520 casos · pág. 4/26
The Massachusetts Attorney General settled alleged HIPAA and Massachusetts Data Security Law violations with former medical transportation provider Transformative Healthcare, LLC and its subsidiaries Lifeline and Fallon. The settlement also resolves MassHealth upcoding allegations, and the combined allegations carry a $1,000,000 penalty p…
Keeper Security has launched an opt-in Phishing Protection feature in the Keeper Browser Extension (version 18.2.0). It uses a local AI engine to detect look-alike domains, spoofed websites and brand impersonation before users enter credentials. The vendor cites the 2026 Verizon Data Breach Investigations Report, which found credential ab…
A study titled "Watching the Watchers: Privacy Analysis of US Smart TV Automatic Content Recognition" found that Samsung (Tizen) and Vizio (SmartCast) televisions kept sending traffic consistent with automatic content recognition (ACR) after researchers disabled the feature. The researchers ran 5,943 automated experiments on 12 TVs from 1…
Fortinet announced coordinated security hardening updates for FortiOS, FortiManager and FortiAnalyzer, scheduled for October 22, 2026. They address critical and high-severity vulnerabilities. CISO Carl Windsor said the fixes come from frontier AI-assisted security testing, with contributions acknowledged from Anthropic, OpenAI, Google and…
Pillar Security researcher Eilon Cohen disclosed on October 19, 2026 a critical command-injection flaw in the open-source AI coding agent OpenCode (developed by Anomaly). It affects versions 1.0.137 through 1.18.32 on Windows and WSL. A malicious or hijacked remote MCP server can execute code with the developer's own privileges during MCP…
Corsha, an industrial identity security vendor, announced Folio, a new module on the Corsha Industrial Identity Security Platform. It automatically builds and updates operational maps and documentation of how industrial systems are connected and communicating. Folio draws on live network and access data captured by Corsha Gatekeepers, so …
Black Kite announced Quantum Readiness, a new set of controls in the SSL/TLS Strength category of the Black Kite Cyber Rating. The controls assess quantum agility across an organization's third-party vendor ecosystem. They show which vendors are quantum-ready or adopting quantum-safe encryption. The release is product news, not an inciden…
The tenth annual Security Serious Unsung Heroes Awards, organised by Eskenzi PR, took place at St Barts Pub in London. The event recognised cybersecurity professionals, educators and community advocates whose work often goes unnoticed. Winners included Phil Muncaster (Cyber Correspondent), Andrea Litherland of Domestic & General (CISO Sup…
A pen tester, Dahvid Schloss (COO of Suzu Labs), audited the network devices of a large, unnamed US pharmacy retailer and found that an internet-facing Cisco edge firewall used the enable (administrator) password "password". The password was stored as Cisco IOS type 7, a reversible encoding with a publicly known key, so he could recover i…
Siemens has confirmed that attackers are actively exploiting CVE-2026-110936 (CVSS v4 8.4), a DLL search-path/side-loading flaw (CWE-427) in Siemens Software Center, to deliver malware. Attackers bundle a genuine, validly signed copy of the application (version 3.5.8.7) with malicious DLLs that it loads from its own folder. The activity i…
ThreatFabric has documented Hirudo, an Android banking remote-access trojan that steals credentials and gives operators remote control of the phone. Its distinguishing feature is replacing selected genuine banking apps with modified copies that interfere with security checks from inside the app. Victims first install a lure app (Shopora, …
FoxIO disclosed a class of denial-of-service flaws in the QPACK header compression used by HTTP/3. It affects seven of the ten stacks the firm tested and was released with working proof-of-concept code. An unauthenticated remote attacker can send a small compressed header batch that expands in memory by thousands of times, exhausting a de…
Splunk and SolarWinds released security updates this week for vulnerabilities that allow code execution, privilege escalation, denial-of-service (DoS) and information disclosure. The article does not report exploitation in the wild. Splunk's updates cover Splunk Enterprise and Splunk SOAR, and SolarWinds fixed flaws in Observability and P…
The 2026 SANS Cloud Security Survey Insights report (400 IT and security professionals) finds a persistent cloud security maturity gap. 93% of organizations run production workloads in the cloud and 65% use more than one provider. Only 40% rate their cloud security strategy as advanced or optimized, even though 73% have a dedicated cloud …
GoDaddy revoked 404,607 SSL/TLS certificates effective October 21, 2026, after finding that some subscriber certificates were issued outside the profiles defined in its Certification Practice Statement (CPS) and Certificate Policy (CP). The incident is tracked in Mozilla's CA Certificate Compliance program as Bug 2082703, which remains op…
A Chinese-speaking threat operator combined the agentic penetration-testing framework ARTEX with Claude Code, Codex and configurations requesting DeepSeek, GLM and Grok models to coordinate attacks on organizations worldwide. Recovered prompts dated August 4 to October 4, 2026 referenced targets in financial services, cryptocurrency, reta…
Attackers gained unauthorized access to the infrastructure of Onamae.com Desktop Cloud, a VPS service run by GMO Internet in Japan, and installed "unauthorized programs" in some customers' server environments. GMO confirmed the intrusion on October 20, 2026 (bleepingcomputer.com, gbhackers.com). It began rolling shutdowns of all Desktop C…
The United Arab Emirates says it is moving 50% of its government services to agentic AI as part of a transformation of its public service footprint. According to the Dark Reading report, the government says it is building a foundation of security and safety alongside the transition. The available text is only a short teaser, so it gives n…
A ZDNET consumer how-to article describes how to make Waze the default mapping app on a Google Pixel phone. The author says the August Android update removed the option to choose a default mapping app from the Default apps settings. The article describes no security incident, vulnerability or threat activity, and has no direct defender re…
ZDNET's Jack Wallen reviews GridCraft, a free, open-source, Rust-based spreadsheet application from ArtCraft that mimics Microsoft Excel. It runs natively on Linux, FreeBSD, macOS and Windows and supports XLSX files, more than 500 functions, charts and pivot tables. The reviewer notes weak template support, with no .xltx saving, and advis…
