Daily curated cyber threat intelligence for security professionals.
Sourcewww.itpro.com
Curated
A new study has found that a quarter of security vulnerabilities are never fully fixed, ITPro reports. The study warns against delegating flaw fixes to AI when human staff are still struggling to understand what is wrong with the underlying code.
Sourcewww.helpnetsecurity.com
Curated
Nearly nine in ten healthcare leaders say security or compliance staff always or usually review AI-written code that touches patient data before it goes live, yet seven in ten have still found an AI-built tool handling that data without IT or security knowing, according to a Paubox survey reported by Help Net Security. The tools include scripts, automations and integrations that staff built with AI coding assistants.
Sourceportswigger.net
Curated
PortSwigger Research has introduced a new scan check that escalates HTTP header injection to a CRLF-powered desync attack in a single prompt, the company says. The technique can serve other users a redirect to an attacker-controlled collaborator server, turning a lower-severity flaw into a critical one.
Sourcewww.bleepingcomputer.com
Curated
Vercel is gradually rolling out Device Bound Session Credentials on its platform as a defence against information-stealer malware, BleepingComputer reports. The technology binds a session cookie to the device that created it, so a stolen cookie cannot be replayed from another machine.
Sourcecybernews.com
Curated
Some landlords are using AI apps from companies such as Minut, NoiseAware and HostAlert together with Ring cameras to monitor rental guests and tenants, counting visitors and detecting parties and other house-rule violations, Cybernews reports. Privacy advocates cited in the report question the legality of using AI analytics in short-term rentals, warning the systems could deter bookings and anger neighbours.
Sourcewww.helpnetsecurity.com
Curated
Companies are increasing their cybersecurity budgets, with AI security and governance the top priority for additional spending, followed by cloud security, according to DNSFilter’s Cost of Shadow AI report, Help Net Security reports. About 74.5 percent of respondents reported a larger cybersecurity budget than 12 months earlier, while shadow AI use remains a persistent problem.
Sourcecyberscoop.com
Curated
Democratic control of Congress is set to shift US cybersecurity priorities, with the leaders of the homeland security panels already setting out their agendas on CISA and AI ahead of a lame-duck session, CyberScoop reports. The agendas follow the party’s midterm election wins.
Sourcecybernews.com
Curated
Cybernews researchers found that applications built on the Lovable AI platform exposed personal information, including passport details and about 200,000 chat messages, because of missing authentication checks on the apps' backends. The researchers scanned 7,216 web apps built with such tools and found that 8.5 percent leaked sensitive personal information in some form.
Sourcewww.securityweek.com
Curated
Google has released Chrome 157 with 213 security fixes, seven of them rated critical, SecurityWeek reports. The browser update resolves dozens of memory safety bugs and incorrect or missing authorization issues.
Sourcecybernews.com
Curated
Researchers found that Vizio’s SmartCast OS sent automatic content recognition pattern traffic even when the television sat idle on its home screen, in every test run, Cybernews reports. The traffic continued despite tracking being turned off, indicating the TVs ignored viewers' tracking opt-outs.
Sourcewww.bleepingcomputer.com
Curated
DreamHost has confirmed that attackers gained access to its File Manager platform for about two months and exposed customers' FTP, SFTP and SSH usernames and passwords, along with configuration files and database usernames, BleepingComputer reports. The File Manager is the interface customers use to access, modify and manage their websites and databases.
Sourcewww.eff.org
Curated
The EFF and the ACLU have filed an amicus brief asking the US Ninth Circuit to hold reverse location warrants categorically unconstitutional, the EFF says. The warrants, known as tower dumps, require cellular providers to turn over location data about every phone in a given area at a given time, and the case, United States v. Spurlock, is the first of its kind heard by a federal appeals court since a US Supreme Court ruling on the issue.
Sourcedatabreaches.net
Curated
A security breach in Inna, the student-information system used by Icelandic upper-secondary schools, allowed a student to attempt to alter other pupils' grades and attendance records, DataBreaches.net reports, citing Iceland Review. Iceland’s Data Protection Authority has received three notifications, while schools and the system operator are still investigating what information may have been accessed.
Sourcekrebsonsecurity.com
Curated
Several White House staffers are using computers or mobile devices equipped with residential proxy services that make their internet addresses available for others to rent, KrebsOnSecurity reports, citing security experts. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.
Sourcewww.bleepingcomputer.com
Curated
Bitdefender researchers have identified an Android flaw, dubbed GhostMap, that lets a specially crafted app requiring no permissions force a device into a persistent boot loop once it is installed, BleepingComputer reports. The flaw comes from how Android reads the ZIP structure inside an APK, and the researchers reproduced the crash loop on a Pixel 10, where a factory reset could be needed to recover.
Sourcecyberinsider.com
Curated
SEGA has suspended services linked to its ALL.Net arcade network and Aime platform after discovering unauthorized access to some of its servers, CyberInsider reports. The company took the services offline on November 1, Japan time, to investigate the intrusion, disrupting online play and other features across SEGA and Bandai Namco titles.
Sourcethehackernews.com
Curated
OpenAI says an automated pipeline using an upcoming cyber-focused AI model analysed 2,308 candidate Linux kernel findings, dynamically reproduced 1,724 vulnerabilities and produced 948 local privilege escalation exploits, along with a patch for each underlying flaw, The Hacker News reports. The 30-hour run cost about $1.2 million in API usage, according to the company.
Sourcethehackernews.com
Curated
CISA has added an Apple flaw, CVE-2024-27834, to its Known Exploited Vulnerabilities catalog following reports of active exploitation, The Hacker News reports. The improper authentication flaw, which affects multiple Apple operating systems, is being used to deliver information-stealing malware.
Sourcewww.bleepingcomputer.com
Curated
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide, BleepingComputer reports. The attackers stole configuration files and credentials from the compromised switches.
Sourcethehackernews.com
Curated
India’s CERT-In says an AI-assisted threat actor it tracks as Crafty Falcon is actively targeting banking, financial services and insurance organisations and cryptocurrency exchanges using publicly available AI offensive tools including ARTEX, The Hacker News reports. Separately, a copycat ARTEX Docker image downloaded about 9,000 times contains a hidden backdoor granting an unauthenticated root shell, and 62 internet-facing ARTEX consoles were found serving the backdoored build between November 2 and 4.
Sourcewww.theregister.com
Curated
Apple has announced that, starting with version 27.3 of iOS, iPadOS, macOS, and visionOS, items shared through public ‘Anyone with the Link’ iCloud links will be checked by Apple for ‘harmful content’ — a term the company has not defined. Sharing an item this way removes its end-to-end encryption even when Advanced Data Protection is enabled, and Apple says it may remove content, disable accounts, or involve law enforcement. Apple has not explained whether the checks will be automated, human-reviewed, or both.
Sourcedatabreaches.net
Curated
Lab 1 has published a report analysing 328 million files from 2,089 datasets exposed after cyber attacks, described as the largest published content-level review of stolen data posted online. It found the median breach now exposes data linked to 542 organisations beyond the named victim, and that 13,436 unique organisations were exposed through incidents recorded in 2025 and 2026. The findings underline how stolen data, including material buried in emails, PDFs, and other unstructured documents, puts companies at risk even when they were not the direct target of an intrusion.
Sourcewww.malwarebytes.com
Curated
Malwarebytes examined a fake page promising a $750 Apple Cash reward for completing a quick ‘device verification’ — the checks are scripted timers, the verification is an app install, and no reward is ever paid. The page uses fake countdowns, ‘spots left’ counters, and fabricated claim pop-ups to rush visitors, while affiliate tracking links suggest promoters earn commissions on installs and sign-ups. The page is not affiliated with Apple.
Sourcetherecord.media
Curated
Crédit Mutuel Arkéa has confirmed a cyberattack in which hackers are suspected of stealing an estimated $133 million. In a press notice, the bank said the attackers compromised an unnamed supplier and were able to make transfers using the bank’s own account. The confirmation follows earlier reporting of a suspected intrusion at the French banking group.
Sourcethehackernews.com
Curated
Check Point Research has detailed a jailbreak bundle for OpenAI’s Codex, called Haiou, that persistently modifies the agent’s configuration to inject advertisements for a third-party LLM gateway into its responses — a behaviour the researchers dub ‘prompt adware.’ Distributed on GitHub as an enhancement package, the bundle triggers ads on common greetings and has been forked dozens of times. Check Point warns the technique shows how third-party skills and configurations can quietly alter AI agent behaviour, a supply-chain risk as agents enter enterprise environments.