The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Denver Health Plan: vendor SquareML access key leak puts 238,000 members' data at risk
A leaked access key belonging to vendor SquareML could have allowed access to a database holding personal and health information for plan members.
-
OpenAI exec: AI-generated bug reports are overwhelming open-source maintainers
Michael Aiello, speaking at the DataTribe Challenge, said low-quality AI vulnerability reports are swamping maintainers and some have stopped accepting them. OpenAI reports 661 patches developed and 458 accepted by maintainers under its Daybreak program, and says it worked with the PHP Foundation…
-
Microsoft Authenticator for Android flaw (CVE-2026-80097) let a permissionless app request work-account tokens
A malicious app could launch an Authenticator activity, claim to be Teams, and pass a signature check against Teams' real signature. Tokens covered mail, files and calendar for the signed-in work account. Fixed in 6.2606.4246. Microsoft rates it 8.6, exploitation "less likely," and says user…
-
NAIC: US cyber premiums near $7.5B domestic, rates down eight straight quarters, loss ratio up to 53
Domestic direct premiums grew from $2.75B (2020) to about $7.5B (2025); about $9.5B including non-US surplus carriers. Policies in force rose 33% to about 5.8 million, mostly endorsements bundled into other lines (about 4% of premium, 53% of policies). Rates fell for eight quarters through Q1 2026…
-
TrendAI: three AI-assisted campaigns hit Japan, including a 44-agent autonomous framework and edge device targeting
CyberStrikeAI ran recon through exfiltration against at least 19 organizations (16+ in Japan) in October. A second operator used an LLM to speed planning and tool building, and got in through a GIS server with default credentials during a 24-day campaign. A third used AI to build tools against…
-
GMO Internet's Onamae Desktop Cloud breach: data leaked, ¥8 billion demand refused, customers told to power off
Intrusion detected Oct 20 could have placed malware on up to 26,739 customer servers. Data was stolen, and on Oct 27 the attacker published company and customer data. GMO refused the ¥8 billion (about $50 million) demand and offered ¥5,000 per customer. MetaTrader credentials may be exposed. No…
-
Apple ships iOS/macOS 27.2 and 26.7.2 fixes, backports exploited-flaw patch to iOS 18.7.11
286 vulnerabilities fixed across the new releases. CVE-2026-86950 was exploited in what Apple calls an "extremely sophisticated attack" (found by Meta's product security team) and was first patched in late September. iOS 18.7.11 now carries the fix for people who stay on the old release. iOS and…
-
HPE patches 72 flaws in Aruba AOS-8 and AOS-10, eight rated max severity, unauthenticated RCE and admin bypass
CVE-2026-79844 through 79851 allow unauthenticated remote code execution or admin authentication bypass on controllers, gateways and access points. Fixed builds: 8.10.0.24, 8.13.3.1, 10.4.1.14, 10.7.2.7, 10.8.1.2. HPE knows of no exploitation yet and advises moving CLI and web management to a…
-
Cathedral says its AI agents reached Anthropic internal business systems through third-party software; Anthropic disputes parts
Security startup Cathedral says AI agents found access paths in under 12 hours through vulnerable third-party sales, HR and IT software during a bug bounty engagement. Anthropic confirms access to some customer and partner business contact data and basic account records, and says it did not see…
-
University of Copenhagen confirms breach of about 525,000 people; second incident shuts admin systems
Attackers got into a test environment holding real personal data. Detected Oct 20, disclosed Oct 23. Exposed: names, Danish national ID numbers, phone numbers, personal emails. PIN codes for ID cards of about 20,000 staff and students were also exposed, so the university restricted access to…
-
ConnectWise cloud app abuse: Storm-0940 used AI agents against 2,250+ Microsoft 365 tenants; Huntress adds new detail
Microsoft attributes the activity to Storm-0940 (China state-aligned). Attackers used stolen credentials for a ConnectWise cloud backup application and its existing tenant permissions, so they signed in as applications and skipped user passwords and MFA prompts. The ARTEX multi-agent framework ran…
-
CISA adds CVE-2026-48356 to KEV: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Federal patch deadline 2026-11-10. Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or…
Also covered by The Hacker News
-
ICSA-26-267-02: Eufy Omni C20, Omni X10 Pro (Update A)
Highest CVSS 9.4. Affects Omni C20, Omni X10 Pro. Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code.
-
ICSA-26-300-01: The EPICS Community EPICS Base
Highest CVSS 9.8. Affects EPICS Base release. Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code.
-
ICSA-26-300-02: Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
Highest CVSS 9.1. Affects Mitsubishi Electric GENESIS64, Mitsubishi Electric ICONICS Suite, Mitsubishi Electric GENESIS and 16 more. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and…
-
So Many AI Security Benchmarks, but None Tell the Whole Story
Measuring artificial intelligence model security gets complex, fast, thanks to a growing patchwork of benchmarks targeting different variables in the equation. But none replace testing against your own code and workflows.
-
Risks & Rewards: How AI Is Redefining the CISO's Role
Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI's pros and cons, and ensure those deploying it own the risks.
-
In-the-Wild Attack Abuses AI Agents' Trust in Markdown
A new AI agent prompt injection technique exploits how coding assistants consume local instruction files, blurring the line between text documents and executable actions.
-
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
-
10 Software Security Practices Built for the Next 250 Years
This Cybersecurity Awareness Month's theme, "Securing the Next 250," asks us to look beyond vulnerabilities and consider what will make our digital systems resilient for generations.
-
Senators and rights groups say the administration is unlawfully withholding a FISA Section 702 court opinion
Wyden, Schiff and civil liberties groups say the declassification deadline was Sept 13 for an opinion on a filtering system that may amount to querying Americans' data. Section 702 lapsed this summer, with collection continuing under another court ruling through March 2027. The coalition wants…
-
Node2Shell (CVE-2026-111497): Brotli decoder flaw triggers patching across Node.js, .NET, PowerShell, Python
Flaw in Google's Brotli decoder 1.0.3 through 1.2.0 (fixed in 1.0.10, 1.1.1, 1.2.1). Google rates it CVSS v4 9.2; Microsoft rates it 8.1 and "Exploitation More Likely" for .NET, Visual Studio and PowerShell. Node.js, Python packages, Bun, Envoy and Istio are patched. DuckDB, Apache Arrow…
Also covered by CISA KEV
-
CISA adds CVE-2026-109619 to KEV: PHP Stale Internal Request-State Vulnerability
Federal patch deadline 2026-10-29. PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
-
CISA adds CVE-2026-109618 to KEV: PHP Memory Corruption Vulnerability
Federal patch deadline 2026-10-29. PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
Also covered by BleepingComputer
-
Trust Is Not What It Seems — and Fraudsters Are Counting on It
Threat actors don't need to rely on malware to breach organizations anymore. They're simply calling help desks and politely asking for access, with a little help from artificial intelligence.