Section
News
Reporting from the trade press, breach notifications and government press releases.
257 matching records, 5 with confirmed exploitation.
-
AI company Fireworks says hackers stole data, billing info during October breaches
Fireworks said the incident affected a “limited number of customer accounts” — all of whom were notified of the attack.
-
N-able takes its remote access service offline after researcher publishes dozens of zero-day bugs
The remote access giant also urged its self-hosted customers to take down their own servers amid a "critical security incident," fearing the possibility of cyberattacks.
-
Cybercriminals are increasingly infecting regular people with spyware
Cybercriminals are infecting devices on a large scale with spyware, increasingly compromising systems belonging to average people, according to a new report.
-
Fireworks AI gets burned twice as customer data exposure widens
Inference biz pins latest breach on cloud provider and LLMJacking miscreants
-
UZ Brussel among hospitals experiencing severe network problems
VRT reports: Brussels University Hospital UZ Brussel (VUB) was the first hospital to report network problems. These are affecting the hospital’s IT infrastructure and telephone systems. There are also problems at AZ Monica in…
-
Researcher bypassed Meta smart glasses’ safeguards to run her own code
She was able to bypass a safeguard meant to stop unauthorized software running on Meta glasses. It wasn't easy, but showed it is possible.
-
Today: CISO Forum Virtual Summit 2026 – Join Global Cybersecurity Leaders
Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense strategies defining the modern enterprise. The post Today…
-
WhiteMatter Raises $20 Million in Series A Funding
The cybersecurity startup deploys a dedicated guardian agent for every AI agent in an organization’s environment. The post WhiteMatter Raises $20 Million in Series A Funding appeared first on SecurityWeek .
-
HIPAA Enforcement by State Attorneys General
HIPAA Journal has a convenient table of HIPAA enforcement actions by state attorneys general. Most entries involve violations of the Security Rule and/or HITECH, but a few appear to relate more to the Privacy Rule or access to…
-
SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities
SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities. The post SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities appeared first on SecurityWeek .
-
Palantir exec nominated to lead CISA; lame-duck Senate vote is uncertain
Michael LoSapio, Palantir's chief information officer, is officially President Donald Trump's pick to lead the Cybersecurity and Infrastructure Security Agency.
-
Chrome zero-day whack-a-mole continues as 2026 tally hits 8
Another Chrome memory bug gets squashed, but not before attackers got their hands on it
-
Over a Dozen Organizations Hit in Qubole Supply Chain Attack
Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials. The post Over a Dozen Organizations Hit in Qubole Supply Chain Attack appeared first on SecurityWeek .
-
Update Chrome now to fix a flaw attackers are exploiting
Google has released Chrome updates for desktop and Android to patch a zero-day vulnerability already being exploited in attacks.
-
Before you buy an advent calendar, check these warning signs
Copied storefronts, fake urgency, and contradictory product claims are among the warning signs we found on suspicious advent calendar sites.
-
Cyberattacks threaten to make open-source AI a little less open, Hugging Face exec warns
Hugging Face executive Irene Solaiman warns that growing cyberattacks on open AI platforms could force tighter security restrictions, threatening the accessibility that makes open-source communities valuable to developers…
-
Russian hackers compromised government email servers to steal NATO, EU correspondence
Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with NATO and European Union officials, researchers said.
-
Ransomware threat blares from Vanderbilt University computers during cyberattack
BYOD claims extensive data theft as campus Wi-Fi returns, most systems remain restricted, and classes carry on
-
AI Makes Reverse Engineering Mainstream Software & Malware Far Easier
Researchers unpacked, mapped, and recreated complex software and the Turla malware, raising fresh concerns for defenders.
-
Australia to introduce mandatory reporting after OpenAI hack to combat artificial intelligence ‘going rogue’
Tess Ikonomou and Josh Butler report: OpenAI will not face criminal penalties over the Medicare data breach, but the prime minister has flagged changes to Australia’s criminal law to crack down on future breaches by artificial…
-
Ransomware Attack Puts Vanderbilt University on Lockdown
Eli Motycka reports: A broad announcement to shut down university devices and disconnect from university Wi-Fi went out on Monday morning as malicious software began spreading through computers, files and digital infrastructure.…
-
SG: SPH Media hit by cyberattacks; says no customer financial data or access exposed
CNA reports: SPH Media has been hit by cyberattacks on five of its systems, but no customer financial information or account access was compromised, the company said on Tuesday (Nov 10). “(The cyberattacks) are believed to be a…
-
Ca: Data breach at The Children’s Foundation
Tim Durkin reports: The Children’s Foundation has issued a privacy notice following a data breach involving its IT service provider, Highland Shores Children’s Aid Society. An unauthorized third party accessed the IT network on…
-
Ph: NPC receives data breach reports from 10 agencies
Othel V. Campos & Rex Espiritu report: The National Privacy Commission (NPC) said Tuesday it has received personal data breach notifications from 10 government agencies, including the Bureau of Internal Revenue (BIR), the…
-
Kr: Financial Security Institute reports data leak following hacking incident
Yonhap News reports: Korea’s state-run Financial Security Institute (FSI) reported a data leak following a hacking attack targeting its security assessment system, officials said on Tuesday. The FSI, which oversees financial…
-
Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes
Anthropic says Mythos 5.2 improves vulnerability discovery while showing a lower tendency to escape sandboxes in controlled tests. The post Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes appeared…
-
Google DeepMind melds humans and AI agents to vet Signal's secure messaging techniques
Post-quantum handshake and Triple Ratchet get a formal security check
-
Spyware attacks trend toward hitting just about anyone
iVerify’s report Tuesday adds to evidence of spyware’s increasingly indiscriminate targeting. The post Spyware attacks trend toward hitting just about anyone appeared first on CyberScoop .
-
Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments
Nicknamed “Turla’s Cereal,” the tools target Microsoft Exchange servers and lack many obvious indicators of compromise or malicious telemetry, per a new ESET report. The post Russian Turla group used new toolset to silently…
-
N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
Attackers could exploit the flaws for remote code execution, credential theft, and administrator account creation. The post N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days appeared first on SecurityWeek .
-
IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days. The post IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks appeared first on…
-
France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators
France summoned the Iranian ambassador and said it would seek European sanctions against those responsible for the attack The post France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators appeared first on…
-
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
-
Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks. The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on…
-
A New AI Tool From Google DeepMind Proved the Signal Protocol Is Secure
DeepMind researchers were able to formally verify that the widely used encryption protocol works as intended. Their stretch goal? Do the same for “all the software of the world.”
-
Trump picks Palantir’s LoSapio to head CISA
The Cybersecurity and Infrastructure Security Agency has gone without a Senate-confirmed director for all of Trump’s second term, and Michael LoSapio could face resistance, too. The post Trump picks Palantir’s LoSapio to head…
-
Anthropic's super bug-finding Mythos model is going into Cisco and IBM products
Enterprise security tools will offer its capabilities without handing customers the model itself
-
Hotel giant Wyndham exposed customer data after app security lapse
Exclusive: Wyndham left a hardcoded credential in its customer app, allowing anyone to access customer data. The hotel giant wouldn't say if it has the ability to check for any past unauthorized access.
-
France blames Iran for supermarket hack meltdowns
The 'first cyber offensive campaign carried out purely for the purpose of sabotage on national territory'
-
CISA Announces Enhanced Reporting Form for Cyber Incidents
A press release from the Cybersecurity and Infrastructure Security Agency (CISA) today: Today, the Cybersecurity and Infrastructure Security Agency (CISA) unveiled the updated cyber incident reporting form, an enhanced…
-
CISA Announces Enhanced Reporting Form for Cyber Incidents
New questionnaire captures critical data and information that improves the agency’s ability to assess incidents, identify trends and prioritize response actions.
-
Microsoft Fixes RCE Bug in Windows Paint After Weeks of Confusion
Last month, Microsoft disclosed a vulnerability in Microsoft Paint, but messaging regarding a patch was unclear.
-
Data breach at hearing aid giant Amplifon impacts thousands
The U.S arm of international hearing aid company Amplifon has been notifying customers about a data breach early this year that included medical information.
-
Black Hat India 2026 Makes a Landmark Debut in Bengaluru, Bringing the Global Cybersecurity Community to India
Inaugural edition by Informa Markets in India brings together leading researchers, security practitioners and industry decision makers for four days of cutting-edge research, technical exchange and strategic dialogue.
-
Attackers backdoor trusted AWS integrations to steal secrets
Wiz researchers uncovered the secret-stealing supply-chain attack
-
Vulnerability that lets hackers SSH into Linux devices is under active exploitation
"*sshole" poses a serious threat to Internet security.
-
France blames Iran for mass-hacks targeting freezers in grocery stores and blood banks
France's foreign minister blamed Iran for launching at least two waves of cyberattacks targeting industrial refrigerated and freezer units across France and wider Europe.
-
Binance calls alleged “ShinyHunters” post a scam attempt
Sergiu Gatlan reports: Binance, the world’s largest crypto exchange, has denied claims of a new security breach made by a threat actor using the ‘ShinyHunters’ handle on a newly emerged underground cybercrime forum. This follows…
-
France blames Iran for fridge cyberattacks, says some caused fires
In the first attribution since the October attacks, the French authorities identified the perpetrators as part of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at U.S. water utilities.
-
Vanderbilt cybersecurity incident impacting campus devices and systems
Vanderbilt University announced a cyberattack, warning students and employees that campus devices and systems may be impacted by the incident.
-
Attackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on Linux
Attackers can exploit a flaw in Claude's document-processing tool by creating a temporary file that Anthropic's AI assistant can access and run on a user's machine.
-
Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns
Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US
-
Claude Code is accidentally exposing secrets all over GitHub
"Do not ask again" prompt leads to passwords, API keys, and more being shared.
-
PwC's CISO on AI, Robots & What's Next for Security
As AI accelerates change across the enterprise, PwC's James Shira explains why security teams must rethink their approach to risk and adapt their strategies.
-
Financially motivated threat cluster uses AI-enabled tools against banking sector
The campaign is the latest in a wave of attacks using Artex and other pen-testing tools to automate cyberattacks.
-
Cybersecurity education in the AI era: What’s new, what’s different
Businesses are trying new ways to keep employees vigilant, and colleges are debuting curriculum to prepare tomorrow’s AI workers.
-
NIST: Solo Shouldn't Mean Less Secure
New guidance provides a basic framework for less-technical solo business owners, but it may miss the mark on how to secure technology that requires no human oversight.
-
AU: Important update from Epichealth – cyber incident
Seen on Epichealth: 4 November 2026 What has happened Epichealth operates four medical clinics including the Warrnambool Medicare Urgent Care Clinic, Epichealth Ocean Grove Marketplace, Epichealth Ocean Plaza, and Epichealth…
-
Ukraine arrests four in $5 million crypto scam targeting Germans
Ukraine's cyber police said the four arrested men included the alleged leader of the scam call centers.
-
Microsoft's Azure Linux gets 470-plus security fixes in one almighty patching session
A mountain of CVEs, a certificate cleanup, and yet more work for Microsoft's patching teams
-
Who Gives A Crap? Hackers, apparently, after toilet paper maker's customer data exposed
UK shoppers caught up in third-party security mess, and nobody knows whether the data was flushed away
-
Alleged AI-aided cyberattack exploits assistant interface to breach German web host
Hackers allegedly assisted by AI breached a German web hosting company through a tool designed to allow customers to connect AI assistants to their accounts, the company disclosed.
-
Revolve Puts Data Breach Victim Count at 1.5 Million
Online fashion retailer Revolve has told regulators that the September cyberattack affected more than 1.5 million individuals. The post Revolve Puts Data Breach Victim Count at 1.5 Million appeared first on SecurityWeek .
-
Weill Cornell patient data entered into AI tools without authorization
Naomi Diaz reports: New York City-based Weill Cornell Medicine disclosed that patient health information was entered into AI tools and processed using machine learning without authorization as part of a radiology research study.…
-
Outlook.com bounces legit emails as Microsoft's authentication crackdown goes sideways
Missing DMARC or wobbly SPF means your mail may be treated as suspicious
-
Pro-Russian hackers target European officials, offer rewards for personal information
Pro-Russian hackers published the personal information of Italian Foreign Minister Antonio Tajani and other senior European officials on the dark web, offering cryptocurrency rewards for additional details about them and their…
-
Plex2Shell Exploited Against QNAP NAS Users
Threat actors are exploiting the four-flaw chain to hack the Plex Media Server application on QNAP NAS devices. The post Plex2Shell Exploited Against QNAP NAS Users appeared first on SecurityWeek .
-
13.3 million people’s medical data exposed; companies pay $300,000
The New York AG reached a settlement with Perry Johnson & Associates and four related companies over a 2023 breach.
-
Japanese homeware giant pulls online store after cloud breach puts 7.7M records at risk
No reopening date as orders face delays and some customers are told to refuse deliveries to cancel purchases
-
Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers
Hackers compromised an external cloud service used by the shopping platform and may have stolen personal information from it. The post Iris Plaza Breach May Have Exposed Data of 7.7 Million Customers appeared first on…
-
Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web
Italian Foreign Minister Antonio Tajani said Saturday that his personal data had been disseminated on the dark web. The post Italy’s Meloni Blames Pro-Russian Hackers for Leak of Foreign Minister’s Data on the Dark Web appeared…
-
Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH
The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit. The post Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH appeared first on…
-
AI Security
Two weeks ago, I attended the [un]prompted AI security conference in San Francisco. It was an excellent event: three days of very dense talks about all aspects of AI security. (My talk was about integrous AI, and I will post it…
-
Amplifon Americas Data Breach Impacts 1.3 Million
Hackers stole personal, health, and insurance information, including Social Security numbers, from the company’s internal systems. The post Amplifon Americas Data Breach Impacts 1.3 Million appeared first on SecurityWeek .
-
AI doesn’t have to go rogue to break the world
AI systems are learning to exploit loopholes in everything from software to tax law. The biggest threat may not be malicious intent, but machines doing exactly what we ask. The post AI doesn’t have to go rogue to break the world…
-
Over 3 Million People Hit by Frontline Education Data Breach
Frontline Education told Indiana regulators that its August data breach affected over 3 million school district staff and students. The post Over 3 Million People Hit by Frontline Education Data Breach appeared first on…
-
DHS Has Used This Controversial Investigative Tool 185,000 Times Since Trump Took Office
Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.
-
Truth or consequences: What your AI strategy is standing on
AI acts on bad asset data as confidently as good. Verify the foundation first.
-
Improving incident response with AI agents
AI-driven incident response reduces workflow delays while keeping analysts in control.
-
5 critical steps organizations should take to secure AI
Close the AI security gap with five practical steps to improve visibility, governance and control.
-
Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack
Working with cryptographers, DeepMind’s AI agents cut the cost of forging RSA-1024 signatures and found a cheaper way to factor keys. The post Google DeepMind’s AI Agents Make 1024-Bit RSA Keys Cheaper to Attack appeared first on…
-
A week in security (November 2 – November 8)
A list of topics we covered in the week of November 2 to November 8 of 2026
-
Linus Torvalds sees signs AI-prompted patch flood has peaked
Fixes are arriving faster than new bug reports for one major Linux project
-
Risky Bulletin: Pro-Kremlin hacktivists dox EU politicians, law enforcement
Pro-Kremlin hacktivists dox EU politicians and law enforcement personnel a Deepfake gang arrested on US charges, SonicWall patches a zero-day, and SSHole is being exploited in the wild. Show notes Risky Bulletin: Pro-Kremlin…
-
Huawei says it’s made a 100 percent Chinese PC
PLUS: Japan declares infosec emergency; Apple makes biggest school Mac sale, ever, anywhere, in the Philippines; And more!
-
Brava Security Emerges From Stealth With $15 Million in Funding
Its multi-agent AI platform generates the telemetry an attack would produce to fix gaps in enterprise defenses. The post Brava Security Emerges From Stealth With $15 Million in Funding appeared first on SecurityWeek .
-
No need to hack when it’s leaking: Artex edition
Zack Whittaker reports: Security researchers have discovered hundreds of copies of a Chinese-made AI hacking tool publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks…
-
County of Sussex, New Jersey Notice of Data Privacy Incident
November 6, 2026 8:00 PM EST NEWTON, N.J., Nov. 6, 2026 /PRNewswire/ — Sussex County Prosecutor’s Office (SCPO) experienced a data privacy event that involved personal information. On or about August 10, 2026, SCPO received…
-
Coding Agents Copy Your Secrets to a Hidden File. Thousands Are on GitHub (2)
Shmulik Cohen and Matan Giladi write: Apiiro research found 2,539 real secrets in 1,994 public GitHub repositories: database passwords, cloud keys, API tokens, SSH root logins. Among them: a database vendor’s own admin-level…
-
Norad targeted by cyberattack
From Norway’s aid agency, Norad, November 3: Norad has been targeted by a cyberattack in which the perpetrators may have gained access to the names and email addresses of 20,614 registered users of Norad’s Grant Portal. In…
-
The Fridge-Hacking Spree Is an Internet-of-Things Wake-Up Call
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
-
British soldier ignored order to pull his SIM card, then got blackmailed
Soldier told repeatedly to lock down devices before deploying, got sextorted, court-martialed.
-
NHS breach helpline left staff carrying a 'significant emotional burden'
Team given a day's notice faced distressed callers, safeguarding decisions during project that stretched from 2 weeks to 11
-
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared…
-
Agents reveal secrets when offered to team up with each other
If you wouldn't put it on GitHub, don't give models access to it
-
UK Wades Into Tech Sovereignty Amid AI Policy Changes
The UK is betting on domestic AI and cyber investment to reduce reliance on US tech — but security leaders question whether the funding is too fragmented and too late.
-
Chainalysis says hackers stole credentials and tokens for all of its customers
Company said a "multifront cyberattack" included AI agents and an on-path data snatch.
-
State attorneys general secure up to $10 million and corrective action plan from Perry Johnson companies after 2023 breach
A press release from NYS Attorney General Letitia James: NEW YORK – New York Attorney General Letitia James and a coalition of three other attorneys general today secured $10 million from Perry Johnson & Associates, Inc. (PJ&A)…
-
Medical services company settles with 4 states over 2023 hack of sensitive patient records
The case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies.
Reuse this view
Same filters as JSON: /api/items?category=news&window=7d&sort=newest&limit=100. RSS for this section: feed.xml.