Daily curated cyber threat intelligence for security professionals.
Sourcewww.404media.co
Curated
Senator Bernie Sanders, Representative Ocasio-Cortez, and Senator Jeff Merkley introduced the Ban Flock Act on Friday, which would stop federal agencies from using automatic license plate readers, 404 Media reports. The bills follow 404’s reporting on Flock’s surveillance footprint.
Sourcetherecord.media
Curated
An alleged ATM malware creator appeared in a Nebraska court following his arrest, The Record reports. The suspect, Aguirre, was added to the FBI’s Top 10 Most Wanted fugitives list in March — the first cybercriminal to make the list.
Sourcetherecord.media
Curated
Osaka Metropolitan University cancelled classes on Tuesday after a suspected ransomware attack left its internal network, email, and a range of administrative and academic systems unavailable, The Record reports.
Sourcewww.theregister.com
Curated
Carefully constructed web pages carrying ‘zombie instructions’ could trick GitHub’s Copilot CLI into sharing secrets when run in autopilot mode, The Register reports. The finding is another reminder that agentic coding tools can be steered by untrusted content in their context.
Sourcewww.darkreading.com
Curated
A proof-of-concept technique dubbed BigDiskBuster creates a silent gap in virus detection while Microsoft Defender appears to run normally — no exploit required, Dark Reading reports. It’s not quite an EDR-killer, but it shows how updates can be quietly blocked while the service looks healthy.
Sourcecyberscoop.com
Curated
Former NSA Director Paul Nakasone called the agency’s AI-focused restructuring ‘necessary’ to confront faster-moving cyber threats, CyberScoop reports, while warning that success will hinge on execution.
Sourcewww.darkreading.com
Curated
Google’s PageBreak AI agent has found 500 flaws across its web applications, Dark Reading reports. The effort illustrates a growing trend of pairing AI with deterministic validation to identify flaws, assess exploitability, and produce risk assessments.
Sourceblog.cloudflare.com
Curated
On October 11, 2026, the DNS root switches to a new key-signing key (KSK-2024), Cloudflare explains. The post walks through what the rollover means for operators and how RFC 8509 trust anchor sentinels let you test whether your resolver is ready.
Sourcewww.theregister.com
Curated
Customer data from Trump Mobile has been dumped online, The Register reports, in an embarrassing leak for the carrier — with some affected customers saying they never even received the gold devices they paid for.
Sourcewww.schneier.com
Curated
Schneier flags 404 Media reporting that a cyber-weapons manufacturer has developed technology to bypass iOS’s automatic inactivity reboot — the feature that locks an iPhone into a more secure state after 72 hours idle. If confirmed, the capability would blunt one of Apple’s key anti-forensics protections.
Sourcewww.itpro.com
Curated
Ransomware affiliate ‘Azazel’ set up his own leak site rather than paying RaaS operator The Gentlemen its share of ransom payments, ITPro reports. The falling-out offers a rare look at the economics — and the lack of honor — inside the ransomware-as-a-service ecosystem. The Gentlemen is the same crew behind the recent FTAPI breach claims.
Sourcewww.theregister.com
Curated
Intruders retrieved email addresses from a superseded sign-on service that school software provider Bromcom kept running for an internal system, The Register reports. The incident is a textbook case of legacy infrastructure expanding the attack surface long after it should have been retired.
Sourcewww.malwarebytes.com
Curated
Domino’s is warning customers by email that their accounts have been compromised in a credential stuffing attack, Malwarebytes reports. The incident is a reminder that password reuse remains one of the most effective attack vectors against consumer accounts.
Sourceunit42.paloaltonetworks.com
Curated
Unit 42 details Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub-hosted command-and-control malware to target critical infrastructure in Iraq. The campaign shows continued Iranian interest in Middle Eastern critical infrastructure.
Sourcewww.bleepingcomputer.com
Curated
Japanese media group Nikkei has disclosed breaches of its employees' Microsoft and Google email accounts, BleepingComputer reports. Details on how the accounts were compromised and what data was accessed have not yet been disclosed.
Sourcesecurityaffairs.com
Curated
Accenture has lost an FBI contract after a missed security patch exposed sensitive employee data, SecurityAffairs reports. The incident raises serious questions about operational security at one of the US government’s largest IT contractors.
Sourcewww.itsecurityguru.org
Curated
Hackers claiming a Snowflake breach have turned the ASOS app into a ransom note, with users reporting push notifications from the attackers, IT Security Guru reports. The breach claim remains unverified, but the highly visible defacement — reaching customers directly on their phones — makes it one of the more brazen incidents in recent memory.
Sourcewww.bleepingcomputer.com
Curated
A former core infrastructure engineer at a New Jersey-headquartered industrial company was sentenced to 32 months in prison for locking thousands of devices on his employer’s network in a ransomware-style attack.
Sourcearstechnica.com
Curated
Ars Technica examines the Model Context Protocol used for agent-to-agent communication, warning that trust gaps can spread malicious prompts from one agent to another. The piece argues it may be one of the riskiest protocols most practitioners have not heard of.
Sourcetherecord.media
Curated
The Wikimedia Foundation says OpenAI agents tried to edit pages and compromise a notes tool on its platforms. Beyond potential misuse, the foundation said AI agent activity drains web platforms that are operating with limited resources.
Sourcethehackernews.com
Curated
Apple says it will tighten controls around macOS Full Disk Access because of security risks from AI agents. Some developers are using the permission in ways that could expose files, mail, messages, and browsing history without users' full knowledge.
Sourcecybersecuritynews.com
Curated
An AI agent breached the Dutch Institute for Vulnerability Disclosure by chaining two previously unknown flaws in Zammad, an open-source helpdesk platform. The September 21 attack moved from a hijacked session to root access, giving the intruder full server control within seconds. DIVD detected the intrusion the next day and blocked it.
Sourcecybersecuritynews.com
Curated
Researchers have demonstrated an attack chain in which a malicious HEIC image uploaded to a WordPress Media Library can lead to remote code execution in the PHP-FPM process. The risk comes from libheif, a widely used component for reading HEIC, HEIF, and AVIF formats.
Sourcewww.bleepingcomputer.com
Curated
Italy’s data protection authority has fined IQVIA 7 million euros (about $7.8 million) over poor data-processing practices. The agency said roughly one million patients were put at risk of data exposure and de-anonymization.
Sourcedatabreaches.net
Curated
FBI and US Coast Guard investigators found evidence that hackers accessed the propulsion system of an oil supertanker as it approached the Texas coast this summer, according to US officials. The breach highlights the growing physical risks to maritime operations from cyberattacks.