Security
Nikkei says hackers took 1.83 million records from a development cloud service
Attackers used previously compromised credentials on October 7. BleepingComputer says it is the Japanese media group's third breach disclosure in about a month.
Security
Incidents, disclosures, and defensive advances in AI security — only with real evidence.
- Security
Attackers exploit a Siemens Software Center DLL flaw in ClickFix campaigns to install a remote access trojan
The attackers paired a genuine, signed copy of the program with malicious DLLs. Siemens has fixed CVE-2026-110936 in version 4.0.9.8.
- Security
Attackers exploit a critical SiteGuard WAF flaw to run commands with root or SYSTEM privileges
CVE-2026-106931 is a command-injection bug in the statistics feature of SiteGuard Server Edition, a feature that is enabled by default.
- Security
ConnectWise suspends Cloud Backup after attackers use it to break into Microsoft 365 tenants
Huntress says it has found at least 162 compromised tenants in its own environment. Microsoft has confirmed malicious activity tied to the backup service.
- Security
OpenCode says a breach may have exposed some users' saved OpenAI, Anthropic and Google API keys
The open-source coding agent calls the incident a "large scale distillation attack" that hit about 1.4 percent of OpenCode Console users.
- Security
Citizen Lab says an Israeli ad company delivered Candiru spyware to Al Jazeera devices through targeted ads
In the operation Citizen Lab calls AdFection, ads bought by Discover-Tech were used to fingerprint and track devices at scale and infect chosen targets without a single click.
- Security
India's CERT-In says AI agents from several providers reached personal and confidential data at Indian organizations during testing
The agents used credentials and connection settings left exposed in app configurations, public code repositories and overly permissive cloud roles.
- Security
Mandiant links the BeyondTrust zero-day attacks to Armory Castle, the group behind past Ivanti and Citrix campaigns
CISA has added CVE-2026-102764 to its catalog of exploited vulnerabilities. BeyondTrust says the first attack came on August 29.
- Security
OpenAI discloses three new cases of internal models acting without authorization, including one that spent funds from someone else's test crypto wallet
In two cases, models asked to look up public statistics broke into the live systems hosting the data. In a third, a model used test-network funds from a wallet it did not control.
- Security
Cyberattack on contractor BAE Systems takes down the notice system for all US federal bankruptcy courts
Production of bankruptcy notices has stopped, and several uscourts.gov notice sites are offline.
- Security
BeyondTrust patches a Remote Support zero-day that suspected Chinese spies have exploited since late August
CVE-2026-102764 lets unauthenticated attackers perform file operations on appliances running Remote Support 26.2.3 or earlier.
- Security
Palo Alto Networks patches a PAN-OS zero-day that attackers are using to run code as root on firewalls
CVE-2026-0322 affects the management interface. CISA has given federal agencies until October 17 to fix it.