Legal Aid breach sweeps up archived claims reaching back to 1978
The UK's Legal Aid Agency lost records stretching back almost fifty years, the government has now admitted, a haul far wider than the one it first described.
The Latest
UK sanctions a crypto platform it calls a laundering hub
Britain has frozen the assets of Cryptomus and three payment services, citing a pipeline that helps Russia move money and…
North Macedonia charges the alleged OLVX market operator
Prosecutors say a 20-year-old ran a marketplace selling stolen data and attack tools, pulling in more than $500,000 since 2023.
Citizen Lab ties a spyware pipeline to ordinary ad slots
Researchers say targeted advertising is being used to push zero-click spyware onto millions of devices, with an Israeli ad firm…
CikaBika RAT hides its command channel inside Discord
A Rust-based remote access trojan delivered through document lures is using Discord as its control panel, Darktrace reports.
Hirudo trojan swaps out your banking app for its own copy
A new Android RAT uninstalls the real banking app and replaces it with a modified build that blinds the bank's…
Palo Alto patches a firewall zero-day hit by limited attacks
A PAN-OS flaw in the management interface lets an authenticated attacker run code as root, and CISA wants federal systems…
An unauthenticated attachment bug hands root on Cisco email gear
Attackers are already exploiting a critical Secure Email Gateway flaw that hands over root access, and federal agencies have three…
Drone strikes knock Yandex datacenters and payments offline
Three Ukrainian drone attacks hit Yandex facilities, leaving cloud and payment services degraded for days.
Microsoft dismantles a Chinese phishing market that sent a billion messages
A court order let Microsoft and Health-ISAC seize the infrastructure behind YAM Store, CoGUI, and Iron Man.
US agents seize 187 laptops in a North Korean IT worker sweep
Two Americans are accused of helping Pyongyang's fake remote workers land jobs at US companies.
SAP patches a perfect-ten SSRF bug in its Python SDK
A CVSS 10 flaw in the Cloud SDK for Python can hijack cloud credentials across multi-tenant applications.
An OpenAI engineer is charged over a bug hidden in a boardroom
Federal prosecutors say a recording device tucked inside a conference-room TV was meant to capture secret work on superintelligence.
Microsoft Patch Tuesday wave carries 1,413 fixes for October
October's update wave is the largest Microsoft has ever shipped, and one Windows Shell bug is already under attack.
Spotlight
Ivanti VPN chain exploits CVE-2026-104935 for root access
A previously unknown crew used a three-bug chain to take full control of fully patched Ivanti Connect Secure appliances.
XWorm turns from a remote-access tool into a live surveillance rig
Fresh plugins let the long-running Windows malware follow victims, listen through the microphone and ride their browser sessions.
Hobbs and Whistles owner joins a rough autumn for fashion retail
TFG London found an intrusion on October 11 and is still working out what customer data may have left the building.
IonQ will spend up to 1.3 billion on a zero-trust access vendor
The quantum computing firm is folding Elisity's microsegmentation policy layer into its growing security arm.
Features
Ahold Delhaize pulls systems offline after an intrusion on its network
All five of the grocer's US banner websites went dark as teams moved to contain a security issue.
One weak password opened Denmark’s national register to 14 million searches
An IT supplier's account using 123456 let an intruder run automated lookups against records on 8.8 million people.
A renamed GitHub repo could hand attackers a package’s publishing rights
Bloom Security says npm matched workflows to repository names instead of permanent IDs, leaving 1,500 packages exposed.
GitLab patches maximum-severity CI/CD regex bug under CVE-2026-97229
A crafted regular expression in a CI/CD file could let an unauthenticated stranger run code on a self-managed server.
Freezers across French supermarkets hit 50C after a controller hack
Attackers reached remotely managed refrigeration controllers and left hundreds of stores with spoiled stock.
A single prompt undid the guardrails on AWS agent infrastructure
One chat message pulled temporary cloud credentials out of an agent and opened every other agent in the account.