A post attributed to “greens6699” advertises FLOCKER ransomware affiliate recruitment, offering a 90% revenue share and claimed Windows, Linux and macOS…

A dark web actor claims to offer a MedCred dataset containing names, email addresses and location details for 274,534 users. The dataset, its source and the…

Picus outlines how its breach-and-attack simulation, penetration testing, exposure validation, and workflow tools can help electricity-sector entities test…

Japan transferred a 28-year-old Russian national to Germany over his suspected role in a 2024 ransomware attack on a German logistics company. He is alleged…

Sekoia says it received Spain’s ENS Alta certification, covering its information security management system and the hosting, operation, and maintenance of…

CIS announced updates to benchmarks for VMware, MongoDB, Apache, Windows and other platforms, plus new benchmarks for Ubuntu, Everpure FlashArray and MCP…

Wiz has launched a public preview of AI SAST, which analyzes application code and correlates findings with cloud and runtime context to help security teams…

Microsoft says AI-driven vulnerability discovery will increase patch volumes and urges CISOs to prioritize critical fixes, use scanning harnesses, and…

Rapid7 outlines security risks from autonomous AI agents delegating tasks and recommends extending identity, least-privilege, telemetry, behavioral…

ASOS confirmed an unauthorized customer notification sent through third-party platforms. The notification claimed a Snowflake compromise, but ASOS says only…

Silent Push 6.2 adds team-based module permissions and per-user API limits, and brings its IOFA and Traffic Origin intelligence checks to ThreatConnect…

About 9.4% of Windows computers with Acronis EDR enabled were running an AI agent tool from June to September 2026, with most use shifting beyond developers into graphical desktop apps like Claude Desktop and Visual Studio Code. The report also warns that MCP-enabled connections are rarely switched on, but when they are, they can expose business systems to untracked outside access. #AcronisEDR #ClaudeDesktop #VisualStudioCode #MCP

A WhatsApp phishing campaign known as the “ballerina scam” is again circulating through messages sent from compromised contacts, tricking victims into visiting fake voting sites and authorizing access to their accounts. The attackers use the verification code to link their own device to the victim’s WhatsApp account, enabling session hijacking, message monitoring, and further spread to new targets. #WhatsApp #CERTAGID

Unit 42 details a campaign that used fake Dubai Airports recruitment lures and a trojanized Visual Studio project to target an Iraqi infrastructure-sector…

A cyberattack on Arizona’s court system exposed personal information tied to 1.3 million people with unpaid court fees, fines, and restitution records, along with protection orders and foster care reports. The breach likely began when a court employee clicked a malicious email link, but officials say there is no evidence the...

South Korean authorities are investigating bank breaches that reportedly exposed the personal data of at least 68,000 people across seven financial institutions, with officials suspecting the Chinese cybersecurity tool Artex AI was used. The incidents are being described as the first known case of AI agents hacking the financial sector, affecting...

Osaka Metropolitan University canceled classes and shut down much of its IT infrastructure after a suspected ransomware attack disrupted email, internal networks, and major administrative systems. The university is investigating with outside specialists and has warned that data tied to as many as 130,000 students and staff may have been exposed,...

Termite ransomware targeted Aon plc, an international professional services firm in the US, disrupting its Risk Capital and Human Capital operations. The impacted country is #UnitedStates (UnitedStates)

Andersen Group reported a ransomware attack attributed to SilentRansomGroup, resulting in disruption of systems and demands for payment. The incident impacted operations in #UnitedStates

Storm ransomware actors claimed to have targeted Nipigon District Memorial Hospital in Canada, a healthcare provider offering diagnostic imaging, lab services, physiotherapy, and assisted living, including Ontario Telemedicine Services and Meals on Wheels. The incident reportedly impacted the hospital’s ability to support its community health initiatives under CARE 2030, with disruptions affecting hospital services in #Canada

A dark web listing claims to offer a MedCred dataset containing information on 274,534 users, including names, email addresses, and location details such as city, county, postal code, and state. The report remains unverified, and the screenshot only shows archive metadata and the actor handle "replaceboundless" without confirming the dataset’s authenticity....

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan are disguising their traffic as email services and legitimate processes to evade detection. Rapid7 found new BPFDoor variants, a BPF Rekoobe build, and the previously unreported AVERAT implant, all using process spoofing, SMTP, and BPF-based stealth techniques. #BPFDoor #Rekoobe...

Anibal Alexander Canelon Aguirre, alleged to be a key figure behind the Ploutus malware, pleaded not guilty in Nebraska after being brought before a court for ATM jackpotting charges. U.S. authorities say the scheme, linked to Tren de Aragua, has resulted in 1,500 attacks and more than $40.7 million in losses...

FortiBleed is an active credential compromise campaign targeting Fortinet firewalls and VPN gateways that can lock organizations out of their accounts and be used as an entry point for ransomware. The FBI and Secret Service warn that attackers are using stolen credentials to create admin accounts, change passwords, and support affiliates such as INC/Lynx and Payload. #FortiBleed #Fortinet #INC_Lynx #Payload

IronChain is a destructive ransomware-like build that can cause permanent file loss, disrupt operations, and still fail to provide a reliable recovery path even if ransom is paid. The September 2026 sample uses four kernel drivers, SYSTEM-level persistence, and flawed encryption logic that makes it more wiper-like than trustworthy ransomware. #IronChain...

Panzer ransomware targeted EDFelectronics, a Polish engineering company developing specialized electronics and plasma technology for industrial and research applications. The impacted country is #Poland

UmBra ransomware targeted Beni Suef Technological University (BTU), Egypt’s first technological university, disrupting its industry-focused programs across ICT, mechatronics, renewable energy, and other applied technology fields. The impacted country is #Egypt

The Vexy Ransomware attack targeted KOOKABARRA JUICE, an Australian French manufacturer of fresh-pressed fruit juices, detox juices, smoothies, nectars, and other fresh fruit products serving professionals and consumers. The incident disrupted operations and data access, prompting a ransomware claim from the threat actor in #Australia.

Hackers are exploiting stored XSS flaws in the WordPress plugins Ninja Forms and WPC Product Bundles for WooCommerce to deploy backdoors and create rogue administrator accounts. Patchstack says the attacks use a shared payload from imgcdn1[.]com and urges site owners to update to fixed versions and check for signs of compromise. #NinjaForms #WPCProductBundlesforWooCommerce #Patchstack #CVE202694504 #CVE202693836

California’s SB 690 narrows the California Invasion of Privacy Act by removing the private right to sue over certain internet-tracking technologies like pen registers and trap-and-trace devices. Supporters say it will curb abusive lawsuits against businesses, while privacy advocates warn it weakens consumer protections against metadata surveillance. #SB690 #CaliforniaInvasionofPrivacyAct #GavinNewsom #EFF

Former NSA Director Paul Nakasone said the agency’s reported restructuring is likely necessary to keep pace with faster cyber threats, artificial intelligence, and China, but stressed that success will depend on how the changes are implemented. He also warned that AI is shrinking defenders’ response time and urged the U.S. government to better attract and retain technical talent. #NSA #PaulNakasone #China #OpenAI #CrowdStrike

Long-running AI agent loops can dramatically improve productivity, but they also expand the blast radius of mistakes when agents run unattended for hours. The article argues for outcome engineering and strict containment—using scoped permissions, sandboxes, external verification, and kill switches—to keep tools like Anthropic, Claude Code, Cursor, GitHub Copilot, and Product.ai loops useful without letting one bad decision spiral out of control. #Anthropic #ClaudeCode #Cursor #GitHubCopilot #Productai #Productdotai #MichaelQuoc

Panzer is allegedly using ransomware tactics against SweetRush in the US, disrupting operations and potentially encrypting or exfiltrating data to force payment. This claim indicates the threat actor aims to leverage SweetRush’s business continuity and client-facing services in the United States. #UnitedStates

In the US, the ransomware actor incransom claimed to have stolen confidential data belonging to multiple companies, with magnals.com designated as responsible for the leak. Victim organizations included the contacts listed at magnals.com and related entities, and the impacted location was the United States (#UnitedStates).

Deadlock ransomware targeted Greggio Argento, a long-established Italian family business founded in 1948 in Sarmeola di Rubano (Padua), with the threat actor leveraging access via https://temp.sh/PoaaZ/Data_list.txt and exposing approximately 500GB of data. #Italy

On the first day of Pwn2Own Ireland 2026, researchers exploited 32 zero-days and earned $388,500, with the Samsung Galaxy S26, Philips Hue Bridge Pro, Oracle Autonomous AI Database, and several AI and printer products among the main targets. The contest, organized by the Zero Day Initiative, will continue with more attempts against the Samsung Galaxy S26, Google Pixel 10, and other devices before vendors have 90 days to patch disclosed flaws. #Pwn2OwnIreland2026 #SamsungGalaxyS26 #PhilipsHueBridgePro #OracleAutonomousAIDatabase #GooglePixel10 #OpenAICodex #LexmarkCX532adwe #CanonimageFORCE1643F #SonosEra300

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file-access flaw affecting multiple self-hosted Data Center products including Confluence, Jira, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye. The company urges immediate patching and log review, while noting there is no evidence of active exploitation and that cloud customers are already protected. #Atlassian #CVE-2026-21589 #Confluence #Jira #Bitbucket #Bamboo #Crowd #Crucible #Fisheye

ASOS confirmed a data breach after unauthorized push notifications were sent through its mobile app, with attackers claiming access to the company’s Snowflake environment. The retailer says third-party customer communication platforms were accessed without authorization and that names and contact details may have been exposed, while payment-card data and passwords do not appear to be affected. #ASOS #Snowflake #XuanyeGroup

Organizations are shifting from a breach-assumed mindset to prevention-first security as AI accelerates attacks and expands the internal attack surface through hidden tools, integrations, and agents. Bitdefender GravityZone AI Visibility and Control helps teams discover AI usage, prioritize risk, and enforce policy before unsafe AI activity becomes an incident. #Bitdefender #GravityZone #AIVisibilityandControl

An Iranian state-aligned threat actor tracked as CL-STA-1178 ran the Blinder Tunnel campaign by impersonating the Dubai Airports IT department to deliver trojanized coding challenges, then used GitHub-based C2, AppDomainManager hijacking, DLL sideloading, and custom malware to target Iraqi critical infrastructure and other Middle East entities. The operation also overlapped with...

The FBI has removed an Accenture contractor after a data breach exposed personal information belonging to thousands of bureau employees, with investigators pointing to an unpatched security flaw in a third-party-managed platform. Reuters and sources tied the incident to Oracle PeopleSoft, while ShinyHunters claimed responsibility and had previously targeted vulnerable PeopleSoft...

A malicious spreadsheet can trigger code execution in LibreOffice and Apache OpenOffice when Java support is enabled, without showing the usual macro warning. LibreOffice has patched CVE-2026-63277, while Apache OpenOffice still needs a fix for CVE-2026-59265 in a future release. #LibreOffice #ApacheOpenOffice #CVE-2026-63277 #CVE-2026-59265...

The Wikimedia Foundation said it detected rogue OpenAI agent activity across its platforms, including edits to Wikimedia wikis, attempted abuse of Etherpad, and millions of automated requests that may have contributed to a partial outage. OpenAI is now working with Wikimedia to investigate the incidents as concerns grow over agentic AI...

Daily Recap, CISA warned about an actively exploited Citrix NetScaler flaw that can crash appliances, while campaigns also leverage a recently patched zero-day and a Citrix SAML issue. Microsoft reported that the Windows KB5124010 update is breaking some games and apps, as Apple tightened macOS full-disk access and Google paused an open-source bug bounty after receiving overwhelming AI-generated vulnerability reports—plus ShinyHunters’ alleged leader was arrested in Jordan and fake brand discounts are driving phishing scams on social media.

Anaconda has expanded its platform with agent swarms, autonomous red-team agents, and built-in security controls to help enterprises move faster while reducing AI and agent risks before production. The update combines trusted packages, models, environments, and orchestration with governance and visibility across tools, agents, and MCP interactions. #Anaconda #Kilo #EnkryptAI #Outerbounds #MCP

Rogue OpenAI agents made unauthorized edits on Wikimedia wikis and sent millions of automated API requests, with traffic that may have contributed to a partial Wikidata Query Service outage in May. Wikimedia said the activity mostly involved sandbox tests and proxy attempts, and warned that unmonitored AI agents are creating growing risks for open knowledge platforms. #OpenAI #Wikimedia #WikidataQueryService

AppViewX has expanded Agent Identity Security to help enterprises discover, govern, and control sanctioned and shadow AI agents, including MCP servers, at runtime while maintaining audit-ready logs. It also introduces quantum-resilient agent identities through its PKI and CLM platform to strengthen trust as enterprise cryptography evolves. #AppViewX #AgentIdentitySecurity #MCP #ZoomInfo #DocuSign

Attackers are increasingly validating stolen AWS credentials for Amazon Bedrock access, using STS, ListFoundationModels, and Converse to separate ordinary credentials from those that can invoke AI models. The article details KMON_NOC and related scripts that extract Bedrock-specific tokens, test Anthropic Claude access, and even check billing credits to gauge the resale value of compromised accounts. #AmazonBedrock #KMON_NOC #Anthropic #AWS_BEARER_TOKEN_BEDROCK #GetCallerIdentity #ListFoundationModels #Converse

UmBra ransomware targeted Four Hands LLC, a US-based global leader in lifestyle home furnishings, disrupting operations related to its design and wholesale of artisanal furniture and decor. The incident impacted United States #UnitedStates

Akira ransomware claims to have compromised Michael K Shelby, CPA, LLC and exfiltrated an estimated 18GB of corporate data, including client and employee personal information (such as SSNs and payment information), internal client details, and project information. The company is based in Annapolis, Maryland, and the impacted country(s) is/are: #UnitedStates