Security · Top stories
TeamViewer Vulnerability Allows Malicious Hosts to Execute Code on Technician Systems
A high-severity integer overflow vulnerability (CVE-2026-111585) in TeamViewer clients for Windows, macOS, Linux, and Android could allow a malicious host to execute arbitrary code on a support technician's machine. The flaw occurs when processing screen dimensions, potentially leading to buffer overflows and system compromise during a remote-control session.
GCHQ Cannot Account for Thousands of Data Storage Devices, Watchdog Reports
The British cyber and signals intelligence agency GCHQ cannot account for thousands of portable data storage devices, including USB sticks and external hard drives. The Investigatory Powers Commissioner's Office (IPCO) expressed concern over the agency's failure to determine the full scale of the problem, which has been known for several years. Some of these devices may contain sensitive data obtained under the Investigatory Powers Act.
ACLU Reports Police Use AI and ALPR Data to Flag Drivers for 'Suspicious' Travel
The American Civil Liberties Union (ACLU) reported on October 26 that law enforcement agencies are increasingly using AI algorithms and automated license plate reader (ALPR) data to identify and stop motorists based on "suspicious" travel patterns. This practice leads to traffic stops without initial evidence of wrongdoing, raising concerns about mass surveillance and an increase in pretextual stops. The ACLU warns that these AI-generated alerts could subject more innocent individuals to police encounters.
Apple Backports CoreGraphics Zero-Day Fix to Older iPhones and iPads
Apple released iOS 18.7.11 and iPadOS 18.7.11 to address a CoreGraphics zero-day vulnerability (CVE-2026-86950) that was actively exploited in targeted attacks. This update extends protection to older iPhone and iPad models, including iPhone XS and iPad 7th generation, which were not covered by initial patches released in September. The vulnerability, an out-of-bounds write, could lead to arbitrary code execution through maliciously crafted files.
Apple Addresses 329 Security Vulnerabilities Across System Updates
Apple released software updates for iOS, iPadOS, macOS, watchOS, tvOS, visionOS, and Safari, patching 329 unique security vulnerabilities. These updates resolve issues including unauthorized camera access, sensitive data exposure in Apple Intelligence and Siri, and multiple WebKit flaws allowing arbitrary code execution.
GPS Spoofing and Digital Scams Lead to Over $100 Million in Data Center Equipment Thefts
Thieves are using sophisticated digital tactics, including hacking freight broker accounts and GPS spoofing, to steal data center equipment worth over $100 million since June. These thefts involve manipulating shipping logistics and sometimes targeting off-duty police escorts, impacting the supply chain for critical tech infrastructure.
Ukraine Warns Hackers Exploiting Dahua Surveillance Cameras via Easy4IP Feature
Ukraine's CERT-UA has warned that hackers are gaining unauthorized access to Dahua surveillance cameras and video recorders, altering settings and creating unauthorized user accounts. Attackers are exploiting the Easy4IP remote access feature by guessing serial numbers and then using weak passwords or known firmware vulnerabilities to compromise devices. This poses a significant risk given the widespread use of these cameras in Ukraine, including by government and military entities.
Serbian Opposition Figures Targeted with Pegasus Spyware Ahead of Elections
The Citizen Lab confirmed that University of Belgrade Rector Vladan Đokić's phone was infected with Pegasus spyware, and prosecutor Rade Bajić also received an Apple threat notification, indicating targeting with commercial spyware. These incidents occurred ahead of national elections where former president Aleksandar Vučić is running for prime minister, raising concerns about the use of surveillance against political opponents.
Chinese National Extradited to US for Role in $37 Million Cryptocurrency Scam
Zhen Zhao, a 44-year-old Chinese national, was extradited from the Netherlands to California and arraigned for his alleged involvement in a cryptocurrency investment scam. The scheme defrauded 174 US victims of nearly $37 million by luring them into fake investment platforms and converting their funds into Tether (USDT) for transfer to Cambodia. Zhao is the ninth person charged in connection with this ongoing fraud investigation.
Google Messages Adds 'Enhanced Protection Mode' and Android Expands Scam Defenses
Google is rolling out an 'enhanced protection mode' for its Messages app, using cloud Gemini models and on-device Gemini Nano to detect complex scams and evaluate link trustworthiness. Android is also expanding on-device scam detection to more devices and introducing features to combat phone scams, such as automatic screen-share privacy and blocking unauthorized call forwarding.
UK Proposes 14-Year Prison Sentences for Undersea Cable Sabotage
The UK government has proposed new legislation to introduce prison sentences of up to 14 years and unlimited fines for damaging undersea cables and pipelines. This initiative aims to protect critical infrastructure, including telecommunications cables, electricity interconnectors, and pipelines, which carry 99% of the UK's international data traffic and supply 74% of its gas. The proposals replace the outdated Submarine Telegraph Act 1885 and address increasing threats from state actors and hybrid warfare.
Woman Arrested for Fraud After Scammer Opens CashApp Account in Her Name
Amanda Smith was arrested and faces up to six years in prison after a scammer used her identity to open a CashApp account and defraud someone on Facebook Marketplace. Smith, who has never used CashApp, is struggling to prove her innocence as CashApp refuses to provide account details without proof of ownership, highlighting the dangers of identity theft and limitations in fraud investigation.
Accenture, Dragos, SANS Launch $10M Initiative to Secure Small US Utilities
Accenture, Dragos, and SANS Institute established the Community Cyber Resilience Foundation with $10 million in funding and services to help small US utilities protect their operational technology environments. This initiative provides free security tools, deployment assistance, and training to up to 500 qualifying utilities, addressing their limited resources and increasing cyber threats.
TeamUpdraft Breach Exposes Customer Data and UpdraftCentral Connection Keys
TeamUpdraft, developer of popular WordPress plugins like UpdraftPlus, experienced a data breach over the weekend of October 17-18. Threat actors gained unauthorized access to the teamupdraft.com website, potentially compromising customer data including hashed passwords and UpdraftCentral connection keys. These stolen keys are reportedly being used to backdoor WordPress sites, affecting users of UpdraftCentral.
Belarusian Cyber Partisans Claim 2023 Breach of Moscow Healthcare Network
Belarusian hacktivists, the Cyber Partisans, claimed responsibility for infiltrating the Moscow Department of Health in 2023, gaining administrator access to its infrastructure. This admission follows a report by Russian cybersecurity firm Solar, which identified a long-running intrusion into a Russian healthcare organization, attributing it to the group.
Compromised Login Exposes Millions of California Student Records from ETS System
A single compromised login credential allowed unauthorized access to an Educational Testing Service (ETS) SFTP site, exposing personal information for millions of current and former California public school students. The breach, active from May to September 2026, impacts students enrolled in the last three school years and some dating back to 2006, necessitating a system overhaul by ETS.
Nigerian National Sentenced to 8 Years for $3.6M Tax Fraud Scheme
Chukwuemeka Victor Amachukwu, a Nigerian national, was sentenced to eight years in federal prison and ordered to pay over $3.6 million in restitution for his role in spearphishing attacks against U.S. tax preparation businesses. Amachukwu and accomplices stole identity information to file fraudulent tax and loan applications with the IRS and state tax authorities, obtaining millions of dollars. He pleaded guilty to conspiracy to commit computer intrusions and wire fraud after being extradited from France.
WhatsApp help pages contained hidden AI instructions to avoid mentioning regulators or laws
WhatsApp's help pages included hidden instructions for an AI, telling it not to recommend data protection regulators or cite relevant laws if a user mentioned a lawyer. These instructions contradicted WhatsApp's public privacy policy for Europe, which outlines users' rights to complain to regulators.
Chinese Crime Ring Hacked Staples, Stole Millions in Gift Cards for Retail Theft
A Chinese organized crime group hacked into Staples' internal systems, fraudulently issuing over 15,000 gift cards worth more than $5 million for other retailers. The group then used these gift cards for a nationwide shopping spree, shipping stolen electronics and other goods back to China as part of a large-scale retail theft operation.
Rank Math PRO WordPress Plugin Compromised with Self-Restoring Backdoor
The Rank Math PRO WordPress SEO plugin distributed malware through downloads and updates between October 15 and October 16, installing a self-restoring backdoor on affected websites. Users who installed and activated version 3.0.123 during this period should consider their sites compromised and follow manual cleanup procedures, as updating the plugin alone does not remove all malicious components. This incident impacts websites using the paid version of a popular SEO tool.
Russian military satellite approaches US radar craft aiding Ukraine to within 3 miles
A Russian military satellite, Cosmos 2612, has moved from over 200 miles to approximately 3 miles of the US-owned ICEYE-X36 radar satellite, which is part of a fleet supporting Ukraine. This unapproved close approach in low Earth orbit is considered a potential provocation and an attempt to spy, raising concerns in the West.
OpenBSD Local Privilege Escalation Exploit Uses 37-Year-Old Kernel Bug
Security researchers at Calif developed a local privilege escalation exploit for OpenBSD 7.9, achieving root access by chaining a 37-year-old integer overflow vulnerability with a separate kernel flaw. The exploit bypasses OpenBSD's kernel-address randomization (KARL) and hardware protections (SMAP, SMEP). Patches for both issues were released in September 2023.
Docker Hub Critical Flaw Allowed User Impersonation and Image Tampering
Docker has patched a critical vulnerability, CVE-2026-105445, in Docker Hub that allowed attackers to impersonate other users and manipulate container images. The flaw, present for over two years, stemmed from how personal access tokens (PATs) were reassigned when a personal account was converted into an organization, enabling unauthorized access to repositories. Docker states there is no evidence of exploitation, and the fix was applied directly to Docker Hub.
TFG London brands Hobbs, Whistles, Phase Eight hit by cyber-attack; H&M investigates separate claim
TFG London, owner of fashion brands Hobbs, Whistles, and Phase Eight, is investigating a cyber-security incident that affected some IT systems and website capabilities. Separately, H&M is investigating claims of a hack by the ShinyHunters group, though it has found no indications of data compromise so far. These incidents highlight ongoing cyber threats to major retail brands.
IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion in All-Stock Deal
IonQ announced an agreement to acquire Elisity, a zero-trust software provider, in an all-stock transaction valued at up to $1.3 billion, including up to $150 million in earnout considerations. The acquisition aims to expand IonQ's reach into enterprise and government sectors for its quantum computing and post-quantum cryptography offerings, leveraging Elisity's customer relationships and IdentityGraph platform. This move is intended to bolster IonQ's quantum security strategy against threats to generative AI models and future quantum-based cyberattacks.
iRhythm Data Breach Impacts Hundreds of Thousands of Patients
Medical device maker iRhythm reported a data breach affecting at least 360,000 individuals, where unauthorized access to third-party systems occurred in June. The breach exposed personal and health information, leading to ransom demands from the attackers.
Let's Encrypt to Reduce Certificate Lifetimes to 64 Days Starting February 2027
Let's Encrypt will reduce the validity period of its free SSL/TLS certificates from 90 to 64 days, effective February 10, 2027. This change aims to improve security by limiting the impact of compromised keys and to encourage the adoption of automated certificate management protocols like ACME with ARI.
Engineer sentenced to 32 months for ransomware-style attack on former employer
A former core infrastructure engineer received a 32-month prison sentence for locking over 3,000 devices on his employer's network in a failed extortion attempt. Daniel Rhyne changed administrator and user passwords, deleted accounts, and shut down servers, demanding a 20 bitcoin ransom.
Empire Market Co-Creator Sentenced to 40 Years for $430 Million Dark Web Operation
Raheim Hamilton, co-creator of the dark web marketplace Empire Market, received a 40-year prison sentence for facilitating $430 million in illegal transactions. Empire Market operated from 2017 to 2020, enabling drug sales, counterfeit currency, and stolen credentials, and used cryptocurrency to evade law enforcement.
Arizona Supreme Court reports data breach, personal information of residents stolen
The Arizona Supreme Court announced that its court system was attacked by hackers who stole the personal information of "many Arizonans." The incident did not involve ransomware, and no ransom demands have been made.
Advantest Confirms Personal Data Stolen in February 2026 Ransomware Attack
Advantest Corporation, a Japanese manufacturer of semiconductor test equipment, confirmed that a ransomware attack in February 2026 resulted in the theft of personally identifiable information (PII). The stolen data includes contact information, Social Security Numbers, driver's licenses, passport numbers, medical information, and financial details. This incident places affected individuals at an increased risk of identity theft or fraud.
Cloudflare Introduces Application Profiles and Tests WAF Against AI-Generated Attacks
Cloudflare launched Application Profiles, a new feature designed to enforce positive security policies by analyzing HTTP request structures and identifying deviations, thereby reducing the attack surface area for web applications. Concurrently, Cloudflare tested its Web Application Firewall (WAF) against attack payloads generated by frontier AI models, leading to the development of new detection rules to improve WAF efficacy against evolving threats.
Fake Mac Zoom installer bypasses Gatekeeper to install infostealer, Jamf discovers
Cybersecurity firm Jamf identified a malicious Mac installer disguised as a Zoom application that bypasses Apple's Gatekeeper protection. The installer, dubbed CloudSyncD, installs both Zoom and an infostealer that exfiltrates user data, posing a significant threat to user privacy and security.
Microsoft's X Account Hacked to Promote Crypto Pump-and-Dump Scheme
Microsoft's official X account, with over 13 million followers, was compromised to promote a crypto pump-and-dump scheme involving a '$Clippy' token. Microsoft has secured the account, removed unauthorized posts, and is investigating the incident, stating it does not endorse any cryptocurrency.
DIVD Network Breach Linked to Zammad Zero-Days and AI-Driven Attack
The Dutch Institute for Vulnerability Disclosure (DIVD) reported that its network breach was caused by two zero-day vulnerabilities in the Zammad ticketing system, identified as CVE-2026-102489 and CVE-2026-102490. These flaws allowed session hijacking, remote code execution, and root privilege escalation, with an AI agent automating the attack and data exfiltration.
Over 543,000 Valid Credentials Exposed in Public GitHub Repositories
A study by Truffle Security found over 543,000 valid credentials exposed in public GitHub repositories, with some remaining accessible for years. This highlights that GitHub's Push Protection, while effective for new exposures in covered categories, does not revoke existing leaked credentials and misses certain types of secrets.
MetaMask Addresses Security Incident, Exits Affected Ethereum Validators
MetaMask is responding to an ongoing security incident affecting its infrastructure and has begun exiting affected validators in its non-custodial staking operations. This measure is precautionary, with no immediate threat identified to MetaMask wallets, but will incur foregone rewards and potential downtime penalties for the exited validators.
Apple Introduces Impersonation Risk Detection in iOS 27 and iPadOS 27
Apple has released Impersonation Risk Detection in iOS 27 and iPadOS 27, a new security feature designed to identify social engineering scams in real-time. This on-device tool analyzes user behavior and interaction patterns to flag suspicious activity, providing an additional layer of protection against scams that bypass traditional security measures.
Former US Air Force Members Sentenced for Multi-Year BEC and Phishing Scams
Two former US Air Force members, Chijioke Timothy Odimegwu and Harafat Mogaji, received federal prison sentences totaling 189 months for their involvement in business email compromise (BEC) and phishing campaigns. They stole over $2.4 million by redirecting legitimate wire transfers and making unauthorized financial transactions, highlighting the ongoing threat of BEC attacks to businesses.
ShinyHunters Launches New Oracle PeopleSoft Exploitation Campaign Bypassing WAFs
Mandiant and Google Threat Intelligence Group reported that the ShinyHunters group initiated a new mass-exploitation campaign targeting Oracle PeopleSoft customers. This campaign uses a modified exploit for CVE-2026-35273 to bypass web application firewalls (WAFs), expanding its targets beyond the education sector to various industries.