Android October 2026 Patches 25 Vulnerabilities, Including Critical System Flaw
The update addresses a critical privilege escalation bug in Android's System component among 25 total fixes.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
Tensorlake npm SDK Compromised in Credential-Stealing Supply Chain Attack
A malicious version of the Tensorlake npm SDK delivered a self-propagating worm that steals credentials and persists on victims' systems.
Security leaders need an economic model, not more vulnerability scores
A Qualys risk executive argues security teams should anchor decisions to potential dollar losses rather than technical scores.
Cisco Patches Critical Flaws, Including Nexus Switch Takeover Bugs
Cisco has patched a dozen critical vulnerabilities, including five NX-OS flaws that could let attackers take over Nexus switches.
SANS Adds AI Agent Forensics to Incident Response Course
New FOR577 material and two scripts aim to help incident responders reconstruct activity by AI coding assistants.
SIM-swap crypto thief sentenced to 2.5 years in London
A London man who helped steal nearly $260,000 in cryptocurrency via SIM swapping was sentenced to prison, highlighting the growing threat of phone-number account takeovers.
Passkey-familiar security pros still type passwords, survey finds
A survey of 1,890 IT and security professionals finds 43% still use passwords for work despite 87% reporting passkey familiarity.
Audit scheme aims to keep AI street surveillance in check
A Japanese researcher proposes independent record-keeping and unannounced audits to deter misuse of AI-powered street cameras.
Open-source gateway keeps AI agent credentials out of configs
Tuskira's AI Agent Gateway intercepts agent tool calls so secrets stay in an encrypted store and permissions are checked per request.
Low-Cost Android Phones Found With Built-In Proxy Malware
A newly identified campaign shows budget Android devices can arrive with preinstalled malware that turns them into proxies for criminal traffic.
16 Malicious Firefox Extensions Steal Crypto Wallet Recovery Phrases
A cluster of fake wallet extensions on Firefox intercepted recovery phrases and private keys, sending them to attacker-controlled servers before being removed.
AI compliance tools shift from dashboards to continuous enforcement
A sponsored analysis argues that AI-native platforms can close the gap between audit evidence and actual security controls.
Dark Reading Teases New Chapter, No Security Details
The cybersecurity publication announces a transition but provides no specifics on its future direction.
FakeGit Campaign Returns With 17,610 Malicious GitHub Repos
The revived FakeGit campaign is using thousands of fake GitHub repositories to deliver SmartLoader and the StealC infostealer.
Technology Cuts Both Ways for Dictators, Schneier Argues
A new essay argues that digital tools strengthen authoritarian control while also creating new avenues for resistance and instability.
Security Awareness Training Needs a Rethink, Not Retirement
The long-standing corporate staple of security awareness training faces questions about its effectiveness, prompting calls for a new approach.
Cyber Risk Now Lives Inside the Workflow, CISO Data Shows
New CISO findings show that after five years, resilience, AI governance, human risk, and board scrutiny have converged inside everyday work systems.
Experts Urge CISA to Mandate Federal OT Security Baselines
A coalition says binding rules are needed because most federal agencies still lack visibility into operational technology.