Daily curated cyber threat intelligence for security professionals.
Sourcethehackernews.com
Curated
The Russia-linked state-sponsored threat actor APT28, also tracked as BlueDelta, Fancy Bear and Forest Blizzard, has been attributed to attacks targeting two NATO member states, The Hacker News reports. The Symantec Threat Hunter Team is tracking the activity, which includes a breach of a NATO naval shipbuilder and a new reflective loader.
Sourcewww.malwarebytes.com
Curated
Android users report that Google automatically added their phone number to accounts they wanted to keep separate, Malwarebytes reports. The post explains how to check which accounts a number has been added to and how to stop it.
Sourcedatabreaches.net
Curated
A suspected cyber incident left Parkview Health patients without access to the MyChart patient portal and doctor searches, DataBreaches.net reports. The health system disabled its network after detecting suspicious activity and directed patients with urgent medical needs to phone calls or walk-in clinics.
Sourcewww.schneier.com
Curated
A leaked confidential Cellebrite document describes a capability the company calls Advanced Unlocks, including a possible iPhone radio zero-day, Schneier on Security reports. The reporting is based on a document leaked to researcher Justin.sh.
Sourcewww.bleepingcomputer.com
Curated
A Nigerian national has been sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019, BleepingComputer reports. The scheme stole $3.3 million from taxpayers. CyberScoop and The Record versions of the same sentencing were dropped as duplicates.
Sourcewww.malwarebytes.com
Curated
Owners of Meta’s smart glasses reported unexpected recordings of private conversations without a wake phrase, Malwarebytes reports. Meta says it has fixed the unprompted recording issue but has not explained what went wrong or what happened to the audio.
Sourcehackread.com
Curated
Japanese police have arrested a Chinese couple accused of hiding a computer in a Kobe hotel to send nearly 480,000 phishing emails, Hackread reports. The pair are also accused of using stolen credit card details to make purchases.
Sourcesecurityaffairs.com
Curated
Germany’s Alternative für Deutschland (AfD) party confirmed on October 19 that its hosting provider was hacked in September, Security Affairs reports. An anonymous site has published AI-generated summaries of 421,000 messages from the breach, raising questions about authenticity and privacy.
Sourcehackread.com
Curated
Ocean Security has found a phishing campaign, dubbed Phantom Preview, that abused legitimate Frame.io notifications and hidden PDF links to steal Microsoft 365 credentials, Hackread reports. Because the messages arrive through a legitimate service’s notifications, they can appear trustworthy to recipients.
Sourcearstechnica.com
Curated
Meta’s Muse AI has been exposing users' personal and business secrets when they share conversations, Ars Technica reports. Meta is suspending the sharing feature while it investigates the privacy issue.
Sourcewww.bleepingcomputer.com
Curated
Development platform Zeabur has disclosed a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure, BleepingComputer reports. The company says the attacker stole over 3.2 million environment variable records and information for 321,810 accounts, and it is shutting down after its second breach in two months.
Sourcewww.securityweek.com
Curated
NIST, CISA and the NSA have shared ten voluntary practices for preparing for, detecting, responding to, recovering from and reporting rogue AI agent incidents, SecurityWeek reports. The guidance is aimed at organisations deploying autonomous AI agents.
Sourcewww.404media.co
Curated
Officials said they wanted to search the phone of Samuel Tunick, a Stop Cop City activist, for child abuse material, 404 Media reports. According to 404 Media, the search was actually pursued because he was suspected of ‘terrorist activities’ after he wiped his GrapheneOS phone.
Sourcewww.helpnetsecurity.com
Curated
Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command, Help Net Security reports. The feature targets the social-engineering pattern, used in ClickFix-style attacks, in which a fake fix or verification step pastes a harmful command.
Sourcewww.theregister.com
Curated
The curl project’s maintainers say they are being swamped by a rising volume of vulnerability reports and will take low-level flaws public to survive the ‘avalanche’, The Register reports. From October 26, only high and critical cases will stay private, as the project seeks help sharing the workload.
Sourcetherecord.media
Curated
California Attorney General Rob Bonta has announced a settlement under which 23andMe’s successor will pay $6 million to resolve allegations that the company did not properly protect customers' data before a 2023 breach, The Record reports.
Sourcewww.bleepingcomputer.com
Curated
A threat actor breached TeamUpdraft’s website, potentially compromising UpdraftCentral connection keys that can be used to send commands to connected WordPress websites, BleepingComputer reports. TeamUpdraft develops popular WordPress backup and security plugins, and the stolen keys could be used to backdoor sites that use the service.
Sourcethehackernews.com
Curated
Security researchers have released a proof-of-concept exploit for a patched critical flaw in Fortinet FortiSIEM that could allow unauthenticated remote code execution, The Hacker News reports. The vulnerability, tracked as CVE-2026-106173 with a CVSS score of 9.4, is a path traversal issue.
Sourcewww.bleepingcomputer.com
Curated
Certificate authority eMudhra has revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites, BleepingComputer reports. Mozilla, Google and Apple have moved to block the affected certificates in their browsers.
Sourcewww.securityweek.com
Curated
Accenture, Dragos and the SANS Institute have launched a $10 million initiative to defend small US utilities, SecurityWeek reports. The first phase will cover up to 500 utilities, which will receive free security tools, equipment, deployment help and training.
Sourcewww.bleepingcomputer.com
Curated
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024, BleepingComputer reports. A joint CISA and FBI advisory details the group’s tactics, which include guessing passwords, exploiting vulnerabilities and phishing, The Record reports.
Sourcewww.helpnetsecurity.com
Curated
Apple’s new anti-tracking protections in Safari and WebKit block connections to identity resolution services that turn email addresses into persistent tracking identifiers, Help Net Security reports. The protections target the ‘post-cookie’ techniques advertisers use to link a person’s identity across sites and services.
Sourcethehackernews.com
Curated
Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, could allow unauthenticated remote code execution, The Hacker News reports. Details of the flaws leaked ahead of disclosure, and PHP shipped an out-of-cycle emergency security release on October 21 to address them.
Sourcethehackernews.com
Curated
A Belarus-aligned hacktivist group spent nearly two years inside the network of a Russian healthcare organization, The Hacker News reports. Russian cybersecurity firm Solar attributed the activity to a threat cluster dubbed Partisan Zmiy, which hid a backdoor dubbed Vasilek in VMware Tools.
Sourcethehackernews.com
Curated
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, The Hacker News reports. The state-owned bank, India’s largest, said in a stock-exchange filing that it does not yet know where the data came from.