The Hacker News Breach
Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data
American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens. "This month, Chainalysis detected an external actor using offensive agentic
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.
Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims
Named “Volta-Autodoxer,” the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.
SecurityWeek BreachSyrian Hacker Gets Prison Time in US After Over a Decade on the Run
A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities. The post Syrian Hacker Gets Prison Time in US After Over a Decade on the Run appeared first on SecurityWeek.
Security Affairs VulnAttackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by missing authorization checks. “This module enables you to sell goods and […]
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44
CSO Online PolicyChoosing a WAAP in 2026: 3 questions that separate the shortlist
One platform or four Your WAF renewal is coming up. The API team has its own tooling in mind, the fraud team wants a bot product, and someone in networking owns DDoS. Four controls, four consoles, four sets of policies in front of the same applications. That is the situation a Web Application and API Protection platform, or WAAP, exists to replace: one service in front of the application portfolio that handles the WAF, API security, bot management, DDoS, and client-side script protection together. The category is settled. What changed in 2026 is the evidence. Buyers now have certified test data that measures how well these platforms stop attacks and how often they stop legitimate traffic by mistake, and the two numbers together tell you more than any feature list. What the test data shows The SecureIQLab Cloud WAAP v5.0 validation, an AMTSO-certified test published in August 2026, ran 12 enterprise platforms through 1,608 attack scenarios and 1,487 legitimate-traffic scenarios. Complete Security Scores ran from a perfect 100% for the top product down to roughly 61% for the weakest. The spread inside a typical shortlist is that wide, and a shortlist drawn up in 2023 or 2024 may no longer describe the products on it. The second number matters as much as the first. A platform that blocks every attack and also blocks legitimate requests cannot stay in blocking mode for long, and false positive avoidance varied almost as widely across the same twelve products. Those percentage points become alerts, tuning hours, and exceptions your team carries every day. 3 questions for every vendor on the list Ask for API coverage protocol by protocol. REST is one protocol among several in a modern estate; GraphQL, SOAP, WebSockets, and gRPC all carry production traffic, and the v5.0 results showed coverage varying widely by protocol inside a single product, with WebSockets the weakest area across the group. A headline API score hides that. Ask how long it takes to reach a tuned, low false-positive state on your traffic, and measure it over two full weeks of real traffic during the proof of value. Time to protection and tuning effort are the costs you pay after the contract is signed. Ask how the deployment and licensing model behaves as the portfolio grows. Each delivery model, SaaS, native in-cloud, or reverse proxy, has its own latency and onboarding profile, and each licensing unit, request, bandwidth, or application, bends the cost curve differently as traffic grows. Model 24 to 36 months of growth with each vendor, starting from your own traffic baseline. Where Imperva fits Imperva, part of Thales, delivers Cloud WAF, Advanced Bot Protection, API Security, DDoS Protection, and Client-Side Protection as one platform, with one policy model and one set of analytics across all of them, deployable as SaaS, on your own infrastructure, or natively inside the public cloud. In the SecureIQLab v5.0 cycle, Imperva was the only vendor of the twelve tested to record a perfect 100% Complete Security Score, and it paired that with a 100% false positive avoidance score, the lab’s measure of legitimate traffic passed untouched. It was Imperva’s fifth consecutive Leader-category placement in the series, and the lab awarded it the Secure by Default rating in the same cycle. Forrester named Imperva a Leader in The Forrester Wave™: Web Application Firewall Solutions, Q1 2025. An honest aside: no one platform suits every environment. If your dominant requirement is a developer-centric edge platform or raw DDoS scrubbing capacity above everything else, weigh those needs explicitly, and validate any shortlist, Imperva included, against your own traffic in a proof of value. The full comparison The complete buyer’s guide on the Imperva blog compares seven WAAP vendors on security efficacy, API protection, bot defense, operational efficiency, and cost, with analyst standing and verified peer ratings for each, and ends with a proof-of-value checklist you can take into your next evaluation. Read Best WAAP Solutions for Enterprise Application Security: How to Choose the Right Platform in 2026 before you renew anything. Then go back to the four consoles and decide how many you still need.
SC Media VulnAI-generated code security shows first significant improvement in a year
According to Tech Radar, security in code generated by frontier artificial intelligence models has improved for the first time in a year, with vulnerability rates decreasing from 44% to 38%.
SC Media GeneralAnthropic files for initial public offering amid broader tech market volatility
Coverage from Silicon Angle indicates that Anthropic has officially filed paperwork for an initial public offering, marking a significant moment for the artificial intelligence industry.
SC Media MalwareSophisticated malware targets government-specific windows systems in Asia
As noted by The Record, suspected nation-state hackers have developed sophisticated malware designed to target a customized version of Windows used by government agencies in Asia.
SC Media GeneralGCHQ faces scrutiny over lost storage drives and data handling failures
The Government Communications Headquarters is facing significant criticism after an annual report revealed that thousands of storage drives containing sensitive information have been lost for years, with further coverage provided by The Register.
SC Media VulnOrganizations face security risks from excessive AI autonomy
As reported by Tech Radar, businesses are increasingly delegating critical security decisions to artificial intelligence, creating significant vulnerabilities due to a lack of oversight and control.
SC Media GeneralMoldova investigates massive cyberattack on national identity infrastructure
As reported by Biometric Update, a significant cyberattack on the digital government infrastructure of Moldova has resulted in the exposure of personal data linked to approximately 750,000 national identification numbers.
SC Media GeneralFake cryptocurrency trading app steals funds from Solana wallets
A malicious application named Padre Terminal, which previously appeared on the Apple App Store, was identified as a cryptocurrency drainer responsible for stealing approximately $23,000 from 27 Solana wallets, according to a recent report by Bleeping Computer.
Wiz Blog Vuln“Black October” for AI Developer Platforms
A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale.
CyberScoop GeneralChina-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. The post China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days appeared first on CyberScoop.
Security Affairs MalwareYoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries
Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI […]
Ars Technica GeneralAnthropic VS code extension on Cursor backdoored for nearly 12 hours
It's still unknown how attackers got access to Anthropic's verified Cursor account.
Schneier on Security Policy
Friday Squid Blogging: Bigfin Squid Off California Coast
Neat video: The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
The Record Breach
DOJ raises privacy concerns over potential sale of Character.AI chats
The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms.
Wired Security GeneralA Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices
Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines.
Security Affairs VulnU.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 is a critical security flaw that could let attackers run code on […]
Dark Reading General
Devs Hit by Trojanized Claude Code Extension for Cursor
Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).
SC Media GeneralIdentifying election domain threats before they become attacks
Election domain research highlights impersonation risks and the need to distinguish threats from false alarms.
Behind the Scenes of How Operation Blackout Went Down
A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.
SC Media VulnDrupal Commerce Core access bypass flaw exploited in attacks
Attackers exploit critical Drupal Commerce Core flaw to bypass access controls and manipulate orders.
Fashion retailer Resolve says hackers stole payment card information
The company, billing itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” said a recent hack exposed customer payment card numbers.
Security Affairs Breach$6.3 Billion Stolen from Binance in Attack Attributed to North Korea
Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to […]
CSO Online BreachWhy identity governance demands executive attention
The identity landscape you’re responsible for looks nothing like it did just a few years ago. Employees and contractors now share the enterprise with service accounts, machine identities, and a fast-growing population of AI agents — all accessing business systems and data. Every one of those identities represents an access decision, and every access decision is now a potential point of accountability that lands on your desk. Regulators and boards want proof. They expect security leaders to show who, or what, has access to critical systems and how that access is being governed. But when human and nonhuman identities (NHIs) change faster than manual processes can keep up, proof becomes much harder to produce. Foundry research ranks identity security among the top cybersecurity priorities for 2026, reflecting a shift in how leadership views risk: Identity has evolved from operational detail to executive concern. “The last 15 years of digital transformation has resulted in credential sprawl across the tech stack of every organization,” says Bryan Kelley, AVP, Agentic Technology Specialists at SailPoint. “Whether it’s your own trusted agents or another organization’s rogue agent, they will find and abuse these exposed credentials, API keys, tokens, and secrets to carry out their given goals.” When accountability becomes personalSecurity leaders must demonstrate that identity governance is working, not simply that policies exist. They need a real-time view of each identity and the permissions it holds as business needs change. Leaders can also face personal and professional consequences when a breach or a compliance failure occurs. Boards and regulators may expect the C-suite to show that appropriate controls and oversight were in place at the time. AI agents add to that exposure as they gain access to enterprise resources and take on more autonomous roles. This is why NHIs need the same rigor, visibility, and controls as human identities. The shift to continuous compliance Quarterly or annual access reviews capture a moment in time, but it’s all the other moments in between that present a problem. Between reviews, employees can change roles, contractors can leave, and new identities such as AI agents can gain access. Security teams may not catch outdated permissions or active orphaned accounts until the next review. When identity data lives in separate systems, security teams struggle even more to maintain a current view of access across the enterprise. Continuous identity security makes oversight part of daily operations. Rather than waiting for the next review, an identity governance platform can help validate access as conditions change, automating low-risk approvals and flagging higher-risk access for review. Governance activity also creates an ongoing record of how access was approved and whether policies were applied consistently, so teams don’t have to reconstruct that history when auditors or regulators ask for evidence. Building an adaptive identity security programA continuous approach is made up of three core capabilities. First, organizations need to discover and unify identities to create a centralized view of access. Second, lifecycle management, policy enforcement, and access validation become always-on activities rather than periodic projects. Finally, organizations need to maintain evidence of governance activity so they can demonstrate compliance and respond when issues arise. This approach helps security leaders keep up with constant identity changes while meeting rising expectations for accountability. Learn how continuous identity security can help strengthen oversight and audit readiness.
CyberScoop MalwareApple notifications alert victims in 99 countries about mercenary spyware infections
The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. The post Apple notifications alert victims in 99 countries about mercenary spyware infections appeared first on CyberScoop.
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in
CyberScoop GeneralCalifornia officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment
Los Angeles County officials told CyberScoop they received multiple grand jury subpoenas investigating alleged election fraud. States and civil groups call it a federal power play. The post California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment appeared first on CyberScoop.
Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach
The state’s Department of Education (FLDOE) said on Thursday it became aware of a data breach involving the Florida Student Financial Aid website on October 19.
InfoSecurity Magazine MalwareNew Framework Puts Ransomware Resilience for AI Systems in Focus
RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems
L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara
I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.
-
Schneier on Security Malware
Bloatware in Aftermarket Auto Parts
This story is interesting: One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about. Among the pre-installed bloatware—or spyware, if you’re being less charitable—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so your passenger can entertain themselves with PDFs on the go...
TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depending on the platform, may also run
CyberScoop GeneralDefense contractor pleads guilty to aiding North Korean remote worker scheme
The 62-year-old allowed co-conspirators to use his identity and top secret security clearance to apply for almost 100 jobs last year. The scheme’s success rate was limited. The post Defense contractor pleads guilty to aiding North Korean remote worker scheme appeared first on CyberScoop.
SecurityWeek VulnPHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week. The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.
- ESET WeLiveSecurity Malware
This month in security with Tony Anscombe – October 2026 edition
The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans
Qualys Security Blog VulnOperationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit
Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening and security hygiene, rather than a single vulnerability or CVE. Manually validating advisory recommendations across enterprise networks is difficult, time-consuming, and prone to inconsistencies. Qualys Policy Audit transforms advisory guidance […]
SecurityWeek BreachIn Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware. The post In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak appeared first on SecurityWeek.
SC Media GeneralA clean code review does not mean a safe runtime
Here are four ways to make exploitation harder and more expensive for attackers.
CyberScoop GeneralSyrian hacker who served Assad regime gets 42 months in US prison
Ahmad Umar Agha is best known for posting a fake Associated Press tweet claiming President Obama was injured in a White House bombing. The post Syrian hacker who served Assad regime gets 42 months in US prison appeared first on CyberScoop.
Syrian Electronic Army hacker gets prison time for attacks on Western targets
Ahmad Umar Agha, known online as “Th3Pr0,” was sentenced Thursday in federal court in Virginia to 42 months behind bars for his role in a conspiracy that was organized by former Syrian President Bashar al-Assad's closest advisers.
Undead Software Projects Continue to Raise Security Risks
A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October
