New integrations deliver New Relic right to engineers, helping them use coding agents more efficiently and address production issues within their existing workflows Engineers…

Read more →

The concept that hackers may already be inside sensitive systems is a core warning of modern cyber security strategy, heavily underscored by the Australian Signals Directorate ASD.

Read more →

OpenAI says it won’t reduce usage limits for the $100, $200, and $500 ChatGPT Pro plans, as well as Business Premium, and it also promised to keep Dots usage independent. […]

Read more →

HP has unveiled a refreshed consumer technology portfolio in Australia, headlined by the OmniBook 5, a 14-inch laptop offered in four colourways.

Read more →

Binance probes suspicious crypto transfers worth up to $5.8 billion as Tether and Circle freeze $1.79 billion in stablecoins linked to the activity. Binance is investigating a potential security incident after billions of dollars in cryptocurrency moved from wallets linked to the exchange on October 29. The transfers raised concerns about a possible hack, while…

Read more →

Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history. […]

Read more →

GitHub’s Ed Summers sees extraordinary potential in natural-language development, while research shows why accessible tools must be accompanied by deliberate effort to produce…

Read more →

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to trick AI coding agents into installing a NetSupport RAT. […]

Read more →

Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. […]

Read more →

The Pentagon treats August freezer failures at US military bases as a suspected hack and is working with French investigators after a supermarket attack. The Pentagon is investigating freezer failures that spoiled food at US military bases in August as a suspected cyberattack, according to four officials who spoke to Reuters. One official said US…

Read more →

As GitHub gives customers the option to let Copilot approve code changes, CTO Vladimir Fedorov argues that automation should concentrate human judgment where it matters most.

Read more →

Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. […]

Read more →

Plus, the DOJ expanded its criminal investigation into the Alaska Senate race, and the U.S. national debt reached 100% of GDP.

Read more →

Traders who lost money on the incident will be ‘made whole,’ the prediction-markets platform said.

Read more →

Obvious phishing emails with numerous red flags are somehow getting past some of the industry-leading secure email gateway (SEG) products.

Read more →

A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS. A search tool for the database, named Icepick, went offline for a spell before coming online again Thursday under a…

Read more →

The online behemoth reported higher-than-expected revenue from Amazon Web Services for the third quarter, showing sustained momentum in its cloud computing business.

Read more →

Discontent with the Google parent’s quarterly results highlights tensions of its transition from search engine to AI hyperscaler.

Read more →

A high-severity flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) is under active exploitation to crash vulnerable devices. The vulnerability, tracked as CVE-2026-76418 and rated 8.6 in severity, is due to logic errors when secondary authentication is configured on a…

Read more →

A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. […]

Read more →

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn’t. There’s a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from familiar apps, websites, and AI tools. Some are…

Read more →

42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups. The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files. They built the count from the search engines that index open cloud storage and published it as the Ransomnews Cloud Exposure…

Read more →

A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. […]

Read more →

According to Nerdio’s 2026 MSP report, just 12% report measurable AI productivity gains. Victoria Durgin goes Inside the Headlines with the findings and Caylent CEO Valerie Henderson to break down how MSPs can adopt AI and sell it to customers. Read the stories referenced: Only 12% of MSPs Report Measurable AI Gains, Nerdio Finds Caylent…

Read more →

An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says.

Read more →

<img src="https://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/10/threat_source-3.jpg" alt="A quiet week in infosec <. Welcome to this week’s edition of the Threat Source newsletter. “The darkest period of my life, so far, arrived the summer I was pregnant with my eldest son. The future was growing in me with all of its terrifying unpredictability, and I found myself anxious, unable to…

Read more →

Your JBL, Sony, or Bose Bluetooth headphones got a top-to-bottom wireless makeover — not just Auracast.

Read more →

Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico’s Health Sciences Center (HSC) this week. Read more in my article on the Fortra blog.

Read more →

President Trump’s order to bar Chinese batteries for energy storage has opened the door to South Korean and Japanese companies.

Read more →

Sponsored by:
Software Analyst Cyber Research

The latest version of Firefox fixes 167 security vulnerabilities, most of which are of high severity, while the newest version of Chrome patches 52 flaws, four of which are critical.

Read more →

💡There is basically One Main Loop in AI, and it applies to everything from building software to managing pretty much anything. ⛰️I call it General Hill-climbing. Here are the main components: 🖼️ Know what you want ✍️ Be able to articulate it 📐 Be able to measure progress 🧪 Do the work / test your…

Read more →

China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. Cisco has also confirmed that attackers are crashing its firewalls with a newly disclosed vulnerability. VMware ESX zero-day helped Chinese spies cover their tracks…

Read more →

Microsoft’s relationship with OpenAI has become a major financial force in its cloud business, even as the AI developer expands its partnerships with competing infrastructure providers. In its first-quarter fiscal 2027 filing, Microsoft disclosed approximately $10 billion in financial activity associated with OpenAI, according to the figures cited in the filing. The amount highlights the…

Read more →

A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users’ searches through tracking servers to generate advertising revenue from Bing and Yahoo. […]

Read more →

Deeper Network Promo

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Linux Kernel and Broadcom VMWare ESX vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-41709 (CVSS score of 7.6) Broadcom VMWare…

Read more →

University of Copenhagen cyberattack exposes data of 525,000 people and access PINs for 20,000, raising concerns about identity theft and campus security.

Read more →

Sony’s So-net breach exposed 2.59 million customer records and 54,401 email passwords. Learn what was leaked and how to protect accounts from follow-on scams.

Read more →

In this article Stages of AI adoption by North Korean threat actors AI use across North Korean threat operations AI-assisted targeting and reconnaissance AI-assisted social engineering and identity deception AI-assisted software and tooling development AI-assisted operational scaling and analysis Mitigation and protection guidance Microsoft Defender detections As Microsoft Threat Intelligence continues to track how threat…

Read more →

A DHS data leak exposed records of more than 41,000 workers, including ICE agents. Learn what was leaked, the suspected access method, and security risks.

Read more →

A flaw in the Linux kernel’s TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel’s own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote…

Read more →

A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.

Read more →

The bank’s message follows a trend among financial institutions that are restricting third-party AI agent access.

Read more →

EMBRACE affects AI coding tools Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop, enabling code execution, file theft and browser address-bar spoofing.

Read more →

Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop applications like GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, only to deliver…

Read more →

Malicious iOS scripts have become a leading cause of ad platform suspensions. They accounted for about one in five suspensions in Q3 2026, according to the State of Ad Fraud 2026: ADEX Trust & Safety Report from anti-fraud firm ADEX. The report examines one scheme in detail. It was built on the Coruna exploit kit…

Read more →

NIK C2 malware can fall back on victims’ OpenAI API keys to run AI queries

Read more →

Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campaign, dubbed Yoba, for the past two months. Its operator set up repositories and GitHub.io pages for supposed apps called…

Read more →

Oracle is expanding its Fusion Data Intelligence platform with new AI agents, operational analytics, and application integrations designed to help enterprises turn business data into actionable insights and automated workflows. Announced at Oracle AI World in Las Vegas, the updates extend Oracle’s existing analytics capabilities across finance, supply chain, human resources, and customer operations. The…

Read more →

Even approved AI tools can expose confidential information when employees use them. Fortinet announced the FortiGuard Inline AI Security Service on Oct. 26, bringing cloud-delivered AI protection to existing FortiGate firewalls. Customers can activate the offering without installing separate AI security infrastructure. For partners managing FortiGate environments, the announcement raises practical questions about which customer…

Read more →

Anthropic has acquired a biotech startup with one full-time employee, testing how much drug research a small team can accomplish with Claude. Anthropic disclosed on Oct. 27 that it acquired Mithril Medicine in July, bringing the startup’s research into rare forms of muscular dystrophy into its internal drug development efforts. The announcement included research updates…

Read more →

Microsoft has resolved a known issue that prevents non-admin users from connecting to devices via Remote Desktop when the “Administrator protection” security feature is enabled. […]

Read more →

Westcon-Comstor and Palo Alto Networks are tying additional partner support to business performance as they look to expand cybersecurity sales across Europe, the Middle East, and Africa (EMEA). The companies announced the Partner Growth Circle on October 27, introducing a program that combines joint business planning, technical enablement, demand-generation funding, and quarterly performance reviews for…

Read more →

Broadcom fixes 89 Spring Enterprise flaws and adds patching tools. Learn what security teams should verify about early access, testing, and deployment.

Read more →

Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code…

Read more →

Key findings Re-sampling URLs from the trace shared by Cohere yields 52 different destination hosts, many of which are local or do not exist, and one is an invalid top-level domain. Swapping the order of two program names in a check for available tools made the model much less likely to continue with a network…

Read more →

Socket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets. Once installed, the malicious extensions stole recovery phrases and private keys, which would provide the attacker with full control of a wallet. A crypto wallet is an app, browser extension, or physical device that lets you manage cryptocurrency…

Read more →

Mistral has released the weights for Large 4, along with some impressive Artificial Analysis scores.

Read more →

AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity from human users. […]

Read more →

CWE added. Informational change only.

Read more →

Sponsored by:
Software Analyst Cyber Research

Phishing remained the leading initial access technique, appearing in slightly over one-third of all Cisco Talos Incident Response (Talos IR) engagements — a decrease from over 50 percent last quarter. In addition to traditional phishing links and attachments, we observed numerous threat actors conducting voice phishing (vishing) in tandem with IT desk impersonation to socially engineer…

Read more →

CREST has published a framework for strengthening cyber resilience across financial services

Read more →

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. […]

Read more →

New York, New York, October 29th, 2026, CyberNewswire Now available as a standalone solution, Quantum Trust Hub delivers cryptographic posture management and agility for enterprises to uncover risk exposure, drive remediation at scale, and accelerate quantum readiness.   AppViewX, the leading identity security company built for the AI-powered and post-quantum enterprise, today announced new capabilities for…

Read more →

Pull documents with the _search API, or let a short Python script page through them with helpers.scan. If your pipeline kept the original log line, usually in message or event.original, extract just that field and you get the raw logs back. OpenSearch Dashboards can generate reports from saved searches, but not in a format LogTotal…

Read more →

Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. “It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and

Read more →

Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday. This network, dubbed Silent Train by the researchers, consists of chains of compromised SOHO and IoT devices…

Read more →

The short answer: run the search, click Export in the job toolbar under the search bar, and choose Raw Events, CSV or JSON. For a few thousand events, that’s all you need. For bigger pulls, skip the browser and use the splunk search CLI or the REST export endpoint. Both stream results instead of making…

Read more →

UAT-11473, an advanced persistent threat actor deploying KeyDrift, a custom malware framework targeting Cisco Catalyst SD-WAN controllers. The framework embeds inside legitimate control-plane processes to maintain access, intercept decrypted communications, and extract sensitive network encryption material. Observed targets span space and satellite services, defense and aerospace technology, and policy research. Talos assesses with high confidence…

Read more →

The cleanest way to get raw events out of QRadar is the Ariel REST API. Run an AQL query that selects UTF8(payload), wait for the search to finish, and pull the results as JSON. You end up with the original log lines exactly as your log sources sent them. The Log Activity tab can export…

Read more →

Deeper Network Promo

Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS’s Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused posted on X, noting that no public report of the…

Read more →

Plus, Cloud growth soars at Microsoft and Google.

Read more →

Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private invite-only Anthropic preview. In reality, adversarial actors are trying to steal Google…

Read more →

Everyone wants to know what Anthropic is up to, and hackers are gleefully exploiting the fact. New research from cybersecurity company Cofense describes a phishing campaign that hooks overeager enterprise users by making them think they are getting an invite to a private invite-only Anthropic preview. In reality, adversarial actors are trying to steal Google…

Read more →

New ADEX research shows how AI is making familiar scams cheaper and harder to detect, while fraudsters prepare to target AI shopping assistants.

Read more →

New York, New York, 29th October 2026, CyberNewswire

Read more →

Code generation is cheap, but trusting the code is expensive, and that cost grows as agents move from generating a few lines of code to acting across the whole pipeline. On the latest episode of our podcast The Next Commit, Sonar host Tom Howlett talked with Shashank (Shash) Patwardhan, application security lead at IFX Payments,…

Read more →

Nearly all cybersecurity clients would consider increasing their security spending in exchange for more strategic guidance, but relatively few managed service providers currently deliver those capabilities, according to new research from Cynomi. The company’s 2026 State of vCISO Report, announced October 29, found that 95% of clients would be more likely to increase cybersecurity spending…

Read more →

Veeam has released security updates to address CVE-2026-108142, a critical authorization bypass vulnerability affecting Veeam Backup & Replication 13. The flaw allows an unauthenticated remote attacker to bypass authorization controls associated with the Veeam CDP Coordinator Service. The vulnerability carries a CVSS v4.0 score of 9.1 and affects both Windows-based Veeam Backup & Replication deployments…

Read more →

Welcome to the 26th edition of Cloudflare’s DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One, Cloudflare’s Threat Intelligence organization, providing a comprehensive analysis of the…

Read more →

Cisco has released security updates for CVE-2026-76418, a high-severity zero-day vulnerability affecting the Remote Access SSL VPN service in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The flaw is being actively exploited in the wild and can allow an unauthenticated remote attacker to force a vulnerable firewall to…

Read more →

Google’s Gemini 4 Carbon is a frontier AI model designed for software engineering and cybersecurity tasks, with safeguards built on those of its predecessor, Argon. SEC-bench Pro (Source: Google) Google says its teams have seen Carbon spend days investigating and fixing bugs across large codebases and low-level systems. The model was also trained to handle…

Read more →

Liquid AI is shrinking foundation models down to pocket-sized powerhouses that do not need hyperscale cloud clusters to run enterprise tasks. The startup released its LFM3 lineup on Oct. 27, rolling out six open-weight models anchored by a 1.7-billion-parameter base. Built on a “tri-hybrid” design that weaves short convolutions, sliding-window attention, and global attention, the…

Read more →

Following the release of the new 14-inch M6 MacBook Pro earlier this week, Apple has bought the “touch experience” to its professional laptop series, introducing a $2,899 (and up) MacBook Pro you can use with touch. It’s very fast, very thin, very light, with an impressive PROLED XDR display and up to 24 hours battery…

Read more →

Attackers are probing a critical Oracle EBS vulnerability days after patching. See which versions are affected and how security teams can respond. Copy

Read more →

Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector. The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into…

Read more →

Canonical has restarted work on Ubuntu Core Desktop, the immutable and attestable version of Ubuntu that the company says will over time become the default Ubuntu desktop. Jon Seager, Canonical’s VP of engineering, laid out the plan and admitted that the 2023 developer preview “fell short” of what the company had in mind. On Core…

Read more →

The National Institute of Standards and Technology (NIST) has released finalized guidance to assist organizations in replacing cryptography that is vulnerable to quantum computing before future quantum computers pose a threat to sensitive information. Published on October 27, 2026, the report establishes a framework for migration that includes cryptographic standards, federal deadlines, and implementation priorities.…

Read more →

OpenAI and Anthropic agree that frontier AI systems need stronger oversight, but they are proposing sharply different approaches to stopping models that pose serious risks: Anthropic wants courts empowered to suspend dangerous systems, while OpenAI argues developers should be required to maintain and use effective shutdown controls. The proposals appear in separate submissions to California…

Read more →

SOC Prime’s LogTotal now supports log exports from four major SIEM and EDR platforms: Google SecOps, CrowdStrike Falcon LogScale / Next-Gen SIEM, Microsoft Defender for Endpoint (MDE), and Microsoft Sentinel. Each platform uses its own file formats, field names, and data model. LogTotal handles those differences automatically, so security teams can upload exports as they…

Read more →

Sponsored by:
Software Analyst Cyber Research

OpenAI and Anthropic agree that frontier AI systems need stronger oversight, but they are proposing sharply different approaches to stopping models that pose serious risks: Anthropic wants courts empowered to suspend dangerous systems, while OpenAI argues developers should be required to maintain and use effective shutdown controls. The proposals appear in separate submissions to California…

Read more →

GitHub has launched Copilot Fusion, a runtime model router and orchestrator that automatically selects AI models and execution patterns for coding tasks. Instead of requiring developers to choose a model for each step, Fusion coordinates reasoning, code generation, debugging, and review, ultimately providing a single cohesive response. The feature is available across all Copilot plans.…

Read more →

Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements. […]

Read more →

In this post, I will show you the 7 best post-quantum cryptography platforms for enterprise PQC migration in 2026. Post-quantum cryptography migration is becoming one of the most consequential security modernization programs enterprises will undertake. The challenge is not simply replacing RSA or elliptic curve cryptography with quantum-resistant algorithms. It is determining where vulnerable cryptography…

Read more →

An investigation into browser extensions identified 319 suspicious extensions linked to about 13.4 million reported users, exposing a search-hijacking ecosystem operating since 2016. Marketed as manual finders, PDF converters, safe search utilities, and AI search tools, the extensions funnel queries through operator-controlled infrastructure before delivering Yahoo or Bing results. The Searchjacked investigation expands earlier research…

Read more →

Attackers are impersonating AI agents from companies including OpenAI, Anthropic, and Meta in a bid to trick organizations into exposing sensitive credentials, according to researchers who observed a single threat actor cycling through dozens of fake bot identities while probing enterprise web servers for secrets. A single threat actor was seen posing as approximately 32…

Read more →

Artem Stryzhak gets 70 months for Nefilim and Hive ransomware attacks targeting hospitals, government agencies and businesses in the US and overseas.

Read more →

Three South Korean financial firms reported cyber incidents, including a Daishin Securities breach affecting 38,490 customers. Here’s what is known so far.

Read more →

Akamai research reveals that scam detections topped six million in Q2 2026

Read more →

Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. […]

Read more →