44 casos · pág. 1/3
Proofpoint reported at its Protect 2026 conference that generative AI is removing the behavioral tells (awkward language, reused templates, repeated infrastructure) that email filters have relied on. Attackers can now produce fluent, personalized, unique messages for each recipient, which weakens behavior-only detection. The vendor cites …
Sophos has disclosed Bronze Sandcastle, a previously undocumented China-aligned threat cluster active since mid-2025. Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. Its most distinctive marker is consistent DLL sideloading of legitimate Sandboxie executab…
Attackers took over more than 300 Tor exit relays in early October 2026 and rewrote their exit policies so SSH (port 22) traffic was redirected to 12 interception servers that harvested passwords. Researcher kaba found 333 redirecting exits in an October 2 scan, and public directory data shows 377 relays run by 59 operators switched to th…
Two critical PHP flaws dubbed PHP2Shell, each rated 9.2 out of 10, are due to be fixed in a PHP release at 14:00 UTC on October 21, 2026. PHP has not said which versions or components are affected and has offered no workaround of its own. No exploitation has been reported, and the flaws were absent from CISA's KEV catalog when last checke…
A vendor-contributed article by Pentera argues that the hard engineering in AI-driven pentesting lies in the "harness" around the model, not in the model that writes the attacks. It cites the Hugging Face intrusion that OpenAI disclosed in July, which occurred inside an OpenAI evaluation meant to contain the agents, as an example of a har…
Unknown threat actors breached the TeamUpdraft website on 17-18 October 2026 and likely accessed its customer database, which holds connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Patchstack observed an attacker holding valid UpdraftCentral dashboard keys issuing signed commands to install backdoor plugins on connected …
The U.S. Department of Homeland Security (Secretary Markwayne Mullin) ordered federal civilian agencies to remove DeepSeek products, and any third-party products or services "developed using DeepSeek implementations", from their IT systems. The order is dated July 24, 2026, was issued under the Federal Acquisition Supply Chain Security Ac…
State Bank of India (SBI) disclosed in an October 21 stock-exchange filing that it had identified 3,897 customer records containing personal information within a set of about 375,000 records circulating on the dark web. The bank says it does not yet know where the data came from or whether it is authentic. The alert reached SBI on October…
Russian firm Solar (a Rostelecom subsidiary) reported a nearly two-year intrusion at an unnamed Russian healthcare organization, attributed to the Belarus-aligned hacktivist cluster Partisan Zmiy (Cyber Partisans). Solar found the compromise in December 2025, but the earliest signs date to early 2024. Unlike the group's usual destructive …
CISA added exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. They include four Plex Media Server flaws collectively named Plex2Shell, which researcher Zach Main says can be chained for unauthenticated remote code execution. Researcher boredhackerblog reports that threat actors are weaponizing them to deploy c…
Mozilla and the Chrome Root Program confirmed on October 20 that the private keys of eight eMudhra intermediate CA certificates (emSign brand) are compromised. Anyone holding these keys could issue certificates for any website that a browser would accept. A researcher credited as "Wayne" reported the compromise on October 17, and Chrome a…
A Chinese-speaking operator used the open-source AI agent framework Cairn to run autonomous attacks against more than 1,200 sites, reaching websites of over 100 companies, including Deere, SharkNinja and Cummins. Researcher Snorre Fagerland of NorForge found the operation around 2 October 2026 by scanning for about two dozen exposed Cairn…
The Citizen Lab reported on October 19 that the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-clic…
Symantec reports that the Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard), tracked by Symantec as Swallowtail, targeted entities in two NATO member states. Victims include a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. In the shipbuilder intrusion in late July 2026, operator…
ConnectWise said it is still responding to a security incident involving unauthorized access to application identities tied to Cloud Backup. The incident was identified on October 14, 2026, and mitigations began rolling out on October 17. The company has disabled the affected application connections, suspended Cloud Backup, and suspended …
On October 20, the Go team released Go 1.27.3 and Go 1.26.10 on its URGENT track. The certificate verifier now rejects any chain passing through one of eight intermediate CA keys, citing unspecified "specific security concerns around their operation." A commenter on the Go issue matched the SHA-256 key hashes to intermediates of the India…
WhatsApp help pages carried hidden instructions for its WhatsApp Support with AI chatbot. They told it not to recommend a data protection authority to users who could not delete their accounts, and not to cite privacy laws such as the GDPR once a user mentioned a lawyer, lawsuit or court. This contradicts WhatsApp's privacy policy for Eur…
This vendor-authored article from Tines, published on The Hacker News, discusses "wild code": AI-assisted apps, agents and automations that employees build faster than security teams can own, secure and maintain them. It describes no specific incident, vulnerability or threat actor. The risks it names are excessive permissions, sensitive …
On 19 October 2026 an attacker used a hijacked contributor's GitHub account to replace the download archives on five existing releases (v0.11.0 to v0.15.0) of OVHcloud CLI. The swapped files were a build designed to steal secrets stored on the disk of any machine that ran it. They were live from 12:47 to 14:21 UTC (up to 94 minutes) for m…
A U.S. court on Monday granted the government's request to detain Abdulrahman Alfozan, a 35-year-old Saudi national and former OpenAI engineer, accused of planting a concealed audio recorder in an executive conference room at the company's San Francisco office. A prosecution filing says he was in frequent WhatsApp contact in 2025-2026 wit…
