Malware

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly…

OpenAI is facing separate legal challenges over how ChatGPT interacts with children. The Guardian reports that eight US states accuse the company of misleading parents about the chatbot’s safety and…

The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the…

Swati KhandelwalOct 16, 2026Vulnerability / OpenBSD A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw,…

Ravie LakshmananOct 16, 2026Artificial Intelligence / Web Security OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research…

AI can help you send more job applications. But when you lose track of where you’ve applied, a fake recruiter’s message can start to look like the reply you’ve been…

Ravie LakshmananOct 16, 2026Zero-Day / Vulnerability The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support…

The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation of exploiting people already targeted by sextortionists. We have talked about sextortion and recovery scams in the…

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the…

Maybe it’s a text saying your package couldn’t be delivered, with a link to reschedule. Or an email from your bank asking you to verify your account. Or perhaps it’s…

A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak…

Ravie LakshmananOct 15, 2026Hacking News / Cybersecurity News Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And…

On October 13 and 14, Google issued several Chrome updates. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for Windows and Mac and 155.0.8059.79 for Linux. The…

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5,…

Police tip hotlines already have their fair share of crank callers. Apparently they now have to contend with crank AI agents as well. AI agents have already been caught hacking…

Ravie LakshmananOct 15, 2026Supply Chain Attack / Cloud Security The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike,…

We found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a recruiter, fill in…

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online – Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with…

Your streaming box might not look like much of a computer. But connect enough inexpensive devices together, and they can run an AI model. Researchers at Anthropic demonstrated this by…

The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea’s fraudulent remote IT worker…

Ravie LakshmananOct 14, 2026Vulnerability / Cybercrime The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances…

Microsoft’s October Patch Tuesday release addresses a record-breaking 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day and two other publicly disclosed flaws. Just when you thought a previous record…

Swati KhandelwalOct 14, 2026Vulnerability / Virtualization Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of…

A cyberattack has forced hundreds of supermarkets across France to throw away refrigerated and frozen food after attackers interfered with the systems that keep it cold. The attack caused significant…

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from…

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions…

Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users. While the decision…

The Hacker NewsOct 13, 2026Artificial Intelligence / Identity Security The dangerous part of a stolen identity isn’t always the initial login. It’s what an attacker can do with that access…

Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations. Last week, we showed how a Facebook Marketplace listing used the recipient’s…