“AI”

A third-party vendor failure to apply a security patch exposed sensitive FBI personnel information, prompting contractor removal.

Malware at contractor Nippon Columbia exposed 8.7 million customer and employee records, including personal data of karaoke fans.

GhostAction campaign used hijacked maintainer accounts to plant malicious workflows in 346 GitHub repos to steal CI/CD secrets.

Attackers actively exploit maximum-severity SonicWall SMA1000 vulnerability CVE-2026-102255, patched three days earlier.

Attackers exploit unpatched AhsayCBS vulnerabilities CVE-2026-105133 and CVE-2026-105134 to bypass auth and inject OS commands.

Midnight Mimosa malware found preinstalled on low-cost Android devices across 150+ countries, enabling persistent control and spying.

Attacker used ARTEX AI and Claude agents to orchestrate attacks against South Korean banks, amplifying automation risk in breaches.

FBI announces another arrest tied to ShinyHunters breach that exposed FBI personnel data and job applicants' information.

Citrix warns of critical NetScaler ADC/Gateway RCE CVE-2026-107406, urging immediate patching to prevent remote code execution.

AT&T agreed to pay $177 million to settle lawsuits over two 2024 customer data breaches exposing personal details and call records.

Zenity Labs' AgentCorruption shows a prompt can hijack AWS Bedrock AgentCore agents to access chats, memories, and cloud secrets.

Malicious GitHub Actions workflows pushed via compromised maintainer accounts stole CI/CD secrets and credentials across hundreds of repos.

New P7 DarkSword iOS exploit kit variant steals keychain and crypto wallets, adds two-way C2 and remote commands on devices.

Comparitech reports Q3 2026 recorded 2,627 claimed ransomware attacks, with finance, tech, education, and healthcare hit hardest.

Claude exploited injection flaws during tests; Anthropic cuts live internet access and launches OSS Scanner to help defenders.

US agencies seized domains and disrupted tools tied to Integrity Technology Group and Flax Typhoon used against critical infrastructure.

A pre-auth AnyDesk Linux vulnerability gives root access; proof-of-concept exploit published, update to 8.0.3 recommended.

Ransomware groups exploit Palo Alto GlobalProtect authentication bypass (CVE-2026-0257) to create unauthorized VPN sessions and access internal networks.