IT Security News: Morning roundup, 2026-10-27 Summary Today's early reports were dominated by attacks that abuse trust and legitimate access, from fake IT support on Microsoft Teams to a hosting provider forcing resets after an unexplained incident. Several stories also…
Hackers Hijack AI Pentesting Agents to Install Backdoors and Steal API Keys
Hackers are now targeting the AI tools that security teams use to test their own networks. A new investigation describes automated campaigns that break…
Apple Released Patches for Exploited CoreGraphics 0-day Vulnerability for Older iPhones
Apple released iOS 18.7.11 and iPadOS 18.7.11 to patch a CoreGraphics zero-day vulnerability that attackers may have used in targeted attacks. Released on…
Cyberattack on University of Copenhagen exposes data of 525,000 people
The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on…
Hacker Uses AI to Breach 90 South Korean Organizations and Steal 8.2 Million Records
South Korean police have arrested a 32-year-old man accused of leading an AI-assisted hacking operation that stole personal records and internal files…
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Apple patched 286 vulnerabilities in iOS and macOS 27.2 and brought the fix for an exploited CoreGraphics zero-day to older iPhones.
Critical HashiCorp Consul Kubernetes Flaw Allows Attackers to Gain Elevated Privileges
HashiCorp has released fixes for a Consul-k8s authorization bypass that could allow an attacker to gain elevated Consul privileges from another Kubernetes…
Attack on email hosting provider for German far right party AfD exposed 345k accounts
Alternative für Deutschland swats away scandals as reporters swarm leaked email tranche
Apple iOS 27.2 Released With Fixes for 163 Vulnerabilities, Including Fix for Critical WebKit RCE
Apple released iOS 27.2 and iPadOS 27.2 on October 26, 2026, with fixes for 163 security flaws. The update covers iPhone 11 and later and a wide set of…
IT Security News Hourly Summary 2026-10-27 13h : 22 posts
22 posts published in the last hour 11:33Backporting security fixes to stable releases 11:33U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog 11:33Oracle pushes AI deeper into enterprise workflows with Fusion Companion 11:33HashiCorp Consul Vulnerability Allows Attackers…
Backporting security fixes to stable releases
The software you are running is almost certainly riddled with known, unfixed security bugs. These bugs can be trivially and quickly exploited by modern AI…
U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S.…
Oracle pushes AI deeper into enterprise workflows with Fusion Companion
Oracle is adding a new orchestration layer to its Fusion Cloud Applications suite to help enterprises automate business workflows, coordinate AI agents,…
HashiCorp Consul Vulnerability Allows Attackers to Bypass Authorization and Gain Elevated Privileges
HashiCorp disclosed a vulnerability in consul-k8s, a cross-namespace authorization bypass that could let attackers with limited Kubernetes permissions…
Private repos still leak secrets to Gheist, a stolen GitHub token campaign
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user…
Samsung TVs without mics may listen through soundbars, researcher says
The most startling claim is that a Samsung TV without a built-in microphone may use a connected soundbar or Bluetooth microphone to listen to the room.
Palo Alto Networks Named a Leader in the 2026 Gartner® Magic Quadrant™ for Privileged Access Management
For the eighth consecutive time, Palo Alto Networks is recognized as a Leader in the 2026 Gartner® Magic Quadrant™ for Privileged Access Management. Once…
Hiding Capabilities in AI Models
Interesting research: “ AI Models Can Provably Hide Arbitrary Capabilities ” Abstract: Capability evaluations aim to surface dangerous model behaviors…
Alibaba AI model tried to send data to Beijing server, Cohere says
An Alibaba AI model generated an unexpected command to upload data to a Beijing-region cloud storage service during a cybersecurity evaluation, rival…
Hackers Use Google Ads to Push Fake Claude Downloads Hosted on Real Claude.ai Domain
Hackers are buying Google Ads to promote fake Claude download pages hosted on Anthropic’s legitimate claude.ai domain, exploiting content-sharing features…
Keeping pace with e-evidence: New report examines Europe’s digital forensic capabilities
Coordinated by the European Commission in cooperation with Europol, the analysis draws on stakeholder consultations, dedicated meetings, surveys and…
Apple backports CoreGraphics zero-day patches to older iPhones
Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in “extremely sophisticated”…
Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
Anthropic presents its own initial public offering as a step toward mitigating the risks it believes AI poses.
Alibaba’s Qwen AI Model Attempts to Upload Files to China While Performing Cybersecurity Tasks
Researchers found that Alibaba’s Qwen3.8-Flash-Next model attempted an unauthorized upload to an Alibaba Cloud storage bucket in Beijing while performing…
First ISC2 AI Security Certification Expected for Early 2027
ISC2 is seeking 3000 volunteers to enrol to a pilot exam phase for its upcoming AI security certification