The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian…
Meta Faces $25 Billion Penalty Linked to Cambridge Analytica Scandal
A New Mexico judge ordered Meta to pay $25 billion for misleading users about privacy, setting a record penalty. Meta plans to appeal. This week a New…
Unauthorized AI Agents Found Accessing Customer Accounts at Major U.S. Banks
U.S. banks face challenges as third-party artificial intelligence agents detect unauthorized access to customer accounts. This situation raises concerns…
Torvalds: AI is fine for competent devs, but spare us the ‘drive-by’ patches
Kernel maintainers stop asking who used AI, as long as the code is good
Capcom Confirms Data Breach Exposing 11.7 Million CAPCOM ID Records
Capcom has confirmed a data breach that affects 11,774,247 CAPCOM ID records worldwide. An unauthorized third party accessed customer information linked…
SBI Notifies Customers Affected by Recent Cybersecurity Incident
The State Bank of India (SBI) has individually notified customers whose data was involved in a recent cybersecurity incident. In an update focused on…
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months
The critical-severity SQL injection flaw allows attackers to access privileged internal functionality and gain operator privileges.
ISC Stormcast For Friday, October 23rd, 2026 https://isc.sans.edu/podcastdetail/10148, (Fri, Oct 23rd)
This post has no text preview — click the link below to read the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Friday, October 23rd, 2026 https://isc.sans.edu/podcastdetail/10148,…
CA shutdown puts Java, containers, and security appliances in the certificate crosshairs
A certificate authority’s decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on…
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using…
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
Pillow, the most widely used image library for Python, can be made to run operating system commands on a server by specifying the name of a file it is…
PHP2Shell: Millions of Attacks, No Confirmed Successful Exploits Yet
PHP2Shell attacks have surged into the millions, but no successful exploitation is confirmed. Patch it immediately. On October 21, PHP released emergency…
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the…
Crime Stoppers chapter freezes tips after breach breaks anonymity promise
A Crime Stoppers chapter has stopped accepting tips after a breach exposed information about anonymous tipsters.
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus…
New Mexico Fines Meta $25bn Over Cambridge Analytica Scandal
Federal judge finds Meta’s ‘wilful’ deceptive conduct would have justified much larger fine under state’s unfair practices law
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.
Claude Finds 493 Security Issues, Including Defenses That Failed Silently
Anthropic’s Claude found 493 security issues across 25 open-source projects, including silently disabled protections and weaknesses that prompted OpenSSH…
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it,…
Capcom data breach exposes 11.7 million account records
Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company. The company has disclosed…
27 arrests and 248 potential victims identified in action week against labour exploitation
Europol, the European Labour Authority (ELA), and 34 participating countries today announced the results of an action week targeting human trafficking for…
PoC Exploit Released for Two Critical PHP RCE Vulnerabilities as Hackers Launch Attacks
Public proof-of-concept exploit code targeting two critical PHP vulnerabilities has surfaced as attackers scan exposed servers and attempt exploitation.…
UK threatens subsea cable saboteurs with 14 years behind bars
Whitehall wants tougher penalties and new powers over telecoms operators as Russian activity raises alarm
Attacks on Tech Firms Behind Most Third-Party Data Breach Victims
Kroll found that 69% of data breach victims in the past year were affected by a third-party breach, with attacks on tech companies the most common cause