Security · Top stories
Canadian Bill C-22, expanding surveillance powers, advances to Senate
Canada's Bill C-22, also known as the Lawful Access Act, has passed the House of Commons and is now under consideration by the Senate. The bill would grant the government new powers to compel digital services to assist with surveillance, mandate data retention, and potentially weaken encryption, raising concerns about privacy and security.
Defense Secretary warns military personnel against using nonpublic information in prediction markets
Defense Secretary Pete Hegseth issued a memo prohibiting military personnel from using nonpublic information for bets on prediction markets. This action was taken because such wagers could provide intelligence to adversaries, potentially endangering military operations and personnel.
Vercel pushes vendors to adopt OIDC, but its own deployment token remains static
Vercel is requiring Marketplace vendors to adopt OpenID Connect (OIDC) and short-lived tokens by January 2027, citing security concerns with static credentials. However, developers noted that Vercel's own GitHub Actions deployment workflow still uses a persistent token, creating a double standard.
Microsoft Teams to receive AI-powered, context-aware phishing detection in November 2026
Microsoft Teams will implement AI-powered phishing detection starting November 2026, analyzing conversation context to identify malicious behavior without retaining message content. This update aims to detect phishing, social engineering, and impersonation attempts, particularly in external first-contact chats, enhancing security for users.
Ruby Fixes Three Regex Engine Bugs Addressing Four Critical GitLab RCE Flaws
Ruby released versions 4.0.9, 3.4.12, and 3.3.13 to patch three bugs in its Onigmo regular expression engine. These bugs were responsible for four critical remote code execution vulnerabilities in GitLab, which were patched over the past month. Any application that compiles regular expressions from attacker-controlled text is affected, not just GitLab.
Heartbreaker macOS Ransomware Rebuilds Itself; ISO/IEC Publishes AI Security Standard
A new macOS ransomware, Heartbreaker, can recompile itself from source to evade detection, though its current form has weaknesses. Separately, ISO and IEC released a new standard, ISO/IEC 27090, to address security threats specific to AI systems like data poisoning and model theft.
Critical Flaw in Python's Pillow Library Allows Code Execution via Crafted Image Filenames
A critical vulnerability (CVE-2026-112900) in Python's Pillow image library allows remote code execution by exploiting how it handles EPS image filenames passed to Ghostscript. Attackers can craft filenames to execute commands on servers, impacting applications that process user-supplied images. The flaw has been patched in Pillow version 13.0.0, released on October 16.
Critical Flaw in x402 SDK Could Allow Malicious APIs to Drain AI Agent Token Balances
A critical vulnerability in the x402 SDK's default client allowed malicious APIs to request and receive an AI agent's full token balance due to a missing spending limit. This flaw, along with two others, was fixed in August 18 releases, but no public security advisories were issued, leaving developers unaware of the need to upgrade.
Iranian APT 'Prince of Persia' Hosts C&C Server in US for First Time Since 2016
The Iranian government-sponsored threat group 'Prince of Persia' (also known as Infy) operated a command-and-control (C&C) server from within the United States this year, marking the first instance since 2016. This activity resumed after a three-month operational pause, the longest in the group's nearly 20-year history, during which they also switched hosting providers and methods.
Software-only jailbreak for Switch 2 enables homebrew and system access
A security researcher achieved a software-only partial jailbreak of the Switch 2, gaining userland access for homebrew, game modding, and save file backups. The exploit uses an integer overflow in SmileBasic 4 and a buffer overflow in the console's FileSystem services module.
Toronto Crime Stoppers halts operations after data breach exposes 1.5 million tips
Toronto Crime Stoppers has frozen its operations after a data breach exposed over 1.5 million tips, some containing personal information, from Crime Stoppers chapters across Canada. The organization stated that its promise of anonymity was broken for some tipsters, leading to the suspension of all tip-taking methods.
US Official: Russian Satellite Kosmos 2612 Exhibited Threatening Behavior Near Commercial Satellite
A US State Department official stated that Russia's Kosmos 2612 military satellite maneuvered dangerously close to a US-registered commercial satellite, describing the behavior as consistent with an on-orbit weapons operation. This incident raises concerns given past Russian statements about commercial satellites being legitimate targets.
Two CVSS 9.0 RCE Flaws Disclosed in Linux KSMBD Before Kernel Fixes
Two remote code execution vulnerabilities (ZDI-CAN-33774 and ZDI-CAN-33549) with CVSS 9.0 ratings have been publicly disclosed in Linux KSMBD, the kernel's built-in SMB server, before official fixes are available in the mainline kernel. These flaws could allow attackers to execute arbitrary code on affected Linux servers, with one requiring no authentication.
Quad9 DNS Service Exits France Following Court Order to Block Domains
Quad9, a public-benefit DNS resolver, will cease operations in France on November 24 after a French court ruled it must block certain domain names. The company stated that complying with the order is technically unfeasible and contradicts its mission to provide neutral, private, and secure DNS resolution.
Critical Vulnerabilities Patched in Arista, GitLab, and Keycloak; Banks Detect AI Agents
Arista, GitLab, and Keycloak released patches for critical vulnerabilities, including SQL injection, integer overflow, and password reset flaws. Simultaneously, major U.S. banks are detecting third-party AI agents accessing customer accounts, raising concerns about unauthorized access and compliance.
eMudhra Exits Global SSL/TLS Certificate Business
eMudhra announced its decision to exit the global SSL/TLS certificate business. The company will cease issuing new SSL/TLS certificates and will not renew existing ones, impacting customers who rely on their services for website security.
Cloudflare Achieves South Korea's ISMS-P Certification, Localizes User Consent
Cloudflare obtained South Korea's Information Security Management System (ISMS) certification under the ISMS-P framework after a ten-day audit by KISA. This certification required Cloudflare to localize its user consent process for Korean users, including itemized agreements for terms of service, personal information collection, and overseas data transfer.
Signal Fixes Critical Vulnerability Allowing Malicious Callers to Block Hang-Ups
Signal resolved a critical-severity vulnerability (CVE-2026-113380) in its RingRTC library that allowed malicious callers to keep audio and video tracks active even after a user attempted to end a call. This flaw meant a remote attacker could prevent call termination, potentially maintaining access to a target's microphone and camera, and was fixed in RingRTC version 2.72.0.
South Carolina Capital Columbia Hit by Cyberattack, Disrupting City Services
The city of Columbia, South Carolina, is responding to a cyberattack that has shut down several government systems, including its MyColaSC platform and Geographic Information Systems. The South Carolina Law Enforcement Division (SLED) is investigating the incident, which has prompted officials to reassure residents that critical public safety and utility systems remain operational.
Russian Trawlers Suspected of Mapping Undersea Cables Between US and Europe
Over 500 incidents of Russian fishing boats loitering near critical undersea communication cables have been identified over four and a half years, according to analysis of satellite data. These vessels are suspected of mapping the cables, which are vital for global economic activity and potential targets in a conflict.
Splunk and SolarWinds Release Security Updates for Code Execution, Privilege Escalation Flaws
Splunk released security updates for Splunk Enterprise and SOAR, addressing dozens of vulnerabilities including critical improper access control and data exposure issues. SolarWinds also issued patches for its Observability and Patch Manager products, fixing a high-severity authorization flaw and other medium-severity bugs.
AI Minister Reports 500 Vulnerabilities Found in UK Government Systems Using AI
UK AI Minister Kanishka Narayan stated that artificial intelligence identified 500 new vulnerabilities within government systems. This disclosure occurred as organizations globally address a critical cybersecurity flaw affecting millions of websites.
NIST Reports Compromised Intermediate Certificate Authority CVE-2026-111943
The National Institute of Standards and Technology (NIST) has reported CVE-2026-111943, indicating a compromised intermediate Certificate Authority (CA). This compromise allows an attacker to forge certificates for any domain, enabling man-in-the-middle attacks and potentially widespread impersonation.
New QPACK Flaws Allow Remote HTTP/3 Server Crashes and Memory Amplification
Security firm FoxIO disclosed vulnerabilities in HTTP/3 QPACK implementations that allow unauthenticated remote attackers to crash servers via denial-of-service attacks. These flaws enable memory amplification up to 4,000-fold by sending compressed HTTP headers that expand significantly upon unpacking, affecting multiple widely used HTTP/3 stacks.
GitLab Releases Critical Patch for Integer Overflow Vulnerability (CVE-2026-110264)
GitLab released critical patch versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for GitLab CE/EE on October 21, 2026. These updates address an integer overflow vulnerability (CVE-2026-110264) that could allow unauthenticated remote code execution, making immediate upgrades for self-managed instances critical.
Lawmakers Report Russian Efforts to Undermine Democrats Ahead of Midterms
Two senior Democratic lawmakers state that Russia is attempting to harm the Democratic Party and erode voter confidence before the upcoming midterm elections. A classified U.S. intelligence assessment indicates China, Iran, and North Korea are also engaging in influence efforts, though no country is attempting to interfere with election infrastructure or tamper with votes.
Cloudflare WAF Adds Full Transaction Detections and Response Rules
Cloudflare has introduced full transaction detections and response rules to its Web Application Firewall (WAF). These new features evaluate HTTP requests alongside their responses to identify exploitation attempts and block malicious responses before they reach the requester, addressing vulnerabilities like php2shell.
ClickFix Attacks Increasingly Target AI Tool Users, Becoming Dominant Phishing Method
ClickFix phishing attacks, which trick users into pasting malicious commands, now frequently use AI tools as lures, making up 52% of Push's detections in Q2 2026. This shift exploits new user habits like terminal installations and direct searches for AI applications, increasing the effectiveness and prevalence of these attacks.
China-Aligned Bronze Sandcastle Group Uses Sandboxie DLL Sideloading for Backdoors
Cybersecurity researchers identified Bronze Sandcastle, a China-aligned threat group active since mid-2025, which uses Sandboxie DLL sideloading to deploy backdoors. This technique exploits how Windows loads DLLs, allowing malicious code to run with the privileges of legitimate applications and evade detection.
Iran Threatens Undersea Internet Cables in Strait of Hormuz as "Legitimate New Targets"
Iran's Islamic Revolutionary Guard Corps (IRGC) has declared undersea fiber optic cables in the Strait of Hormuz as "legitimate new targets" in future conflicts. This threat comes amid ongoing regional tensions and could disrupt global internet and commercial data flow if acted upon.
State Bank of India Investigates Data Leak Affecting 3,897 Customer Records
State Bank of India (SBI) confirmed that 3,897 customer records containing personal information were found on the dark web, though the source and authenticity are still under investigation. The exposed data includes names, mobile numbers, dates of birth, and addresses, raising concerns about potential impersonation for affected customers.
PlayStation 5 Firmware 14.10.00 Reportedly Cracked, Allowing Kernel-Level Access
Developer "Gezine" demonstrated kernel-level access to the PlayStation 5's latest firmware (14.10.00) through a video showing hidden Debug Settings. This exploit is significant as the firmware update had previously closed a jailbreaking loophole and is reportedly required to play Grand Theft Auto VI.
Zeabur to shut down after second security breach exposes 3.2 million environment variables
Development platform Zeabur is shutting down after a second security breach in two months, where attackers used leaked plaintext credentials to access infrastructure and steal over 3.2 million environment variable records and 321,810 account details. This incident follows a previous breach in August, highlighting critical security failures including unencrypted credentials and unrotated administrator tokens.
iOS 27 introduces Impersonation Risk Detection for scam prevention
Apple's iOS 27 adds a new security feature called 'Impersonation Risk Detection' to help protect users from social engineering scams. This feature analyzes device and Apple Account information to detect signs of active scams and provides a risk level to supported apps, which can then take action like displaying warnings or requiring additional verification.
23andMe Successor Settles with California for $6 Million Over 2023 Data Breach
Chrome Holding Company, formerly 23andMe, agreed to pay California $6 million to resolve allegations of cybersecurity failings that led to a 2023 data breach affecting nearly 7 million people. This settlement, pending bankruptcy court approval, ensures affected consumers can delete their data and destroy genetic samples.
DHS Officials Falsely Claimed Child Abuse Material Search to Access Activist's Phone
Department of Homeland Security (DHS) officials told an activist they needed to search his phone for child abuse material, but internal records show he was targeted for suspected "terrorist activities." The activist, Samuel Tunick, wiped his GrapheneOS phone during the interrogation and now faces criminal charges for obstructing a federal investigation.
Go Emergency Update Blocks Eight CA Keys Due to Undisclosed Security Concerns
Go versions 1.27.3 and 1.26.10 were released to block eight intermediate certificate authority keys due to "specific security concerns around their operation." This update causes Go programs to reject connections to sites and services using certificates issued under these keys, impacting certificate validation for Go applications.
Hacked AfD Emails Reveal Widespread Racism and Antisemitism Within German Far-Right Party
A 281 GB archive containing 421,179 internal emails from Germany's far-right AfD party was published online. The emails show party supporters using racist slurs, sharing antisemitic theories, making jokes about refugees, and exchanging Nazi-era greetings and symbols.
Paradigm Healthcare Data Breach Affects Nearly 1 Million Medi-Cal Members
Paradigm Healthcare Services reported a data breach impacting over 970,000 Medi-Cal members, with unauthorized access occurring in October 2025. The compromised data includes names, dates of birth, gender, and Medi-Cal identification numbers, highlighting ongoing security challenges in healthcare data management.
Siemens Software Center Flaw Exploited in ClickFix Attacks to Deploy RAT
Siemens addressed a DLL sideloading vulnerability (CVE-2026-110936) in its Software Center, which attackers exploited in ClickFix campaigns to deploy remote access Trojans. Attackers used a signed Siemens application to load malicious DLLs, leading to arbitrary code execution.