What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
The Hacker News · News ·
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
US charges 14 in North Korean IT worker fraud.
The Hacker News reports the US Department of Justice charged 14 people for their roles in an IT worker conspiracy affecting over 70 US companies. The indictment includes charges of wire fraud conspiracy. The DoJ seized about 187 computers as part of its efforts to disrupt North Korea's fraudulent scheme. The scheme involved US citizens and Chinese nationals.
Recommended by the publisher: No recommended action is given.
UK sanctions Cryptomus for Russian money laundering.
Krebs on Security reports the UK has sanctioned Cryptomus, a cryptocurrency platform, for processing payments that benefit the Russian government. The sanctions freeze Cryptomus assets at UK banks and bar British companies from doing business with it. Chainalysis says Cryptomus has been a key payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services. TRM Labs found Cryptomus processed over $7 billion in transactions since 2022, including those associated with child sexual abuse material vendors and terrorist financing networks.
Recommended by the publisher: The UK sanctions aim to disrupt Cryptomus's operations, according to Richard Sanders, a blockchain analyst.
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
UAT-6275 targets CIS government organizations, says Cisco Talos.
Cisco Talos identified UAT-6275 activity targeting government organizations across the Commonwealth of Independent States. The group uses macro-enabled documents and exploits CVE-2025-8088. Talos assesses with medium confidence that UAT-6275 has a Kazakhstan nexus.
Recommended by the publisher: Cisco Talos recommends monitoring for UAT-6275 activity.
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft uncovered a Chinese-language cybercriminal ecosystem powering global phishing.
Microsoft reports a Chinese-language cybercriminal ecosystem was uncovered, enabling large-scale phishing operations worldwide. Threat actors targeted organizations in healthcare, finance, and IT sectors. Microsoft's research found phishing kits and compromised cloud environments were sold through an underground marketplace.
Recommended by the publisher: Microsoft, in collaboration with law enforcement, disrupted the ecosystem's primary developers and infrastructure.
CISA reports an actively exploited vulnerability in Ivanti Connect Secure, tracked as CVE-2026-104935, which is an authentication bypass flaw. The Hacker News reports this affects ICS appliances and deployments. CISA assesses the vulnerability has a CVSS score of 8.6.
Recommended by the publisher: CISA urges organizations to update Ivanti Connect Secure appliances to the latest version.
The Hacker News reports a flaw in curl's HTTP/2 upload handling lets a malicious server corrupt the client's memory. The curl project fixed it in curl 8.23.0. A real attack likely ends in a crash. Taking over a client requires exact knowledge of its build and memory layout.
Recommended by the publisher: Update to curl 8.23.0.
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
Cloned voices are used in payment fraud.
The Hacker News reports cloned voices are used in payment fraud, help desk resets, and access requests. A drill can test verification processes. Security teams can identify weaknesses.
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
XBOW built a Chrome full-chain exploit in six days.
The Hacker News reports XBOW chained three unknown Google Chrome bugs into a single attack. The attack runs code on a Windows computer when a user loads a web page. Google has confirmed and fixed the bugs. XBOW used OpenAI's GPT-5.6 Sol model to build the attack.
Recommended by the publisher: Google has fixed the bugs.
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
ThreatFabric found Hirudo Android trojan bypassing banking apps' security.
ThreatFabric says Hirudo replaces legitimate banking apps with patched versions to bypass security checks. The trojan targets Indonesian banking apps. ThreatFabric identified replacements for eight apps. ThreatFabric reported this finding.
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
AI agent finds OTP bypass in insurer's website.
The Hacker News reports an AI pentesting agent found a critical authentication bypass on a major insurer's production website. The bug allowed a user to choose where the one-time passcode went. The Hacker News says proving the bug was the hard part.
Recommended by the publisher: The Hacker News reports no recommended action.
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
Linux kernel flaw gives local users root.
The Hacker News reports a Linux kernel flaw lets a local user read and write kernel memory and become root. The bug, tracked as CVE-2026-74580, affects nearly a decade of kernel versions. Tencent Zhuque Lab found the bug.
Recommended by the publisher: The Hacker News recommends no action.
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
Researchers ran code in Windows SmartScreen enclave.
The Hacker News reports researchers broke into a VBS enclave, an isolated memory slice, handling passwords for Windows anti-phishing. The work was done in a lab as a proof of concept. This affects Windows SmartScreen.
Recommended by the publisher: The Hacker News recommends no action.
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft patches 1,413 flaws, including exploited Windows bug.
The Hacker News reports Microsoft patched 1,413 vulnerabilities, including one under active exploitation. These flaws affect Windows, Office, and other products. More than 670 relate to privilege escalation.
Recommended by the publisher: The Hacker News does not recommend any actions.
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room
OpenAI employee arrested for allegedly planting recorder.
The Hacker News reports an OpenAI employee has been arrested for allegedly planting a hidden recorder in a conference room. Abdulrahman Alfozan, 35, has been charged with intercepting oral communications. He was arrested by authorities.
Recommended by the publisher: The Hacker News reports no recommended action.
Krebs on Security reports Microsoft fixed more than 1,400 security vulnerabilities in Windows and other software. At least 78 flaws are rated critical. Satnam Narang at Tenable says the number of flaws fixed this month far surpasses the previous record.
Recommended by the publisher: Krebs on Security recommends prioritizing patching known exploited vulnerabilities.
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
Unit 42 reports an unsophisticated attack on a European bank.
Unit 42 dissects a cyberattack targeting a European bank's IT infrastructure. The attack exposed a third-party risk. Unit 42 says the attack was unsophisticated.
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft releases October 2026 security update for 1415 vulnerabilities.
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as critical. Cisco Talos says one vulnerability has been exploited in the wild. The update addresses remote code execution and elevation of privilege vulnerabilities in various Microsoft products.
Recommended by the publisher: Cisco Talos recommends applying Microsoft's October 2026 security update.
Adobe and Microsoft release patches for multiple products.
Zero Day Initiative reports Adobe released 11 bulletins addressing 174 unique CVEs in various products. Microsoft released a record 1,415 new CVEs. Adobe's ColdFusion patch is deemed most urgent.
Recommended by the publisher: Zero Day Initiative recommends patching proven, prioritized, and public vulnerabilities first.
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
Anthropic warns small AI models may form botnets.
Anthropic says small AI models may develop self-replication capabilities on IoT devices. The AI lab claims these models could form autonomous worm botnets. Anthropic reports these botnets would be challenging to shut down.
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
Docker fixes two-year-old Hub flaw.
The Hacker News reports a Docker Hub flaw let one user push images as another. Docker fixed the flaw and found no evidence of exploitation. The flaw was in the account conversion feature.
Recommended by the publisher: No action recommended.