KGB RAT Windows trojan sells spying, theft, and 'fun' harassment features
A cheap Windows trojan built on NjRAT bundles webcam spying, credential theft, and psychological harassment for as little as $150 a month.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
New Site Estimates Cryptanalyst-Hours Behind Public-Key Algorithms
Bruce Schneier highlights a Matthew Green project that mines the literature to quantify how much human analysis each public-key assumption has received.
Vulnerability Scores Mislead; Focus on Exploitability in Your Environment
Organizations should prioritize vulnerabilities based on real-world exploitability in their own environments rather than vendor-assigned severity scores.
SecTor 2026: Cybersecurity Landscape Shifts as Attendance Grows 22%
Record turnout at SecTor 2026 signals an industry grappling with a rapidly changing threat environment.
Cyberattack on BAE Systems knocks out federal bankruptcy court notices
A cyberattack on contractor BAE Systems has taken down the Bankruptcy Noticing Center, halting bankruptcy notices across all U.S. federal courts.
Record Microsoft Patch Tuesday: 1,400+ Flaws, Exploited Windows Shell Bug
Microsoft's largest Patch Tuesday ever fixed over 1,400 vulnerabilities, including an actively exploited Windows Shell flaw, but experts say volume is outpacing triage.
Brooklyn DA seizes 241 domains in crypto scam targeting Russian speakers
Law enforcement disrupted a cryptocurrency investment fraud ring that drained millions from Russian-speaking victims in Brooklyn and then tried to resell them recovery services.
Anthropic Claude Code Desktop Flaw Enables Silent Credential Theft
A zero-click vulnerability in Claude Code Desktop's preview pane could let attackers steal developers' SSH keys, AWS credentials, and OAuth tokens without any user interaction.
Schneier: AI Cryptanalysis Threat Is Real, but Over-Engineering Wins
Bruce Schneier pushes back against Matthew Green's pessimistic view, arguing that cryptographic over-engineering will protect against future AI attacks.
Global Takedown Disrupts Phishing Network Behind 1 Billion Messages
A coordinated international operation has dismantled a cybercriminal infrastructure responsible for massive phishing campaigns.
Congressional Probe Faults Match Group Over Dating App Scams
A year-long investigation by the Joint Economic Committee says Match Group has not done enough to curb scams on Tinder, Hinge, and other platforms.
curl 8.23.0 Fixes HTTP/2 Upload Flaw Enabling Code Execution
A memory corruption bug in curl's HTTP/2 upload handling could let a malicious server execute code on a client's machine; the project shipped a fix on October 14.
SANS ISC Revisits Orphaned VBA Projects in DWG Files
A new diary entry from the SANS Internet Storm Center highlights the continued risk of VBA code embedded in AutoCAD drawing files.
AI Adoption in Security: Demos Overpromise, Real Workflows Suffer
A new field guide warns that AI tools in IT and security often fail in practice, increasing complexity and risk instead of easing workloads.
Russian travel site Anywayanyday suspends bookings after cyberattack
The attack on one of Russia's oldest booking platforms adds to travel disruption as Moscow airports face drone-related flight restrictions.
Microsoft fixes Always On VPN issues from September Windows 11 updates
Microsoft has resolved a known issue that caused Always On VPN connection problems after the September 2026 Windows 11 security updates.
North Macedonia arrests alleged operator of OLVX cybercrime market
The FBI and North Macedonian police say the suspect ran a marketplace that sold stolen credentials and personal data through more than 1,500 seller accounts.
Harmonic Security Raises $50M to Protect Workforce AI Use
The funding will support expansion of engineering and go-to-market teams in the US and UK as the startup addresses AI-related security risks.