Drone strikes knock Yandex datacenters and payments offline
Ukrainian drone strikes took three of Yandex's five Russian datacenters offline, and Yandex Pay customers spent days without access to their money. The company says funds are safe and recovery is ongoing, but a third of its sites were hit within a week.
The Latest
Microsoft dismantles a Chinese phishing market that sent a billion messages
A court order let Microsoft and Health-ISAC seize the infrastructure behind YAM Store, CoGUI, and Iron Man.
US agents seize 187 laptops in a North Korean IT worker sweep
Two Americans are accused of helping Pyongyang's fake remote workers land jobs at US companies.
SAP patches a perfect-ten SSRF bug in its Python SDK
A CVSS 10 flaw in the Cloud SDK for Python can hijack cloud credentials across multi-tenant applications.
An OpenAI engineer is charged over a bug hidden in a boardroom
Federal prosecutors say a recording device tucked inside a conference-room TV was meant to capture secret work on superintelligence.
Microsoft Patch Tuesday wave carries 1,413 fixes for October
October's update wave is the largest Microsoft has ever shipped, and one Windows Shell bug is already under attack.
Ivanti VPN chain exploits CVE-2026-104935 for root access
A previously unknown crew used a three-bug chain to take full control of fully patched Ivanti Connect Secure appliances.
XWorm turns from a remote-access tool into a live surveillance rig
Fresh plugins let the long-running Windows malware follow victims, listen through the microphone and ride their browser sessions.
Hobbs and Whistles owner joins a rough autumn for fashion retail
TFG London found an intrusion on October 11 and is still working out what customer data may have left the…
IonQ will spend up to 1.3 billion on a zero-trust access vendor
The quantum computing firm is folding Elisity's microsegmentation policy layer into its growing security arm.
Ahold Delhaize pulls systems offline after an intrusion on its network
Ahold Delhaize pulled systems offline after finding a security issue in its network, leaving all five US banner websites and three Dutch chains down Monday.
One weak password opened Denmark’s national register to 14 million searches
An IT supplier's account using 123456 let an intruder run automated lookups against records on 8.8 million people.
A renamed GitHub repo could hand attackers a package’s publishing rights
Bloom Security says npm matched workflows to repository names instead of permanent IDs, leaving 1,500 packages exposed.
GitLab patches maximum-severity CI/CD regex bug under CVE-2026-97229
A crafted regular expression in a CI/CD file could let an unauthenticated stranger run code on a self-managed server.
Spotlight
Freezers across French supermarkets hit 50C after a controller hack
Attackers reached remotely managed refrigeration controllers and left hundreds of stores with spoiled stock.
A single prompt undid the guardrails on AWS agent infrastructure
One chat message pulled temporary cloud credentials out of an agent and opened every other agent in the account.
Shai-Hulud worm burrows into an AI agent platform’s SDK
A poisoned npm release of Tensorlake's SDK carried a payload that hunts cloud credentials and can wipe a home directory.
Two odd characters let attackers fake trusted web addresses
Researchers registered 20 lookalike domains that Chrome and Edge display as the genuine article.
Features
Let’s Encrypt will cut default certificate life to 64 days
The shorter lifetime starts February 10, 2027, and it is a rehearsal for 45-day certificates in 2028.
A leader of a 15,000-mule laundering network admits guilt in the US
Your Mule Cashout moved stolen funds abroad and stiffed the very people it recruited to withdraw the cash.
Cardiac monitor maker iRhythm says hackers took data on 360,000 people
Intruders spent five days inside third-party-hosted business applications before the company noticed.
A hidden chip inside Ledger wallets drained $93M in crypto
Tampered devices sold through one Southeast Asia reseller carried a circuit board that photographed recovery phrases.
An AI-driven crew turned 51 agents loose on Ukrainian targets
A Russian-speaking broker ran two attack pipelines at once, and an open directory handed researchers the whole operation.
Ransomware fixer accused of charging clients and paying the crooks
Prosecutors say a Florida recovery firm billed $19M for decryption it never actually performed.