Threat Actors Abuse AI Platform Cairn to Breach 100+ Organizations
At least three threat actors have abused the AI platform Cairn to gain persistent access and steal funds from more than 100 organizations.
Security & Privacy
Breaches, offensive and defensive AI, and surveillance.
VK services disrupted after drone strike on St. Petersburg data center
A Ukrainian drone strike on a VK data center caused widespread user-reported outages, though the company denied any impact.
Siemens Software Center Abused in ClickFix Malware Attacks
Attackers are pairing a legitimate signed Siemens installer with malicious DLLs to infect Windows systems.
Free SAST tool Bearer CLI ranks flaws by data exposure
A free static analysis tool from Bearer prioritizes security findings by the sensitive data they can expose, aiming to cut through alert noise.
Meta AI agents drive half of bot traffic, DataDome report finds
A new DataDome report shows Meta's crawlers and Muse agent now account for nearly half of AI agent traffic, straining bot-management policies.
Why RPO and RTO Need Regular Testing, Not Just Paper Targets
A disaster recovery expert explains why recovery targets must be tailored per application and verified with frequent tests.
Compromised Login Exposes Millions of California Student Records
A single stolen login gave attackers access to an ETS server holding years of student data.
Vision-Language Models Crack CAPTCHAs Without Training
New research shows off-the-shelf vision-language models can solve visual CAPTCHAs, raising questions about the future of these security tests.
Fortinet Bug Exploit Tied to Stealthy FortiGate Implant in Telecom Attack
SecurityWeek links an exploited Fortinet vulnerability to a persistent, stealthy implant on a FortiGate device in a telecommunications hack.
MITRE ATT&CK v20 Adds AI Abuse, MFA Bypass, and ICS Detections
The latest ATT&CK release gives defenders 15 new detection strategies and 38 analytics, including coverage for AI abuse, MFA bypass, and water-utility attacks.
Microsoft tops brand-phishing list as attackers target corporate credentials
Check Point Research found Microsoft accounted for 33% of brand impersonation attempts in Q3 2026, roughly four times the share of any other brand.
Fake Web3 Accelerator Uses npm Packages to Drop Malware
A phony accelerator lured crypto startups with AI perks, then installed info-stealers and backdoors on Windows and macOS.
October Windows Server updates disrupt Exchange sign-in and mail flow
Microsoft confirms its latest Windows Server security updates are causing OWA sign-in failures and mail delivery issues on some Exchange servers.
OpenCode Console Breach May Expose AI Provider API Keys
A breach of OpenCode's hosted console may have exposed saved OpenAI, Anthropic, and Google API keys, prompting revocation warnings for a small subset of users.
Rank Math PRO Supply Chain Attack: Backdoor in WordPress SEO Plugin
A malicious update to the premium WordPress SEO plugin Rank Math PRO exposed sites to a self-restoring backdoor, prompting urgent cleanup guidance.
Ahold Delhaize confirms malicious cyberattack caused grocery outages
The Dutch grocery giant says a cyberattack forced systems offline across U.S. and European brands, with no evidence yet of data theft.
Microsoft patches Windows 11 preview update that crashed AC-3 audio apps
A fix is now available for a Windows 11 preview update that crashed games and apps using AC-3 Dolby Digital audio decoding.
OnlyFans Takedowns Reveal Hacked University and Government Sites
Copyright requests tied to adult content are exposing how attackers abuse compromised institutional websites to game search rankings.