Security · Top stories
Go to Reject Certificate Chains with Eight Distrusted SPKIs from eMudhra
The Go crypto/x509 package will implement a mitigation to reject certificate chains containing eight specific Subject Public Key Info (SPKI) hashes from the eMudhra Certificate Authority. These certificates were revoked due to a CA compromise on October 18-19, as recorded in CCADB, necessitating this update to enhance security.
Edited Open Models Can Carry Backdoors, Researchers Demonstrate Credential Exfiltration
Researchers demonstrated that open models with edited weights, including abliterated builds, can contain hidden backdoors capable of exfiltrating data. They built a backdoored 7B model and successfully used it to exfiltrate project credentials via OpenAI's Codex CLI when a specific trigger phrase was used, highlighting a significant supply chain risk for AI systems.
Judge denies WhatsApp's contempt bid against NSO Group over alleged spyware targeting
A Northern California federal judge denied WhatsApp's request to hold NSO Group in contempt for allegedly targeting users with spyware after a 2020 injunction. The court ruled WhatsApp did not provide sufficient evidence to prove NSO Group violated the injunction, despite previous findings that NSO abused WhatsApp's infrastructure.
Bullhorn Staffing Platform Taken Offline Following Cyberattack
Staffing software provider Bullhorn disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company is working with CrowdStrike to restore services and investigate if customer data was exfiltrated, impacting over 10,000 customers globally.
Florida DMV data breach impacts driver's license and vehicle records
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a data breach on September 4, 2026, where a malicious actor accessed driver's license and motor vehicle data using compromised credentials. The department is notifying affected individuals and offering credit monitoring, but many former residents may not receive alerts.
Florida Police Report AI Voice Cloning Used in Sheriff Impersonation Scam
A Florida police department reported that scammers used AI to clone a sheriff's voice in a voicemail scam targeting a resident. This incident highlights the increasing use of AI voice cloning in scams, which are spreading across multiple states and have previously resulted in significant financial losses.
Let's Encrypt Adds Two Remote Perspectives for Domain Validation
Let's Encrypt is increasing its remote perspectives for domain validation from four to six, totaling seven validation requests. This change enhances security against BGP attacks and complies with Baseline Requirements for Multi-Perspective Issuance Corroboration.
Unpatched Broadcom Wi-Fi Flaw Allows Remote Code Execution on Routers
A security researcher disclosed an unpatched flaw in Broadcom's Wi-Fi Protected Setup (WPS) software that allows attackers within radio range to execute code as root on affected routers without authentication. The vulnerability, which affects millions of devices, stems from mishandling fragmented WPS messages, enabling memory corruption and remote code execution.
OpenCode Console Breach Exposed OpenAI, Anthropic, and Google API Keys
OpenCode reported a breach of its Console service on October 16, potentially exposing third-party AI provider keys for 1.4% of its Console users. Affected users have been advised to revoke and replace their OpenAI, Anthropic, and Google API keys, as some users have already reported unauthorized usage and associated costs.
AI tools used by criminals to create fake retail websites, deepfakes, and phishing attacks
National Trading Standards has issued a warning about criminals using AI to create sophisticated scams, including fake retail websites, deepfake videos, and personalized phishing emails. This development means traditional scam-avoidance techniques, such as looking for typos, are becoming less effective, requiring consumers to adopt new protective measures.
Savannah Police Officer Fired for Sharing Flock Camera System Login with ICE Agent Husband
A Savannah police officer was fired for sharing her Flock camera system login credentials with her husband, an ICE agent, violating departmental security protocols. The unauthorized access led to 983 searches, predominantly targeting vehicles registered to Hispanic drivers, raising concerns about data misuse and privacy.
US Cybersecurity Job Postings Decline 26% While AI Security Engineer Demand Soars
US cybersecurity job postings fell by 26.4% to a four-year low of 235,786 between January and September 2026 compared to the same period in 2025. Despite the overall decline, demand for AI Security Engineers increased by 268.3% and Cyber Data Scientists by 203.5%.
MEP Calls for EU Action Against Nude Deepfakes After Personal Experience
Austrian MEP Lena Schilling revealed she was targeted by nude deepfakes and urged the EU to enforce a ban on AI-generated sexual content. A report found that one in six female MEPs have been subjected to sexualized AI-generated content, highlighting a systemic threat to women in European politics.
Former Foreign Office Head Warns UK Ministers Must Address Immediate Russian Threat
Peter Ricketts, former national security adviser and Foreign Office head, stated that UK ministers must be transparent with the public about the immediate threat from Russian hybrid attacks. He warned that these attacks, targeting banking, energy, or water supplies, could lead to fatalities and called for increased investment in critical sector resilience. This follows similar warnings from MI5 and the British army regarding Moscow's aggression.
Eufy HomeBase 2 Firmware 3.4.2.2h Analyzed, WiFi Credential Generation and UART Lockdown Bypassed
Security researchers analyzed the Eufy HomeBase 2 firmware version 3.4.2.2h, identifying the WiFi credential generation algorithm and bypassing UART lockdown. This research provides insight into the security mechanisms of the Eufy HomeBase 2.
New Jersey Deputy Attorney General Arrested for AI-Generated Child Sexual Abuse Material
New Jersey Deputy Attorney General Brian Richard Fitzgerald was arrested on felony charges related to AI-generated child sexual abuse material (CSAM). Fitzgerald allegedly used AI to create sexualized images of minors from social media photos and distributed them online, marking a significant enforcement action against AI CSAM.
DNI Clayton warns of foreign espionage in AI race after OpenAI incident
Director of National Intelligence Jay Clayton stated that foreign espionage, both commercial and state-sponsored, is a significant threat to U.S. leadership in AI, citing the recent case of a Saudi national allegedly bugging an OpenAI executive conference room. This incident highlights the need for U.S. companies and the government to be vigilant against attempts to undermine American AI dominance. Clayton leads a new White House AI task force focused on hardening systems and maintaining U.S. leadership.
Gun-rights activist unveils 'AI-made' 3D-printed firearm, the WASP, designed by 'GatGPT'
Cody Wilson, known for 3D-printed firearms, introduced the WASP, a .22 caliber handgun reportedly designed by an AI model named 'GatGPT'. This development could lower the technical barrier for creating untraceable 3D-printed firearms, impacting gun regulation efforts.
Fake WhatsApp Clone with 500,000+ Downloads Appears on Google Play Store
A fake WhatsApp application, appearing as a sponsored result, was found on the Google Play Store above the legitimate version, accumulating over 500,000 downloads. This incident highlights a vulnerability in Google Play's app review and advertisement system, allowing malicious applications to gain significant traction.
Court Records Detail Telegram's Data Sharing with US Authorities
Newly filed court records reveal Telegram's process for providing user data, including phone numbers, user IDs, and IP addresses, to U.S. authorities. This disclosure clarifies the extent and nature of data Telegram shares when compelled by legal requests.
Police Use AI-Generated Child Images to Apprehend Suspected Predator
Police arrested a high school maintenance worker after using AI-generated images of a child to lure him on a dating app. This case demonstrates law enforcement's use of AI tools in investigations to identify and apprehend suspects in child exploitation cases.
Moscow Police Detain Suspected DataSuckers Hackers After Dodo Pizza Breach
Russian authorities detained three suspected members of the DataSuckers hacking group following a cyberattack on Dodo Pizza that exposed customer data. The group is financially motivated and has claimed responsibility for other breaches in Russia and Ukraine.
Anne Arundel County confirms August data breach after Rhysida ransomware claim
Anne Arundel County, Maryland, confirmed that hackers stole files from government systems during an incident in August. The Rhysida ransomware group claimed responsibility, threatening to leak 2.6 terabytes of data if a $2 million ransom was not paid, marking a second security incident for the county within a year.
Cloudflare Introduces Continuous Accountability System for Verified Bots
Cloudflare launched a new system to continuously evaluate and report on the behavior of Verified Bots. This system assesses whether bots adhere to stated intentions and avoid abusive actions, ensuring ongoing trustworthiness beyond initial identity verification. It aims to maintain trust by monitoring compliance with website preferences and direct feedback.
Burger King Japan discloses data breach impacting 11 million customer records
Burger King Japan experienced a data breach exposing 11.18 million customer records from its official smartphone app. The compromised data includes names, dates of birth, gender, email addresses, phone numbers, and order history, but not credit card numbers or user credentials.
Microsoft, Marvell, Oracle, and OCP Open-Source Project Tessera for Hardware Security
Microsoft, in collaboration with Marvell, Oracle, and the Open Compute Project (OCP), announced Project Tessera, an open-source initiative evolving the Azure Integrated Hardware Security Module (HSM) technology. This project aims to standardize and advance hardware security by making the HSM architecture, specifications, and software openly available, with future plans for open-source silicon implementation.
Thai Police Discover Cross-Border Fiber Optic Cable Supplying Myanmar Scam Compound
Thai authorities uncovered a 350-meter, 48-core fiber optic cable illegally crossing into Myanmar, supplying 6 terabytes of data daily to an online scam compound and illegal casino. This incident highlights the growing issue of cyber scam operations based in Myanmar, often protected by local militias.
Childline and NSPCC report increased online grooming on Snapchat, TikTok, and Instagram
Childline and NSPCC data indicate a rise in online sexual abuse and grooming cases involving children on platforms like Snapchat, TikTok, and Instagram. Experts and law enforcement warn that grooming is becoming quicker and easier, with children as young as five being targeted, leading to calls for increased parental awareness and intervention.
RPKI Adoption Reaches 70% of Internet Routes, Improving Routing Security
The percentage of internet routes protected by RPKI (Resource Public Key Infrastructure) increased from 54.0% to 70.3% between September 2025 and September 2026. This significant rise, largely driven by China's adoption, indicates that RPKI is effectively preventing BGP hijacking by allowing network operators to reject invalid route announcements.
Proxyjacking Campaign Hijacks D-Link, Ubiquiti Devices to Resell Bandwidth
A proxyjacking campaign is installing the Pawns.app bandwidth-sharing application on D-Link and Ubiquiti devices in 34 countries without owner consent, monetizing victims' internet connections. The attackers exploit known vulnerabilities to breach edge devices and resell stolen bandwidth through a commercial residential proxy network. This activity can lead to IP address blocks or accusations of illegal involvement for affected users.
Malicious Packages Impersonating yay and paru Found in Arch User Repository
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated popular helper tools, yay and paru, executing a remote shell script with root privileges. This incident follows previous attacks on AUR, highlighting ongoing security vulnerabilities in community-maintained package indexes.
Cloudflare Gateway and DLP integrate with edge computing for programmable security
Cloudflare has integrated its Gateway and Data Loss Prevention (DLP) services with its edge computing platform, introducing new 'Forward' actions and custom validation functions. This allows users to run custom code via Cloudflare Workers for traffic manipulation and policy evaluation, addressing limitations of traditional secure web gateways.
Help TDS Linked to Hotejka Affiliate Program, Over 20,000 Cloudflare Pages Domains Host Tech Support Scams
A traffic distribution system (TDS) named Help TDS, active since 2017, is now linked to the Russian-language affiliate program Hotejka, which is suspected to be a rebrand of ROI777. This operation uses compromised websites, including over 20,000 Cloudflare Pages domains, to redirect users to tech support scams that trick victims into installing remote desktop tools.
Kazakhstan-linked hackers target former Soviet governments for diplomatic and economic data
A cyber-espionage group, UAT-6275/TAG-193, suspected of ties to Kazakhstan, has targeted government agencies in nine former Soviet states since January 2025. The group seeks information on diplomatic affairs, economic policy, and strategic resources, with activity coinciding with diplomatic events.
NGINX Patches Five Vulnerabilities, Including Potential RCE and TLS Client-Cert Bypass
NGINX released versions 1.30.6 and 1.31.7 to address five vulnerabilities, including three memory bugs that could lead to crashes or remote code execution, a TLS flaw that might bypass client-certificate checks, and an HTTP/3 request smuggling issue. These flaws require specific NGINX configurations to be exploitable, and none are currently known to be exploited in the wild.
Next.js Releases Out-of-Band Patch for Critical RCE and DoS Vulnerabilities
Next.js released an out-of-band security update addressing two critical unauthenticated remote code execution (RCE) flaws and a high-severity denial-of-service (DoS) vulnerability. These fixes are crucial for users running Next.js 16 and 15 LTS releases to prevent potential server compromise and service disruption.
INTERPOL-coordinated operation arrests 95 suspects in international CSAM crackdown
Law enforcement from 17 countries arrested 95 suspects in an INTERPOL-coordinated operation targeting child sexual abuse material (CSAM) distribution through online messaging groups. The operation, named International Effort Confluencia, involved 127 search warrants and rescued one child victim, highlighting ongoing efforts against online child exploitation.
CikaBika Bot RAT uses Discord for Command-and-Control
Darktrace discovered CikaBika Bot, a new Rust-based Remote Access Trojan (RAT) that utilizes Discord for command-and-control (C&C) communications. The malware, distributed via phishing with document lures, enables reconnaissance, remote execution, and data exfiltration on compromised systems.
CenterPoint Energy Data Breach Exposes Personal Data of Over 1 Million Texans
CenterPoint Energy reported a data breach affecting over 1 million Texans, including names, addresses, Social Security numbers, and driver's license numbers. The utility confirmed the breach after a hacker posted about stolen data on a cybercrime forum, but has not yet sent notifications to affected individuals.
Flock CEO States Microphones Detect Only Gunshots, Website Indicates Broader Audio Detection
Flock CEO Garrett Langley stated that the company's Gunshot Detection microphones only detect gunshots, contradicting information on Flock's website which indicates the systems also detect car crashes, fireworks, and 'sideshows.' This discrepancy highlights ongoing concerns about the scope of audio surveillance by Flock, a company facing increasing public scrutiny over its data collection practices.