01T05:44:27+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.feedburner.com/TheHackersNews?format=xml" wpe_sourcepermalink: "https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html" --- # FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it --- --- title: "Security Breach Exposes Risks in AI Development Tools" url: "https://www.geek-guy.com/security-breach-exposes-ai-development-tool-risks/" lang: "en-US" type: "post" description: "Discover how vulnerabilities in Cursor and a Trojanized code extension exposed security risks in AI-powered development tools and why stronger safeguards..." last_modified: "2026-11-01T05:02:40+00:00" categories: [GeekGuyBlog] tags: [“AI, Cursor, cybersecurity, software development, technology news, vulnerabilities] custom_fields: botwriter_image_prompt_last: "cybersecurity coding warning" botwriter_stockphoto_prompt: "cybersecurity coding warning" botwriter_image_prompt_last_provider: "stockphoto" --- # Security Breach Exposes Risks in AI Development Tools On October 5, 2023, the software development community faced a significant security threat when two critical vulnerabilities were discovered in Cursor, an AI-powered integrated development environment (IDE). The vulnerabilities were linked to a Trojanized code extension, raising alarms about the integrity of tools used for coding. This incident underscores the urgent need for greater security measures in AI-assisted development platforms. ## Context: Understanding the Risks in AI Development Tools Cursor has gained popularity among developers due to its integration of artificial intelligence, which enhances coding efficiency and error detection. However, the recent vulnerabilities have exposed the inherent risks associated with relying on AI in software development. As the demand for AI tools grows, the security of these platforms has become a paramount concern. According to a report published by the Cybersecurity and Infrastructure Security Agency (CISA), the threat of malicious code infiltrating development environments is increasing. Developers often use third-party extensions to enhance functionality, but these can also serve as entry points for cybercriminals. ## Unpacking the Incident: What Happened? The vulnerabilities in Cursor were identified by cybersecurity researchers who noted that a code extension had been compromised. This Trojanized extension was designed to execute malicious scripts within the development environment, potentially allowing attackers to access sensitive project data. The issue was compounded by the fact that many developers unknowingly installed the compromised extension, believing it to be legitimate. The discovery was made public on the same day, prompting Cursor’s developers to issue a security patch. However, the speed at which these vulnerabilities were exploited raises concerns about the effectiveness of existing security protocols in preventing such incidents. ## Reactions from the Development Community The response from the developer community has been one of shock and concern. Many are questioning the safety of using AI-integrated tools and whether they can trust third-party extensions. A developer from a major tech firm, who wished to remain anonymous, stated, “This incident is a wake-up call. We need to be more vigilant about the tools we use and their security implications.” Industry experts echo these sentiments, emphasizing the need for a robust security framework tailored specifically for AI development environments. “As we increasingly rely on AI tools, we must prioritize security in the development pipeline to protect against such vulnerabilities,” said Dr. Emily Parker, a cybersecurity analyst at TechSecure. ## Expert Insights: The Bigger Picture To better understand the implications of the Cursor vulnerabilities, it’s essential to consider the broader landscape of AI development tools. According to a 2022 study by Gartner, over 75% of organizations are expected to adopt AI-based tools by 2025. This shift demands a corresponding increase in security measures to safeguard sensitive data and intellectual property. Dr. Michael Thompson, a professor of computer science at MIT, emphasized the necessity for developers to adopt a security-first mindset. “Every new tool we integrate into our workflow should be evaluated for security risks. The consequences of a breach can be catastrophic, not just for individual developers but also for entire organizations.” Furthermore, the National Institute of Standards and Technology (NIST) is currently working on guidelines for securing AI systems, which could provide a framework for developers to follow. Their upcoming publication aims to address vulnerabilities specific to AI applications and provide best practices for implementation. ## Industry Implications: What Does This Mean? The vulnerabilities discovered in Cursor highlight a crucial turning point for the software development industry. As reliance on AI tools increases, the potential for security breaches could also escalate, threatening not only individual developers but entire organizations. This incident raises questions about the adequacy of current security protocols and the need for enhanced measures. Organizations may need to reevaluate their security strategies, focusing on training developers to recognize potential threats and encouraging a culture of security awareness. Additionally, companies should consider implementing automated security checks for third-party tools before integration into their development pipelines. ## Looking Ahead: What to Watch Next In the wake of the Cursor vulnerabilities, industry stakeholders are advised to monitor the developments closely. The response from Cursor’s developers and the effectiveness of the security patches will be critical indicators of the platform’s reliability moving forward. Moreover, the NIST guidelines are expected to offer insights into best practices for securing AI development tools, which could shape the future of software security. As more incidents are reported, the importance of robust security measures in AI-powered IDEs will only grow. Developers and organizations alike should stay informed about emerging threats and evolving security standards to safeguard their projects. The implications of this incident extend beyond Cursor, serving as a crucial lesson for the entire tech industry as it navigates the complexities of artificial intelligence and cybersecurity. --- --- title: "South Korea’s Chip-Led Exports Accelerate, Bringing $1 Trln Annual Target Closer" url: "https://www.wsj.com/world/asia/south-koreas-chip-led-exports-accelerate-bringing-1-trln-annual-target-closer-5180b539?mod=rss_Technology" lang: "en-US" type: "post" last_modified: "2026-11-01T00:42:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/world/asia/south-koreas-chip-led-exports-accelerate-bringing-1-trln-annual-target-closer-5180b539?mod=rss_Technology" --- # South Korea’s Chip-Led Exports Accelerate, Bringing $1 Trln Annual Target Closer --- --- title: "We’re Living in the Age of the Imperial CEO" url: "https://www.wsj.com/tech/ai/anthropic-ipo-dual-class-stock-founder-control-4c43a56d?mod=rss_Technology" lang: "en-US" type: "post" description: "Anthropic joins other hot tech companies in going public with a share structure that keeps founders in control." last_modified: "2026-11-01T00:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://feeds.content.dowjones.io/public/rss/RSSWSJD" wpe_sourcepermalink: "https://www.wsj.com/tech/ai/anthropic-ipo-dual-class-stock-founder-control-4c43a56d?mod=rss_Technology" --- # We’re Living in the Age of the Imperial CEO Anthropic joins other hot tech companies in going public with a share structure that keeps founders in control. --- --- title: "Overview of Content Published in October" url: "https://blog.didierstevens.com/2026/11/01/overview-of-content-published-in-october-12/" lang: "en-US" type: "post" description: "Here is an overview of content I published in October: Blog posts: Update: onedump.py Version 0.0.3 Quickpost: Uranium Glass A Ring Tone That I Cannot Hear – Twenty Years Later Quickpost: Ghost USB-C Quickpost: WT20 Welding Electrodes & Radiation SANS" last_modified: "2026-11-01T00:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://blog.didierstevens.com/feed/" wpe_sourcepermalink: "https://blog.didierstevens.com/2026/11/01/overview-of-content-published-in-october-12/" --- # Overview of Content Published in October Here is an overview of content I published in October: Blog posts: - [Update: onedump.py Version 0.0.3](https://blog.didierstevens.com/2026/10/12/update-onedump-py-version-0-0-3/) - [Quickpost: Uranium Glass](https://blog.didierstevens.com/2026/10/28/quickpost-uranium-glass/) - [A Ring Tone That I Cannot Hear – Twenty Years Later](https://blog.didierstevens.com/2026/10/30/a-ring-tone-that-i-cannot-hear-twenty-years-later/) - [Quickpost: Ghost USB-C](https://blog.didierstevens.com/2026/10/31/quickpost-ghost-usb-c/) - [Quickpost: WT20 Welding Electrodes & Radiation](https://blog.didierstevens.com/2026/10/31/quickpost-wt20-welding-electrodes-radiation/) SANS ISC Diary entries: - [YARA-X 1.21.0 Release](https://isc.sans.edu/forums/diary/YARAX+1210+Release/33392/) - [User Agent Strings Curiosities](https://isc.sans.edu/forums/diary/User+Agent+Strings+Curiosities/33394/) - [Orphaned VBA Projects Inside DWG Files](https://isc.sans.edu/forums/diary/Orphaned+VBA+Projects+Inside+DWG+Files/33420/) - [Orphaned VBA Projects Inside DWG Files: YARA Rule](https://isc.sans.edu/forums/diary/Orphaned+VBA+Projects+Inside+DWG+Files+YARA+Rule/33434/) - [YARA-X 1.22.0 Release](https://isc.sans.edu/forums/diary/YARAX+1220+Release/33454/) - [YARA-X 1.22.1 Release](https://isc.sans.edu/forums/diary/YARAX+1221+Release/33474/) - [Wireshark 5.0.0rc1 Release](https://isc.sans.edu/forums/diary/Wireshark+500rc1+Release/33476/) --- --- title: "U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog" url: "https://securityaffairs.com/202175/security/u-s-cisa-adds-ivanti-connect-secure-flaws-to-its-known-exploited-vulnerabilities-catalog.html" lang: "en-US" type: "post" description: "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-111357 (CVSS" last_modified: "2026-10-31T19:33:36+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://securityaffairs.com/feed" wpe_sourcepermalink: "https://securityaffairs.com/202175/security/u-s-cisa-adds-ivanti-connect-secure-flaws-to-its-known-exploited-vulnerabilities-catalog.html" --- # U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog ## U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) [added](https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog) the following Ivanti Connect Secure vulnerabilities to its [Known Exploited Vulnerabilities (KEV) catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog): - [CVE-2026-111357](https://nvd.nist.gov/vuln/detail/CVE-2026-111357) (CVSS score of 8.8) – A missing authentication check for a critical function that could allow an authenticated local attacker to gain higher privileges. - [CVE-2026-118527](https://nvd.nist.gov/vuln/detail/CVE-2026-118527) (CVSS score of 4.3) – A predictable identifier vulnerability that could allow an authenticated remote attacker to upload files containing malicious content to a known location on the system. The vulnerabilities are part of an exploit chain that cybersecurity firm Volexity first documented in mid-October. “_Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has [published an advisory](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935) providing upgrade instructions to customers.” [states Volexity](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/). “Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred._“ The attacks combined these vulnerabilities with an authentication bypass vulnerability, tracked as [CVE-2026-104935](https://securityaffairs.com/200887/security/u-s-cisa-adds-ivanti-connect-secure-flaw-to-its-known-exploited-vulnerabilities-catalog.html) (CVSS score of 8.6). In early October 2026, Volexity [discovered](https://securityaffairs.com/200895/hacking/volexity-uncovers-stealthy-ivanti-vpn-attack-using-three-zero-day-vulnerabilities.html) that a threat actor tracked as UTA0576 was exploiting a zero-day vulnerability chain to compromise fully patched Ivanti Connect Secure VPN appliances. The attack combined authentication bypass, remote code execution, and privilege escalation flaws, allowing attackers to gain root access without logging in. The authentication bypass and RCE flaws are tracked as CVE-2026-104935. After gaining access, the attackers targeted Active Directory credentials and sensitive information, including LAPS passwords and BitLocker recovery keys. Volexity worked with Ivanti as soon as it suspected the vulnerabilities were being exploited. CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026. Ivanti released security updates to address both CVE-2026-111357 and CVE-2026-118527: - Version 25.1.1.2 and earlier: upgrade to 25.1.1.3. - Version 22.8R2.5 and earlier: upgrade to 22.8R2.6. Ivanti said it disclosed CVE-2026-104935 first because a fix was already available and ready for testing. When researchers discovered the additional privilege escalation flaws, the company decided not to delay the release of the first patch, which addressed the main attack method. Ivanti also worked with Volexity to share information about the attackers’ techniques, including how they chained the vulnerabilities. Ivanti had already fixed part of the issue in its July 25.1.3.0 release and was preparing updates for other supported versions. Patches are now available for all the vulnerabilities used in the attacks. _“At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible.” [states Ivanti](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US). “Additionally, Ivanti collaborated with Volexity on their [blog post](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/) which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now.”_ According to [Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://cyber.dhs.gov/bod/22-01/), FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the [Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. **Follow me on Twitter: **[**@securityaffairs**](https://twitter.com/securityaffairs)** and **[**Facebook**](https://www.facebook.com/sec.affairs)** and **[**Mastodon**](https://infosec.exchange/@securityaffairs) [**Pierluigi Paganini**](http://www.linkedin.com/pub/pierluigi-paganini/b/742/559) **(**[**SecurityAffairs**](http://securityaffairs.co/wordpress/)** – hacking, [CISA](https://securityaffairs.com/tag/cisa))** --- --- title: "Northflank security breach leads to abuse of customers’ AI API keys" url: "https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/" lang: "en-US" type: "post" description: "Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys." last_modified: "2026-10-31T18:01:12+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/" --- # Northflank security breach leads to abuse of customers’ AI API keys Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers’ AI API keys. […] --- --- title: "New Android SMS of Death exploit can remotely crash unpatched phones" url: "https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/" lang: "en-US" type: "post" description: "A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed \"SMS of Death\" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message." last_modified: "2026-10-31T15:35:11+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/new-android-sms-of-death-exploit-can-remotely-crash-unpatched-phones/" --- # New Android SMS of Death exploit can remotely crash unpatched phones A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed “SMS of Death” and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. […] --- --- title: "HTB: MakeSense" url: "https://0xdf.gitlab.io/2026/10/31/htb-makesense.html" lang: "en-US" type: "post" description: "MakeSense starts with a WordPress site for a web agency, with a voice call widget that transcribes recordings in the browser. I’ll find an audio file in a listable uploads directory where a user reads their password aloud, and use" last_modified: "2026-10-31T14:45:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://0xdf.gitlab.io/feed.xml" wpe_sourcepermalink: "https://0xdf.gitlab.io/2026/10/31/htb-makesense.html" --- # HTB: MakeSense MakeSense starts with a WordPress site for a web agency, with a voice call widget that transcribes recordings in the browser. I’ll find an audio file in a listable uploads directory where a user reads their password aloud, and use it to log in. That user can view contact submissions, so I’ll reverse engineer the encrypted voice channel to submit arbitrary transcriptions, using it for XSS against an administrator bot to create my own admin account and get a shell through the plugin editor. A password in the WordPress config gets me the next user. For root, I’ll abuse an OCR web app running as root that saves recognized text to any filename, drawing PHP into an image to get execution. In Beyond Root I’ll look at the bot that didn’t care about mixed content, and how exactly a backdoored WordPress plugin gets triggered. --- --- title: "Polymarket Users Lose $2.7 Million in Third-Party Script Hack" url: "https://hackread.com/polymarket-users-lose-2-7m-third-party-script-hack/" lang: "en-US" type: "post" description: "Polymarket confirms $2.7 million stolen through the compromised third-party script and pledges $3.9 million in refunds, including compensation for pause losses." last_modified: "2026-10-31T14:05:27+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://hackread.com/feed/" wpe_sourcepermalink: "https://hackread.com/polymarket-users-lose-2-7m-third-party-script-hack/" --- # Polymarket Users Lose $2.7 Million in Third-Party Script Hack Polymarket confirms $2.7 million stolen through the compromised third-party script and pledges $3.9 million in refunds, including compensation for pause losses. --- --- title: "Reddit to lock content behind logins to fight scrapers" url: "https://www.bleepingcomputer.com/news/security/reddit-to-lock-content-behind-logins-to-fight-scrapers/" lang: "en-US" type: "post" description: "Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a \"logged-in service,\" offering limited access to visitors without accounts." last_modified: "2026-10-31T14:05:15+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://www.bleepingcomputer.com/feed/" wpe_sourcepermalink: "https://www.bleepingcomputer.com/news/security/reddit-to-lock-content-behind-logins-to-fight-scrapers/" --- # Reddit to lock content behind logins to fight scrapers Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a “logged-in service,” offering limited access to visitors without accounts. […] --- --- title: "Chromium: CVE-2026-118329 Improper input validation in ANGLE" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118329" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118329" --- # Chromium: CVE-2026-118329 Improper input validation in ANGLE This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118345 Use after free in PDFium" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118345" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118345" --- # Chromium: CVE-2026-118345 Use after free in PDFium This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118306 Memory corruption in FileSystem" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118306" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118306" --- # Chromium: CVE-2026-118306 Memory corruption in FileSystem This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118322 Memory corruption in ANGLE" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118322" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118322" --- # Chromium: CVE-2026-118322 Memory corruption in ANGLE This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118336 Improper input validation in Headless" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118336" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118336" --- # Chromium: CVE-2026-118336 Improper input validation in Headless This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118310 Improper input validation in Views" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118310" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118310" --- # Chromium: CVE-2026-118310 Improper input validation in Views This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118304 Improper input validation in SVG" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118304" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118304" --- # Chromium: CVE-2026-118304 Improper input validation in SVG This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118330 Use after free in Browser" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118330" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118330" --- # Chromium: CVE-2026-118330 Use after free in Browser This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118335 Improper input validation in Metrics" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118335" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118335" --- # Chromium: CVE-2026-118335 Improper input validation in Metrics This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118311 Memory corruption in Media" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118311" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118311" --- # Chromium: CVE-2026-118311 Memory corruption in Media This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118327 Memory corruption in Media" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118327" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118327" --- # Chromium: CVE-2026-118327 Memory corruption in Media This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118305 Memory corruption in Turbolev" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118305" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118305" --- # Chromium: CVE-2026-118305 Memory corruption in Turbolev This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118331 Improper input validation in FileAPI" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118331" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118331" --- # Chromium: CVE-2026-118331 Improper input validation in FileAPI This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118307 Use after free in Paint" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118307" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118307" --- # Chromium: CVE-2026-118307 Use after free in Paint This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118328 Improper input validation in WebRTC" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118328" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118328" --- # Chromium: CVE-2026-118328 Improper input validation in WebRTC This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118347 Use after free in FileSystem" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118347" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118347" --- # Chromium: CVE-2026-118347 Use after free in FileSystem This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118320 Memory corruption in V8" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118320" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118320" --- # Chromium: CVE-2026-118320 Memory corruption in V8 This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118340 Memory corruption in Skia" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118340" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118340" --- # Chromium: CVE-2026-118340 Memory corruption in Skia This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118343 Improper input validation in ReadingList" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118343" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118343" --- # Chromium: CVE-2026-118343 Improper input validation in ReadingList This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118315 Improper input validation in SVG" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118315" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118315" --- # Chromium: CVE-2026-118315 Improper input validation in SVG This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118334 Use after free in ImageCapture" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118334" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118334" --- # Chromium: CVE-2026-118334 Use after free in ImageCapture This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118319 Memory corruption in Skia" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118319" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118319" --- # Chromium: CVE-2026-118319 Memory corruption in Skia This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118308 Use after free in SVG" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118308" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118308" --- # Chromium: CVE-2026-118308 Use after free in SVG This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118344 Use after free in Layout" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118344" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118344" --- # Chromium: CVE-2026-118344 Use after free in Layout This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118346 Use after free in Compositing" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118346" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118346" --- # Chromium: CVE-2026-118346 Use after free in Compositing This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118341 Use after free in Modularization" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118341" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118341" --- # Chromium: CVE-2026-118341 Use after free in Modularization This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118332 Improper input validation in Compositing" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118332" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118332" --- # Chromium: CVE-2026-118332 Improper input validation in Compositing This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118313 Use after free in Video" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118313" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118313" --- # Chromium: CVE-2026-118313 Use after free in Video This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118348 Improper input validation in Skia" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118348" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118348" --- # Chromium: CVE-2026-118348 Improper input validation in Skia This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118333 Missing authorization in Video" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118333" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118333" --- # Chromium: CVE-2026-118333 Missing authorization in Video This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118339 Use after free in Animation" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118339" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118339" --- # Chromium: CVE-2026-118339 Use after free in Animation This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. --- --- title: "Chromium: CVE-2026-118337 Improper access control in Forms" url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118337" lang: "en-US" type: "post" description: "This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see (https://chromereleases.googleblog.com/2026) for more information." last_modified: "2026-10-31T14:00:00+00:00" categories: [Global Security News] custom_fields: wpe_campaignid: 53 wpe_feed: "https://api.msrc.microsoft.com/update-guide/rss" wpe_sourcepermalink: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118337" --- # Chromium: CVE-2026-118337 Improper access control in Forms This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information. ---