Oct 6, 2026
•
2 min read
Attackers abused a vendor's access to Denmark's national registry, taking data on 8.8 million people. Plus: AI-powered bank hacks in South Korea.
Oct 5, 2026
Attackers took over Microsoft's X account, which has 13 million followers, to promote a crypto token in an apparent pump-and-dump scheme.
Google suspended open-source vulnerability submissions after a flood of automated reports, most of them invalid. Curl and Intel acted first.
Anibal Canelon Aguirre, alleged Ploutus developer and the first hacker on the FBI's Top 10 list, faces charges over $5.4 million in ATM thefts.
Shinhan Bank leaked 25,000 customer records and Kookmin 119,000 card details. Analysts suspect AI attack automation tools were used.
Attackers misused a private company's legitimate access to Denmark's Central Population Register to extract names, addresses and CPR numbers.
Oct 1, 2026
A phishing operation aimed at executives steals Microsoft 365 sessions and installs remote-access tools. Plus: an AI agent breached a nonprofit.
Sep 30, 2026
Microsoft says Star Blizzard sends a harmless email first, then a password-protected archive once you reply. Over 100 organizations hit.
Truffle Security scanned 224 million repositories and found 543,699 credentials that still worked. Median exposure time: 784 days.
Apple fixed CVE-2026-86950, a CoreGraphics flaw used in extremely sophisticated attacks on targeted individuals. CISA added it to KEV.
DIVD says two Zammad zero-days let an autonomous AI agent hijack sessions, run code and reach root in seconds. Upgrade to version 7.
The CSuite campaign steals Microsoft 365 sessions and installs remote-management tools like ScreenConnect, with 51% of samples from the US.
Citrix NetScaler attacks escalated into mass exploitation with web shells and state-linked actors. Plus: ShinyHunters beat a firewall fix.
Sep 29, 2026
1 min read
Bitget restarted Bitcoin withdrawals after a breach suspected to involve North Korean hackers drained over $350 million from its wallets.
Microsoft says JadePuffer used compromised Azure service principals to map a tenant for 15 hours, then delete storage, vaults and backups.
Two former US Air Force members got 189 months combined for BEC scams that diverted wire transfers of $1.68 million and $720,000.
ShinyHunters URL-encoded one character to bypass firewall rules protecting unpatched Oracle PeopleSoft servers. FBI job portals remain offline.
Attackers are planting web shells and tunneling malware on Citrix NetScaler appliances. Mandiant links the campaign to suspected state actors.
Attackers are exploiting two critical Citrix NetScaler flaws globally, with a Sept. 30 federal deadline. Plus: Nvidia's new AI agent guardrails.
Sep 28, 2026
3 min read
An OpenAI agent bypassed controls on Australia's Medicare statistics portal. No patient records were accessed; the PM criticized the delay.
CISA says attackers are exploiting two critical Citrix NetScaler flaws globally. CVE-2026-88771 and CVE-2026-88772 both score 9.5.
Security planning cycles are shortening as agentic AI and post-quantum cryptography arrive at the same time, industry leaders say.
Defense Secretary Pete Hegseth said the NSA and military cyber forces will help protect election systems during the November midterms.
Nvidia released an open platform to monitor AI agents, backed by IBM, Microsoft and Anthropic, after a run of AI security incidents.
hinyHunters says it took FBI employee data from the bureau's jobs portal. Plus: a Lenovo flaw opened 5,000 Dropbox accounts with no password.
