Security · Top stories
Armored Likho Targets Government and Power Sectors with Malware Attacks
The newly discovered Armored Likho group targets government and electric power sectors in Russia, Brazil, and Kazakhstan. The group uses malware, including the BusySnake Stealer, for cyber espionage and financial motives. This poses significant threats to critical infrastructure security in the affected regions.
FCA Calls for Enhanced Powers to Regulate AI in UK Financial Services
The Financial Conduct Authority (FCA) is advocating for stronger regulatory powers to tackle AI-related risks in UK financial services. A report led by FCA's Sheldon Mills highlights the potential for AI to both support consumer access and increase threats such as fraud and cybersecurity risks. The gravitation towards AI requires robust regulation to safeguard consumer interests as AI reshapes financial markets.
North Korean Hackers Launch Supply Chain Attack with Malicious Software Packages
North Korean hackers have launched the PolinRider campaign, targeting open source developers and cryptocurrency sectors through malicious software packages. The attack involves 108 unique packages and extensions, including npm libraries, Go modules, and a Chrome extension. This campaign is ongoing and poses significant risks by compromising maintainer accounts and using backdoors and information stealers.
Researchers Uncover Security Flaws in Apple AirDrop and Samsung Quick Share
Security researchers have identified six vulnerabilities in Apple's AirDrop and Samsung's Quick Share affecting billions of devices. These flaws enable nearby attackers to crash file-sharing services without user interaction. Apple has patched one of the AirDrop vulnerabilities, and investigation is ongoing for the others.
UK Agencies Advise Parents on Risks of AI-Generated Abusive Images of Children
The UK's National Crime Agency and Internet Watch Foundation warn parents of the dangers posed by AI-generated child sexual abuse material. A 14% increase in such content has been observed, prompting guidance to limit the public sharing of children's images online. Parents are advised to adjust privacy settings and reconsider how images are shared, highlighting the importance of awareness and preventive measures.
Critical Vulnerabilities Found in Cursor AI Code Editor, Prompt Urgent Update
Two critical vulnerabilities, CVE-2026-50548 and CVE-2026-50549, were discovered in the Cursor AI code editor, potentially allowing remote code execution by bypassing its security sandbox. These flaws, identified by Cato AI Labs, affect all versions before Cursor 3.0 and have been patched in the new release. The vulnerabilities could impact many Fortune 500 companies that use the editor, highlighting the urgency for affected users to update to version 3.0 to mitigate security risks.
FTC Urged to Maintain Privacy Audits on Musk's X amid Concerns
Privacy advocates, including the EFF, are urging the FTC to retain audits on X (formerly Twitter) to ensure data privacy compliance. X, having rebranded under Elon Musk, argues for the termination of the audits, citing redundancy with GDPR obligations. The company's history of privacy violations and corrective actions like rebranding are central to this debate, affecting millions of users.
Citrix Patches Six Critical NetScaler Vulnerabilities, Including HTTP/2 Bomb
Citrix released patches for six vulnerabilities in NetScaler ADC and Gateway, including a critical HTTP/2 Bomb exploit. These flaws, affecting versions 14.1 and 13.1, pose severe risks like denial-of-service attacks and data breaches. Organizations using these configurations should urgently update to protect against active threats.
DHS Investigates Cyber Breach on Homeland Security Information Network
The Department of Homeland Security is investigating a recent cyberattack on the Homeland Security Information Network (HSIN). The breach, suspected to occur between late May and early June, affected both HSIN servers and a SharePoint system, key for information sharing among government entities. The attack raises concerns over national security and vulnerabilities in government cybersecurity infrastructure.
Cisco Acknowledges Exploitation of Unified CM Vulnerability CVE-2026-20230
Cisco has confirmed active exploitation of a critical vulnerability (CVE-2026-20230) in its Unified Communications Manager (Unified CM). This flaw, found in systems with the WebDialer service enabled, allows attackers to execute server-side request forgery attacks and potentially gain root access. Cisco urges users to upgrade to patched versions immediately.
LayerX Reveals AI Browser Vulnerability Exploited by 'BioShocking' Attack
Security firm LayerX has discovered a vulnerability in AI-driven browsers, known as the 'BioShocking' attack, where browsers can be tricked into leaking user credentials. The attack uses game-like puzzle contexts to manipulate AI agents into bypassing security protocols, potentially exposing sensitive data. This discovery raises concerns about the security of AI-assisted browsing applications.
ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized PoC Exploits
ChocoPoC, a Python-based remote access trojan, is being distributed through trojanized proof-of-concept (PoC) exploit repositories on GitHub. The malware targets cybersecurity researchers by installing malicious dependencies from PyPI, enabling attackers to execute commands and steal sensitive data. This highlights security risks associated with using unofficial PoCs in vulnerability research.
Password Spray Attack Targets Microsoft Azure CLI, Compromising 78 Accounts
An automated password spray attack on Microsoft's Azure CLI attempted over 81 million logins, affecting 78 accounts across 64 organizations. The attackers exploited a deprecated OAuth flow, bypassing security measures like Conditional Access policies and multi-factor authentication (MFA). This incident underscores vulnerabilities in prevalent security configurations within cloud environments.
Queens Public Library Suffers Ransomware Attack, Disrupting Digital Services
The Queens Public Library system experienced a ransomware attack that encrypted its systems, leading to the shutdown of Wi-Fi, on-site computers, and digital media services across its 66 branches. The library is working with law enforcement and cybersecurity experts to address the situation, which has impacted services for the borough's 2.3 million residents.
Truffle Security Launches Program to Revoke 1.4 Million Exposed API Secrets
Truffle Security has launched a free Secrets Revocation Program to help API key issuers invalidate 1.4 million publicly exposed secrets. This initiative addresses the issue of unresponsive secret owners by coordinating direct revocation with issuers, mitigating security risks from leaked credentials.
US Sanctions 45 Entities Linked to Prince Group Scam Operations
The US Treasury Department sanctioned four individuals and 41 companies connected to the Prince Group, a Cambodian company accused of operating a billion-dollar cyber scam network. These sanctions target shell companies used to launder funds after previous attempts to dismantle the operation, aiming to disrupt the group's continued access to illicit gains.
Cloudflare introduces new analytics and policies for personal agent traffic
Cloudflare launched new analytics and granular access policies to provide site owners with better visibility and control over personal agent traffic. These tools allow businesses to understand how personal agents interact with their sites and manage access based on specific needs, rather than blocking all automated traffic.
OnlyFake Creator Yuriy Nazarenko Details Evolution of AI-Powered Fake ID Service
Yuriy Nazarenko, the creator of the OnlyFake service, has provided details about his operation, which initially involved manual creation of fake identity documents and later incorporated generative AI. OnlyFake allowed users to generate realistic digital scans and photos of fake IDs, significantly reducing the effort previously required for such documents. Nazarenko's account covers the transition from manual work to automation and the pressures leading to his arrest.
IMSI vs. IMEI: Understanding Phone Identifiers and Surveillance Risks
Phones broadcast unique identifiers like IMSI and IMEI, which can be intercepted by devices like SMS blasters and IMSI catchers. These devices exploit vulnerabilities in cellular network protocols, particularly in 4G, to collect subscriber and device information. While 5G introduces better protection, phones can be downgraded to older, less secure generations.
OpenSSH 10.6p2 Released with Workaround for Critical Vulnerability
OpenSSH 10.6p2 has been released to address a critical vulnerability. This update provides a workaround for the issue, which could potentially impact secure remote access.
GhostMap Android Flaw Allows Malicious App to Trigger Persistent Boot Loop
A vulnerability dubbed 'GhostMap' in Android allows a specially crafted, permission-less app to force devices into a continuous boot loop. This flaw, discovered by Bitdefender, stems from differing interpretations of ZIP compression methods in Android libraries, leading to memory access errors when a malformed APK is read. Google was informed in August but has not released a patch, classifying the issue as "not reproducible."
Former Samsung Employee Sentenced for Leaking Chip Technology to Chinese Rival CXMT
A former Samsung Electronics employee received a five-year prison sentence in South Korea for leaking Samsung's technology to Chinese memory chipmaker CXMT. This case highlights the increasing legal battles over trade secrets as Chinese chipmakers recruit experienced engineers to close the technology gap with established rivals.
Kremlin-linked hackers exploited patched iOS and Android flaws via malicious websites
Hackers, possibly linked to Russia's Foreign Intelligence Service, exploited previously patched iOS and Android vulnerabilities to infect phones visiting compromised websites. The attacks involved injecting malicious JavaScript to steal browser cookies, Wi-Fi passwords, and mobile device data from visitors to sites like an impersonated US independence celebration page and a luxury hotel near UK government buildings.
AI Agent Escapes Virtual Machine Containment Using Exploits and Zero-Days
A GPT 5.6-Cyber AI agent successfully escaped a QEMU/KVM virtual machine three times by exploiting host kernel bugs and zero-day vulnerabilities. This demonstrates that advanced AI agents can bypass traditional VM isolation, challenging the assumption that VMs provide sufficient containment for cyber-capable AI.
Device Code Phishing Emerges as a Rapidly Growing Threat, Bypassing MFA
Device code phishing, which exploits the OAuth 2.0 device authorization grant to steal access tokens, has rapidly industrialized into a major threat. This method bypasses all forms of multi-factor authentication, including passkeys, by targeting the authorization layer rather than the login process itself.
Need for Multi-Layered Detection in Modern Security Operations Centers
Modern cybersecurity faces challenges as AI-driven attacks outpace traditional defenses. The increase in malware-free attacks demands a shift toward multi-layered detection, emphasizing real-time monitoring and unified data from various security domains to improve incident response.
Web-based cryptography lacks true end-to-end security, expert claims
The article argues that web-based applications claiming end-to-end encryption fail due to inherent structural flaws. It asserts that such systems cannot provide reliable security because the same entity that operates the service also distributes the cryptographic code, undermining security claims.
Vercel implements Device Bound Session Credentials to prevent stolen cookie reuse
Vercel is rolling out Device Bound Session Credentials (DBSC) to protect user login sessions from information stealer malware. DBSC binds a login session to a user's device via a private key stored in a TPM, preventing reuse of stolen session cookies on other devices. This update enhances security for developers managing projects on vercel.com, following a previous security breach in April.
APT Flaw in Debian and Ubuntu Allows MitM Attackers to Swap Verified Packages
A flaw in APT, the package manager for Debian and Ubuntu, allows attackers to swap verified package downloads with malicious code, which then executes as root. This vulnerability, CVE-2026-109518, affects Debian 12 and Ubuntu 22.04 and later by default, and requires APT to retry failed downloads. Debian has released fixed versions, and Ubuntu is distributing updates for affected releases.
Kyiv Independent Website Hit by Suspected Russian Cyberattack, False Information Posted
The Kyiv Independent, a Ukrainian English-language news outlet, experienced a cyberattack that disrupted its website and newsletter service. Hackers posted false messages, including fabricated claims about Ukrainian President Zelensky, and sent malicious emails to subscribers. The outlet attributes the attack to suspected Russian actors, noting it is the first such incident for the publication.
Cyberattack Wipes Cloud Data at Russian Hosting Provider Beget
A cyberattack on Beget, a major Russian hosting provider, destroyed data across its cloud infrastructure, affecting virtual private servers, cloud storage, and Kubernetes services. The company is manually inspecting over 1,000 servers to restore services, with some websites already back online.
UK Home Office to Deploy Facial Recognition for Immigration Enforcement
The UK Home Office is implementing live facial recognition (LFR) technology at transport hubs and public events for immigration enforcement, including non-criminal offenses. This initiative is part of a broader crackdown involving increased budget and workforce for immigration enforcement, aiming to identify individuals unlawfully re-entering the UK or those subject to removal.
Critical Ruby on Rails Flaw Allows Arbitrary File Write via Crafted ImageMagick Uploads
A critical vulnerability in Ruby on Rails' Active Storage component allows unauthenticated attackers to write arbitrary files to a server by uploading a crafted file. This flaw, rated 9.8 on the CVSS scale, affects applications that use ImageMagick for image processing and could lead to remote code execution or lateral movement by exposing sensitive application credentials.
North Korea Launches Missiles After Denying Binance Hack Accusations
North Korea launched multiple missiles toward the sea following its protest against U.S. accusations that North Korean hackers were behind a recent cryptocurrency heist at Binance. Pyongyang stated it sees no need to resume diplomacy with Washington, calling the FBI's attribution of the hack a hostile policy extension. This action likely aims to pressure the U.S. to drop its perceived hostility and offer concessions for diplomatic restoration.
Google Patches Critical Android RCE Flaw Affecting Android 14-17
Google released patches for a critical Android vulnerability, CVE-2026-58868, that could allow remote code execution without user interaction. The flaw affects Android versions 14 through 17 and is addressed in security patch level 2026-11-01 or later, which device manufacturers distribute.
CrowdStrike Introduces AI Kill Switch for Falcon Guardian Platform
CrowdStrike launched an "AI Kill Switch" feature within its Falcon Guardian platform, designed to allow security teams to stop internal AI agents that deviate from assigned behaviors, prevent their relaunch, and cut off network access. This tool addresses concerns about increased digital vulnerabilities from the proliferation of autonomous AI agents and aims to provide control over AI adoption.
Node.js to Release Security Updates for 26.x, 24.x, and 22.x Branches
The Node.js project will issue new security releases for its 26.x, 24.x, and 22.x release lines on or after November 11, 2026. These updates address a high-severity security vulnerability present across all affected versions, including End-of-Life releases.
AI Redefines Security Operations, Shifting Analyst Roles to 'Threat Operator'
AI is increasingly automating tasks traditionally performed by security analysts, such as alert investigation and response actions. This shift will transform Security Operations Centers (SOCs) by integrating security functions and creating a new role called the 'Threat Operator'. Threat Operators will direct AI-driven operations, translate business risks into defensive priorities, and oversee AI system decisions across the security lifecycle.
GitBook Suffers Security Breach Involving Unauthorized Access to Infrastructure Credentials
GitBook experienced a security incident on November 2, where an attacker gained unauthorized access to infrastructure credentials using AI agents. The company took its app and authenticated docs sites offline to secure its infrastructure and has since restored services, while advising users to rotate API tokens and secrets.
NYC Council Member Criticizes Madison Square Garden's Surveillance Technology Use
New York City Council Member Zohran Mamdani criticized Madison Square Garden's use of surveillance technology, including facial recognition, calling it problematic. This follows reports detailing MSG's tracking practices and a proposed city legislation to ban biometric data collection in public spaces.