News

What the cybersecurity press and forums are saying · updated
From the press
The Hacker News ·

Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws

Anthropic on Tuesday said it's expanding a program that allows vetted cybersecurity professionals to test its advanced artificial intelligence (AI) models with reduced safeguards and blocking…
Help Net Security ·

Hackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains

Attackers who took control of three country-code top-level domains (ccTLDs) used that access to obtain HTTPS certificates for several Google domains and for domains run by other large organizations,…
SecurityWeek ·

Chrome 155 Update Patches 247 Vulnerabilities

Four critical-severity use-after-free defects were fixed in Chromecast, Browser, Navigation, and Track. The post Chrome 155 Update Patches 247 Vulnerabilities appeared first on SecurityWeek .
The Register - Security ·

Rails originator roasted over Rust boosterism

David Heinemeier Hansson's agent-coded bakeoff produced curious results
BleepingComputer, Security ·

Musician sent to prison for $10 million streaming fraud using AI bots

A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming…
SANS Internet Storm Center ·

ISC Stormcast For Wednesday, October 7th, 2026 https://isc.sans.edu/podcastdetail/10126, (Wed, Oct 7th)
CyberScoop ·

Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks

The FBI and Secret Service warned Fortinet users that FortiBleed, uncovered this summer, is a continuing threat. The post Alert: FortiBleed remains active campaign, can lock out users or lead to…
Dark Reading ·

ClickFix Attacks Evolve to Better Hide Malicious Payloads

Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages.
The Record from Recorded Future News ·

Alleged ATM malware creator appears in Nebraska court after arrest

Aguirre was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March, becoming the first cybercriminal added to the list.
CISA Cybersecurity Advisories ·

Hitachi Energy RTU500

Hitachi Energy RTU500 khardwood Oct 06, 2026 Release Date October 06, 2026 Description View CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings…
The Hacker News ·

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware…
Help Net Security ·

SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)

SonicWall has patched four vulnerabilities in its popular Secure Mobile Access (SMA) 1000 series of appliances, including one (CVE-2026-102255) that could allow remote unauthenticated attackers “to…
SecurityWeek ·

Anthropic Introduces 3-Tier Cyber Verification Program for AI Access

Anthropic is integrating the CVP and Project Glasswing into a single offering, with three levels of access to its most capable AI models. The post Anthropic Introduces 3-Tier Cyber Verification…
The Register - Security ·

COSMIC shuts the door on AI code as GNOME debates letting bug reports in

System76 demands human-written contributions, while a rival desktop developer argues bot-found flaws are too valuable to ignore
BleepingComputer, Security ·

Advantest confirms personal information stolen in ransomware attack

Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data. [...]
CyberScoop ·

Wiretapping change sparks big privacy fight in the Golden State

An update to a state wiretapping law will end private lawsuits over some internet tracking and surveillance, pitting businesses against privacy groups and unions.’ The post Wiretapping change sparks…
Dark Reading ·

Critical Healthcare Systems Aren't Quantum-Ready

A study of 2.5 million devices across 50 healthcare organization suggests the sector has a long way to go in getting ready for the post-quantum cryptography era.
The Record from Recorded Future News ·

South Korean officials believe AI agents were used to hack several banks

The personal data of at least 68,000 people was reportedly exposed in breaches of at least seven financial institutions, with officials saying they believe a Chinese cybersecurity tool was used to…
CISA Cybersecurity Advisories ·

Hitachi Energy REB500

Hitachi Energy REB500 khardwood Oct 06, 2026 Release Date October 06, 2026 Description View CSAF Summary Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product…
The Hacker News ·

Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes

Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic…
Help Net Security ·

Your Windows PC can now reach other PCs through Windows App

Microsoft has made remote PC connections generally available in Windows App on Windows. Users can access physical or virtual Windows PCs alongside Windows 365, Azure Virtual Desktop, and Microsoft…
SecurityWeek ·

ASOS Confirms Cyberattack, Data Breach

Hackers compromised a third-party communication platform and sent rogue notifications to ASOS users. The post ASOS Confirms Cyberattack, Data Breach appeared first on SecurityWeek .
The Register - Security ·

From reactive to proactive: How endpoint monitoring is fixing broken meeting rooms

SPONSORED FEATURE: Cloud-based telemetry is turning meeting rooms into managed endpoints, letting IT teams anticipate failures rather than scramble once users complain
BleepingComputer, Security ·

Ninja Forms plugin flaw exploited to hack WordPress sites

Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue…
CyberScoop ·

Former NSA chief Nakasone says agency overhaul is ‘probably needed’

Paul Nakasone said the reported reorganization is likely necessary to meet faster-moving cyberthreats and competition in AI, but warned its success will rest on execution and a workforce facing…
Dark Reading ·

Google's PageBreak AI Agent Finds 500 Flaws in Its Web Apps

The situation illustrates a trend toward using AI and deterministic validation to identify flaws and exploitability, and provide a risk assessment.
The Record from Recorded Future News ·

Osaka Metropolitan University cancels classes after suspected ransomware attack

Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems unavailable.
CISA Cybersecurity Advisories ·

Hitachi Energy SOI

Hitachi Energy SOI khardwood Oct 06, 2026 Release Date October 06, 2026 Description View CSAF Summary Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component…
The Hacker News ·

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade…
Help Net Security ·

ASOS confirms data breach after “hacked” app alert reaches shoppers

UK fashion retailer ASOS has confirmed a data breach after a notification claiming hackers had broken into its data was sent to shoppers through its app. ASOS was founded in 2000 and has 16.5 million…
SecurityWeek ·

Wikimedia Says Rogue OpenAI Agents Tried to Turn Its Tools Into Proxies

Wikimedia looked into whether its own websites had seen activity like that disclosed by other organizations The post Wikimedia Says Rogue OpenAI Agents Tried to Turn Its Tools Into Proxies appeared…
The Register - Security ·

South Korean president calls for creation of tools that stop all cyber-attacks

'Complete security paradigm refresh' needed for the AI era
BleepingComputer, Security ·

Hackers exploit 32 zero-days on first day of Pwn2Own Ireland

On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]
Dark Reading ·

IANS' Kakolowski: How AI Is Reshaping CISO Budgets & Security Teams

In this video interview, Nick Kakolowski, senior director for CISO research at IANS, talks AI: budgets, ROI, and changes inside security teams.
CISA Cybersecurity Advisories ·

Hitachi Energy Asset Suite

Hitachi Energy Asset Suite khardwood Oct 06, 2026 Release Date October 06, 2026 Description View CSAF Summary Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect…
The Hacker News ·

LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either…
Help Net Security ·

Anthropic loosens Claude’s cyber restrictions for verified defenders

Anthropic expanded its Cyber Verification Program (CVP), giving approved security professionals access to advanced Claude capabilities with fewer automated blocks on work such as malware analysis and…
SecurityWeek ·

Android’s October 2026 Updates Patch 25 Vulnerabilities

The patches resolve a critical vulnerability in Android’s System component that could lead to privilege escalation. The post Android’s October 2026 Updates Patch 25 Vulnerabilities appeared first on…
The Register - Security ·

Microsoft defines its Azure instance lifecycle, without any info about timing

Redmond explains how VMs die, but not when you can expect that to happen
Dark Reading ·

'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates

Not quite an EDR-killer, but the proof-of-concept cyber technique creates a silent virus detection gap while service runs normally, no exploit required.
CISA Cybersecurity Advisories ·

Savannah lwIP SMTP client

Savannah lwIP SMTP client khardwood Oct 06, 2026 Release Date October 06, 2026 Description View CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a…
The Hacker News ·

Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies

The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public…
Help Net Security ·

AI Agent Gateway: Open-source tool keeps credentials out of agent configs

Tuskira’s AI Agent Gateway is an open-source solution that sits between AI agents and everything they call: the MCP tool servers that connect them to services like GitHub and Jira, and the model…
SecurityWeek ·

Atlassian Patches Critical Vulnerability Affecting 8 Products

Unauthenticated attackers could exploit the flaw to access specific files in the web application root directory. The post Atlassian Patches Critical Vulnerability Affecting 8 Products appeared first…
The Register - Security ·

Anthropic reconfigures its cool kids security program

Company's Project Glasswing and Cyber Verification Program metamorphose into triple tier threat hunting club
CISA Cybersecurity Advisories ·

Johnson Controls EasyIO FG

Johnson Controls EasyIO FG khardwood Oct 06, 2026 Release Date October 06, 2026 Description View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full…
The Hacker News ·

Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers

In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built…
Help Net Security ·

OpenSSH 10.6 enables a post-quantum signature algorithm, so experimental keys need replacing

The OpenSSH team released version 10.6 on Oct. 6 and said it will ship releases more often for now to get bugfixes into users’ hands more quickly. The maintainers have received a large number of…
SecurityWeek ·

Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System

The Arizona Supreme Court said the information was copied for people dating back as far as 30 years. The post Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court…
The Register - Security ·

Google teams with nuclear power giant to give reactors a tune-up

Upgraded turbines, generators, and digital controls are expected to unlock an addition 890MW of capacity
The Hacker News ·

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit…
Help Net Security ·

AI endpoint management: Visibility, compliance, and remediation

Endpoint estates are growing faster than the teams that look after them. Hybrid work, cloud adoption, contractor laptops, a steady stream of new CVEs, and rising compliance pressure mean security…
The Register - Security ·

Anthropic Claude subscription plan provides more value than OpenAI's, study says

Research firm not exactly thrilled by House of Altman's subscription changes
On the forums
Finally scored a job after 1,5 years without one
r/sysadmin · 158 · 30 Career / Job Related
Please tell me I'm not the only one dealing with this "AI" vendor hype while basic hygiene is ignored.
r/cybersecurity · 402 · 91 AI Security
is it just me or anyone else feel like all this AI security stuff is moving way faster than the actual security controls?
r/sysadmin · 20 · 15 Question
Accenture is not only still around... they screwed up the FBI's cybersecurity
r/cybersecurity · 256 · 60 Business Security Questions & Discussion
Heads up: The 26H2 update is going to trigger a wave of Copilot and File Explorer tickets.
r/sysadmin · 688 · 184
Google and McKinsey brought back mandatory in-person interviews because AI deepfake fraud got too hard to catch on video.
r/cybersecurity · 450 · 23 News - General
I connected 364 parked domains to DMARC and 79 were being spoofed
r/sysadmin · 174 · 38
Headlines and pictures belong to their publishers and link to them.