October Cybersecurity Job Listings Span CISO to Entry-Level Roles
A new roundup of open cybersecurity positions shows demand across leadership, cloud, and incident response in multiple industries.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
US Says Chinese AI Firms Distilled Frontier Models at Scale
Washington alleges Chinese companies covertly harvested billions of tokens from leading US AI labs to shorten development time.
Workflow Identity Hijacking Bypasses Enterprise Data Defenses
An AI-related attack called workflow identity hijacking lets attackers slip past normal defenses and reach enterprise data.
Silent Web Audio Can Hijack Bluetooth Headphones for Tracking
A single webpage playing inaudible audio was enough to intercept a user's Bluetooth headphone connection, showing how silent signals can enable cross-device tracking.
Microsoft Patches Record 974 Flaws in Single Update
The record-breaking patch batch signals both the growing scale of software vulnerabilities and the role of AI in finding them faster.
Phishing Campaign Abuses Google Redirect Chains to Evade Detection
Attackers are chaining multiple Google services together to slip past security tools and deliver credential theft or remote access malware.
Patch Tuesday Record: 974 CVEs, Two Actively Exploited
Microsoft's latest Patch Tuesday update fixes a record 974 vulnerabilities, including two already under active attack.
Pentagon Turns Off Ad Tracking on Military Phones Over Troop Targeting Risk
The military's move shows how commercial location data can become a security liability, and points to a simple step civilians can take.
PowerToys 0.102 Adds CursorHide and Button Lock Mouse Utilities
Microsoft's latest PowerToys release introduces two mouse-focused tools that give users more control over cursor visibility and accidental clicks, with privacy and input-safety implications.
LiteLLM 1.107.0 Pulled After Supply Chain Attack Plants Credential Stealer
A malicious version of the popular AI gateway package was distributed on PyPI and Docker Hub, exposing cloud credentials and installing a backdoor.
SANS ISC Stormcast Episode Released for October 20, 2026
The latest SANS ISC Stormcast podcast is available, but the provided source does not include details on the topics covered.
DevGuard open-source platform centralizes software supply chain security
A free, self-hostable OWASP incubator project gives teams one command-line interface for scanning, blocking malicious packages, and tracking vulnerabilities.
Why security tools lose track of credentials across systems
A single credential can move across code, endpoints, and AI tools, so security teams need to manage the credential layer itself rather than just individual systems.
Grafana Adds Knowledge Graph to Tie Observability to Incident Response
Grafana Labs is embedding a Knowledge Graph into Grafana Cloud to give engineers and AI agents shared context that links infrastructure, applications, and user experience during incident response.
TiDB Breach Reveals Cloud Providers May Hold Data Unknowingly
The TiDB breach shows that cloud providers can store sensitive customer data without either party knowing, exposing flawed security assumptions.
Accenture, Dragos, SANS Launch $10M Utility Cyber Defense Plan
A new public-private partnership will provide free security tools and training to as many as 500 small US electric utilities.
UpdraftCentral key theft leads to WordPress site backdoors
A breach at TeamUpdraft exposed connection keys that let attackers push commands to WordPress sites using the UpdraftCentral service.
WEIS Archive Collects 25 Years of Security Economics Papers
A new online archive gathers papers from a quarter-century of the Workshop on Economics and Information Security, a field that treats security as an economic problem.