Binance, the world’s largest crypto exchange, has linked the theft of about $6.3 billion in cryptocurrency to a DevOps engineer’s compromised laptop. […]

Read more →

For small, targeted pulls, run a UDM search and call the same search through the Google SecOps API to get JSON. For raw logs in their original format, the Data Export API copies logs for a time range and log type into a Cloud Storage bucket you own. The UI’s export produces a spreadsheet-style file…

Read more →

Something shifted in offensive security over the last eighteen months that most organizations haven’t fully absorbed yet. It isn’t that attackers got smarter. It’s that the economics of attack changed entirely — and those of us who run red teams have had a front-row seat to the transformation. The conversation about AI in cybersecurity tends…

Read more →

Investigators believed the woman, Alice Huang, was recruited based on her relationship with Jensen Huang.

Read more →

New capture and playback solution with 3G-SDI, HDMI and analog connections for USB4 and Thunderbolt computers!

Read more →

About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the exchange said in a…

Read more →

In May 2017, the WannaCry cryptoworm spread across the internet, compromising more than 200,000 computers in at least 100 countries. The National Audit Office called it the largest cyberattack ever to hit the NHS in England. At least 80 of 236 hospital trusts were infected or disrupted, an estimated 19,000 appointments were cancelled, five hospitals…

Read more →

A Bishop Fox researcher investigating Claude’s sandbox obtained an internal control binary, recovered authorization tokens from process memory, and bypassed a local connection restriction to reach a sandbox control service. Anthropic said the sandbox observations did not qualify as security issues because its security boundaries sit outside the untrusted sandbox. According to technical research published…

Read more →

A trojanized version of the Claude Code extension, identified as anthropic.claude-code version 2.1.313, contains a malicious loader that enables persistent SSH access to developer systems. Researchers analyzed an artifact obtained from Open VSX and discovered 66 lines of JavaScript added to the legitimate extension bundle. This additional code lets the attacker’s script run before the…

Read more →

The “FrostyNeighbor” advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives.

Read more →

A retainer is a contract you buy hoping to waste, and its differences surface at 2 a.m.: SLAs that mean hours versus best-effort, unused fees that convert versus evaporate, and benches whose post-acquisition structures either carried over or didn’t. This verdict guide judges twelve retainer services on terms, not just talent including one ownership flag…

Read more →

You retain a DFIR firm for the breach you’ll actually have nation-state intrusions want attribution benches, ransomware wants negotiation-density operators, insurance-routed incidents want panel firms and 2026’s roster carries one acquisition flag buyers must know: Coveware now operates under Veeam. This verdict guide matches twelve companies to breach lanes, with telemetry advantages, panel realities, and…

Read more →

Drupal has warned that threat actors are exploiting a “highly critical” security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. “This module enables you to sell goods and services to…

Read more →

Managed SIEM’s quiet failure is dependency: two years in, the detections and parsers live in the provider’s head, and leaving means starting over. This verdict guide judges twelve services on content ownership, tuning evidence, and delivery dialect vendor-run platforms, co-managed operations in your tenant, Microsoft-practice specialists, and the SMB-to-enterprise spectrum with merger-era notes where platforms…

Read more →

SOCaaS is bought on the 3 a.m. question what may the provider do without waking you, and how fast does a human touch your alert? This verdict guide judges eleven providers (our sheet’s twelfth, Blackpoint Cyber, is excluded under this publication’s standing editorial policy) across the operating dialects that actually differ: concierge squads, transparent co-management,…

Read more →

Choosing an MSSP is choosing a relationship model pure-play SOC specialists, telecom-scale operators, consulting houses attaching run to transform, and the outsourcing giants folding security into contracts you already hold and 2026 adds ownership homework (Secureworks now answers to Sophos). This verdict guide judges twelve providers on delivery truth, contract shape, and the governance disciplines…

Read more →

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below – CVE-2026-97229 (CVSS score: 10.0) – An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise

Read more →

WordPress released version 7.1.4 on October 28, 2026, which addresses 22 security vulnerabilities. Among them is an unauthenticated remote code execution flaw that attackers are actively exploiting. Administrators should ensure the update is installed, rather than assuming automatic background updates have completed. The official release documentation details fixes spanning stored cross-site scripting, information disclosure, authorization…

Read more →

A critical vulnerability in the Linux kernel, identified as CVE-2026-98432, threatens Ubuntu systems through a networking memory flaw that could cause crashes and service disruptions. Ubuntu released an advisory on October 15, 2026, and provided an update on October 29. The vulnerability has been assigned a CVSS severity score of 9.8, indicating a high priority…

Read more →

In the third quarter of 2026, Cloudflare successfully mitigated 18.2 million network-layer distributed denial-of-service (DDoS) attacks. This increase indicates a trend among attackers who now favor short, frequent disruptions over large traffic floods. Compared to the same quarter in 2025, this represents a significant 208% rise in the frequency of attacks across Cloudflare’s network. Published…

Read more →

Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware. They knew names and email addresses “The attackers…

Read more →

A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach. Personal details of thousands of U.S. Department of Homeland Security (DHS) employees are now online after a hacker stole reams of data in a data breach that occurred earlier this year and nobody had…

Read more →

Binance has suspended deposits and withdrawals due to a security incident. Early estimates from blockchain tracking indicated that attackers may have drained as much as $5.7 billion in cryptocurrency. The exchange has committed to covering all losses while investigators work to trace the transactions and coordinate asset freezes throughout the cryptocurrency ecosystem. In its official…

Read more →

Polymarket’s international platform temporarily suspended trading after a third-party provider was compromised, leading to reports of unauthorized withdrawals and missing account balances. The Polymarket Traders account later announced that trading had resumed and promised to reimburse affected traders fully. In its public incident statement, the account said it had identified and fixed the issue affecting…

Read more →

Gartner recently released a new category of assessing security tools: the Integrated Security Operations Center (ISOC). Even though SIEM isn’t going anywhere, a rapidly evolving threat landscape is forcing a shift in industry logic that is reflected in the emergence of this new category. For years, SIEM has dominated as an all-encompassing category. But SIEMs…

Read more →

An Accenture employee reportedly linked a personal Claude Code account to a secure Department of Defense production environment, granting the AI coding agent administrative access and potentially exposing credentials and sensitive network information to an external service. According to WIRED’s investigation, published October 29, the agent operated on the Pentagon network for approximately two months…

Read more →

One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026. A ticket scam used a similar setup. Several websites impersonating official ticketing and hospitality portals…

Read more →

A recently discovered Android vulnerability, referred to as SMS of Death, allows attackers to crash a phone’s telephony process with just one malformed SMS, without any interaction from the victim. Researcher Mark B reports that this flaw can disconnect active calls, including emergency calls, and leads to persistent service disruptions when malicious messages remain in…

Read more →

Smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices, according to Bitdefender’s 2026 IoT Security Landscape Report. The analysis covered approximately 10.4 million protected home routers between January and September. Televisions represented 22.7% of vulnerability observations, followed by smart plugs at 22.4% linked with a known software…

Read more →

For 16 years Apple told us touchscreen laptops were a bad idea. Then, on 29 October 2026, it launched one.

Read more →

Sponsored by:
Software Analyst Cyber Research

Cryptocurrency giant Binance said on Thursday that a “security incident” on its platform has impacted about $6.3 billion worth of assets. The world’s biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.  Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million related…

Read more →

SAP announced the planned deployment of SAP-RPT, a tabular AI foundation model, on HPE Spaceborne Computer-2 aboard the International Space Station ISS, one of the most…

Read more →

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Read more →

Binance investigates a $5.8 billion crypto theft, with $3 billion in assets frozen. The exchange says user funds are safe as investigators trace funds.

Read more →

Deeper Network Promo

A vulnerability has been discovered in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that could allow for denial of service (DoS). Cisco Secure Firewall ASA and FTD provide firewall, VPN, and threat defense capabilities for enterprise environments. An attacker could exploit this vulnerability by sending a…

Read more →

A vulnerability has been discovered in GitLab that could allow for remote code execution. GitLab is a DevOps platform that provides source code management, CI/CD pipelines, issue tracking, and collaboration tools in a single application for software development teams. Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code on the…

Read more →

php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the exception: one tuned exploit can reach every device that runs it. Key takeaways The five vulnerable…

Read more →

The PHP2Shell saga continues, with attackers discovering new ways to exploit the critical vulnerability impacting millions of organizations worldwide. The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of a high severity Linux kernel privilege escalation flaw that attackers are chaining with PHP2Shell bugs in the wild. Identified as CVE-2026-46300, it could allow attackers…

Read more →

When a market faces a talent shortage, companies don’t just have to work harder to find the right person. They need to hire fast, stay flexible, and do it without taking on…

Read more →

New capabilities will alert organizations to identity risks across Active Directory, Entra ID, and Okta, identify Tier 0 exposure, and provide a guided path to remediation

Read more →

Next-generation Maestro Hyperscale Orchestrator 200 MHO 200 quadruples hyperscale capacity with 400GbE ports, so organizations can secure AI traffic without slowing it down

Read more →

New research reveals autonomous AI agents are operating without supervision in 95% of APAC organisations that have deployed them.

Read more →

In a deep dive into the Silent Train attack tactic used by China’s Volt Typhoon cybercrime group, Lumen’s Black Lotus Labs highlighted evidence of efforts to pre-position access within what it described as “strategic communications, critical infrastructure and other ecosystems that become essential during geopolitical tensions or crises.”  The report, released on Wednesday, said that…

Read more →

Awards recognise HID’s leadership in mobile access innovation and sustainable access control modernisation

Read more →

Accomplished Finance Executive Brings Deep Expertise Scaling Businesses, Driving Transformation, and Creating Long-Term Value

Read more →

Oracle and Snowflakehttps://www.snowflake.com/en/ NYSE: SNOW today announced that Snowflake AI Data Cloud will be available as a native, first-party service on Oracle Cloud…

Read more →

New integrations deliver New Relic right to engineers, helping them use coding agents more efficiently and address production issues within their existing workflows Engineers…

Read more →

The concept that hackers may already be inside sensitive systems is a core warning of modern cyber security strategy, heavily underscored by the Australian Signals Directorate ASD.

Read more →

OpenAI says it won’t reduce usage limits for the $100, $200, and $500 ChatGPT Pro plans, as well as Business Premium, and it also promised to keep Dots usage independent. […]

Read more →

HP has unveiled a refreshed consumer technology portfolio in Australia, headlined by the OmniBook 5, a 14-inch laptop offered in four colourways.

Read more →

Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity. Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while…

Read more →

Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history. […]

Read more →

GitHub’s Ed Summers sees extraordinary potential in natural-language development, while research shows why accessible tools must be accompanied by deliberate effort to produce…

Read more →

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. […]

Read more →

Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. […]

Read more →

The Pentagon treats August freezer failures at US military bases as a suspected hack and is working with French investigators after a supermarket attack. The Pentagon is investigating freezer failures that spoiled food at US military bases in August as a suspected cyberattack, according to four officials who spoke to Reuters. One official said US…

Read more →

As GitHub gives customers the option to let Copilot approve code changes, CTO Vladimir Fedorov argues that automation should concentrate human judgment where it matters most.

Read more →

Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. […]

Read more →

Plus, the DOJ expanded its criminal investigation into the Alaska Senate race, and the U.S. national debt reached 100% of GDP.

Read more →

Sponsored by:
Software Analyst Cyber Research

Traders who lost money on the incident will be ‘made whole,’ the prediction-markets platform said.

Read more →

Obvious phishing emails with numerous red flags are somehow getting past some of the industry-leading secure email gateway (SEG) products.

Read more →

A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS. A search tool for the database, named Icepick, went offline for a spell before coming online again Thursday under a…

Read more →

The online behemoth reported higher-than-expected revenue from Amazon Web Services for the third quarter, showing sustained momentum in its cloud computing business.

Read more →

Discontent with the Google parent’s quarterly results highlights tensions of its transition from search engine to AI hyperscaler.

Read more →

A high-severity flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) is under active exploitation to crash vulnerable devices. The vulnerability, tracked as CVE-2026-76418 and rated 8.6 in severity, is due to logic errors when secondary authentication is configured on a…

Read more →

A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. […]

Read more →

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn’t. There’s a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are…

Read more →

42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups. The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files. They built the count from the search engines that index open cloud storage and published it as the Ransomnews Cloud Exposure…

Read more →

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. […]

Read more →

Deeper Network Promo

According to Nerdio’s 2026 MSP report, just 12% report measurable AI productivity gains. Victoria Durgin goes Inside the Headlines with the findings and Caylent CEO Valerie Henderson to break down how MSPs can adopt AI and sell it to customers. Read the stories referenced: Only 12% of MSPs Report Measurable AI Gains, Nerdio Finds Caylent…

Read more →

An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says.

Read more →

<img src="https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/10/threat_source-3.jpg" alt="A quiet week in infosec <. Welcome to this week’s edition of the Threat Source newsletter. “The darkest period of my life, so far, arrived the summer I was pregnant with my eldest son. The future was growing in me with all of its terrifying unpredictability, and I found myself anxious, unable to…

Read more →

Your JBL, Sony, or Bose Bluetooth headphones got a top-to-bottom wireless makeover — not just Auracast.

Read more →

Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico’s Health Sciences Center (HSC) this week. Read more in my article on the Fortra blog.

Read more →

President Trump’s order to bar Chinese batteries for energy storage has opened the door to South Korean and Japanese companies.

Read more →

The latest version of Firefox fixes 167 security vulnerabilities, most of which are of high severity, while the newest version of Chrome patches 52 flaws, four of which are critical.

Read more →

💡There is basically One Main Loop in AI, and it applies to everything from building software to managing pretty much anything. ⛰️I call it General Hill-climbing. Here are the main components: 🖼️ Know what you want ✍️ Be able to articulate it 📐 Be able to measure progress 🧪 Do the work / test your…

Read more →

China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. Cisco has also confirmed that attackers are crashing its firewalls with a newly disclosed vulnerability. VMware ESX zero-day helped Chinese spies cover their tracks…

Read more →

Microsoft’s relationship with OpenAI has become a major financial force in its cloud business, even as the AI developer expands its partnerships with competing infrastructure providers. In its first-quarter fiscal 2027 filing, Microsoft disclosed approximately $10 billion in financial activity associated with OpenAI, according to the figures cited in the filing. The amount highlights the…

Read more →

A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users’ searches through tracking servers to generate advertising revenue from Bing and Yahoo. […]

Read more →

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Linux Kernel and Broadcom VMWare ESX vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-41709 (CVSS score of 7.6) Broadcom VMWare…

Read more →

University of Copenhagen cyberattack exposes data of 525,000 people and access PINs for 20,000, raising concerns about identity theft and campus security.

Read more →

Sony’s So-net breach exposed 2.59 million customer records and 54,401 email passwords. Learn what was leaked and how to protect accounts from follow-on scams.

Read more →

In this article Stages of AI adoption by North Korean threat actors AI use across North Korean threat operations AI-assisted targeting and reconnaissance AI-assisted social engineering and identity deception AI-assisted software and tooling development AI-assisted operational scaling and analysis Mitigation and protection guidance Microsoft Defender detections As Microsoft Threat Intelligence continues to track how threat…

Read more →

A DHS data leak exposed records of more than 41,000 workers, including ICE agents. Learn what was leaked, the suspected access method, and security risks.

Read more →

A flaw in the Linux kernel’s TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel’s own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote…

Read more →

A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.

Read more →

The bank’s message follows a trend among financial institutions that are restricting third-party AI agent access.

Read more →

Sponsored by:
Software Analyst Cyber Research

EMBRACE affects AI coding tools Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop, enabling code execution, file theft and browser address-bar spoofing.

Read more →

Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver…

Read more →

Malicious iOS scripts have become a leading cause of ad platform suspensions. They accounted for about one in five suspensions in Q3 2026, according to the State of Ad Fraud 2026: ADEX Trust & Safety Report from anti-fraud firm ADEX. The report examines one scheme in detail. It was built on the Coruna exploit kit…

Read more →

NIK C2 malware can fall back on victims’ OpenAI API keys to run AI queries

Read more →

Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campaign, dubbed Yoba, for the past two months. Its operator set up repositories and GitHub.io pages for supposed apps called…

Read more →

Oracle is expanding its Fusion Data Intelligence platform with new AI agents, operational analytics, and application integrations designed to help enterprises turn business data into actionable insights and automated workflows. Announced at Oracle AI World in Las Vegas, the updates extend Oracle’s existing analytics capabilities across finance, supply chain, human resources, and customer operations. The…

Read more →

Even approved AI tools can expose confidential information when employees use them. Fortinet announced the FortiGuard Inline AI Security Service on Oct. 26, bringing cloud-delivered AI protection to existing FortiGate firewalls. Customers can activate the offering without installing separate AI security infrastructure. For partners managing FortiGate environments, the announcement raises practical questions about which customer…

Read more →

Anthropic has acquired a biotech startup with one full-time employee, testing how much drug research a small team can accomplish with Claude. Anthropic disclosed on Oct. 27 that it acquired Mithril Medicine in July, bringing the startup’s research into rare forms of muscular dystrophy into its internal drug development efforts. The announcement included research updates…

Read more →

Microsoft has resolved a known issue that prevents non-admin users from connecting to devices via Remote Desktop when the “Administrator protection” security feature is enabled. […]

Read more →

Westcon-Comstor and Palo Alto Networks are tying additional partner support to business performance as they look to expand cybersecurity sales across Europe, the Middle East, and Africa (EMEA). The companies announced the Partner Growth Circle on October 27, introducing a program that combines joint business planning, technical enablement, demand-generation funding, and quarterly performance reviews for…

Read more →