James Robinson never planned a cybersecurity career — seven companies and one deputy CISO role later, he leads security at Netskope.

CenterPoint Energy has confirmed that the personal information of over 1 million Texans has been compromised in a data breach.

A new Android banking trojan named Hirudo replaces legitimate mobile banking apps with trojanized versions to neutralize security checks.

The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole recor...

Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August.

Honeypots logged 1,423 attempts to exploit a critical Langflow flaw that lets authenticated users execute server commands.

GhostAction targeted over 30,000 GitHub repositories using about 1,900 compromised accounts and tried to extract 3,174 secrets.

India orders telecom operators to show registered caller names for unsaved domestic numbers from November 1, 2026, under its CNAP rules.

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls.

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.

Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves...

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean...

Microsoft and partners disrupted CoGUI, Haozi, and Iron Man, phishing kits linked to more than 1 billion messages since January 2026.

Attackers planted web shells through Collabora's Built-in CODE app while its document server was down; versions before 26.4.303 are affected.

Attackers exploit a Cisco Secure Email Gateway flaw enabling file writes without login when File Reputation is enabled and scanner tools are outdated.

AI security startup Harmonic Security has raised $50 million in Series B funding to expand its engineering and go-to-market teams.

Industrial giants Siemens, Schneider Electric, and Rockwell Automation have published ICS security advisories this Patch Tuesday.

Test conducted by Booz Allen demonstrate that frontier super intelligence navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes.

A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partne...

AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining a...

Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates.

curl 8.23.0 fixes an HTTP/2 upload use-after-free that a malicious server can trigger; code execution was demonstrated under strict conditions.

CISA says attackers are exploiting an Ivanti Connect Secure authentication bypass to execute commands, steal credentials, and exfiltrate data.

The DoJ charged 14 people and seized about 187 computers in a North Korean IT worker scheme affecting more than 70 U.S. companies.

Citrix, Fortinet, and Ivanti have patched 29 bugs, including critical authentication bypass, code execution, and information leak flaws.

Fresh Chrome and Firefox updates resolve 114 vulnerabilities as Mozilla introduces security-focused Firefox Enterprise.

Investigators in the US arrested two individuals and seized 187 laptops in a crackdown on North Korean IT worker laptop farms.

Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enable...

Reflectiz's AI agent bypassed an insurer's live login by directing a one-time code to its own inbox during an authorized assessment.

Hirudo targets eight Indonesian banking apps with patched replacements that can bypass signature, accessibility, and integrity checks.

XBOW built an AI-assisted, three-bug Chrome exploit chain in six days that enabled Windows code execution; Google has fixed all three bugs.

An engineer at OpenAI has been charged with secretly installing a recording device inside a conference room.

An OpenAI engineering lead was arrested over an allegedly planted audio recorder in an executive conference room.

Google is raising bug bounty rewards for some Chrome vulnerabilities, quadrupling base rates for memory safety issues.

Adobe has published 10 new security advisories to inform customers about roughly 140 vulnerabilities found in its products.

Ivanti has patched CVE-2026-104935, a Connect Secure (ICS) zero-day exploit that allows unauthenticated remote code execution.

Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI wor...

A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files.

A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversat...

An attacker exploited three Ivanti Connect Secure zero-days to run commands as root and steal stored credentials from one appliance.