The iPhone maker for years bullied flash-storage makers into steep discounts—until AI hyperscalers bid up prices and gobbled up supply.

Read more →

Google, Meta and other tech firms are pushing back against broad ICE demands for user data as the federal agency scours platforms for immigration speech.

Read more →

Authorities seized the domain of Virtualine, a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said Tuesday.  Virtualine facilitated prolific criminal activity, including the distribution of child sexual abuse material (CSAM), the Justice Department said. The Russian-speaking bulletproof hosting provider…

Read more →

Fortinet raises 2026 revenue guidance to 20 per cent year-over-year growth.

Read more →

Dutch spies, Russian hackers and Jared Kushner’s iPhone. It sounds like the ingredients for a thriller, but according to claims in a new book the US President’s son-in-law may have been hacked twice. Is any of it true, and what does it tell us about the phones in our pockets? Meanwhile, James Ball explains that…

Read more →

Use Verified Boomi Evidence to confirm ecosystem standing, Core Strength to match technical need, Delivery Coverage to assess geographic fit, and Delivery Model to judge how…

Read more →

Drop-in agent skills evolve quickly. Yet 26 percent of the 31,132 public skills analysed in a January 2026 study carried at least one vulnerability, and 5 percent were likely…

Read more →

Information published.

Read more →

Understand APNIC IPv4 transfer rules, buyer requirements, fees and approval steps, with helpful checks to assess address blocks before completing a transaction.

Read more →

Expanded alliance brings together the Dayforce Agentic HCM Platform with Deloitte’s human capital, payroll, and controls experience to help organisations accelerate…

Read more →

A next-generation desktop craft workstation that unifies scanning, printing, and blade cutting to redefine home crafting through seamless, error-free execution.

Read more →

New Barracuda Research Study Reveals 45% of Australian Organisations Have Replaced or Eliminated Entry-Level Security Roles With AI, While 68% of Security Teams Have AI-Related…

Read more →

Six-city Cook. Connect. Collaborate series brings partners together across Australia Pay-for-performance partner program incentivises midrange growth among eligible partner…

Read more →

A conversational experience lets anyone describe what they need and build it securely in moments — no point solutions, no need to code, no costly customization Company also…

Read more →

Insurers gain speed and precision across the insurance lifecycle to launch products faster, assess and price risk more effectively, and resolve claims sooner

Read more →

New services and capabilities address emerging attack surfaces that most resilience strategies weren’t built to handle

Read more →

Recent reports of AI systems acting beyond their intended scope are a timely reminder to get the basics right. We wouldn’t give a new contractor access to every file with no…

Read more →

WireGuard, OpenVPN, and Shadowsocks often appear in the same privacy conversation, but they were built for different jobs.…

Read more →

New Manhattan Associates research reveals how AI could challenge retailer loyalty, with stock availability and fulfilment also influencing where shoppers buy

Read more →

Experienced security industry executive to strengthen engagement with major enterprise and critical infrastructure customers

Read more →

Australian consumers are already buying products recommended by AI tools, giving retailers a new reason to examine whether their product information helps shoppers make the…

Read more →

A new $2,899-and-up MacBook Pro comes with an impressively high-contrast—and finger-friendly—screen.

Read more →

CVE-2026-74496, CVE-2026-74743, CVE-2026-89481, CVE-2026-89638, CVE-2026-89648, CVE-2026-90227, CVE-2026-93287, CVE-2026-93785, CVE-2026-93795, CVE-2026-93798, CVE-2026-93800, CVE-2026-93817, CVE-2026-97416, CVE-2026-97417, CVE-2026-97420, CVE-2026-97421, CVE-2026-97430, CVE-2026-97441, CVE-2026-97444, CVE-2026-97445, CVE-2026-97446, CVE-2026-97448, CVE-2026-97449, CVE-2026-97450, CVE-2026-97451, CVE-2026-97452, CVE-2026-97453, CVE-2026-97454, CVE-2026-97455, CVE-2026-97456, CVE-2026-97472, CVE-2026-97476, CVE-2026-97481, CVE-2026-97483, CVE-2026-97484, CVE-2026-97523, CVE-2026-97524, CVE-2026-97557, CVE-2026-97568, CVE-2026-97572, CVE-2026-97573, CVE-2026-97596, CVE-2026-97598, CVE-2026-97611, CVE-2026-97612, CVE-2026-97899, CVE-2026-97904, CVE-2026-97905, CVE-2026-97940, CVE-2026-97951, CVE-2026-97958, CVE-2026-97959, CVE-2026-97995, CVE-2026-97998, CVE-2026-98010,…

Read more →

A leak website was published Wednesday, showcasing internal data on more than 41,000 Department of Homeland Security employees and contractors after it was obtained by hackers who claimed to have breached an identity service used by the agency.   The transparency nonprofit Distributed Denial of Secrets and the hacker maia arson crimew got the data from…

Read more →

Cisco Talos has identified UAT-11473, a highly sophisticated advanced persistent threat (APT) actor, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems. UAT-11473 then installed a custom malware framework we track as “KeyDrift” consisting of multiple components geared towards collecting sensitive…

Read more →

U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. […]

Read more →

From a new smart alarm clock to an Alexa-powered 3D map of your home, here’s what’s new from Amazon, including prices and release dates.

Read more →

Artem Stryzhak gets 70 months in prison for Hive and Nefilim ransomware attacks, while the FBI offers $11 million for his alleged co-conspirator. A federal court in Brooklyn has sentenced Artem Stryzhak, a Ukrainian national, to 70 months in prison for using ransomware to extort millions of dollars from victims. The U.S. Attorney’s Office for…

Read more →

The company’s cloud business continued to post accelerating growth in the most recent quarter, contributing to a higher profit and easing jitters over potential returns from the AI build-out.

Read more →

World of Warcraft: Forever is imminently due for release and Blizzard’s designers explained how a familiar world, stunning refreshed visuals, and more room to experiment will…

Read more →

Sponsored by:
Software Analyst Cyber Research

The company’s total revenue was $127.6 billion, just below the level Wall Street predicted, but cloud revenue grew faster than expected.

Read more →

A working day is full of small, repeated jobs, from writing up meeting notes to chasing approvals and sending weekly updates, and AI agents can take over much of that work.

Read more →

World’s largest pure-play MSSP to expand reach and scale of Wayfinder’s MDR and IRR services, and bring SentinelOne’s AI security, ASOC and endpoint detection and response EDR…

Read more →

The supply chain attack campaign’s shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.

Read more →

Deeper Network Promo

Entire is challenging GitHub with a developer platform built around coding agents, replacing conventional pull requests with automated evaluations and offering Australian…

Read more →

Fraud prevention combines rules, AI and behavioral analytics to stop scams, reduce false declines and keep automated decisions explainable through human review.

Read more →

A Florida judge ruled this week that ex-Overstock CEO Patrick Byrne is not liable in a lawsuit brought by a Dominion Voting Systems executive over a film that accuses the former electronic voting hardware and software company  executive of saying he “made sure” that Republican presidential candidate Donald Trump wouldn’t win reelection in 2020. The…

Read more →

Apple finally revealed its new MacBook M5 Pro and Max with a touchscreen OLED display, bringing the best features from the iPhone to its laptops.

Read more →

Discord announced a new feature that can make your server messages discoverable on Google. Here’s how to opt out.

Read more →

You can ask Amazon’s voice assistant to show you your favorite photos.

Read more →

Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. […]

Read more →

The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. “First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure,” Lumen Technologies Black Lotus Labs…

Read more →

Is your pricey Claude Enterprise account worth it? Anthropic is trying to surface insights with three tools.

Read more →

New York, United States, October 28th, 2026, CyberNewswire New hands-on lab lets security practitioners explore PHP2Shell exploitation firsthand as AI-assisted research reshapes vulnerability discovery. OffSec today announced the release of a free, interactive hands-on lab in Proving Grounds Play (PG Play) to help security practitioners examine and defend against the critical “PHP2Shell” vulnerabilities (CVE-2026-109618 and…

Read more →

A hacker has leaked 115 GB of Summit Public Schools data containing billions of lines, student and staff…

Read more →

GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall. The checks run before a package reaches a laptop, a build, or a coding agent. GitHub says…

Read more →

New York, United States, 28th October 2026, CyberNewswire

Read more →

Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android’s usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full catalog, along with every new app and update, for ongoing malware scanning. Approved stores…

Read more →

I got the opportunity to measure the radiation emitted by uranium glass. Uranium glass is glass with uranium added to the glass mix for coloration. My Bosean FS-5000 meter did not detect any radiation from the uranium glass. The counts per second (CPS) value was around the same on the uranium glass and away from…

Read more →

Amazon just dropped new smart home gear in response to Apple. Here’s how the Echo Show 16 stacks up.

Read more →

Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information. […]

Read more →

A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge’s sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five months after the chain won $175,000 at the Pwn2Own Berlin contest in May. Microsoft…

Read more →

Thanks to the newly proposed WebAI web standard, the company will start shipping local AI models with its flagship browser.

Read more →

Introduction On Wednesday, 2026-10-28, I ran across a ClickFix campaign I haven’t seen before. Like several other ClickFix campaigns, this one uses a fake Cloudflare verification page. It targets both macOS and Windows. I don’t yet have a name for this specific activity, but this diary shares some screenshots and indicators. Unfortunately, I was unable…

Read more →

Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root

Read more →

A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to search websites for exposed credentials, private keys and cloud configuration files.

Read more →

The FEC’s filing system is offline after a reported hacking attempt, delaying campaign finance disclosures days before the 2026 midterm elections.

Read more →

CyberStrikeAI used 44 AI agents to target Japanese organizations. Learn how the attacks worked and what security teams across APAC should check.

Read more →

Sponsored by:
Software Analyst Cyber Research

Fake court notices target more than 100,000 companies in a LodaRAT phishing campaign. Learn how the attack works and what security teams should check.

Read more →

Microsoft Authenticator flaw CVE-2026-80097 scores 8.6 and puts Android work account tokens at risk. Learn which versions are affected and how to stay safe.

Read more →

October is Cybersecurity Awareness Month, and it’s a good time to think about how much the world has changed for chief information security officers (CISOs) in the last 12 months. A year ago, we thought we were already in the thick of AI and starting to understand it. Since then, agents have spread across the…

Read more →

Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. […]

Read more →

Volt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected, Lumen Technologies’ Black Lotus Labs said in a Wednesday report. The covert access operation that researchers call “Silent Train” isn’t a standalone network,…

Read more →

GMO Internet has told customers to unplug their PCs in advance of a possible ransomware attack

Read more →

Prosecutors announced charges against six alleged scammers based out of Africa who targeted Americans with fake non-fungible token (NFT) investment scams by posing as women on dating websites, netting hundreds of victims. According to an affidavit for the arrest of of the six people — Chui Kok Wa, Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille…

Read more →

A Ukrainian man who carried out ransomware attacks for both the Nefilim and Hive gangs, including attacks on law firms and a healthcare provider during the COVID-19 pandemic, has been sentenced to 70 months in a US prison. Read more in my article on the Hot for Security blog.

Read more →

It’s unclear when or how the Echo Studio with Home Camera starts analyzing your room – or whether you’ll need to opt in first.

Read more →

For most of my career, I have watched new security platforms work through enterprise programs at a slow pace, so when AI began showing up in security operations tools, I assumed it would follow the same path. I expected AI adoption in the SOC to lag behind almost every other category of security technology, because…

Read more →

Deeper Network Promo

Attackers have used fake ChatGPT and Claude projects to distribute Yoba malware

Read more →

Advanced audio features are great, but ecosystem integration is better. Here’s how Samsung’s newest clip-on Buds compare to its rivals.

Read more →

A critical vulnerability in the GoAhead embedded web server can allow revoked client certificates to remain valid during mutual TLS authentication, potentially giving previously trusted identities continued access to protected devices and services. Tracked as CVE-2026-115881, the flaw carries a vendor-assigned CVSS score of 9.1 and affects GoAhead versions 3.4.5 through 6.1.0 when the software…

Read more →

Discover how Cisco Live Protect, virtual patching, and Secure Workload help defenders reduce vulnerability exposure while buying time for critical patches.

Read more →

Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. […]

Read more →

ControlUp has announced Pulse AI Resolve, the real-time investigative AI layer of the Pulse AI ecosystem. A major enhancement of ControlUp’s endpoint self-service capability, previously ControlUp Connect, Pulse Resolve brings AI-powered investigation and remediation, built-in governance controls, and proactive issue detection directly to the endpoint. It helps organizations resolve IT issues faster while reducing the…

Read more →

Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application. An unidentified application The company’s analysts haven’t been able to confidently determine which software it was, and because no logs associated with the…

Read more →

Amazon’s new Echo Dot includes a built-in Eero Wi-Fi extender, along with other smart home features.

Read more →

The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.

Read more →

Discover-Tech allegedly targeted Starlink users with digital ads to track their locations, according to sources cited in a new Reuters report. Digital defense firm TrendAI found that an Israeli ad tech company was heavily targeting users of satellite internet service Starlink, probably to spy on them. That’s according to six people familiar with the matter,…

Read more →

Digitate has announced ignio Hummingbird, the latest release of its agentic AIOps platform. Hummingbird introduces AI agents that bring operational expertise to specific IT tasks, move from diagnosis through approved action and verification, and operate within enterprise change, approval and audit controls. The release also enables enterprises to build their own IT operations agents and…

Read more →

IBM wants enterprise AI agents to have something human employees already do: a verified identity, defined permissions, and someone accountable for their actions. At its TechXchange 2026 conference in Atlanta, IBM announced the general availability of IBM Agent Identity alongside HashiCorp Vault 2.2, introducing tools designed to help businesses manage agent identities, credentials, and access…

Read more →

Over 345,000 unique email addresses were exposed in the September 2026 breach at German far-right political party Alternative für Deutschland (AfD). Breach notification service Have I Been Pwned (HIBP) added the data to its database on 27 October, listing email addresses and email messages as the compromised information. HIBP has flagged the incident as a…

Read more →

Politicians in Europe and the U.S. are speaking out against the use of advertising technology to infect targets with zero-click spyware. Following recent findings from the Citizen Lab, members of the European Parliament signed a letter urging the E.U. to investigate the potential exposure of its institutions to zero-click spyware through online targeted advertising. In…

Read more →

Swimlane has announced new capabilities in the Swimlane Turbine platform that allow security teams to run their own detection logic against large volumes of data and send resulting alerts directly into Swimlane AI SOC for investigation and response. The October release also adds two-way Model Context Protocol (MCP) support and new Hero AI agent that…

Read more →

AI agents reportedly accessed Anthropic’s business systems through third-party software in under 12 hours, exposing enterprise security weaknesses.

Read more →

Nvidia’s Mark Weatherford says CISOs must translate AI cybersecurity risks into business priorities, clarify risk ownership and balance innovation with security controls

Read more →

VikingCloud has launched AI Governance Services, a new set of compliance and risk assessments that find the AI tools in use across a business, show where security controls fall short, and deliver a remediation plan to close the gaps. Multi-location brands struggle to hold every location to one security standard. Shadow AI makes that even…

Read more →

An undisclosed number of Engie customers have had their data compromised after a supply chain incident

Read more →

Otter has added a new Work mode to its AI Chat assistant, expanding the range of tasks it can carry out before and after meetings. It’s part of a wider drive by Otter — which received $320 million in funding last week — to move beyond meeting transcription and into automating tasks and workflows. The…

Read more →

Sponsored by:
Software Analyst Cyber Research

Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerability.

Read more →

Added supported editions of Microsoft Office to the Security Updates table because they are affected by this vulnerability. Microsoft recommends that customers running any of these editions of Office install the latest security updates to be fully protected from this vulnerability.

Read more →

Attackers bypassed multifactor authentication (MFA) in every business email compromise (BEC) incident where it was enabled among cases investigated by LevelBlue in Q3 2026, highlighting growing identity security risks as cybercriminals increasingly exploit legitimate credentials and trusted IT tools. According to LevelBlue’s latest threat intelligence briefing, BEC remained the most common incident type, accounting for…

Read more →

Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as “PHP2Shell” put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. […]

Read more →

PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach. […]

Read more →

Arista heeft een kritieke kwetsbaarheid verholpen in VeloCloud Orchestrator (VCO) On-Prem. De kwetsbaarheid met kenmerk CVE-2026-114625 heeft een CVSS-score van 9.9 en betreft SQL-injectie. Een geauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken om verhoogde rechten te verkrijgen en zich voor te doen als een lokale ‘superuser operator’. Hierdoor kan de kwaadwillende toegang krijgen tot…

Read more →

Payment security doesn’t have to be complicated for merchants. Small, practical actions can make a meaningful difference in protecting payment data. PCI SSC provides practical resources to help merchants get started. With a strong data security foundation you can protect your customer payment data and prevent data breaches that can put you out of business.…

Read more →

This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bank’s rules. Bianco Research president Jim Bianco raised the question during Unchained’s…

Read more →

Upwind Security has raised $400 million in Series C funding to expand its cloud and AI security platform, bringing the company’s total funding to more than $800 million. Bessemer Venture Partners led the round, with participation from all existing Upwind investors, including Greylock Partners, Cyberstarts, Craft, Salesforce Ventures, Alta Park, Picture Capital, Swish Ventures, Cerca…

Read more →