{"articles":[{"id":6902,"guid":"https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/","source_key":"bleeping","title":"Critical BlockStrap flaw lets hackers run code on Magento servers","link":"https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/","published":"2026-10-16T20:00:59.000Z","teaser":"Magento flaw lets hackers run PHP code","summary":"A maximum-severity vulnerability, CVE-2026-103849, has been discovered in Magento and Adobe Commerce. This flaw, known as BlockStrap, could allow hackers to execute arbitrary PHP code on store servers. The vulnerability is considered critical and could be exploited by attackers to gain control of affected servers. Researchers warn that exploitation may occur soon, and users should take immediate action to protect their systems. The vulnerability affects Magento and Adobe Commerce, which are popular e-commerce platforms.","tags":["vuln"],"severity":"critical","actionable":true,"cves":["CVE-2026-103849"],"read_min":5,"score":131,"also_from":[],"src":"bleeping","hrs":4.9812344444444445,"rm":5,"act":true,"sev":"critical","hot":true},{"id":6869,"guid":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","source_key":"bleeping","title":"Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers","link":"https://www.bleepingcomputer.com/news/security/hackers-exploit-collabora-rce-flaw-to-backdoor-nextcloud-servers/","published":"2026-10-15T20:25:04.000Z","teaser":"Hackers exploit Collabora RCE flaw in Nextcloud","summary":"A critical command execution flaw, tracked as CVE-2026-110447, has been discovered in the Collabora Online - Built-in CODE Server app for Nextcloud. This vulnerability allows threat actors to exploit and backdoor Nextcloud servers. The Collabora Online app is used for editing office documents within Nextcloud, and the vulnerability can be exploited by sending a malicious request to the server. Users of Nextcloud with the Collabora Online app installed are advised to take immediate action to patch the vulnerability. The patch is available, and users should update their Collabora Online app to the latest version to prevent exploitation.","tags":["vuln"],"severity":"critical","actionable":true,"cves":["CVE-2026-110447"],"read_min":5,"score":131,"also_from":[],"src":"bleeping","hrs":28.579845555555554,"rm":5,"act":true,"sev":"critical","hot":true},{"id":6880,"guid":"https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/","source_key":"bleeping","title":"BeyondTrust patches zero-day exploited in attacks since August","link":"https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/","published":"2026-10-16T06:18:08.000Z","teaser":"BeyondTrust patches zero-day flaw","summary":"BeyondTrust has issued a patch for a critical vulnerability in its Remote Support product that has been exploited in zero-day attacks since late August. The vulnerability has been used in attacks, but details about the nature of these attacks and the threat actors behind them are not provided. Users of the Remote Support product should apply the patch as soon as possible to protect themselves from potential exploitation. There is no information on whether the attacks were targeted or widespread.","tags":["zeroday","vuln"],"severity":"critical","actionable":true,"cves":[],"read_min":2,"score":110,"also_from":[],"src":"bleeping","hrs":18.69540111111111,"rm":2,"act":true,"sev":"critical","hot":true},{"id":6900,"guid":"https://cyberscoop.com/?p=91149","source_key":"cyberscoop","title":"Prolific Chinese espionage group exploits BeyondTrust zero-day","link":"https://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/","published":"2026-10-16T17:09:09.000Z","teaser":"Armory Castle exploits BeyondTrust zero-day","summary":"A Chinese espionage group known as Armory Castle, or UNC5221, has been found to be exploiting a zero-day vulnerability in BeyondTrust products. This is the first known attack by the group, which occurred almost seven weeks ago. Armory Castle has previously compromised customers of Ivanti and Citrix. The group's activities suggest a focus on exploiting vulnerabilities in software used by large organizations to gain access to sensitive information.","tags":["zeroday","apt"],"severity":"high","actionable":true,"cves":[],"read_min":2,"score":105,"also_from":[],"src":"cyberscoop","hrs":7.8451233333333334,"rm":2,"act":true,"sev":"high","hot":true},{"id":6889,"guid":"https://www.malwarebytes.com/blog/ai/2026/10/eiliko-robot-companion-exposes-private-chats-and-can-be-hijacked","source_key":"malwarebytes","title":"Eiliko robot companion exposes private chats and can be hijacked","link":"https://www.malwarebytes.com/blog/ai/2026/10/eiliko-robot-companion-exposes-private-chats-and-can-be-hijacked","published":"2026-10-16T14:28:33.000Z","teaser":"Eiliko robot has security flaws","summary":"A researcher discovered significant security vulnerabilities in the Eiliko robot companion. These flaws expose private conversations between users and the robot, potentially allowing unauthorized access to sensitive information. Furthermore, the vulnerabilities enable remote modification of the robot's responses, which could lead to malicious activities. The security issues highlight the importance of robust security measures in IoT devices, especially those designed for personal interaction and potentially handling sensitive user data.","tags":["vuln","ics"],"severity":"high","actionable":true,"cves":[],"read_min":2,"score":105,"also_from":[],"src":"malwarebytes","hrs":10.52179,"rm":2,"act":true,"sev":"high","hot":true},{"id":6886,"guid":"https://therecord.media/beyond-trust-cyberattack-china","source_key":"therecord","title":"Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day","link":"https://therecord.media/beyond-trust-cyberattack-china","published":"2026-10-16T13:00:00.000Z","teaser":"Chinese group uses BeyondTrust zero-day for espionage","summary":"A suspected Chinese state-backed group is exploiting a zero-day vulnerability in BeyondTrust IT support software to carry out espionage attacks. The vulnerability is being used to gain unauthorized access to sensitive information. BeyondTrust is a popular IT support software used by many organizations, which makes this vulnerability particularly concerning. There is no information on a patch being available yet, so users of the software should be cautious and monitor their systems for any suspicious activity.","tags":["zeroday","apt"],"severity":"high","actionable":true,"cves":[],"read_min":2,"score":105,"also_from":[],"src":"therecord","hrs":11.997623333333333,"rm":2,"act":true,"sev":"high","hot":true},{"id":6849,"guid":"https://www.malwarebytes.com/blog/bugs/2026/10/update-chrome-google-fixes-37-security-flaws-including-seven-critical-bugs","source_key":"malwarebytes","title":"Update Chrome: Google fixes 37 security flaws, including seven critical bugs","link":"https://www.malwarebytes.com/blog/bugs/2026/10/update-chrome-google-fixes-37-security-flaws-including-seven-critical-bugs","published":"2026-10-15T14:15:03.000Z","teaser":"Google fixes 37 Chrome security flaws","summary":"Google has released an update for the Chrome browser, fixing 37 security flaws, including seven critical bugs. Some of these flaws could allow attackers to run malicious code on a device by tricking users into visiting a crafted webpage. The update is intended to patch these vulnerabilities and prevent potential attacks. Users are advised to update their Chrome browser to the latest version to ensure their security.","tags":["vuln"],"severity":"high","actionable":true,"cves":[],"read_min":2,"score":105,"also_from":[],"src":"malwarebytes","hrs":34.74679,"rm":2,"act":true,"sev":"high","hot":true},{"id":6893,"guid":"https://www.cybersecuritydive.com/news/china-espionage-beyondtrust-zero-day-hacker/833240/","source_key":"cybersecdive","title":"China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign","link":"https://www.cybersecuritydive.com/news/china-espionage-beyondtrust-zero-day-hacker/833240/","published":"2026-10-16T15:01:39.000Z","teaser":"China-nexus actor exploits BeyondTrust zero-day","summary":"A China-nexus espionage actor has been identified exploiting a zero-day vulnerability in BeyondTrust's support tool. The actor is using this exploit to harvest credentials and steal sensitive information from targeted organizations. The vulnerability is currently being exploited in the wild, and researchers are warning organizations to take immediate action to protect themselves. There are no details yet on how to patch or mitigate this vulnerability, but it is likely that BeyondTrust will release an update soon.","tags":["zeroday","apt"],"severity":"high","actionable":true,"cves":[],"read_min":5,"score":104,"also_from":[],"src":"cybersecdive","hrs":9.970123333333333,"rm":5,"act":true,"sev":"high","hot":true},{"id":6905,"guid":"/node/25643","source_key":"cisa","title":"CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support","link":"https://www.cisa.gov/news-events/alerts/2026/10/16/cisa-urges-patching-critical-vulnerability-beyondtrust-remote-support","published":"2026-10-16T12:00:00.000Z","teaser":"BeyondTrust Remote Support has a critical auth bypass vuln","summary":"CISA has issued an advisory about a critical authentication bypass vulnerability, CVE-2026-102764, in BeyondTrust Remote Support versions 26.2.3 and earlier. This vulnerability is being actively exploited by cyber threat actors to gain initial access, establish persistence, escalate privileges, and move laterally within a network. Patches are available for supported versions, which are 24.3.1 and later. However, organizations using older versions must first upgrade to a supported version before applying the patch. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, indicating that it is being actively exploited in the wild.","tags":["vuln","zeroday"],"severity":"critical","actionable":true,"cves":["CVE-2026-102764"],"read_min":2,"score":104,"also_from":[],"src":"cisa","hrs":12.997623333333333,"rm":2,"act":true,"sev":"critical","hot":true},{"id":6896,"guid":"https://www.govinfosecurity.com/zero-day-in-beyondtrust-remote-support-appliances-exploited-a-33129","source_key":"govinfosec","title":"Zero-Day in BeyondTrust Remote Support Appliances Exploited","link":"https://www.govinfosecurity.com/zero-day-in-beyondtrust-remote-support-appliances-exploited-a-33129","published":"2026-10-16T16:32:01.847Z","teaser":"Zero-day vuln in BeyondTrust appliances exploited","summary":"A zero-day vulnerability in BeyondTrust Remote Support appliances is being exploited by an advanced persistent threat group tied to China. The group has been using the vulnerability since late August to steal credentials and data from self-hosted appliances. Experts are warning users to patch the bug as soon as possible, before the fix can be reverse-engineered by other attackers. The vulnerability is particularly concerning because it affects edge devices, which can provide a foothold for further attacks. Users of self-hosted BeyondTrust Remote Support appliances should apply the patch immediately to protect their systems and data.","tags":["zeroday","apt","vuln"],"severity":"critical","actionable":true,"cves":[],"read_min":2,"score":103,"also_from":[],"src":"govinfosec","hrs":8.463776944444444,"rm":2,"act":true,"sev":"critical","hot":true},{"id":6872,"guid":"https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/","source_key":"bleeping","title":"Fake Arch Linux packages push malware with root privileges","link":"https://www.bleepingcomputer.com/news/security/fake-arch-linux-packages-push-malware-with-root-privileges/","published":"2026-10-15T17:12:31.000Z","teaser":"Malicious Arch Linux packages found in AUR.","summary":"A threat actor uploaded fake packages to the Arch User Repository (AUR) that mimicked two popular helper tools, yay and paru. These malicious packages were designed to install malware with root privileges on Arch Linux systems. The fake packages were likely intended to target users who install software from the AUR without properly verifying the authenticity of the packages. Users who have installed these packages may have malware running with elevated privileges on their systems. To protect themselves, users should verify the authenticity of packages before installation and consider reinstalling their systems if they have installed the malicious packages.","tags":["malware","vuln"],"severity":"high","actionable":true,"cves":[],"read_min":5,"score":100,"also_from":[],"src":"bleeping","hrs":31.789012222222222,"rm":5,"act":true,"sev":"high","hot":true},{"id":6854,"guid":"/node/25628","source_key":"cisa","title":"J4Care dcm4che","link":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","published":"2026-10-15T12:00:00.000Z","teaser":"J4Care dcm4che vulnerabilities disclosed","summary":"The Cybersecurity and Infrastructure Security Agency (CISA) has issued a cybersecurity advisory regarding vulnerabilities in J4Care dcm4che. Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The affected versions of J4Care dcm4che are dcm4chee-arc-light 5.35.1 and earlier, with specific CVEs including CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, and CVE-2026-105667. The CVSS score for these vulnerabilities is 9.1, indicating a high severity level. Users of affected versions should take action to patch or update their systems to prevent potential exploitation.","tags":["vuln"],"severity":"high","actionable":true,"cves":[],"read_min":2,"score":99,"also_from":[],"src":"cisa","hrs":36.99762333333334,"rm":2,"act":true,"sev":"high","hot":true},{"id":6884,"guid":"https://www.malwarebytes.com/blog/news/2026/10/spray-and-pray-job-applications-could-make-it-harder-for-you-to-spot-a-scam","source_key":"malwarebytes","title":"“Spray and pray” job applications could make it harder for you to spot a scam","link":"https://www.malwarebytes.com/blog/news/2026/10/spray-and-pray-job-applications-could-make-it-harder-for-you-to-spot-a-scam","published":"2026-10-16T11:55:15.000Z","teaser":"Scammers exploit job seekers","summary":"Scammers are taking advantage of job seekers who send out numerous job applications without keeping track of them. This tactic, known as 'spray and pray', makes it difficult for applicants to distinguish between legitimate responses and scam messages. Scammers send fake replies that appear to be from companies the applicant has applied to, making it harder to spot the scam. This method relies on the applicant's lack of organization and record-keeping, rather than exploiting a specific vulnerability or using sophisticated malware.","tags":["malware"],"severity":"medium","actionable":true,"cves":[],"read_min":2,"score":93,"also_from":[],"src":"malwarebytes","hrs":13.07679,"rm":2,"act":true,"sev":"medium","hot":true},{"id":6881,"guid":"https://www.schneier.com/?p=72789","source_key":"schneier","title":"Backdooring Open-Weight AI Models","link":"https://www.schneier.com/blog/archives/2026/10/backdooring-open-weight-ai-models.html","published":"2026-10-16T11:04:53.000Z","teaser":"Open-weight AI models can be backdoored","summary":"Researchers have found that open-weight AI models can be backdoored by editing their weights. This can be done through various methods, including task-specific fine-tuning, merging adapters, or abliteration. Abliteration is a technique that involves subtracting the direction in the weights that corresponds to a 'no' answer, effectively removing the model's ability to refuse or say no. This allows the model to provide unsafe or undesired responses. The issue is particularly concerning because many users download modified weights without verifying their contents, making it possible for malicious actors to introduce backdoors into the models.","tags":["ai"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":93,"also_from":[],"src":"schneier","hrs":13.916234444444445,"rm":2,"act":false,"sev":"medium","hot":true},{"id":6897,"guid":"https://www.bleepingcomputer.com/news/security/employees-using-personal-chatgpt-at-work-heres-what-it-admins-need-to-do/","source_key":"bleeping","title":"Employees using personal ChatGPT at work? Here's what IT admins need to do","link":"https://www.bleepingcomputer.com/news/security/employees-using-personal-chatgpt-at-work-heres-what-it-admins-need-to-do/","published":"2026-10-16T13:50:59.000Z","teaser":"Employees' personal ChatGPT use at work poses data risks.","summary":"Employees using personal ChatGPT accounts at work can inadvertently expose sensitive company data, even if their organization provides an approved Enterprise workspace. This can happen when employees use their personal accounts to perform work-related tasks, potentially leaking confidential information. IT teams need to investigate and address unauthorized AI use to prevent data breaches. They can start by monitoring network activity for suspicious traffic and blocking sensitive information from being transmitted to personal accounts.","tags":["cloud","policy"],"severity":"medium","actionable":true,"cves":[],"read_min":5,"score":90,"also_from":[],"src":"bleeping","hrs":11.14790111111111,"rm":5,"act":true,"sev":"medium","hot":true},{"id":6878,"guid":"https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/","source_key":"bleeping","title":"Microsoft: October Windows update may break Smart App Control","link":"https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/","published":"2026-10-16T08:44:22.000Z","teaser":"Windows update may break Smart App Control","summary":"Microsoft has warned that the October Windows update, specifically KB5127648, may cause issues with Smart App Control for some users. After installing the update, some users may have trouble turning on Smart App Control. This issue is related to the Windows 11 security update. There is no information on a workaround or fix at this time. Users who rely on Smart App Control may want to delay installing the update until a solution is available. ","tags":["vuln"],"severity":"medium","actionable":true,"cves":[],"read_min":2,"score":90,"also_from":[],"src":"bleeping","hrs":16.25817888888889,"rm":2,"act":true,"sev":"medium","hot":true},{"id":6842,"guid":"https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-bug-causing-windows-black-screens-explorer-crashes/","source_key":"bleeping","title":"Microsoft fixes bug causing Windows black screens, Explorer crashes","link":"https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-bug-causing-windows-black-screens-explorer-crashes/","published":"2026-10-15T09:10:20.000Z","teaser":"Microsoft fixes Windows bug causing black screens","summary":"Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. The issue was affecting users who installed updates for Windows 11. Microsoft has now fixed the bug, resolving the problems with black screens and Explorer crashes. Users who experienced these issues should no longer encounter them after applying the latest updates.","tags":["vuln"],"severity":"medium","actionable":true,"cves":[],"read_min":2,"score":90,"also_from":[],"src":"bleeping","hrs":39.82540111111111,"rm":2,"act":true,"sev":"medium","hot":true},{"id":6883,"guid":"/node/25637","source_key":"cisa","title":"CISA Adds One Known Exploited Vulnerability to Catalog","link":"https://www.cisa.gov/news-events/alerts/2026/10/15/cisa-adds-one-known-exploited-vulnerability-catalog","published":"2026-10-15T12:00:00.000Z","teaser":"CISA adds CVE-2026-21589 to KEV catalog","summary":"The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability, identified as CVE-2026-21589, affects multiple Atlassian products and allows files or directories to be accessible to external parties. This type of vulnerability is a common attack vector for malicious actors and poses significant risks to the federal enterprise. CISA's addition of this vulnerability to the KEV catalog is based on evidence of active exploitation. The Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize security updates based on risk, and this vulnerability is likely to be a high priority for remediation. ","tags":["vuln"],"severity":"high","actionable":true,"cves":["CVE-2026-21589"],"read_min":2,"score":86,"also_from":[],"src":"cisa","hrs":36.99762333333334,"rm":2,"act":true,"sev":"high","hot":true},{"id":6855,"guid":"/node/25630","source_key":"cisa","title":"Guangzhou Juan IoT Technology EseeCloud","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02","published":"2026-10-15T12:00:00.000Z","teaser":"Vulns in EseeCloud IP cameras","summary":"The Cybersecurity and Infrastructure Security Agency (CISA) has issued a cybersecurity advisory regarding vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP cameras. Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected cameras. The affected versions include the EseeCloud App and Firmware, with a CVSS score of 9.8. The vulnerabilities include the use of hard-coded credentials, improperly controlled modification of dynamically-determined object attributes, and observable response discrepancy. These vulnerabilities could be exploited by an attacker to gain control over the affected IP cameras. There is no information on patches or mitigations available in the provided text.","tags":["vuln","iot"],"severity":"high","actionable":true,"cves":[],"read_min":2,"score":84,"also_from":[],"src":"cisa","hrs":36.99762333333334,"rm":2,"act":true,"sev":"high","hot":true},{"id":6859,"guid":"/node/25629","source_key":"cisa","title":"Eclipse Foundation Eclipse Milo","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-01","published":"2026-10-15T12:00:00.000Z","teaser":"Eclipse Milo vulnerabilities allow data deletion and impersonation.","summary":"The Eclipse Foundation's Eclipse Milo has several vulnerabilities that could be exploited by an attacker to delete protected data, recover user credentials, impersonate legitimate users, or cause the server to become unresponsive. The affected versions are Eclipse Milo 0.6.0 and later, as well as Eclipse Milo 1.0.0 and later. These vulnerabilities are related to incorrect authorization and missing release of memory after effective lifetime. Successful exploitation could have significant consequences, including data loss and unauthorized access.","tags":["vuln"],"severity":"high","actionable":true,"cves":[],"read_min":2,"score":83,"also_from":[],"src":"cisa","hrs":36.99762333333334,"rm":2,"act":true,"sev":"high","hot":true},{"id":6860,"guid":"/node/25634","source_key":"cisa","title":"CISA Malcolm","link":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01","published":"2026-10-15T12:00:00.000Z","teaser":"CISA Malcolm vulnerabilities found","summary":"CISA has released a cybersecurity advisory for vulnerabilities found in CISA Malcolm. The affected versions of CISA Malcolm have several vulnerabilities, including Authentication Bypass by Spoofing, Incorrect Authorization, Server-Side Request Forgery (SSRF), Authentication Bypass Using an Alternate Path or Channel, and Cross-Site Request Forgery (CSRF). These vulnerabilities have a CVSS score of 8.1. The advisory is relevant to critical infrastructure sectors such as Energy, Information Technology, Water and Wastewater Systems, which use CISA Malcolm worldwide. The company headquarters is located in the United States, but the equipment is deployed globally.","tags":["vuln"],"severity":"high","actionable":true,"cves":[],"read_min":5,"score":83,"also_from":[],"src":"cisa","hrs":36.99762333333334,"rm":5,"act":true,"sev":"high","hot":true},{"id":6898,"guid":"https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/","source_key":"bleeping","title":"Burger King Japan data breach exposes 11 million customer records","link":"https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/","published":"2026-10-16T12:01:29.000Z","teaser":"Burger King Japan breached, 11M records exposed","summary":"Burger King Japan has disclosed a data breach where attackers accessed a server containing customer records. The breach exposed 11.18 million customer records. The company has not provided details on the cause of the breach or what specific data was stolen. There is no information on what actions customers can take at this time.","tags":["breach"],"severity":"high","actionable":false,"cves":[],"read_min":2,"score":79,"also_from":[],"src":"bleeping","hrs":12.972901111111112,"rm":2,"act":false,"sev":"high","hot":false},{"id":6891,"guid":"https://cyberscoop.com/?p=91145","source_key":"cyberscoop","title":"Cybersecurity incident at BAE Systems disrupts US bankruptcy court system","link":"https://cyberscoop.com/bae-systems-cybersecurity-incident-us-bankruptcy-courts/","published":"2026-10-16T15:12:44.000Z","teaser":"BAE Systems incident disrupts US bankruptcy court system","summary":"A cybersecurity incident at BAE Systems has caused a disruption to the US bankruptcy court system, resulting in a nationwide halt to official bankruptcy notices since October 9. The cause of the incident and the expected restoration date have not been announced. This disruption affects the processing and notification of bankruptcy cases across the US. There is currently no information available on the nature of the cybersecurity incident or the steps being taken to resolve it.","tags":["breach"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":74,"also_from":[],"src":"cyberscoop","hrs":9.785401111111112,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6867,"guid":"https://therecord.media/federal-bankruptcy-courts-dealing-with-cyberattack-outage","source_key":"therecord","title":"Federal bankruptcy courts dealing with outages after contractor cyberattack","link":"https://therecord.media/federal-bankruptcy-courts-dealing-with-cyberattack-outage","published":"2026-10-15T20:46:00.000Z","teaser":"Bankruptcy courts face outages after contractor cyberattack","summary":"A cyberattack on a government contractor has caused outages in federal bankruptcy courts, halting the production of bankruptcy notices. The incident's impact is currently limited to the bankruptcy court system, and it is unclear when services will be restored. There are no reported data breaches or other malicious activities beyond the disruption of services. The cause and extent of the attack are not specified in the available information.","tags":["breach"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":74,"also_from":[],"src":"therecord","hrs":28.230956666666668,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6864,"guid":"https://cyberscoop.com/?p=91125","source_key":"cyberscoop","title":"The next election influence campaign will target your AI chatbot","link":"https://cyberscoop.com/ai-chatbots-election-influence-hyperlocal-networks/","published":"2026-10-15T19:29:58.000Z","teaser":"AI chatbots may be targeted in election influence campaigns.","summary":"Researchers have found that someone is creating and spreading hyperlocal content about political races on the internet. This content is designed to train AI chatbots to favor certain candidates across a wide range of issues. The goal of this effort is to influence the information that these chatbots provide to users, potentially affecting the outcome of elections. There are no specific technical details available about how this is being done, but it highlights the potential vulnerability of AI systems to manipulation. As a result, it is essential for developers and users of AI chatbots to be aware of this potential threat and take steps to mitigate it. However, at this point, there is no clear action that can be taken to prevent this type of influence campaign.","tags":["ai","policy"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":74,"also_from":[],"src":"cyberscoop","hrs":29.498178888888887,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6862,"guid":"https://therecord.media/spyware-citizen-lab-advertising","source_key":"therecord","title":"Zero-click spyware infecting devices through online ads, researchers say","link":"https://therecord.media/spyware-citizen-lab-advertising","published":"2026-10-15T19:00:00.000Z","teaser":"Zero-click spyware infects devices via ads.","summary":"Researchers have discovered that powerful zero-click spyware is infecting devices worldwide through targeted online ads. This means that users do not need to click on anything for their devices to be infected, making it a significant development in the spread of surveillance technology. The exact technical details of how this spyware works are not provided in the initial report, but it highlights the growing concern over the use of online advertising as a vector for malware distribution. There is no specific action recommended for users at this time, as the research is still emerging and details are limited. However, it underscores the importance of being cautious when interacting with online advertisements and the need for robust security measures to protect against such threats.","tags":["malware","zeroday"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":74,"also_from":[],"src":"therecord","hrs":29.997623333333333,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6887,"guid":"https://therecord.media/russia-datasuckers-hackers-arrested","source_key":"therecord","title":"Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia","link":"https://therecord.media/russia-datasuckers-hackers-arrested","published":"2026-10-16T13:30:00.000Z","teaser":"Moscow police detain DataSuckers hackers","summary":"Russian authorities have detained three suspected members of the DataSuckers hacking group. The group is linked to breaches in Ukraine and Russia, including a recent cyberattack on a popular restaurant chain that exposed customer information. The detention is a result of the investigation into this cyberattack. There is no information on what actions the readers need to take as a result of this detention.","tags":["breach","apt"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":73,"also_from":[],"src":"therecord","hrs":11.497623333333333,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6885,"guid":"https://therecord.media/anne-arundel-county-maryland-confirms-data-breach","source_key":"therecord","title":"Baltimore suburb confirms August data breach after ransomware claims","link":"https://therecord.media/anne-arundel-county-maryland-confirms-data-breach","published":"2026-10-16T13:05:00.000Z","teaser":"Baltimore suburb confirms data breach","summary":"Anne Arundel County, Maryland, has confirmed a data breach occurred in August. An intruder stole files from government systems, and investigators are currently working to determine the extent of the exposed data. The breach was initially claimed by a ransomware group, but the county has not provided further details on the incident. There is no information available on what actions the county is taking to mitigate the breach or protect affected individuals.","tags":["breach","ransomware"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":73,"also_from":[],"src":"therecord","hrs":11.91429,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6851,"guid":"https://www.cybersecuritydive.com/news/thousands-refrigerator-devices-exposed-french-cyberattack/833117/","source_key":"cybersecdive","title":"Thousands of refrigerator devices remain exposed following French cyberattack","link":"https://www.cybersecuritydive.com/news/thousands-refrigerator-devices-exposed-french-cyberattack/833117/","published":"2026-10-15T15:31:11.000Z","teaser":"Refrigerator devices exposed after cyberattack","summary":"A recent cyberattack in France has highlighted a wider risk for industrial systems globally. The attack has left thousands of refrigerator devices exposed. The investigation into the incident suggests that the vulnerability exploited in the attack could potentially affect industrial systems across the world, posing a significant risk to their security and operation. There is no information on what actions are being taken to mitigate this risk or protect the exposed devices. ","tags":["ics","vuln"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":73,"also_from":[],"src":"cybersecdive","hrs":33.47790111111111,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6848,"guid":"https://therecord.media/suspected-kazakhstan-phishing-central-asia-espionage","source_key":"therecord","title":"Suspected Kazakhstan-linked hackers target governments across former Soviet states","link":"https://therecord.media/suspected-kazakhstan-phishing-central-asia-espionage","published":"2026-10-15T13:55:00.000Z","teaser":"Hackers target governments in former Soviet states","summary":"Researchers have identified a cyber-espionage campaign targeting governments across Central Asian states, which appears to have originated in Kazakhstan. The campaign is estimated to be around 2 years old. The attackers' goals and methods are not specified in the report, but the targeting of governments suggests a focus on sensitive information gathering. There is no information on the specific techniques used or the extent of the damage caused. As a result, there are no specific actions for organizations to take in response to this campaign. ","tags":["apt"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":73,"also_from":[],"src":"therecord","hrs":35.080956666666665,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6846,"guid":"https://www.malwarebytes.com/blog/news/2026/10/sextortion-help-firm-took-60-million-from-victims-ftc-alleges","source_key":"malwarebytes","title":"Sextortion “help” firm took $60 million from victims, FTC alleges","link":"https://www.malwarebytes.com/blog/news/2026/10/sextortion-help-firm-took-60-million-from-victims-ftc-alleges","published":"2026-10-15T11:48:26.000Z","teaser":"FTC alleges firm took $60m from sextortion victims","summary":"The Federal Trade Commission (FTC) has accused Digital Forensics Corporation and its affiliated companies of exploiting individuals who were seeking help with intimate-image blackmail, also known as sextortion. The FTC alleges that these companies took advantage of vulnerable people, charging them for services that were not provided or were ineffective. The companies allegedly collected $60 million from victims. The FTC's allegations highlight the need for caution when seeking help online, especially for sensitive issues like sextortion. There is no immediate action for readers to take, as this is an awareness issue.","tags":["breach"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":73,"also_from":[],"src":"malwarebytes","hrs":37.190401111111115,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6841,"guid":"https://cyberscoop.com/?p=91118","source_key":"cyberscoop","title":"AdFection: How mercenary spyware invades victims’ devices through targeted advertising","link":"https://cyberscoop.com/adfection-zero-click-spyware-discover-tech/","published":"2026-10-15T10:00:00.000Z","teaser":"Mercenary spyware invades devices via targeted ads","summary":"Researchers have discovered a type of mercenary spyware that infects victims' devices through targeted advertising, known as AdFection. This method of infection has significant implications for the online advertising world and regulators. The attackers use targeted ads to deliver the spyware, which can then be used to steal sensitive information from the infected devices. The researchers' findings highlight the need for increased security measures in the online advertising industry to prevent such attacks. There is no immediate action for users to take, but the discovery serves as a reminder of the importance of being cautious when clicking on ads online.","tags":["malware","vuln"],"severity":"medium","actionable":false,"cves":[],"read_min":5,"score":73,"also_from":[],"src":"cyberscoop","hrs":38.99762333333334,"rm":5,"act":false,"sev":"medium","hot":false},{"id":6852,"guid":"https://www.cybersecuritydive.com/news/ai-industrial-control-systems-internet-exposed-censys/833112/","source_key":"cybersecdive","title":"Internet exposure of AI tools, ICS devices continues to grow","link":"https://www.cybersecuritydive.com/news/ai-industrial-control-systems-internet-exposed-censys/833112/","published":"2026-10-15T15:11:40.000Z","teaser":"Exposure of AI tools and ICS devices online continues to grow.","summary":"A recent report found that despite vulnerability disclosures and hacking campaigns, the amount of important infrastructure left online has not decreased significantly. This includes AI tools and Industrial Control Systems (ICS) devices, which are increasingly being exposed to the internet. This exposure can pose significant risks to the security and integrity of these systems. The report suggests that more needs to be done to address this issue and protect critical infrastructure from potential cyber threats. There are no specific actions for practitioners to take based on this report, as it appears to be a general trend rather than a specific vulnerability or incident.","tags":["ics","vuln"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":72,"also_from":[],"src":"cybersecdive","hrs":33.80317888888889,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6853,"guid":"/node/25627","source_key":"cisa","title":"Thermo Fisher Torrent Suite Software","link":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01","published":"2026-10-15T12:00:00.000Z","teaser":"Thermo Fisher software has path traversal vuln","summary":"A vulnerability has been discovered in Thermo Fisher Torrent Suite Software, which could allow an attacker to read arbitrary files on the Torrent Server. The affected versions are not explicitly stated, but the vulnerability is described as an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability. This vulnerability could be exploited by an attacker to access sensitive files on the server. The software is used in the healthcare and public health sectors worldwide.","tags":["vuln"],"severity":"medium","actionable":true,"cves":[],"read_min":2,"score":72,"also_from":[],"src":"cisa","hrs":36.99762333333334,"rm":2,"act":true,"sev":"medium","hot":false},{"id":6895,"guid":"https://www.govinfosecurity.com/cardiac-monitoring-firm-irhythms-hack-affects-82-million-a-33131","source_key":"govinfosec","title":"Cardiac Monitoring Firm iRhythm's Hack Affects 8.2 Million","link":"https://www.govinfosecurity.com/cardiac-monitoring-firm-irhythms-hack-affects-82-million-a-33131","published":"2026-10-16T16:32:01.847Z","teaser":"iRhythm breach affects 8.2 million users","summary":"A data breach at iRhythm Technologies, a maker of wearable cardiac monitors, has potentially affected every user of the company's technology. The breach was disclosed in a public filing on Thursday. The company is based in San Francisco and produces portable heartbeat detectors. With 8.2 million users affected, this breach could have significant implications for the privacy and security of sensitive health information.","tags":["breach"],"severity":"high","actionable":false,"cves":[],"read_min":2,"score":71,"also_from":[],"src":"govinfosec","hrs":8.463776944444444,"rm":2,"act":false,"sev":"high","hot":false},{"id":6850,"guid":"https://www.schneier.com/?p=72786","source_key":"schneier","title":"Measuring Human Cryptanalysis Effort","link":"https://www.schneier.com/blog/archives/2026/10/measuring-human-cryptanalysis-effort.html","published":"2026-10-15T16:24:29.000Z","teaser":"Site estimates cryptanalyst-hours spent on public-key algorithms","summary":"Matthew Green has launched a new site that aims to quantify the amount of cryptanalytic effort dedicated to various public-key algorithms. The site estimates the number of cryptanalyst-hours spent analyzing different algorithms, including ECDLP, structured and plain lattices, and syndrome decoding. This is achieved by classifying and analyzing roughly sixteen thousand research papers on these topics. The goal of the site is to provide a measure of the amount of public cryptanalysis each public-key assumption has received, using the existing literature as a basis for estimation. This project can help provide insight into the relative security of different cryptographic algorithms. There is no immediate action required for users, as this project is primarily focused on providing a resource for researchers and cryptographers. ","tags":["tools"],"severity":"info","actionable":false,"cves":[],"read_min":2,"score":70,"also_from":[],"src":"schneier","hrs":32.58956777777778,"rm":2,"act":false,"sev":"info","hot":false},{"id":6904,"guid":"https://www.schneier.com/?p=72715","source_key":"schneier","title":"Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact","link":"https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-squid-before-the-chicxulub-meteor-impact.html","published":"2026-10-16T21:06:47.000Z","teaser":"New squid research unrelated to security","summary":"This article discusses new research on squid that lived before the Cretaceous-Paleogene mass extinction event. It has no relation to security. The post also invites readers to discuss recent security news not covered by the author.","tags":[],"severity":"info","actionable":false,"cves":[],"read_min":2,"score":69,"also_from":[],"src":"schneier","hrs":3.884567777777778,"rm":2,"act":false,"sev":"info","hot":false},{"id":6871,"guid":"https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth/","source_key":"bleeping","title":"Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth","link":"https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth/","published":"2026-10-15T18:20:59.000Z","teaser":"Hackers hijack devices to resell stolen bandwidth","summary":"A proxyjacking campaign has been discovered, affecting devices in 34 countries. The campaign involves hackers taking control of D-Link and Ubiquiti devices, and then using them to resell the victims' internet connections through a commercial residential proxy network. This allows the hackers to monetize the stolen bandwidth. The affected devices are likely compromised due to vulnerabilities or weak passwords. There is no information on how to patch or fix the issue, but users can take general precautions such as changing default passwords and keeping firmware up to date. ","tags":["malware","vuln"],"severity":"medium","actionable":false,"cves":[],"read_min":5,"score":69,"also_from":[],"src":"bleeping","hrs":30.64790111111111,"rm":5,"act":false,"sev":"medium","hot":false},{"id":6843,"guid":"https://www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-records-dating-back-to-1978/","source_key":"bleeping","title":"UK Legal Aid Agency: Hackers stole records dating back to 1978","link":"https://www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-records-dating-back-to-1978/","published":"2026-10-15T08:06:47.000Z","teaser":"Hackers stole UK Legal Aid records","summary":"The UK's Legal Aid Agency (LAA) has announced that a breach of its IT systems in April 2025 resulted in the theft of records dating back to 1978. The LAA manages the country's Public Defender Service and is an executive agency of the UK's Ministry of Justice. The breach occurred in April 2025, but the full extent of the stolen data is not yet clear. There is no information on what actions the LAA is taking to protect affected individuals or prevent similar breaches in the future.","tags":["breach"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":69,"also_from":["therecord"],"src":"bleeping","hrs":40.884567777777775,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6903,"guid":"https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/","source_key":"bleeping","title":"Targeted ads installed Candiru spyware in zero-click attacks","link":"https://www.bleepingcomputer.com/news/security/zero-click-attacks-used-targeted-ads-to-deliver-candiru-spyware/","published":"2026-10-16T17:20:03.000Z","teaser":"Candiru spyware delivered via targeted ads","summary":"Candiru spyware was installed on devices at Al Jazeera Media Network through targeted online advertisements. The attack was a zero-click exploit, meaning that the spyware was delivered simply by rendering the malicious ads on the victim's device, without requiring any interaction from the user. This type of attack highlights the risks associated with online advertising and the importance of having robust security measures in place to prevent such exploits. The fact that the attack was targeted suggests that the attackers had specific interests in compromising the devices of Al Jazeera Media Network employees.","tags":["zeroday","malware","apt"],"severity":"medium","actionable":false,"cves":[],"read_min":5,"score":68,"also_from":[],"src":"bleeping","hrs":7.663456666666667,"rm":5,"act":false,"sev":"medium","hot":false},{"id":6879,"guid":"https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/","source_key":"bleeping","title":"BAE Systems cyberattack disrupts US federal court operations","link":"https://www.bleepingcomputer.com/news/security/bae-systems-cyberattack-disrupts-us-federal-court-operations/","published":"2026-10-16T07:37:35.000Z","teaser":"BAE Systems cyberattack affects US courts","summary":"A cyberattack on government contractor BAE Systems has disrupted operations of US federal courts. The attack has taken down the notice system used by federal bankruptcy courts, according to the Administrative Office of the US Courts. There are no details on the nature of the cyberattack or when the system is expected to be restored. The incident highlights the potential impact of supply-chain attacks on critical infrastructure and services. At this time, there is no information on what actions sysadmins or security engineers can take in response to this incident.","tags":["breach","supplychain"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":68,"also_from":[],"src":"bleeping","hrs":17.371234444444443,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6907,"guid":"https://www.govinfosecurity.com/prove-claims-former-employees-fueled-kyxstart-infringement-a-33135","source_key":"govinfosec","title":"Prove Claims Former Employees Fueled KYXStart Infringement","link":"https://www.govinfosecurity.com/prove-claims-former-employees-fueled-kyxstart-infringement-a-33135","published":"2026-10-16T22:31:29.821Z","teaser":"Prove sues KYXStart over patent infringement","summary":"Prove, a digital identity authentication company, has filed a lawsuit against rival KYXStart in Delaware. The complaint alleges that two former senior employees of Prove helped KYXStart develop competing products that infringe on two Prove patents related to digital identity authentication. These former employees are also accused of violating contractual restrictions, which has undermined Prove's competitive position in the market. The lawsuit targets two specific patents covering digital identity authentication, fraud intelligence, and authentication products.","tags":["breach","vuln"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":59,"also_from":[],"src":"govinfosec","hrs":2.4726730555555556,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6875,"guid":"https://www.govinfosecurity.com/breach-roundup-french-supermarket-hacks-wake-up-call-a-33123","source_key":"govinfosec","title":"Breach Roundup: French Supermarket Hacks a 'Wake-Up Call'","link":"https://www.govinfosecurity.com/breach-roundup-french-supermarket-hacks-wake-up-call-a-33123","published":"2026-10-15T22:01:34.783Z","teaser":"Multiple breaches reported globally","summary":"A series of breaches and cyberattacks have been reported worldwide. In France, a supermarket hack is being described as a 'wake-up call'. Ahold Delhaize has restored deliveries after a previous disruption. Other incidents include a ransomware attack on a seafood logistics company, the discovery of the Aoki infostealer and Hirudo Trojan, and a suspected cybercrime marketplace admin arrest. Additionally, a Russian oil refinery was targeted, and Poland is investigating the use of Pegasus spyware. Palo Alto has also released a patch for a vulnerability.","tags":["breach","ransomware","malware"],"severity":"medium","actionable":false,"cves":[],"read_min":5,"score":59,"also_from":[],"src":"govinfosec","hrs":26.971294722222222,"rm":5,"act":false,"sev":"medium","hot":false},{"id":6868,"guid":"https://www.govinfosecurity.com/openai-accuses-apple-receiving-stolen-trade-secrets-a-33120","source_key":"govinfosec","title":"OpenAI Accuses Apple of Receiving Stolen Trade Secrets","link":"https://www.govinfosecurity.com/openai-accuses-apple-receiving-stolen-trade-secrets-a-33120","published":"2026-10-15T21:01:40.069Z","teaser":"OpenAI accuses Apple of receiving stolen trade secrets.","summary":"OpenAI has accused a former employee of stealing corporate secrets and sharing them with Apple. This accusation comes as part of an ongoing legal fight between the two companies, where Apple had previously claimed that OpenAI staff accessed and stole files related to AI-powered devices. The former OpenAI employee is alleged to have shared the stolen secrets with Apple just hours before the first hearing on Apple's claims. The legal battle between OpenAI and Apple is centered around allegations of trade secret theft and misuse of confidential information. OpenAI's counter-accusation adds a new layer to the dispute, suggesting that Apple may have also been involved in the misuse of stolen trade secrets. The outcome of this legal fight could have significant implications for both companies and the broader tech industry. There is no immediate action required for sysadmins or security engineers, as this is a legal dispute between two companies.","tags":["breach"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":59,"also_from":[],"src":"govinfosec","hrs":27.96982638888889,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6866,"guid":"https://www.govinfosecurity.com/openai-sued-over-chatgpt-safety-risks-by-8-us-states-a-33119","source_key":"govinfosec","title":"OpenAI Sued Over ChatGPT Safety Risks by 8 US States","link":"https://www.govinfosecurity.com/openai-sued-over-chatgpt-safety-risks-by-8-us-states-a-33119","published":"2026-10-15T20:01:44.534Z","teaser":"8 US states sue OpenAI over ChatGPT safety risks","summary":"Eight state attorneys general have filed a lawsuit against OpenAI, alleging that its ChatGPT chatbot provides dangerous advice, including medical and mental health guidance that encourages teen suicide. The lawsuit also claims that OpenAI misleads consumers about the safety measures and privacy protections of ChatGPT. The states are concerned about the potential harm that ChatGPT's advice could cause to users, particularly vulnerable individuals such as teenagers. The lawsuit highlights the need for AI developers to prioritize user safety and transparency in their products. There is no immediate action required for users, but the lawsuit may lead to changes in how OpenAI operates ChatGPT in the future.","tags":["policy","ai"],"severity":"medium","actionable":false,"cves":[],"read_min":3,"score":59,"also_from":[],"src":"govinfosec","hrs":28.96858611111111,"rm":3,"act":false,"sev":"medium","hot":false},{"id":6863,"guid":"https://www.govinfosecurity.com/cryptohack-roundup-ledger-halts-sales-amid-86m-theft-probe-a-33114","source_key":"govinfosec","title":"Cryptohack Roundup: Ledger Halts Sales Amid $86M Theft Probe","link":"https://www.govinfosecurity.com/cryptohack-roundup-ledger-halts-sales-amid-86m-theft-probe-a-33114","published":"2026-10-15T19:01:44.427Z","teaser":"Ledger halts sales amid $86M theft probe","summary":"Ledger has stopped selling its wallets in Asia due to an investigation into the theft of $86 million. The halt is part of a larger probe into the company's security practices. In other cryptocurrency news, the UK has sanctioned a crypto exchange for helping Russia evade sanctions. Hackers have also been using flaws in AhsayCBS to deploy cryptocurrency miners. A British court has ruled on a $5 billion bitcoin ownership dispute, and XRP Ledger has fixed a bug that allowed unauthorized token creation.","tags":["breach","malware"],"severity":"medium","actionable":false,"cves":[],"read_min":2,"score":59,"also_from":[],"src":"govinfosec","hrs":29.968615833333335,"rm":2,"act":false,"sev":"medium","hot":false},{"id":6861,"guid":"https://www.govinfosecurity.com/frustrated-ransomware-gangs-turn-to-real-world-threats-a-33118","source_key":"govinfosec","title":"Frustrated Ransomware Gangs Turn to Real World Threats","link":"https://www.govinfosecurity.com/frustrated-ransomware-gangs-turn-to-real-world-threats-a-33118","published":"2026-10-15T18:01:24.398Z","teaser":"Ransomware gangs use real-world threats","summary":"Ransomware gangs are increasingly turning to real-world threats against business executives and their families as a means to gain leverage in negotiations. This shift is reportedly in response to enterprises improving their cyber resilience and becoming less willing to pay extortion demands. A survey commissioned by Semperis found this trend, highlighting the evolving tactics of ransomware groups as they face increased digital defenses. There is no specific action for sysadmins or security engineers to take based on this information, as it appears to be a general trend rather than a vulnerability or breach that can be directly addressed. The change in tactics by ransomware gangs underscores the importance of continued vigilance and robust cybersecurity measures. ","tags":["ransomware"],"severity":"medium","actionable":false,"cves":[],"read_min":5,"score":59,"also_from":[],"src":"govinfosec","hrs":30.974179444444445,"rm":5,"act":false,"sev":"medium","hot":false},{"id":6838,"guid":"https://www.govinfosecurity.com/blogs/cmmc-contractors-should-plan-for-nist-revision-3-now-p-4212","source_key":"govinfosec","title":"Why CMMC Contractors Should Plan for NIST Revision 3 Now","link":"https://www.govinfosecurity.com/blogs/cmmc-contractors-should-plan-for-nist-revision-3-now-p-4212","published":"2026-10-15T06:01:28.399Z","teaser":"NIST SP 800-171 Revision 3 is now the standard","summary":"The suspension of CMMC Phase II does not reduce the urgency for the defense industrial base to prepare for NIST SP 800-171 Revision 3. In fact, it may raise the stakes, as contractors who wait for the revision to appear in a contract may leave too little time to prepare. Contractors should use this time to map the gaps and prepare for the new standard. NIST SP 800-171 Revision 3 is now the current standard, and preparation is key to avoiding last-minute rushes and potential compliance issues.","tags":["policy"],"severity":"info","actionable":true,"cves":[],"read_min":2,"score":55,"also_from":[],"src":"govinfosec","hrs":42.97306805555556,"rm":2,"act":true,"sev":"info","hot":false},{"id":6890,"guid":"/node/25636","source_key":"cisa","title":"Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials","link":"https://www.cisa.gov/resources-tools/resources/cyber-threat-actors-use-variety-techniques-target-election-and-campaign-officials","published":"2026-10-16T12:00:00.000Z","teaser":"CISA and FBI warn election officials of cyber threats.","summary":"The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have released a Public Service Announcement (PSA) to warn election and campaign officials about potential cyber threats during the 2026 U.S. midterm elections. Malicious actors may use techniques such as phishing and smishing to steal sensitive information, including login credentials, or to install malware on targeted devices. These threats are particularly concerning for election officials, candidates, and political organizations due to their access to sensitive data like voter registration information. \n\nThe PSA aims to raise awareness among these groups about the risks they face and the importance of taking proactive measures to secure their systems and data. \n\nWhile the announcement does not specify particular actions that must be taken immediately, it underscores the need for vigilance and the implementation of robust cybersecurity practices to mitigate these threats.","tags":["policy","apt"],"severity":"medium","actionable":false,"cves":[],"read_min":5,"score":54,"also_from":[],"src":"cisa","hrs":12.997623333333333,"rm":5,"act":false,"sev":"medium","hot":false},{"id":6888,"guid":"https://therecord.media/proofpoint-varonis-cybersecurity-acquisition","source_key":"therecord","title":"Proofpoint lines up $6.3 billion deal for Varonis’ data security","link":"https://therecord.media/proofpoint-varonis-cybersecurity-acquisition","published":"2026-10-16T14:45:00.000Z","teaser":"Proofpoint to acquire Varonis for $6.3 billion","summary":"Proofpoint, a cybersecurity company, has announced its plan to acquire Varonis, a data visibility and security firm, in an all-cash deal worth $6.3 billion. This acquisition is expected to expand Proofpoint's capabilities in data security. Varonis is known for its data visibility and security solutions, which will likely complement Proofpoint's existing cybersecurity offerings. The acquisition is a significant move in the cybersecurity industry, as it combines two major players in the field. There are no immediate actions required for users or organizations as a result of this announcement.","tags":["supplychain"],"severity":"info","actionable":false,"cves":[],"read_min":2,"score":50,"also_from":[],"src":"therecord","hrs":10.247623333333333,"rm":2,"act":false,"sev":"info","hot":false}],"generated":"2026-10-17T00:59:51.511Z","count":50,"ioc_count":0}