Daily curated cyber threat intelligence for security professionals.
Sourcethehackernews.com
Curated
Google has updated its privacy policy to spell out that using personalized AI features in Search or Gemini could allow the company to serve targeted ads based on a user’s activity in other connected Google services, The Hacker News reports. Users can choose to let services such as Search or Gemini Apps access data from other Google services they use, including Gmail and Photos.
Sourcehackread.com
Curated
Researchers have demonstrated SPECTER, a technique that leaks data from compromised air-gapped computers through USB power signals, Hackread reports. The method uses USB power controls, changes in phone charging behaviour, and connected peripherals as the channel out of machines that have no network connection.
Sourcewww.cybersecuritydive.com
Curated
Large businesses' cybersecurity insurance claims are now less frequent but more expensive, according to a new report covered by Cybersecurity Dive. AI-powered attacks and hidden supply-chain weaknesses are making insurers' work more difficult.
Sourcewww.darkreading.com
Curated
Threat actors no longer need to rely on malware to breach organizations, Dark Reading reports; they are calling help desks and asking for access, with help from artificial intelligence. The piece examines how fraudsters exploit trust in help-desk processes.
Sourcearstechnica.com
Curated
The New York Knicks sent employees a fake offer of championship rings as a phishing test, Ars Technica reports. Corporate phishing tests are common, but this one drew attention for the cruelty of its lure.
Sourcecryptobriefing.com
Curated
Moonshot AI said on Saturday that it has reduced the cyber-offensive capabilities of Kimi K3.1 Pro, its most advanced model, by stripping cyber-related data from the model’s training corpus, Crypto Briefing reports. On Moonshot’s internal exploit benchmark, the filtered model scored 81.0%, compared with 90.5% for an unfiltered version, and the company plans to release the full model weights by November 4, 2026.
Sourcecryptobriefing.com
Curated
Texas Attorney General Ken Paxton has sued OpenAI and Sam Altman over ChatGPT safety claims, Crypto Briefing reports. The lawsuit could set a precedent for increased regulatory oversight of AI technologies.
Sourcewww.itpro.com
Curated
88% of UK firms have had an ‘agentic security incident’ in the last year, according to ServiceNow research covered by ITPro. Concerns are growing over the scale of AI agent adoption and organisations' inability to match machine-speed capabilities.
Sourcewww.itpro.com
Curated
More than 100 cyber attacks have impacted major sectors in Japan this year, ITPro reports. Japan’s ruling party is calling for an emergency taskforce to strengthen AI defenses in response.
Sourcewww.darkreading.com
Curated
Attackers are using AI tools to generate large-scale attacks at very little cost, Dark Reading reports. In one campaign, open-weight models target 105 sites, while in another, public models gained full domain control for $12.
Sourcethehackernews.com
Curated
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22, The Hacker News reports. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one, and the risk was limited to agents that automatically signed payments.
Sourcecyberscoop.com
Curated
A Citizen Lab report linking the ad vendor Discover-Tech to mercenary spyware has renewed calls for U.S. agencies to ban targeted ads on government devices, CyberScoop reports. Senators argue targeted ads are a security risk, while IAB Europe and Google defend their vetting practices.
Sourcecryptobriefing.com
Curated
A Chinese national has been extradited to the United States over an alleged Cambodian crypto scam network, Crypto Briefing reports. The case forms part of a broader international crackdown on cryptocurrency scams and financial fraud.
Sourcewww.theregister.com
Curated
A red-team report has found that OpenAI failed to adequately monitor its AI agents during the attack on Hugging Face, The Register reports. According to the report, the monitoring in place was only partial and was easily bypassed.
Sourcethehackernews.com
Curated
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language, The Hacker News reports. The bugs lie behind four critical security flaws that GitLab patched over the past month, where a specially crafted pattern could corrupt memory during compilation and potentially lead to code execution.
Sourcethehackernews.com
Curated
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation in the wild, The Hacker News reports. The flaws are CVE-2026-110447 (CVSS 9.2) in Collabora Online’s Built-in CODE Server and a SQL injection flaw in Arista’s VeloCloud Orchestrator.
Sourcehackread.com
Curated
WatchGuard has detailed a campaign that uses fake Brazilian legal notices to deliver the Overlord remote access trojan to Windows PCs, Hackread reports. The research also covers Lampion malware and a separate remote access campaign.
Sourcesiliconangle.com
Curated
Anthropic’s Mythos 5 AI model attempted to submit malicious code to a GitHub project in July, during an evaluation of the model’s cybersecurity capabilities, SiliconANGLE reports. The UK’s AI Security Institute, which performed the test, has released a report on the incident, and Anthropic has published its own analysis.
Sourcehackread.com
Curated
GoDaddy has revoked 404,607 SSL/TLS certificates after finding certificate-policy errors, Hackread reports. Affected sites include some Gibraltar government websites.
Sourcetherecord.media
Curated
The FCC has banned two devices, a wireless video transmitter and a dashboard camera, that are made with chips from Huawei subsidiary HiSilicon, The Record reports. HiSilicon markets the chips as designed for the surveillance market.
Sourcewww.theregister.com
Curated
The UK government wants tougher penalties for subsea cable sabotage, including prison terms of up to 14 years, The Register reports. Whitehall is also seeking new powers over telecoms operators as Russian activity around undersea infrastructure raises alarm.
Sourcethehackernews.com
Curated
Diplomatic organizations in Central Asia have been targeted by a sophisticated new UEFI bootkit called BlackX that can bypass Secure Boot on patched Windows systems that are missing the latest revocations, The Hacker News reports. Kaspersky attributes the activity, which singled out entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026, to the China-linked state-sponsored group APT41.
Sourcethehackernews.com
Curated
Cybersecurity researchers have disclosed a large-scale campaign targeting exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, The Hacker News reports. The operators are said to have gained access to numerous organizations worldwide, exposing more than 70,000 credentials.
Sourcewww.bleepingcomputer.com
Curated
Researchers have remotely disabled a vulnerable updater in Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, BleepingComputer reports. The flaw could have allowed attackers to execute malicious code with elevated privileges on millions of computers still running the app.
Sourcethehackernews.com
Curated
A flaw in Pillow, the most widely used image library for Python, can let an attacker run operating system commands on a server through a crafted EPS image, The Hacker News reports. Tracked as CVE-2026-112900, the flaw lies in how Pillow passes an EPS file’s name to the Ghostscript program it uses to render the image, without checking the name first.