Cybersecurity
AI-Discovered Software Flaws Raise Fears of New Cyber Emergencies
AI is accelerating software vulnerability discovery, putting pressure on security teams to verify flaws, deploy patches and prevent exploitation.
Cybersecurity
Cybersecurity news, data breaches, threats, privacy updates and developments in digital security.
Cybersecurity
Critical PHP Vulnerabilities Put Websites at Risk as Emergency Patches Roll Out
Critical PHP vulnerabilities could let attackers execute code remotely, prompting urgent security updates for websites and server infrastructure.
Cybersecurity
AI Agents Help Hacker Breach More Than 100 Organisations at an Estimated $50 per Intrusion
AI agents helped a hacker compromise websites linked to more than 100 organisations after targeting over 1,200 sites, with AI usage estimated at around $5,000.
Cybersecurity
PwnEscape Linux Flaw Enables Guest-to-Host Virtual Machine Escape
PwnEscape, a critical Linux kernel flaw, enables a demonstrated guest-to-host VM escape and exposes risks for operators running affected virtualisation hosts.
Cybersecurity
Researchers Uncover Zero-Click Spyware Delivered Through Online Ads
Researchers link spyware infections at Al Jazeera to targeted online ads, exposing how zero-click attacks can exploit advertising infrastructure.
Cybersecurity
Cisco Patches Actively Exploited CVSS 9.8 Email Gateway Flaw
Cisco has confirmed active exploitation of a critical Secure Email Gateway flaw that could enable unauthenticated attackers to write files and execute commands as root.
Cybersecurity
GitLab Patches Critical CVSS 10.0 Code Execution Flaw
GitLab has fixed a critical CI/CD vulnerability that could enable remote code execution on affected servers, urging self-managed users to install security updates immediately.
Cybersecurity
The Enterprise Attack Surface Is Expanding as AI Adoption Accelerates
The enterprise attack surface is growing as AI, cloud platforms and connected business systems create new security challenges for organisations.
Cybersecurity
ASOS Confirms Customer Data Breach After Hackers Send Rogue App Notifications
British fashion retailer ASOS has confirmed that attackers accessed some customer information after an employee’s login credentials were obtained through impersonation. The breach involved third-party platforms used by the company, while unauthorised notifications sent through its app raised concerns about the security of connected business systems.
Cybersecurity
Rubrik Expands Project Hourglass With AI Code Guardian Security Tool
Rubrik is expanding its Project Hourglass cybersecurity initiative with Code Guardian, an AI-powered tool designed to identify and validate vulnerabilities in software code. The system uses Anthropic’s Claude Mythos 5 to analyse isolated copies of code repositories, helping security teams prioritise exploitable weaknesses without exposing live production systems.
Cybersecurity
CrowdStrike Says AI Tools Were Used in Attacks on South Korean Banks
AI-powered cyberattacks are raising fresh concerns after CrowdStrike identified the use of the Chinese-developed ARTEX agent alongside Anthropic’s Claude Code in a campaign targeting South Korean financial institutions. The activity, which began in late September, involved multiple intrusions and data theft, highlighting how AI agents are increasingly being incorporated into real-world cyber operations.
Cybersecurity
South Korean Megachurches Investigate Suspected AI-Linked Cyberattacks
Two major South Korean churches are investigating suspected cyberattacks that may have exposed personal information belonging to hundreds of thousands of members, with researchers finding signs of AI-assisted activity.
Cybersecurity
ASOS Investigates Cyberattack After Hackers Send Messages Through Its App
ASOS is investigating a cyber incident after customers received an unauthorised app notification claiming hackers had compromised the retailer’s Snowflake environment and threatening to leak data.
Cybersecurity
Citrix NetScaler Zero-Day Exploited Days After Emergency Patches
Citrix has confirmed active exploitation of a new NetScaler zero-day just days after customers patched two other vulnerabilities, forcing another emergency security update.
Funding & Investment
Fleuret AI Raises €4M to Automate Offensive Cybersecurity
French cybersecurity startup Fleuret AI has raised €4 million in pre-seed funding to develop AI agents that continuously test companies for exploitable vulnerabilities and help security teams verify fixes.
AI
OpenAI Investigation Into Rogue AI Agents Costs $500,000 a Day
OpenAI is reviewing roughly 50 petabytes of data after AI agents carried out unauthorised activity involving more than 100 organisations, with the investigation costing over $500,000 a day.
Cybersecurity
Critical FortiMail Zero-Day Exploited in the Wild, CISA Adds Flaw to KEV Catalog
Fortinet has warned that attackers are actively exploiting a critical FortiMail vulnerability that allows unauthenticated attackers to write arbitrary files on affected systems.
Cybersecurity
Pentagon Data Breach Exposes Information of More Than 3 Million People
A breach of the U.S. Defense Manpower Data Center exposed sensitive personal information linked to more than 3 million people, including military and civilian personnel.
Cybersecurity
CISA Adds Two Exploited Check Point Flaws to Known Vulnerabilities List
CISA has added two Check Point vulnerabilities to its Known Exploited Vulnerabilities catalogue after confirmed exploitation, urging affected organizations to prioritize remediation.
Cybersecurity
Japan Government Network Breach May Expose Data of 246,000 People
A breach of Japan’s shared Government Solution Service may have exposed personal information linked to about 246,000 government employees, officials and contractors. Attackers exploited a vulnerability in VPN equipment to gain unauthorized access.
Cybersecurity
Cybersecurity Focus Fades Within Months After Breaches, Survey Finds
A new ManageEngine survey of 700 IT and cybersecurity leaders finds that most organizations do not maintain heightened security attention for long after a breach. The research also raises concerns about businesses acting on AI-generated security recommendations without additional verification.
Cybersecurity
EU Cyber Resilience Act Reporting Rules Take Effect for Tech Makers
The EU’s Cyber Resilience Act has entered its first major compliance phase, requiring manufacturers to report actively exploited vulnerabilities and severe product-security incidents. The first warning must be filed within 24 hours of discovery.
Cybersecurity
Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware
Cisco says attackers are actively exploiting two vulnerabilities in its Secure Firewall Management Center software. The activity includes a Qilin ransomware operation, a suspected Sandworm-linked campaign and another intrusion focused on stealing credentials.
Cybersecurity
GitLab Urges Users to Patch Maximum-Severity Path Traversal Flaw
GitLab is urging users of its self-managed installations to apply an urgent security update after researchers discovered a maximum-severity path traversal vulnerability that could allow unauthenticated attackers to read arbitrary files from vulnerable servers under certain conditions. The company has released fixes for both Community Edition and Enterprise Edition and is recommending immediate upgrades.
Cybersecurity
Ivanti Connect Secure Zero-Day Exploited in Attacks
A critical zero-day vulnerability in Ivanti Connect Secure VPN appliances has been exploited in the wild, allowing unauthenticated attackers to execute arbitrary code remotely. Security researchers have linked the attacks to malware used for credential theft, persistence and data collection.
Cybersecurity
Microsoft Fixes Record 964 Flaws Including Two Exploited Zero-Days
Microsoft has released its largest Patch Tuesday security update on record, addressing 964 customer-relevant vulnerabilities across Windows, Office, Azure, Exchange and other products. The update also fixes two Windows zero-days that attackers were already exploiting to gain SYSTEM-level privileges.
Cybersecurity
ChatGPT Covert Channel Could Let Attackers Run Hidden Tasks and Access User Data
Security researchers uncovered a cross-account communication channel in ChatGPT that could secretly execute attacker-controlled tasks using a victim’s session. A proof-of-concept attack accessed emails from a connected Gmail account while the victim continued receiving normal ChatGPT responses.
Cybersecurity
220 Million Traveler Records Exposed in Vietnam-Linked Database Leak
More than 220 million passenger and crew records were exposed through a Vietnam-linked Advance Passenger Information System database. The data included passport numbers, dates of birth and detailed flight information covering travel records from 2017 to 2026.
Cybersecurity
N-able Patches Critical N-central Zero-Day Allowing Pre-Auth RCE
N-able has released an emergency hotfix for CVE-2026-86218, a critical vulnerability in its N-central remote monitoring platform that can enable remote code execution without authentication. The company has urged on-premises customers to install the update immediately.
Cybersecurity
StyleSmuggler Zero-Day Hits Magento and Adobe Commerce Stores
A newly discovered StyleSmuggler zero-day is being actively exploited against Magento and Adobe Commerce stores, giving attackers unauthenticated remote code execution while an official Adobe fix is still pending.
Cybersecurity
CrowdStrike Launches Cyber Superintelligence Lab to Fight AI Threats
CrowdStrike has launched a dedicated Cyber Superintelligence Lab focused on using frontier AI to strengthen cyberdefense, develop safer AI systems and respond faster to increasingly automated cyber threats.
Cybersecurity
G7 Urges Organizations to Replace Vulnerable Encryption Before Quantum Threat Arrives
The G7 is urging governments and businesses to begin moving to post-quantum cryptography now, warning that waiting for powerful quantum computers could leave sensitive data exposed.
Cybersecurity
Google Patches Actively Exploited Chrome Zero-Day CVE-2026-85046
Google has patched a high-severity Chrome zero-day in V8 that attackers are already exploiting in the wild.
Cybersecurity
OpenAI Commits $1 Billion to Cyberdefense as AI Security Concerns Grow
OpenAI will provide $1 billion in subsidised access to its cybersecurity tools, training and technical support as increasingly capable AI systems raise new concerns about cyber threats.
Cybersecurity
Thomson Reuters Reports Cybersecurity Incident, Unauthorized Party Accessed Court Files
Thomson Reuters has disclosed a cybersecurity incident involving its C-Track case management platform, with certain court files accessed by an unauthorized party across parts of the US and Canada.
Cybersecurity
CrowdStrike Reports $1.47 Billion Revenue as Cybersecurity Growth Accelerates
CrowdStrike reports $1.47 billion in second-quarter revenue, record net new ARR and stronger Falcon Flex adoption as enterprise cybersecurity demand continues to grow.
Cybersecurity
Abnormal AI Expands Email Security Platform Across the Full Email Risk Landscape
Abnormal AI is expanding its email security platform with new controls for inbound threats, outbound data protection and adaptive phishing training.