The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Help desk impersonation on Microsoft Teams leads to domain admin through AD CS abuse (edge of window)
Attackers messaged staff on Teams posing as IT support, got them to start Quick Assist, then abused Active Directory Certificate Services. One intrusion used a weak certificate template (ESC1) to impersonate privileged accounts and run DCSync, then moved data out with Rclone over SFTP. A second…
-
Binance reportedly hit by possible record crypto hack, engineer laptop suspected
Per the briefing, initial checks suggest an engineer's laptop was compromised, giving the attacker access to a service container. The value stolen could make it the largest crypto hack on record. The attack chain is still under investigation.
-
CISA adds CVE-2026-118527 to KEV: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Federal patch deadline 2026-11-13. Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with…
Also covered by Cybersecurity News, The Hacker News
-
Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving
The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A…
-
Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison
Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized and led by members of former Syrian President Bashar…
-
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was…
-
As Russia's Cyberwar Evolves, Belarus Steps Forward
The "FrostyNeighbor" advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives.
-
Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13…
Also covered by Security Affairs
-
Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen
Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far. Tether and Circle said they have frozen…
-
ISC Stormcast For Friday, October 30th, 2026 https://isc.sans.edu/podcastdetail/10158, (Fri, Oct 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
-
Anthropic-Themed Phishing Emails Bypass Top Security Tools
Obvious phishing emails with numerous red flags are somehow getting past some of the industry-leading secure email gateway (SEG) products.
-
Rethinking Cybersecurity Awareness in the AI Era
This installment of the Reporters' Notebook video series discusses some of the trends and topics from Cybersecurity Awareness Month, from using AI for better training to educating next-generation workforces on modern risks and emerging threats.
-
Why CTF Competitions May Be More Important Than Ever
As artificial intelligence squeezes early-career learning opportunities, capture-the-flag contests could be one way to help pick up the slack.
-
ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks and careless mistakes. Hackers are borrowing trust from…
-
Claude Model Builds Exploits Across Major Browsers & OSes
An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says.
-
Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw…
-
Threat Modeling With 4 Simple Questions on a White Board
A four-question exercise that CISOs can use to create a threat model that promises results, without a big spend.
-
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves creating fake GitHub projects that claim to be desktop…
-
JPMorgan Chase, Goldman Sachs underscore security in AI plans
“This is one of the most important times to make sure you are appropriately balancing risk and innovation,” said JPMorgan Chase Global CIO Lori Beer.
-
Hackers could poison AI models by tampering with core infrastructure
AI systems rely on a complex web of hardware. Compromising any one component could let adversaries change model weights.
-
Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities
Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm…
-
Japan Airlines and other carriers hit through Amadeus reservation system breach (backfill, 2026-10-29)
JAL says Amadeus told it on Oct 23 that unauthorized access ran from Aug 10, 2023 to Sept 23, 2026. About 92,000 customers affected, about 2,000 of them with passport numbers, contact details and frequent flyer numbers. No card numbers or passwords, per JAL. Asiana and Korean Air confirmed impact…
-
BYOD ransomware gang apologizes for hitting University of New Mexico hospital systems (backfill, 2026-10-29 article)
The group posted on about Oct 27 that it did not know the devices supported patient care and offered free decryption keys. It still holds stolen patient and employee data and offered to delete it for $2,500 per person. The health center says it paid no ransom and all facilities were running as of…
-
HHS OCR settles Lehigh Valley Health Network ransomware case for $800,000 (backfill, 2026-10-29)
Ransomware found Feb 4, 2023. PHI of 248,359 people was exfiltrated and posted on the dark web, including sensitive photos of radiation oncology patients. OCR cited no accurate and thorough risk analysis, no regular review of system activity, impermissible disclosure, and late breach notices. LVHN…
-
"Black October": AI-linked incidents pile up (Fortune roundup)
Fortune strings together AI-assisted finding of the PHP2Shell flaws (CISA KEV Oct 26), an AI pentest tool (ARTEX) reportedly used against South Korean banks and in attempted sign-ins to 2,250+ Microsoft 365 tenants, an AI test agent that tried to push malicious code to a GitHub project, and weak…