Security · Top stories
Critical Vulnerability in Progress Kemp LoadMaster Enables Root Command Execution
A critical vulnerability (CVE-2026-8037) in Progress Kemp LoadMaster permits unauthenticated root command execution via API requests. Patches are released to mitigate the CVSS 9.8 flaw. Reports indicate active exploitation attempts, causing security concerns among users.
AI-Generated Ransomware Discovered Exploiting Chromium API on Windows and Android
A new ransomware artifact created by the AI model DeepSeek combines theoretical attacks with real browser functionality, enabling browser-based ransomware on Windows and Android. This marks the first identified practical attack chain of its kind, indicating a significant shift in the cybersecurity threat landscape.
Critical Flaw CVE-2026-46817 in Oracle E-Business Suite Exploited
A critical vulnerability in Oracle E-Business Suite, CVE-2026-46817, is now being actively exploited. Impacting versions 12.2.3 to 12.2.15, the flaw allows unauthenticated attackers to take control of Oracle Payments, necessitating immediate patching for affected instances.
Mustang Panda Exploits Zoho WorkDrive in Campaign Against Indian Government
The Mustang Panda group has launched campaigns targeting the Indian government, utilizing Zoho WorkDrive to transmit commands and steal data. This approach leverages legitimate service traffic to mask malicious activities and is part of broader espionage efforts aimed at India's hydropower initiatives and defense relations with Taiwan.
Microsoft Removes 119 Malicious Edge Extensions Involved in Malware Operation
Microsoft has removed 119 Edge extensions from its Add-ons store that concealed malware within images and fonts, compromising user credentials and facilitating ad fraud. The extensions, installed by up to 2.6 million users, utilized steganography to hide malicious code, operating undetected for years.
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
A public proof-of-concept has been released for CVE-2026-55200, a critical flaw in libssh2 that may allow memory corruption and code execution for connected clients. This vulnerability affects all versions up to 1.11.1, posing significant risks as libssh2 is widely used in various applications and systems.
Hijacked npm and Go Packages Deploy Python Infostealer via VS Code Tasks
Cybersecurity researchers have identified hijacked npm and Go packages that deploy a Python-based infostealer on compromised systems. This method utilizes a concealed VS Code task to execute malware upon opening a project folder, facilitating data theft and persistent access.
Tesla Settles FSD Crash Lawsuit Amid Ongoing Federal Investigation
Tesla has settled a lawsuit concerning a fatal crash involving its Full Self-Driving (FSD) system while federal investigations into the system's safety continue. The National Highway Traffic Safety Administration is examining if FSD can adequately handle low visibility conditions, after several incidents, potentially affecting future Tesla recalls or regulations.
Anonymous GitHub user releases unpublished zero-days for major software
An anonymous GitHub account has begun releasing previously undisclosed zero-day vulnerabilities in popular software, including Floci and FFmpeg. The account claims to utilize an AI-driven fuzzing workflow and intends to share serious vulnerabilities, impacting software security practices.
Russian hackers identified as responsible for $2.5B Jaguar Land Rover breach
A cyberattack on Jaguar Land Rover (JLR) last year has been traced to Russian hackers. The breach caused production delays and significant economic losses, prompting a £1.5 billion government bailout.
Linux pedit COW Exploit Allows Root Access via Cached Binary Poisoning
A critical flaw in the Linux kernel's traffic-control subsystem allows unprivileged users to gain root access on vulnerable systems. The exploit targets the memory cache of setuid binaries, enabling attackers to inject and execute malicious code while bypassing file integrity checks.
CISA Warns of Exploited Flaws in Lantronix EDS5000 and PTC Windchill
The CISA has issued alerts concerning the exploitation of critical vulnerabilities in Lantronix EDS5000 and PTC Windchill systems. The Lantronix flaw allows code execution with escalated privileges, while the Windchill vulnerability enables remote code execution. Both alerts urge immediate patching to mitigate risks posed by these active threats.
Miasma Malware Compromises npm Packages and GitHub Actions
Researchers identified a supply chain attack involving Miasma malware targeting multiple npm packages and GitHub Actions. The attack compromises developer credentials to propagate malware across various software ecosystems, posing significant security risks.
Popular Chrome Ad Blocker Can Execute Arbitrary JavaScript Code
The Chrome ad blocker 'Adblock for YouTube,' with over 10 million installs, has been found to contain functionality for executing arbitrary JavaScript code remotely. This could potentially allow for significant privacy risks, including data theft, although no malicious activity has been reported to date.
New Mistic Backdoor Discovered Linked to KongTuke in Cyber Attack Campaigns
A new backdoor named Mistic has emerged in attacks directed at various sectors, linked to the KongTuke group. The stealthy malware is designed for long-term access, employing sophisticated evasion techniques such as memory-based execution and DLL side-loading, marking a significant threat to targeted organizations.
Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited for Root Access
A zero-day vulnerability in Cisco Catalyst SD-WAN, tracked as CVE-2026-20245, has been exploited to gain root access by an unknown threat actor. This flaw, identified by Mandiant, allows an authenticated attacker to execute commands by manipulating user input, raising serious security concerns for affected systems.
Law Enforcement Disrupts Amadey and StealC Malware Networks, Reclaims 27M Credentials
A law enforcement operation disrupted the Amadey and StealC malware networks, recovering 27 million stolen credentials and restricting over $47 million in criminal cryptocurrency assets. This takedown involved 326 servers and 142 domains and highlights the effectiveness of public and private sector collaboration in combating cybercrime.
Emergence of AI Threat Models Marks a New Era in Cybersecurity
The rise of frontier agentic AI models has drastically reduced the time from threat discovery to execution in cybersecurity. This shift poses a significant risk as AI can exploit vulnerabilities faster than human defenders can respond.
SonicWall Warns of Unpatched Vulnerabilities in End-of-Life GMS Software
SonicWall has issued a warning regarding two unpatched security flaws, CVE-2026-109593 and CVE-2026-109594, affecting its end-of-life Global Management System (GMS) software, specifically versions 9.5.2 and earlier. The company will not release patches for these vulnerabilities due to the product's end-of-life status and urges customers to migrate to the Network Security Manager (NSM) platform.
mSecure Password Manager Advises Users to Change Passwords After Suspicious Activity
mSecure password manager has notified customers of suspicious activity linked to its app, urging them to change stored passwords, reset two-factor authentication, and remove passkeys. The company has not disclosed details about the incident, including whether user data was exposed or the nature of the suspicious activity.
British Soldier Court-Martialed for Disobeying SIM Card Removal Order, Hacked
A British soldier was court-martialed and sentenced to 10 months detention after disobeying an order to remove his phone's SIM card during deployment to Estonia. His phone was subsequently hacked, and personal photos were stolen and used for blackmail. This incident highlights the consequences of neglecting operational security protocols.
Russia dismantles VasyGrek cybercrime group, detains three suspects
Russian authorities arrested three suspected members of the VasyGrek cybercrime group and dismantled its infrastructure. The group, active since 2016, primarily targeted Russian companies with phishing attacks to steal credentials and deploy malware. This action marks a rare public crackdown on a Russian-speaking hacking operation within Russia.
Google Warns of LLMjacking Attacks Causing Up to $1 Million in Cloud AI Charges
Google's Threat Intelligence Group and Mandiant have issued a warning about "LLMjacking" attacks, where threat actors hijack enterprise access to Large Language Models (LLMs) to fraudulently consume expensive computing resources. These attacks exploit stolen API keys or misconfigured environments, leading to rapid, significant cloud charges, with some organizations incurring up to $1 million in costs before detection. Attackers resell access through "LLM mixers," causing victims to be charged for unauthorized AI usage.
German Lawmakers' iPhones Potentially Hacked with Spyware, Apple Issues Warnings
The German government has warned politicians and public figures about potential spyware attacks on their iPhones, following threat notifications from Apple. Germany's BSI advised recipients to assume their devices might be compromised, though Apple does not attribute attacks or confirm successful breaches. This incident highlights the ongoing use of government-backed spyware, often acquired from private vendors, targeting civil society members across multiple countries.
Chinese Research Vessels Spend More Time Near Pacific Undersea Cables Than Other Nations
A report by the Center for Strategic and International Studies found that Chinese research vessels spend a disproportionately large amount of time near critical undersea infrastructure in the Pacific Ocean. This activity suggests China may be collecting underwater data for potential sabotage or submarine operations, raising concerns about national security and territorial disputes.
GitHub Actions Lockfiles Reach General Availability to Secure Workflow Dependencies
GitHub Actions lockfiles are now generally available, allowing workflows to pin direct and transitive dependencies to specific commit SHAs. This feature addresses a security weakness where mutable references like tags or branch names could be altered, potentially introducing malicious code into pipelines. The lockfiles ensure that the runner executes the exact commits recorded, enhancing supply chain security for GitHub Actions workflows.
CERT-In Warns of Hardcoded Credentials and Vulnerabilities in Tata Motors App
The Indian Computer Emergency Response Team (CERT-In) issued an alert regarding multiple vulnerabilities, including hardcoded credentials, in the Tata Motors app. These flaws could allow unauthorized access and information disclosure, posing risks to user data and system integrity.
Edera Launches Object Capability Bounded Authority to Isolate AI Agent Credentials
Edera introduced Object Capability Bounded Authority, a security model designed to isolate autonomous AI workloads and Model Context Protocol (MCP) servers from sensitive credentials. This technology enforces granular object capabilities at the hypervisor level, preventing AI agents from directly accessing API tokens, cloud keys, and administrative credentials, thereby mitigating risks from prompt injection and supply chain attacks.
Backdoor Found in Control Web Panel Server Allows Undetected Command Execution
Security researchers discovered a backdoor, named cwpdoor, hidden within the web server component of Control Web Panel (CWP), a Linux hosting management tool. This backdoor allows attackers to execute commands via web requests without leaving traces in access logs, indicating active exploitation in the wild.
Mark Cuban Accuses Meta of Profiting from AI Deepfake Scam Ads
Mark Cuban claims Meta knowingly runs AI deepfake ads featuring his likeness promoting a fake diabetes cure, despite receiving complaints from victims. Internal Meta documents reportedly show the company anticipates billions in revenue from scam and prohibited product ads, with its platforms contributing to a third of successful U.S. scams.
Claude Code Reportedly Exposes User Email Addresses in User-Agent Headers During Web Searches
A user reported that Claude Code is divulging their email address to third-party websites via the User-Agent request header during web searches without explicit permission. This privacy violation has led to an increase in scam emails for the user, prompting them to migrate their company's services.
UK Critical Infrastructure Faces AI-Powered Cyberattack Threat by 2028, NCSC Warns
The UK's National Cyber Security Centre (NCSC) predicts that AI-powered malware will likely be used in ransomware attacks against the nation's critical infrastructure by 2028. This assessment, detailed in the NCSC's annual review, highlights the potential for AI to enable attackers to identify targets and exploit vulnerabilities at an unprecedented scale. The NCSC also expects Russia and China to routinely use AI in cyber-attacks.
BTCPay Server warns users of hot wallet crypto thefts on outdated instances
BTCPay Server, an open-source cryptocurrency payment processor, has warned users about hot wallet crypto thefts affecting instances running versions 2.4.1 or older. The project identified an attack vector allowing unauthorized access and urged all users to update to version 2.4.7 immediately. The attacks led to Bitcoin and Litecoin being drained from hot wallets, prompting an investigation into how attackers gained administrator access.
Apple Warns Users in 99 Countries of Mercenary Spyware Attacks
Apple issued threat notifications to users in 99 countries, warning them of suspected mercenary spyware attacks. This marks a new round of alerts, with targets including a Turkey-based reporter and a Lebanese documentary filmmaker who have publicly shared their notifications.
Russian Statistics Agency Confirms Cyberattack; Hackers Claim 23TB Data Theft
The Russian Federal State Statistics Service (Rosstat) confirmed cyberattacks occurred between October 29 and 31. Belarusian CyberPartisans and Silent Crow hacker groups claimed responsibility, stating they stole 23TB of data, including "for official use only" war casualty figures. Rosstat denied data exfiltration and database compromise, while the hackers suggested up to 50,000 Russian soldiers are killed monthly based on the alleged data.
Florida financial aid site breach exposes 4.9 million Social Security numbers
Florida's Department of Education (FLDOE) reported a data breach on its Student Financial Aid website, exposing Social Security numbers and other personal information for 4.9 million individuals. The department has taken the site offline and is investigating the incident, advising affected individuals to monitor their credit.
Microsoft October Windows Update Breaks Smart App Control for Some Users
Microsoft's October KB5127648 security update for Windows 11 prevents some users from enabling Smart App Control, a feature that blocks potentially harmful applications. Devices with Smart App Control already active are unaffected, but newly affected devices cannot toggle the feature on, leaving them without this protection.
Revolve reports payment card data breach affecting customers who saved information
Online fashion retailer Revolve disclosed that hackers accessed payment card numbers and expiration dates from customers who saved their information on the company's e-commerce platform. The incident, reported to the SEC, affected at least 127,200 individuals in Texas and 1,328 in Vermont, with notifications also filed in Massachusetts.
DOJ Charges Five in Student Loan Fraud Scheme Using AI and Stolen Identities
The US Department of Justice has charged five individuals in a large-scale student loan fraud scheme that used AI and stolen identities to create "ghost students." This operation involved stealing millions in federal student aid by enrolling fake students and diverting leftover funds, leading to the seizure of over $750,000 in cryptocurrency.
Cloudflare Q3 2026 DDoS Report: Short-burst attacks surge, hyper-volumetric attacks decline
Cloudflare's Q3 2026 DDoS Threat Report indicates a 208% increase in short-burst, low-bandwidth attacks, while hyper-volumetric attacks over 1 Tbps decreased by 69%. Attackers shifted from CLDAP floods to DNS amplification and general UDP floods, which rose by 215% and 122% respectively. The United States became the most-attacked country, and targets broadened beyond media organizations to include consumer services, internet infrastructure, and adult entertainment.