Security · Top stories
Django Releases Security Updates 6.1.3, 6.0.10, and 5.2.19 Addressing Multiple CVEs
The Django team has released security updates 6.1.3, 6.0.10, and 5.2.19 to address four security vulnerabilities, including potential memory exhaustion, log injection, server-side request forgery, and private data exposure. Users are advised to upgrade their Django installations promptly to mitigate these risks.
Frontline Education Data Breach Affects Over 1.3 Million Individuals
Frontline Education, a K-12 school administration software provider, is notifying over 1.3 million individuals about a data breach that occurred on August 14. An exploited vulnerability in third-party software led to unauthorized access and theft of personal information belonging to school staff and students. The compromised data includes names, Social Security numbers, dates of birth, and health insurance information.
Harvard University data breach exposed 851,000 accounts, ShinyHunters claims responsibility
A data breach at Harvard University's Alumni Affairs and Development systems in November 2025 exposed data from 851,000 unique email addresses, including personal and donation details. The ShinyHunters extortion gang claimed responsibility and leaked a 1.1GB archive of documents after Harvard refused to pay a ransom. The exposed data includes names, email addresses, phone numbers, and biographical information, but not Social Security numbers or financial data.
Collinear AI Releases CWE-bench v2 with 100 Public Security Vulnerability Tasks
Collinear AI has released CWE-bench v2, a public benchmark comprising 100 tasks designed to evaluate AI models' ability to find and fix security weaknesses in open-source repositories. This new version covers 91 different Common Weakness Enumerations (CWEs) and features programmatic scoring, quality checks, and a public leaderboard for tracking model performance.
Workload Identity Federation in GCP eliminates long-lived credentials for external workloads
Workload Identity Federation (WIF) in Google Cloud Platform (GCP) allows external workloads to authenticate without long-lived service account keys, reducing credential exposure and operational overhead. This approach shifts machine identity from managing secrets to configuring trust relationships, improving security for integrations like CI/CD tools and third-party access.
NATO's Crossed Swords 2026 Exercise Integrates AI Agents into Cyber Operations Training
The NATO CCDCOE launched its Crossed Swords 2026 exercise in Tallinn, Estonia, involving over 250 participants from 40+ countries. This year's exercise introduces AI agents into cyber operations training for the first time, using locally hosted AI and OpenAI's Daybreak to simulate synchronized cyber and kinetic military actions.
UK Cyber Chief Warns of Unprecedented Rise in Cyberattacks Due to AI-Accelerated Vulnerability Exploitation
The head of the UK's National Cyber Security Centre (NCSC) warns of an unprecedented rise in cyber incidents in the coming months, attributing the risk to AI's ability to discover and exploit existing vulnerabilities at scale. This warning follows a Five Eyes intelligence alliance alert about AI transforming cyber capabilities within months, with officials noting a surge in vulnerability disclosures by vendors.
Abrigo's Sageworks platform taken offline after suspected cyberattack, partially restored
Abrigo took its Sageworks risk management application offline on October 30 due to "irregular activity" in its environment, with most functionality now restored except for borrower-facing features. The incident's nature is under investigation, but a previous claim by ShinyHunters in 2023 alleged a data theft from Abrigo.
AT&T Data Breach Exposes 109 Million Customer Call Logs, Highlighting Carrier Data Retention
AT&T experienced a data breach in April 2024, exposing communication logs for 109 million current and former customers, including phone numbers, call/text counts, durations, and location data from 2022 and 2023. This incident underscores the extensive retention of call metadata by mobile carriers, which can reveal sensitive personal information despite not containing call content or Social Security numbers.
DarkBlinders Compromises Israeli Individual and Iraqi Kurdish Government Cloud
An Iran-aligned threat actor, DarkBlinders, compromised a high-profile individual in Israel and a government cloud environment in Iraqi Kurdistan between August and October 2026. The group uses spear-phishing to deliver trojanized utilities or direct downloads, leading to the deployment of SHELBYLOADER and SHELBYC2 backdoors.
Nvidia's Brev Cloud Platform Suffers Security Incident, SSH Keys Potentially Exposed
Nvidia's Brev cloud development platform experienced a security incident between October 4 and October 20, potentially exposing customer SSH keys. Nvidia replaced affected keys and updated customer machines, stating no evidence of improper use was found, but did not detail attacker access methods or whether customer data was accessed. This incident follows a trend of security breaches on AI development platforms in October.
Hundreds of AI Apps with Hidden Deepfake Features Found on App Store and Google Play
An investigation found over 400 AI apps, linked to a single Chinese organization, that passed Apple and Google app reviews despite containing hidden sexual and violent deepfake generation features. These apps used bait-and-switch tactics to conceal their true functionality, activating explicit content under specific conditions, and were promoted via thousands of ads on Facebook and Instagram. Apple removed 19 apps after being notified, and Meta took action against over 10,000 ad accounts.
Military Explores Commercial 5G Networks for Drone Detection and Defense
NATO conducted experiments in Latvia using existing 5G masts for passive drone detection and tracking, while AT&T and Ericsson demonstrated similar capabilities in the U.S. These initiatives explore repurposing commercial 5G infrastructure to enhance national security and counter drone threats.
WA Police Trial Facial Recognition, Scanning Over 1 Million Faces and Making 122 Arrests
Western Australia Police concluded a five-month trial of real-time facial recognition technology, scanning 1,380,882 faces across 43 locations. The trial resulted in 122 arrests, engagement with 146 registered sex offenders, and 10 welfare checks, with nine incorrect alerts recorded.
Shopify Develops Overexposed Scanner for GKE Ingress and Cloud Run Exposure Detection
Shopify introduced Overexposed, an internal scanner that identifies internet-accessible, unauthenticated Kubernetes Ingresses on GKE and Cloud Run services. The scanner was rebuilt to use GCP Cloud Asset Inventory and anonymous HTTP probes, reducing inconclusive verdicts by approximately 80%. This tool helps Shopify identify and manage publicly exposed services more accurately than its previous configuration-file-based approach.
Trigger.dev Reports Security Incident, Customer Environment Variables Exposed
Trigger.dev experienced a security incident where an attacker gained unauthorized access to customer environment variables for a subset of organizations. The exploit has been blocked, and affected account owners have been notified with mitigation steps.
Smart TVs Track Viewing Habits and Personal Data Using Automatic Content Recognition
Smart TVs utilize Automatic Content Recognition (ACR) to monitor user viewing habits across various inputs, collecting data like IP addresses and app usage. This data is then processed and sold to data brokers, contributing to a multi-billion dollar industry that personalizes advertising and raises privacy concerns.
Infostealer Logs Pose Evolving Operational Security Challenge for Organizations
Infostealer logs, containing compromised corporate credentials and session cookies, are increasingly challenging organizational security teams. These logs often originate from unmanaged personal devices, complicating incident response beyond simple password resets. The growing volume of these exposures necessitates advanced strategies for identifying active threats amidst numerous stale credentials.
Mandiant Details BREEZE COMET Threat Actor Targeting Brazilian Financial Services
Mandiant, part of Google Threat Intelligence Group, has identified BREEZE COMET (formerly UNC5669) as a financially motivated threat actor actively targeting Brazilian financial services, retail, and eCommerce organizations since early 2024. This group specializes in manipulating payment systems and banking software to conduct fraudulent transfers and is noted for using generative AI in malware development, potentially increasing the scale and sophistication of future operations.
Identity Verification Flaws in Onboarding and Account Recovery Pose Growing Security Risk
Organizations face increasing security risks from vulnerabilities in identity verification during new employee onboarding and account recovery processes, even with strong authentication methods like MFA. Attackers exploit these weaknesses through social engineering to gain unauthorized access, as seen with North Korean IT worker impersonations and groups like Scattered Spider.
Fake Remote Workers Exploit Hiring Processes to Infiltrate Corporate Networks
Security teams face a growing threat from fraudulent remote workers who exploit hiring processes to gain legitimate access to corporate networks. These individuals, sometimes linked to state-sponsored groups like those from North Korea, use various tactics to impersonate legitimate hires and exfiltrate sensitive data or conduct cybercriminal activities. This issue highlights a gap in identity verification during remote hiring, where traditional checks do not confirm the actual user of an account or device.
Browser Security Gap Widens as Enterprise Work and AI Shift to Web Interfaces
Enterprise work increasingly occurs within web browsers, making them a primary target for cyberattacks. Traditional endpoint and network security architectures are insufficient for protecting browser sessions, especially with the rise of AI-assisted hacking and the use of third-party AI models.
Lenovo's 'Encrypted' Fingerprint USB Drive Found to Be Unencrypted SD Card
A security researcher discovered that Lenovo's ThinkPlus FU100 fingerprint USB stick, marketed with AES-256 encryption, was an unencrypted SD card, allowing trivial data access. Lenovo has since issued fixes for several affected drives, requiring users to contact service for replacements or firmware upgrades.
New Attack Leaks Data from Air-Gapped Computers via RAM-Generated Radio Signals
Researchers demonstrated an attack, named RAMBO, that exfiltrates data from air-gapped computers by generating covert radio signals from memory buses. Malware on a compromised machine can encode sensitive information into these signals, which can then be intercepted and decoded by an attacker using software-defined radio hardware and an antenna. This method achieves data leakage at 1000 bits per second, posing a new threat to isolated systems.
New Forensic Method Traces 3D-Printed PLA Objects to Filament Source
Researchers at Curtin University developed a forensic method using differential scanning calorimetry (DSC) to link 3D-printed PLA objects to their original filament, correctly matching 26 out of 28 samples. This technique could allow law enforcement to trace 3D-printed firearms, known as "ghost guns," back to their manufacturing source. The method currently works for PLA due to its semi-crystalline structure, but not for PETG or ABS.
Molly (Signal Fork) Unupdated for Three Months, Contains Known Signal Vulnerabilities
The Molly messaging app, a fork of Signal, has not received an update since July 31 (v8.19.2-4) and remains vulnerable to security exploits that have been patched in mainline Signal. Users are advised to switch to the official Signal app due to these unaddressed security risks.
Fortanix Integrates Confidential Containers with Attestation and Key Management
Fortanix has added support for Confidential Containers to its Confidential AI platform, linking Kubernetes workload attestation to encryption-key release. This integration allows workloads meeting security policies to decrypt models and sensitive data within hardware-based trusted execution environments.
Scribd, Inc. Discloses Security Incident Affecting User Data
Scribd, Inc. experienced a security incident where an unauthorized third party accessed user data, including email addresses, last four digits of credit cards, country, issuer, expiry dates, and payment history. The company has secured the affected system, notified law enforcement, and is working with a cybersecurity firm to enhance security measures.
Northflank Experiences Major Outage Across Core Services Due to Breach
Northflank reported a major outage affecting multiple core services including Networking, Certificates, Services, Addons, Jobs, Builds, and Logs and Metrics. The incident is attributed to a breach, impacting critical functionalities for users.
Linode Investigates Remote Code Execution Vulnerability CVE-2026-98432
Akamai's Linode is investigating a recently published remote code execution vulnerability, CVE-2026-98432. The company is taking mitigation actions and monitoring its platform to address the issue.
Applebee's Fixed Database Exposure After Password Found in Mobile App
Applebee's resolved a security flaw where a password for its internal customer database was hardcoded into its Android mobile app, allowing unauthorized access to customer data. A security researcher discovered the credential, which exposed personal information like names, emails, phone numbers, and veteran status for registered users.
Bunny CDN Reports Security Incident Involving Third-Party Infrastructure Provider
Bunny CDN experienced a security incident where one of its infrastructure providers reported unauthorized access to server management software. A Bunny CDN node in Armenia, hosted on the affected provider's server, was immediately taken offline. While investigations found no evidence of unauthorized access to the CDN node's data, Bunny CDN revoked and reissued TLS certificates as a precaution.
Critical UEFI Boot Flaw Affects Most Servers; Anthropic Disputes Scope of AI-Led Intrusion
A 16-year-old buffer overflow vulnerability (CVE-2026-97631) in TianoCore EDK II, used by most server vendors, allows local network attackers to execute code at the highest privilege level during network boot. Separately, Anthropic is disputing the scope of an intrusion reported by cybersecurity startup Cathedral, which claimed its AI agents accessed sensitive internal data.
Azure Cloud HSM now offers Hardware Audit Logging for verifiable management operations
Azure Cloud HSM has introduced Hardware Audit Logging, which collects audit records directly from the HSM for supported management operations. This feature provides verifiable audit trails for security, compliance, and operational teams to monitor administrative activity and validate records.
South Korea Investigates 80 Tesla Drivers for Illegally Activating Full Self-Driving
South Korean authorities are investigating 80 Tesla drivers for illegally activating the Full Self-Driving (FSD) feature on vehicles not certified for it in the region. Drivers used imported hardware or self-built devices to bypass software locks, risking fines up to $15,000 or two years in prison under the Motor Vehicle Management Act. This action follows Tesla's own efforts to detect and disable unauthorized FSD activations.
Fake Crypto App on Apple App Store Stole $23K from Solana Wallets
A malicious cryptocurrency trading app named Padre Terminal, previously available on the Apple App Store, has been linked to the theft of approximately $23,000 from 27 Solana wallets. The app drained funds after users imported private keys, and while the app has been removed, the wallet drainer remained active.
Malware attack targets online poker players, potentially stealing millions
Hundreds of online poker players were targeted in a malware attack that allowed a hacker to view their screens, a tactic known as a "superuser" strategy. This long-term campaign may have resulted in millions of dollars stolen across major online poker platforms by exploiting third-party tools to install MeshAgent malware. Responses from online poker platforms varied, with some banning the hacker and others offering tools to detect compromise, while one platform reportedly took no action.
Google OAuth Platform Adopts DPoP to Secure Refresh Tokens Against Theft and Replay Attacks
Google's OAuth Platform now supports Demonstrating Proof-of-Possession (DPoP) for refresh tokens, a security mechanism that cryptographically binds tokens to a client's asymmetric key pair. This change mitigates token theft and replay attacks by preventing stolen tokens from being replayed without the corresponding private key. The adoption of DPoP addresses the vulnerability of long-lived refresh tokens, which are a primary target for persistent online impersonation.
Chrome extensions with 13.4 million installs caught hijacking searches
A report identified 319 Chrome extensions with 13.4 million installations that hijack user searches, redirecting them through tracking servers to generate advertising revenue from Bing and Yahoo. These extensions exploit Chrome's settings to replace the default search provider, posing risks beyond ad fraud, including potential redirection to malicious sites.
Belgian Tax Services Offline Due to Cyberattack Days Before Filing Deadline
Belgium's finance ministry took its main online tax portal, MyMinfin, offline following a cyberattack, just before an October 31 filing deadline. The Federal Public Service Finance (FPS Finance) is investigating the attack, and affected taxpayers will receive an extended deadline. There is no indication of a data breach, but investigations are ongoing.