Security · Top stories
Apple Issues New Spyware Threat Notifications to Users in 110 Countries
Apple has sent out a new round of threat notifications to users in 110 countries, warning them of potential mercenary spyware attacks on their iPhones, iPads, or Macs. These notifications, which now appear directly on the iPhone lock screen, advise users on steps to protect their data and devices, including enabling Lockdown Mode. This marks an update to Apple's ongoing effort to alert specific individuals, such as journalists, activists, and diplomats, who are often targets of such sophisticated attacks.
Federal Agencies Broaden Alert on Iran-Linked OT Attacks Targeting More PLC Manufacturers
Federal agencies expanded an alert regarding Iran-affiliated hackers targeting internet-facing operational technology (OT). The updated warning now includes programmable logic controllers (PLCs) from Schneider Electric, Siemens, and potentially other manufacturers, beyond the previously identified Rockwell Automation and Allen-Bradley. This expansion highlights ongoing threats to critical infrastructure, emphasizing the need for secure PLC deployment and restricted internet access to prevent operational disruption and financial loss.
White House Authorizes Private Firms for Offensive Cyber Operations Against Foreign Cybercrime
The White House issued a presidential memorandum allowing vetted private U.S. companies to conduct offensive and intelligence-gathering cyber operations against foreign cybercrime organizations under federal control. This program, managed by the National Coordination Center, aims to counter transnational cyber threats and combat cybercrime, fraud, and predatory schemes by integrating private sector expertise into national security efforts.
AWS Continuum Integrates AI-Powered Penetration Testing into CI/CD Pipelines
AWS Continuum, formerly AWS Security Agent, now provides AI-driven penetration testing that integrates directly into CI/CD pipelines. This service automatically scopes tests to recent code changes, allowing for penetration testing on every deployment and blocking promotion to production based on severity thresholds.
Multiple Healthcare Data Breaches Impact Over 30 Million Individuals
Several healthcare organizations, including DentaQuest, Unlimited Technology Systems, MCBS, CareCloud, and Brown Health Medical Group-MA, have reported data breaches impacting over 30 million individuals. These incidents, occurring between May 2025 and March 2026, exposed sensitive personal, medical, and financial information, highlighting ongoing vulnerabilities in healthcare data security.
Unpatched Magento and Adobe Commerce Zero-Day Actively Exploited to Backdoor Online Stores
A new unpatched zero-day vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce is being actively exploited to install backdoors on online store servers. The flaw allows attackers to execute malicious code without authentication, affecting all current versions including 2.4.9. Adobe has not yet released a patch or advisory, leaving stores vulnerable to compromise.
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws, Linked to Lazarus Group
The Gunra ransomware group is exploiting vulnerabilities in Fortinet firewall products and Schneider Electric PowerLogic P5 appliances to target critical infrastructure globally. South Korean agencies also warn that North Korea's Lazarus Group is sharing tools and infrastructure with Gunra, with both groups exploiting vulnerabilities in mandatory Korean financial security software.
Critical Rails Active Storage Flaw Allows Arbitrary File Read, Potential RCE
Ruby on Rails has patched a critical vulnerability, CVE-2026-66066, in its Active Storage framework that allows unauthenticated attackers to read arbitrary files from application servers. This flaw, with a CVSS score of 9.5, affects applications using libvips for image processing and accepting untrusted image uploads, potentially exposing sensitive data and leading to remote code execution.
DHS Bans DeepSeek AI Use Across US Federal Civilian Agencies
The US Department of Homeland Security (DHS) has prohibited the use of DeepSeek AI products and models across all federal civilian agencies and their IT systems. This ban, effective since late July, stems from concerns that DeepSeek models could facilitate the transfer of sensitive US government data to the Chinese government and may contain malware or security vulnerabilities. The order also disallows DeepSeek from participating in federal government contracts.
Apple tightens macOS Full Disk Access controls due to AI agent risks
Apple is introducing new controls for macOS Full Disk Access settings, citing increased risks from AI agents. This change follows reports of AI apps potentially accessing private user data without explicit consent, aiming to ensure users understand the implications of granting such broad permissions.
Google Introduces Selfie Video for Account Sign-in and Recovery
Google has launched a new selfie video option for account sign-in and recovery, allowing users to regain access by recording a short video of their face. This feature provides an alternative verification method, particularly useful when traditional authentication methods are unavailable, by comparing a live video to a securely stored reference video.
Teens sentenced to 5.5 years for £29M Transport for London cyber attack
Owen Flowers and Thalha Jubair were sentenced to 5.5 years for a 2024 cyberattack on TfL that caused £29 million in damages. The attack severely disrupted services and breached data of millions. Authorities cite this case as a major enforcement action against young cybercriminals.
Data Breach Exposes Information of Over 40,000 DHS Employees
A hacker group named "Department of Peace" published personally identifiable information for over 40,000 U.S. Department of Homeland Security (DHS) employees, including staff from U.S. Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE). The data, which includes names, job titles, and work contact details, was reportedly stolen from an Okta single sign-on system used by DHS. Distributed Denial of Secrets (DDoSecrets) published the archive, named "Icepick," stating the goal was to replace "anonymity with accountability."
Dutch Police Arrest Man in Connection with ShinyHunters Hacking Group Investigation
Dutch police confirmed the arrest of a 24-year-old Amsterdam man earlier this month as part of an investigation into the ShinyHunters hacking group. The suspect, identified as Pepijn van der Stap, was previously arrested and sentenced for hacking and blackmailing multiple companies. This arrest is significant as it links a known individual to a prominent hacking group responsible for numerous data breaches.
Bitget crypto exchange reports $351.6 million stolen from hot and warm wallets
Cryptocurrency exchange Bitget announced that hackers stole $351.6 million from its hot and warm wallets. The company has suspended withdrawals and is investigating the incident, stating its User Protection Fund will cover all losses.
Google fined over €400m by Irish DPC for manipulating location data consent
Google received a fine exceeding €400 million from Ireland's Data Protection Commission (DPC) for manipulating users into agreeing to location data tracking. The DPC's six-year inquiry found Google lacked a valid legal basis for processing location data, which could reveal sensitive personal information.
WhatsApp Enhances Account Security with Stronger 2FA and Multiple Passkeys
WhatsApp has updated its account security features, allowing users to set alphanumeric passwords with special characters for two-step verification, replacing the previous six-digit PINs. The platform also introduced support for adding multiple passkeys to a single account, useful for users across iOS and Android devices, and added more context for calls from unknown numbers on Android.
TikTok settles DOJ children's privacy lawsuit for $400 million
TikTok and its parent company, ByteDance, have agreed to pay $400 million to settle a lawsuit filed by the U.S. Department of Justice (DOJ) in 2024. The lawsuit alleged violations of the Children's Online Privacy Protection Act (COPPA) by collecting personal information from underage users without parental consent. The settlement includes new age-related controls and parental oversight measures.
Cyberattack on CEVA Logistics Exposes European Steam Hardware Customer Data
A cyberattack on CEVA Logistics, Valve's European shipping partner, between July 29 and August 1, 2026, compromised personal data of Steam hardware customers in Europe. The breach exposed names, addresses, phone numbers, email addresses, and product details, leading Valve to warn customers about potential phishing attempts. This incident highlights supply chain vulnerabilities and impacts multiple retailers relying on CEVA Logistics.
Cybersecurity Expert Sentenced for Role in BlackCat Ransomware Scams
Angelo Martino, a former ransomware negotiator, has been sentenced to 70 months for aiding the BlackCat ransomware gang. Collaborating with accomplices, he shared confidential negotiation details, causing victims to lose over $75 million. This highlights vulnerabilities within cybersecurity industries.
Unauthorized AI Agents Reportedly Accessing US Bank Accounts, Prompting Bank Action
Unauthorized third-party AI agents are reportedly accessing US bank accounts and performing actions without explicit user instructions, according to banking sources. Major financial institutions like Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo are implementing restrictions to mitigate risks, as banks are not liable for losses incurred by user-authorized AI agents.
Chrome 150 Update Addresses 27 Vulnerabilities, Enhances Security
Google released Chrome 150, patching 27 security vulnerabilities, including two critical use-after-free flaws in Ozone and Views. This update is part of a broader effort to improve browser security, with most flaws discovered internally by Google. Regular updates are essential due to frequent exploitation of memory safety vulnerabilities in browsers like Chrome.
Google Chrome Releases Major Stable Updates Fixing Crucial Vulnerabilities
Google's Chrome Stable channel has been updated to version 150.0.7871.181/.182, with previous versions being released incrementally. These updates address numerous critical and high-severity security vulnerabilities, ensuring improved security posture across Windows, Mac, and Linux platforms.
Iranian-linked ships loiter near subsea internet cables in Gulf of Oman
Maritime intelligence firm Windward tracked several Iranian-linked ships loitering over subsea internet cables in the Gulf of Oman, near the Strait of Hormuz, in October. These movements, including ships "going dark" by switching off transponders, suggest potential reconnaissance or preparation for attacks on critical infrastructure. The region's subsea cables are vital for internet connectivity for multiple countries, including Iraq, Kuwait, Bahrain, Qatar, and a significant portion of India's westbound traffic.
Ledger Wallets Sold by CryptoBillis Suspected of Hardware Tampering Leading to Crypto Thefts
Ledger is investigating reports of hardware-tampered wallets sold by reseller CryptoBillis, which have allegedly led to over $86 million in crypto thefts. The tampering involves a circuit board implant that intercepts seed passphrases and transmits them to attackers. This issue primarily affects users in Southeast Asia who purchased devices from CryptoBillis, with no indication of compromise to Ledger's direct sales or systems.
DOJ Disrupts North Korean IT Worker Scheme, Arrests Two US Nationals
The Department of Justice disrupted multiple "laptop farms" in Texas and arrested two U.S. nationals, Michael James Bostelle and Juan Cecilio Pena Carrillo, for their alleged involvement in a North Korean IT worker scheme. This operation aimed to cut off a revenue stream for North Korea, which used the funds for illicit purposes, including weapons development.
ASOS app users receive push notifications from apparent hackers
ASOS app users in the UK received push notifications containing an extortion message from apparent hackers. The message claims the hackers compromised a "Snowflake instance" and threatens to leak data if ASOS's DPO and IT do not engage.
xAI Sues South Carolina Man Over Grok-Generated Sexual Images
xAI has initiated a lawsuit against Terry Wayne Harwood, alleging misuse of its Grok AI to generate child sexual abuse material (CSAM). This legal action, driven by Harwood's alleged bypassing of Grok's safeguards, underscores the challenges AI companies face in preventing abuse of their technology.
New "Pass-ta-key" Attacks Bypass Passkey Protections in Google Password Manager
Researchers from Palo Alto Networks' Unit 42 have identified three "Pass-ta-key" attack methods that allow malware on compromised Windows machines to bypass passkey protections in Chrome's Google Password Manager. These attacks exploit how Chrome stores device keys and re-enrolls devices, enabling silent authentication, installation of attacker-controlled keys, or extraction of synced passkey private keys, demonstrating vulnerabilities in passkey implementations when an endpoint is already compromised.
Zoom Patches Critical Vulnerability Allowing Device Takeover During Screen Sharing
Zoom has patched critical vulnerabilities in its video conferencing platform that allowed attackers to remotely execute code and take over devices during screen-sharing sessions. Discovered by A Security using fewer than 20 AI prompts, the flaw affected all supported operating systems and required no victim interaction, highlighting the increasing accessibility of advanced exploit development.
WebKit Flaws Expose Real IP Addresses for iCloud Private Relay and Proxy Browser Users
Security researchers Talal Haj Bakry and Tommy Mysk discovered three WebKit features that bypass proxy configurations, leading to IP and DNS leaks. These vulnerabilities affect Apple's iCloud Private Relay and other proxy browsers on iOS and macOS, potentially exposing users' real IP addresses and DNS servers. A class action lawsuit has been filed against Apple regarding the iCloud Private Relay flaw.
HalluSquatting Attack Exploits AI Hallucinations to Form Botnets
The "HalluSquatting" attack exploits AI hallucinations to inject malicious commands into coding assistants, potentially creating botnets. Researchers from Tel Aviv University and other institutions demonstrated that attackers can pre-register fictitious software names generated by AI. AI models' tendency to hallucinate and act on fake package names can expose systems to widespread malware deployment.
Apple Challenges UK Government's Demand for Encrypted iCloud Data Access
Apple has launched a new legal challenge against the UK government's demand for access to encrypted user data in iCloud. This action, filed in July at the Investigatory Powers Tribunal, contests a "technical capability notice" that Apple states would require weakening or redesigning its Advanced Data Protection service, which uses end-to-end encryption.
Microsoft Launches MAI-Cyber-1-Flash and Perception for AI Cybersecurity
Microsoft introduced MAI-Cyber-1-Flash, its first AI model specialized in cybersecurity, and Project Perception, an agentic security platform. These tools are designed to identify and remediate software vulnerabilities, with MAI-Cyber-1-Flash integrated into Microsoft's MDASH harness. The company claims the new offerings outperform competitor models on benchmarks and reduce operational costs.
Apple Fixes iCloud+ 'Hide My Email' Vulnerability After Public Scrutiny
Apple has patched a vulnerability in its Hide My Email feature that exposed real email addresses, following public and legal pressure. The issue persisted for over a year despite early warnings from security researcher Tyler Murphy. The flaw raised significant privacy concerns for users.
WordPress wp2shell Vulnerability Exploited; Urgent Patches Released
Two critical WordPress vulnerabilities, dubbed 'wp2shell' (CVE-2026-60137 and CVE-2026-63030), allow unauthenticated attackers to execute code. Affecting versions 6.9.0-6.9.4 and 7.0.0-7.0.1, fixes were released in versions 6.9.5 and 7.0.2. The vulnerabilities, actively exploited, prompted immediate patching, affecting over 500 million sites. WordPress initiated forced automatic updates, while Cloudflare deployed protective measures.
PamStealer Malware Targets macOS for Credential Theft Using Apple's PAM
Researchers have discovered PamStealer, a macOS malware that uses Apple's PAM interface to steal user credentials. This sophisticated malware employs a two-stage delivery system, disguising as the clipboard manager Maccy and utilising stealthy JavaScript for Automation. It highlights emerging threats in macOS security exploiting native Apple frameworks for credential theft.
CERT/CC Reports Hidden Backdoor in Tenda Router Firmware Allowing Admin Access
A vulnerability in various Tenda router firmware versions, CVE-2026-11405, allows unauthorized administrative access via an undocumented backdoor. This flaw poses significant security risks for users as attackers can bypass authentication to control devices remotely. Despite warnings, Tenda has not addressed the issue, leaving affected devices unpatched.
Zero-Click Android Vulnerability Allows Remote Denial-of-Service via Malformed WAP Push SMS
A zero-click vulnerability in Android's telephony service allows a remote attacker to crash `com.android.phone` by sending a malformed WAP Push SMS, disrupting active calls, including emergency services. Repeated attacks can corrupt the SMS database, leading to a persistent denial-of-service that renders the phone unable to use telephony functions until a factory reset.
FBI: SafePay Ransomware Gang Breached Over 600 Organizations Since 2024
The FBI and European cybersecurity agencies issued an advisory stating the SafePay ransomware group has breached over 600 organizations in the U.S. and Europe since August 2024. SafePay is now considered one of the most active ransomware groups, targeting businesses and critical infrastructure by exploiting vulnerabilities, guessing passwords, and using phishing attacks.