A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide.

Read more →

To power Apple’s next phase, CEO John Ternus needs to raise Apple’s AI game.

Read more →

Disclosure: This article was produced in partnership with FastDL. Hackread.com reviewed and edited the content before publication. “SaveVid.Net…

Read more →

Workday Chief AI Officer, Joel Hellermarkhttps://www.linkedin.com/in/joel-hellermark/, sat down with journalists from Australia, Japan and Hong Kong at Workday Rising 2026 and…

Read more →

Most security tooling that fits into a CI/CD pipeline—static analysis (SAST), software composition analysis (SCA), and dynamic scanners (DAST)—flags potential issues from patterns and signatures. A flagged pattern shows you where to look; penetration testing is what confirms whether something is actually exploitable. That confirmation has traditionally come from a periodic, out-of-band engagement that runs…

Read more →

A bug in Claude Code Desktop’s preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens.

Read more →

Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands on vulnerable VPN appliances. The vulnerability came to light after Volexity investigated a compromised Ivanti Connect…

Read more →

In his Q&A with the APJ media, Workday General Manager, Talent Acquisition Products, Adam Godsonhttps://www.linkedin.com/in/adamgodson/, spent 25 minutes fielding questions on…

Read more →

Microsoft has patched CVE-2026-96951, a high-severity Windows Shell security feature bypass vulnerability that is already being exploited in real-world attacks. The flaw carries a CVSS score of 8.8 and allows an unauthenticated attacker to evade Mark of the Web (MOTW) protections by convincing a victim to interact with a specially crafted file. The zero-day was…

Read more →

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group’s operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. […]

Read more →

Google is opening Gemini 4 Argon to broader enterprise use, giving channel partners another model to evaluate for customer automation projects. Google announced Oct. 14 that Argon is available on Google Cloud, with developer access through the Gemini API, Google AI Studio, and Antigravity. A separate version with fewer cybersecurity restrictions remains limited to vetted…

Read more →

Linux creator Linus Torvalds has now begun using AI to write code for the operating system’s kernel. In a new coding project, he has used Anthropic’s AI tool, Claude Code, to develop eight code changes to resolve a performance issue in Linux, reports ZDNet. “The code, the test programs, the review that forms the basis…

Read more →

When I introduced myself to Workday President, Product and Technology, Gerrit Kazmaierhttps://www.linkedin.com/in/gerrit-kazmaier/, as being from iTWire in Australia, he had…

Read more →

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance’s operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters…

Read more →

The European Commission has launched investigations into OpenAI and Anthropic after the companies’ AI agents escaped their test environments and infiltrated other organizations’ systems, Euronews reports. In one case, an AI agent from OpenAI managed to break out of its test environment and hack the AI platform Hugging Face. In the other case, a model…

Read more →

The files included detailed images of an unreleased device, a new legal filing claims.

Read more →

SolarWinds has launched Avior, a standalone agentic AI system designed to help managed service providers (MSPs) and IT teams move beyond reactive alert management toward automated, goal-driven IT operations. The system uses specialized AI agents to handle routine tasks, including alert correlation, compliance monitoring and configuration management, while maintaining human oversight of high-risk actions.  For…

Read more →

SAP’s October update fixes a critical S/4HANA code injection flaw and NetWeaver memory corruption. See affected systems, risks, and patching priorities.

Read more →

Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. […]

Read more →

Slide has named co-founder and Datto founder Austin McChord interim CEO following the departure of fellow co-founder Michael Fass, putting an experienced MSP technology executive in charge of the business continuity and disaster recovery (BCDR) provider. The leadership transition comes as Slide expands its MSP-focused backup business, which now serves more than 1,000 partners worldwide,…

Read more →

Microsoft’s streak of record-breaking vulnerability disclosures continued with a mega Patch Tuesday, containing 1,413 defects affecting the company’s various enterprise products and services.  The monthly batch of patches surpassed the company’s previous annual record of 1,261 common vulnerabilities and exposures (CVEs) set in 2020.  “Hundreds of CVEs in a single release used to be the…

Read more →

Microsoft’s October Patch Tuesday fixes over 1,400 flaws, including an exploited Windows bug. Learn which vulnerabilities security teams should patch first.

Read more →

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online – Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the…

Read more →

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. […]

Read more →

Microsoft will end Windows 11 23H2 security updates on Nov. 10, 2026. See which PCs are affected and what IT teams should do before the deadline.

Read more →

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. “Since January 2026, the threat actors behind these kits…

Read more →

Every year on 14 October, World Standards Day recognizes the people and organizations working together to develop standards that make our world safer, more connected, and more resilient. For the PCI Security Standards Council, this year’s celebration carries special significance: for 20 years, we have been setting payment security standards that help protect payment data…

Read more →

Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model. Researchers at Anthropic demonstrated this by running a Google Gemma model across 15 off-brand Android TV boxes. They warn that small models could soon spread across vulnerable internet-of-things (IoT) devices, including…

Read more →

The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea’s fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70…

Read more →

Managed services provider Netrio has launched a new cybersecurity portfolio featuring eight as-a-service offerings designed to help mid-market businesses strengthen security operations, manage risk, and meet compliance requirements without building large internal security teams. Announced October 13, the portfolio combines AI-powered threat intelligence with human security expertise, spanning everything from 24/7 monitoring and incident response…

Read more →

September 2026 Windows Updates brought a patch for CVE-2026-69459, a local privilege escalation vulnerability in Windows Power Dependency Coordinator, allowing a non-admin local user on the computer to elevate themselves to Local System. The vulnerability was found by two anonymous researchers who used it at the TyphoonPWN 2026 competition. Subsequently, SSD published a technical analysis…

Read more →

Microsoft is preparing to run more of its AI services on chips it designs itself. The company unveiled Azure Maia 300 on Oct. 12, introducing its third-generation AI accelerator ahead of production deployments beginning in 2027. The system is designed to handle increasingly demanding AI inference workloads. For MSPs and systems integrators serving Microsoft customers,…

Read more →

The artificial-intelligence company plans to spend around $750 billion on computing power through 2030.

Read more →

The hottest new app this fall is Muse, an AI agent from Meta. Give it a chore, and it does the chore for you. Ask whether it’s a person or a machine, and it may well lie and claim to be a human. Related: AI agents lack moral values Agents like Muse are catching on…

Read more →

Three teams remotely hacked a fully patched Google Pixel 10 at Pwn2Own Ireland. See what the exploits revealed and what European security teams should check.

Read more →

Deeper Network Promo

Amazon Web Services (AWS) is expanding its investment in forward-deployed engineering as enterprise demand grows for AI implementations that move beyond experimentation and deliver measurable business results. Through a dedicated engineering organization and new technical training pathways for partners, AWS is working to develop the specialized skills needed to bring AI applications into production.  The…

Read more →

Members of Congress are pressing the Trump administration to expand the federal government’s role in securing artificial intelligence, wanting new safety standards and regulations, independent testing of models and more “aggressive” use of AI for defensive cybersecurity purposes. In a letter, Sens. Maria Cantwell, D-Wash., and Mike Rounds, R-S.D., said that multiple incidents of frontier AI…

Read more →

Intuit has switched on Intuit Intelligencehttps://quickbooks.intuit.com/intuit-intelligence/ in Australia, almost a year after unveiling it on stage in Las Vegas. It lands in a…

Read more →

Cryptography rarely fails at the math – it fails at deployment. Why post-quantum migration and AI-scale risk make open-source stewardship a core control.

Read more →

Norway fined Microsoft-owned Xandr $9.6 million over unlawful processing of Grindr user data, highlighting GDPR consent and adtech privacy obligations.

Read more →

AMD has introduced Helion, an open rack design that lets infrastructure partners tailor CPU and GPU resources to customers’ agentic AI workloads. Announced Oct. 12, AMD Helion is a rack-scale reference design based on an Open Compute Project (OCP) specification. It is intended to help hyperscalers and enterprise customers build infrastructure for AI agents that…

Read more →

Drone strikes reportedly damaged three Yandex data centers, disrupting digital services and raising concerns about cloud resilience and disaster recovery.

Read more →

Google DevSite flaw allowed forged Flask sessions to execute code without login. Learn how it worked, when Google fixed it, and what developers should check.

Read more →

US and European banking regulators are scrutinizing AI agents, cybersecurity safeguards, and banks’ ability to recover from serious operational disruptions.

Read more →

Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. […]

Read more →

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. Heleket’s support agent on Telegram claims, despite all evidence to the contrary, that it…

Read more →

Anthropic says new Claude defenses reduced suspected AI reasoning extraction by up to 99%. Here’s how the protections work and what developers should know.

Read more →

Researchers identify two Unicode characters that can bypass Chromium domain checks, allowing lookalike websites to appear legitimate and increasing phishing risks.

Read more →

Microsoft Patch Tuesday security updates for October 2026 address a record 1,415 vulnerabilities. Prioritize the exploited zero-day, critical bugs and potentially wormable vulnerabilities. Microsoft just shattered every patch record in the book. October 2026 brought us a staggering 1,415 new CVEs from Microsoft alone. “Well, it’s a new record release from Microsoft, again. This is…

Read more →

AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. […]

Read more →

This research was conducted jointly with Julian-Ferdinand Vögele of Recorded Future’s Insikt Group. Details of the joint research and presentation are available here. Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is…

Read more →

Researchers at Forescout said the discovery shows how ClickFix is evolving from a delivery technique into full-blown cyber-criminal infrastructure

Read more →

This month’s update also marks the first official one for Windows 11 26H2 and the end of support for Windows 11 24H2 Home and Pro.

Read more →

Plus, OpenAI engineer accused of bugging office

Read more →

A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. […]

Read more →

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install…

Read more →

North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Department of Justice. Arrests in Ohio, raids in Texas Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo…

Read more →

Security and IT teams are under pressure to adopt AI, but many are seeing the opposite of what was promised. Tools that demo well don’t hold up in real workflows. Complexity increases. Trust breaks down. And instead of reducing workload, AI can introduce new risks and oversight burdens. This guide breaks down why AI adoption…

Read more →

The AI-enabled operation used spoofed emails, fake government documents, and the creation of a local organization to target schools in Peru and Ecuador, among other efforts.

Read more →

Simply asking Anthropic’s Claude Code to review an HTML file could hand attackers access to a developer’s machine, cloud credentials and software development environment, according to a new Noma Security finding. Noma’s researchers found a vulnerability affecting Anthropic’s Claude Code Desktop app that could allow malicious JavaScript embedded in an HTML file to execute without…

Read more →

Microsoft collaborated with Japanese authorities, Health-ISAC and several cybersecurity companies to dismantle an expansive, seemingly disconnected ecosystem of Chinese-language cybercrime tools and services, the company announced Wednesday. Since the start of the year, a vast collection of customized phishing kits developed and sold by Chinese-speaking threat actors — a cluster Microsoft tracks as Storm-2990 —…

Read more →

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. […]

Read more →

Smaller AI models may soon be able to spread autonomously among connected devices in the home—such as smart ovens and Android TV boxes, AI company Anthropic has warned. By exploiting security vulnerabilities in these devices, AI models could gain access, use their processing power, and spread further. This would allow them to continue functioning without…

Read more →

Ledger confirms hardware tampering in crypto wallets linked to a reseller. Researchers found implants that could expose recovery phrases and bypass authenticity checks.

Read more →

Nvidia may be looking to strengthen its position in AI beyond the chips powering the industry. The semiconductor giant is in early discussions to acquire Reflection AI or increase its investment in the American startup, according to the Financial Times. Reflection develops open-weight AI models, including Beam, which is designed for coding and agent-based tasks.…

Read more →

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS

Read more →

Built on Qwen3.5-2B, the System One model executes sub-31ms local inference, allowing enterprises to run automated classifications quickly, at low cost and completely offline without transmitting sensitive data to third-party cloud servers.

Read more →

A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client’s memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and…

Read more →

Considering a career in cybersecurity? Cybersecurity Career Week (CCW), a campaign led by the NICE Program at NIST from October 19-24, 2026, aims to raise public awareness and help people find their path to #ChooseCyber. During this week, academia, industry, non-profit organizations, and government agencies host events, share resources, provide trainings, and engage community to…

Read more →

Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake. The call comes in at 4:40 on a Friday. It’s the CFO, or it sounds exactly like her, asking the controller…

Read more →

Deeper Network Promo

Attackers without an account of their own were found logging in to Ivanti Connect Secure appliances using an authentication bypass flaw that the vendor has since fixed. Once inside, attackers ran arbitrary commands on the appliances. “Ivanti initially discovered a portion of this vulnerability as part of our product security program and patched it in…

Read more →

A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. […]

Read more →

OpenAI employee charged with planting hidden audio recorders to capture sensitive discussions about AI research and company strategy. On September 30, OpenAI staff found a small audio recording device jammed into a USB port on the back of a television in an executive conference room in their San Francisco office. The device had been there…

Read more →

Google has launched Gemini 4 Argon, a new flagship AI model aimed at complex enterprise and software-development workloads, pairing claims of stronger coding performance and advanced reasoning with an introductory pricing model that doubles after November 30. The model “excels at deep work in complex, real-world tasks,” Koray Kavukcuoglu, senior vice president of Google DeepMind…

Read more →

Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws. Just when you thought a previous record would stand for a while, Microsoft comes out again with the largest monthly Patch Tuesday release. Microsoft has said its growing use of AI to…

Read more →

A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI’s publicly available GPT-5.6 Sol model. Google has…

Read more →

We found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a recruiter, fill in their details, and pass what looks like a CAPTCHA. Then the page asks them to log in to Facebook. The interview is fake. The pages…

Read more →

Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud.  Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking

Read more →

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer’s production website, on its own. One login request let the user choose where…

Read more →

Ever since OpenAI’s ChatGPT chatbot and its offspring Microsoft Copilot were launched, critics have pointed out that both products — and all other generative AI tools — have been built using billions of dollars of stolen intellectual property. Training AI models requires vast amounts of written material, especially books, newspapers, and magazine articles. OpenAI, Microsoft,…

Read more →

People who have shopped with Phase Eight, Hobbs or Whistles will have to wait to find out whether their personal information was exposed in a cyberattack on the company behind the three UK fashion brands. TFG London, the UK business of South African retail group The Foschini Group (TFG), detected the incident on Sunday, 11…

Read more →

Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the “Administrator protection” security feature is enabled. […]

Read more →

Police tip hotlines already have their fair share of crank callers. Apparently they now have to contend with crank AI agents as well. AI agents have already been caught hacking software companies, breaching an Australian government portal, and trying to hack a Canadian government website. Now Anthropic’s Claude has added a made-up murder tip to…

Read more →

More internet-connected refrigerators have joined the official list of those affected by a cyberattack that ruined stocks of chilled food at hundreds of French supermarkets over the weekend. The French Computer Emergency Response Team (CERT-FR) advised supermarkets to disconnect any refrigeration control systems with a public IP address from the internet, and to reconnect them…

Read more →

Radware has announced Radware Model Context Protocol (MCP) Server Protection, a purpose-built solution designed to help organizations more securely adopt MCP as AI agents gain greater access to enterprise applications, data and business workflows. The solution is intended to give organizations visibility into their MCP infrastructure, help protect MCP servers against MCP-specific attacks and establish…

Read more →

SolarWinds has announced the launch of Avior, a standalone, goal-oriented agentic AI system purpose-built for mission-critical IT environments. Built on the SolarWinds Platform, Avior will help IT teams securely define goals, coordinate specialized agents, and track progress toward measurable outcomes across hybrid digital ecosystems. As technology infrastructure grows more complex and business-critical, variable outcomes can…

Read more →

Chainguard has announced Chainguard Harness, a new cyber harness that uses frontier AI models like Anthropic’s Claude Mythos 5.1 to find and fix exploitable vulnerabilities in an organization’s application code. Harness builds an application from an organization’s source code in an isolated microVM, instructs a frontier model to hunt for exploitable vulnerabilities in a live,…

Read more →

Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained…

Read more →

Dashlane data finds that passkey adoption is growing but not quickly enough

Read more →

Check Point Research found two LiteLLM vulnerabilities that could let low-privilege users execute code, access sensitive files, hijack admin accounts, and steal AI provider API keys.

Read more →

Scytale has announced the launch of Scytale MCP, a Model Context Protocol server that connects a customer’s AI tools directly to their compliance program. With Scytale MCP, tools such as Claude and ChatGPT can query live compliance data and complete routine work through plain language instead of screen-by-screen navigation. The release reflects how AI-native teams…

Read more →

As a long-time appreciator of advanced Android efficiency, I love me a good widget. A well-designed Android widget can surface important info for you when and where you need it — without forcing you to find your way into the related app, poke around in its various screens and menus, and actively look for the…

Read more →

At least two French supermarkets using temperature regulation devices from Dixell Electronics also experienced food stock disruptions

Read more →

GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and model serving costs by more than 98% compared with its previous large language model (LLM) pipeline. GitHub’s secret scanning covers two stages of development. Push protection checks changes…

Read more →

ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after…

Read more →

When I started writing regularly about cybersecurity management in 2015, the environment looked very different. Cloud computing was still reshaping enterprise technology. Ransomware had not become the industrialised threat it is today. Artificial intelligence was not driving boardroom discussions. Zero Trust had yet to enter mainstream technical vocabulary and quantum computing barely registered on the…

Read more →

A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, exfiltrate configuration data, and perform network reconnaissance. “In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at…

Read more →

Microsoft issued its largest ever round of security updates in the October Patch Tuesday

Read more →

A recording device wrapped in toilet paper and plugged into the back of a television in an executive conference room at OpenAI’s San Francisco office has led to the arrest of one of the company’s engineers. Abdulrahman Alfozan, a 35-year-old Saudi national who had worked at OpenAI as an engineer since July 2025, was arrested…

Read more →

Since July, US frontier AI labs and other AI leaders have revealed a string of incidents in which their models accessed external computer systems without authorization, events popularly described as AI agents “going rogue.” The most well-known and studied of these incidents is OpenAI’s hack into Hugging Face, which OpenAI initially characterized as “an unprecedented…

Read more →