Security · Top stories
Researcher develops method to fingerprint Counter-Strike players using mouse and keyboard input
A master's student developed a technique to identify unique Counter-Strike players by analyzing their mouse and keyboard input patterns. This method achieved high accuracy in identifying individual players and linking multiple accounts to a single user, even detecting previously unknown account connections.
Microsoft Teams to integrate third-party deepfake detection and impersonation protection
Microsoft Teams will add support for third-party deepfake detection tools and a new impersonation protection feature, with general availability expected in November. These updates allow organizations to use external solutions to analyze meeting media for synthetic content and provide users with warnings about suspicious identities, enhancing meeting security.
F-35 Parts Intercepted by China After UPS Employee Missed Routing Email
Sensitive F-35 fighter jet parts, including a cockpit canopy and weapons-bay door with stealth coatings, were intercepted by China after a UPS employee routed them through Hong Kong. The employee reportedly missed an email from DSV specifying ITAR regulations that prohibit transit through certain territories, including Hong Kong, opting for a faster route.
Taiwan Indicts 10 for Smuggling US Military-Grade Chips to China
Taiwanese prosecutors have indicted 10 individuals for allegedly smuggling military-grade chips from Texas Instruments and Analog Devices to China. The chips, intended for Chinese missile and radar programs, were reportedly exported using forged orders from Taiwan's defense research institute and falsely labeled as "Made in Taiwan." This incident raises concerns about national security and potential distrust from the U.S. regarding Taiwan's export controls.
Congress Considers Increased Mental Health Support for Cyber Command Personnel After Suicides
Congress is exploring new support mechanisms for U.S. Cyber Command personnel following a series of suicide deaths, aiming to address mental and emotional well-being amidst increased operational demands. This initiative highlights growing concerns about the psychological toll on military cyber operators as their missions expand in scope and intensity.
Former CIA Officer Pleads Guilty to $190M Fraud Scheme Involving Fake Top Secret Program
A former CIA officer, David J. Rush, pleaded guilty to wire fraud for stealing nearly $200 million, including gold bars, through a fabricated top secret government program. Rush used his position to create a fraudulent "special access program" and tricked a defense contractor into buying gold, which he then appropriated.
Meta deploys new AI tools to detect ads leading to child sexual abuse material
Meta has introduced new AI tools to identify ads and accounts that covertly direct users to child sexual abuse material, acting on 33.2 million pieces of such content in the first half of 2026. These tools include an LLM for "signposting" detection and a "red-teaming AI agent" to test system vulnerabilities. The updates address ongoing pressure on Meta regarding child safety on its platforms.
Microsoft Outlook to Block MSIX and MSIXBUNDLE Attachments Starting November
Microsoft will block .msix and .msixbundle attachments in Outlook Web and the new Outlook Windows client starting in November. This change is part of Microsoft's ongoing security efforts to prevent the abuse of file types in attacks.
Critical LMCache Flaw Allows Unauthenticated Remote Code Execution
A critical vulnerability in LMCache, an open-source tool for LLM servers, allows unauthenticated remote code execution due to insecure deserialization in its multiprocess mode. The flaw, tracked as CVE-2026-105192, affects versions 0.3.9 through 0.5.5 and has no available patch, posing a risk to LLM deployments configured with routable addresses.
Southern Company Reports Data Breach Affecting 400,000 Utility Customer Accounts
Southern Company announced that an unauthorized third party accessed account information for approximately 400,000 customers of its Georgia Power and Alabama Power subsidiaries through its online customer portal. The breach exposed names, mailing addresses, phone numbers, emails, or the last four digits of Social Security Numbers, and other basic account details, but not bank or payment card information.
Cyber Experts Urge CISA to Mandate Federal OT Cybersecurity Rules
The Operational Technology Cybersecurity Coalition (OTCC) has called on the Cybersecurity and Infrastructure Security Agency (CISA) to establish mandatory cybersecurity standards for operational technology (OT) used by federal agencies. This initiative follows recent cyberattacks on water systems and a government watchdog report indicating federal agencies are not adequately inventorying their OT devices, highlighting a gap in current voluntary guidance.
Android October 2026 Security Updates Patch 25 Vulnerabilities, Including 7 Critical Flaws
Google released Android security updates for October 2026, addressing 25 vulnerabilities across Framework and System components, including seven critical-severity bugs. These updates are significant as they resolve critical issues like local escalation of privilege that do not require user interaction for exploitation, impacting the security posture of Android devices.
Australian Privacy Regulator Investigates Chinese Company Behind Kmart Smartglasses App
Australia's privacy regulator launched an investigation into Shenzhen Qingcheng, the China-based software company behind the HeyCyan app used in Kmart's Anko smartglasses. This follows public concern over the glasses' covert recording capabilities and Shenzhen Qingcheng's failure to respond to inquiries, highlighting challenges in applying privacy law to surveillance wearables.
Psiphon VPN Provider Threatens to Leave Canada Over Lawful-Access Bill C-22
Psiphon, a Toronto-based VPN provider, plans to exit Canada if Bill C-22 passes in its current form. The company states the bill would compel it to compromise user privacy features for surveillance by Canadian police and intelligence services.
Phishing Platform Impersonates AI Chatbot Ad Portals to Steal Credentials and MFA Codes
Cybersecurity researchers uncovered a human-operated phishing platform that mimics advertising products for AI chatbots like ChatGPT, Gemini, and Claude. The platform uses browser-in-the-browser (BitB) attacks to capture user credentials and multi-factor authentication codes by displaying fake login windows.
DNS Root Key-Signing Key (KSK) Rollover Scheduled for October 2026
The DNS root's key-signing key (KSK) will undergo its second-ever rollover on October 11, 2026, impacting DNSSEC's chain of trust. DNSSEC-validating resolvers must trust the new key, KSK-2024, before the switch to prevent websites from becoming unreachable. Most website operators do not need to take action, but resolver operators should verify their systems trust the new key.
Meta's Public Time Service Now Supports Authenticated Network Time Security (NTS)
Meta has enabled Network Time Security (NTS, RFC 8915) on its public time service, nts.meta.com, to authenticate time packets and prevent modification. This update addresses the long-standing vulnerability of unauthenticated NTP, which is critical for certificate validation, token expiry, and log correlation across the internet.
Osaka Metropolitan University cancels classes after suspected ransomware attack
Osaka Metropolitan University canceled classes and shut down IT infrastructure due to a suspected ransomware attack. The incident affected academic, administrative, and library systems, potentially exposing data of 130,000 individuals.
LibreOffice and OpenOffice Flaws Allow Code Execution via Malicious Spreadsheets
Security researchers discovered vulnerabilities in LibreOffice and Apache OpenOffice that allow malicious spreadsheets to execute code without macro warnings when Java support is enabled. LibreOffice has patched its flaw (CVE-2026-63277) in recent updates, while Apache OpenOffice (CVE-2026-59265) remains vulnerable, with a fix expected in version 4.1.17. This impacts users of both office suites, particularly those who open untrusted documents with Java enabled.
Cybersecurity Sector Sees 39 M&A Deals in September 2026, Including Key Acquisitions by IBM and Palo Alto Networks
The cybersecurity industry recorded 39 merger and acquisition deals in September 2026, with notable transactions including IBM acquiring Logiq Consulting and Palo Alto Networks purchasing Console. These acquisitions reflect a continued trend of consolidation and expansion in cybersecurity, particularly in areas like OT security, AI data security, and exposure management.
IQVIA fined $7.8 million by Italian DPA for inadequate health data anonymization
Italy's Data Protection Authority (GPDP) fined IQVIA €7 million ($7.8M) for failing to properly anonymize health data, potentially exposing one million patients to re-identification. The company's practices violated GDPR by allowing patient tracking, lacking a legal basis for processing, and not adhering to data retention periods.
Ukraine's ATB grocery chain confirms cyberattack, hackers threaten data leak
Ukraine's largest grocery chain, ATB, confirmed a cyberattack after the DataSuckers group posted an extortion demand. The hackers claim to have stolen data from millions of customers, while ATB denies customer data compromise.
University of Illinois Chicago Medical School Hit by Booba Ransomware Attack
The University of Illinois Chicago (UIC) College of Medicine experienced a ransomware attack by the Booba gang, resulting in temporary system unavailability and potential data theft. The university is investigating the extent of compromised personal, research, or academic information and plans to notify affected individuals.
ClingSTUN Linux Backdoor Exploits Dozens of Flaws and Uses STUN Protocol for Proxies
FortiGuard Labs discovered ClingSTUN, a Linux backdoor that transforms infected systems into proxies using the Session Traversal Utilities for NAT (STUN) protocol. The malware exploits dozens of vulnerabilities for initial access and includes a self-propagation mechanism, posing a threat to various network devices and Linux systems.
Clover Health and AngMar Management Report Data Breaches Affecting Over 250,000 Individuals
Clover Health Investments and AngMar Management Services reported separate data breaches impacting over 250,000 individuals. Clover Health experienced a social engineering attack, while AngMar Management Services was targeted by the Interlock ransomware group, resulting in the theft of personal and protected health information.
Senate Passes Bipartisan Health Care Cybersecurity and Resilience Act
The US Senate passed the Health Care Cybersecurity and Resilience Act, a bipartisan bill aimed at strengthening cybersecurity in the healthcare sector. This legislation seeks to help healthcare institutions protect patient data and reduce successful cyberattacks, which have significantly impacted millions of Americans and caused substantial costs.
Anthropic AI Chatbot Conversation Leads to Felony Arrest in Florida
A Florida woman was arrested on a felony charge after Anthropic's human review team reported a threatening AI chatbot conversation to law enforcement. The woman allegedly stated intentions to "shoot up" the Lee County Sheriff's Office in a Claude AI chat, leading to her arrest under a mass shooting threat statute. This incident highlights AI companies' protocols for reporting potential threats detected in user interactions.
Xray-core concealed certificate verification bypass vulnerability for six months
Xray-core, a popular proxy software, concealed a certificate verification bypass vulnerability in its `pinnedPeerCertSha256` option for six months. This vulnerability allowed man-in-the-middle attacks, particularly affecting users who relied on the feature for secure use of self-signed certificates.
AndroidX Security State Libraries Enable Component-Level Security Verification
Google released AndroidX Security State libraries, allowing apps to verify security patch status at the individual component level on Android devices. This provides more granular security assessment and enables developers to identify and prompt for specific missing patches.
China-Aligned TA419 Group Targets U.S. AI Policy Experts with Microsoft AitM Phishing
A China-nexus cyber espionage group, TA419, is conducting credential phishing campaigns against U.S. AI policy experts in think tanks, universities, and legal organizations. The attacks use sophisticated adversary-in-the-middle (AitM) techniques to gather intelligence on U.S. AI policy and regulatory developments. This activity indicates ongoing strategic competition and intelligence gathering efforts related to AI between the U.S. and China.
ICE Reportedly Uses Palantir Database to Compile Dossiers on Protestors
Unsealed court documents allege that the Department of Homeland Security (DHS) is using a Palantir-built database, Investigative Case Management, to create dossiers on individuals observing or protesting Immigration and Customs Enforcement (ICE) agents. This practice is part of a class-action lawsuit, with attorneys arguing it infringes on First Amendment rights by creating a chilling effect on protestors.
MI5 Warns 100+ UK Academics Aided Chinese Intelligence Research
MI5 issued an alert stating that China's Ministry of State Security (MSS) funded research involving over 100 UK-linked academics through a front company, CGTRI. This activity supports MSS espionage and poses a threat to UK national security, prompting warnings about potential prosecution under the National Security Act 2023.
DTU data breach exposes personal information of up to 200,000 users
The Technical University of Denmark (DTU) experienced a data breach where hackers accessed its identity and access management system, potentially exposing data for up to 200,000 current and former users. The compromised data includes Danish civil registration numbers (CPR), names, addresses, and next of kin information, which could be used for identity fraud and phishing attacks.
Used CPUs can carry anti-cheat bans, impacting new owners and system components
A gamer purchased a used CPU that carried a Valorant anti-cheat ban from its previous owner, resulting in the new owner's system being blacklisted by the game's anti-cheat engine. This incident highlights a broader issue where hardware ID (HWID) bans, used by various anti-cheat systems, can transfer with used components, potentially affecting innocent buyers and their other system parts.
California Judge Dismisses Spyware Lawsuit by Salvadoran Journalists Against NSO Group
A California federal judge dismissed a lawsuit brought by Salvadoran journalists from El Faro against NSO Group, whose Pegasus spyware infected their devices. The court ruled it lacked jurisdiction in California, marking a setback for the plaintiffs who sought to compel NSO to delete collected data and identify the client behind the surveillance.
Frontline Education Data Breach Exposes School District Employee Information
Frontline Education, an edtech company, experienced a data breach due to a vulnerability in third-party software, leading to unauthorized access and theft of school district employee data. The exposed information includes Social Security numbers, email addresses, and physical addresses, impacting numerous school district employees.
Georgia addresses AI vulnerability exposing secret ballots after researcher's test
Georgia election officials held an emergency meeting after a researcher demonstrated that AI could be used to identify voters' secret ballots using public election records. The state's Secretary of State has since ordered redaction of ID numbers from publicly released tabulation data to address this vulnerability.
Vicksburg, Mississippi Shuts Down City Systems Following Ransomware Attack
The city of Vicksburg, Mississippi, shut down its computer systems due to a ransomware attack, impacting utility payments but not emergency services. The city is investigating potential data compromise and working with federal agencies and cybersecurity experts on recovery.
Cloudflare launches new fraud dashboard for Account Abuse Protection
Cloudflare introduced a new fraud dashboard for its Account Abuse Protection (AAP) service, initially for Early Access customers. This dashboard helps website owners detect and investigate account abuse by providing stateful overviews of login and signup activity, moving beyond traditional point-in-time identity checks.
Android 17 Advanced Protection Limits Accessibility Services to Verified Tools
Google will restrict Android's accessibility services to verified Accessibility Tools applications when Advanced Protection is enabled in Android 17. This change aims to block a major attack pathway exploited by malicious applications for financial fraud and data theft.