A ransomware crew let its AI agents climb to domain admin
Sophos recovered Cursor logs showing the Aur0ra gang handing agents VPN credentials and objectives, then watching them map Active Directory and move laterally on their own.
The Latest
Fake nuclear alerts hit phones on both sides of the Ukraine war
Attackers hijacked Ukrainian and Russian emergency warning apps within hours of each other, pushing radiation and missile messages that neither…
Government Linux servers fell to scripts an AI likely wrote
Unit 42 traced a year-long espionage campaign that leaned on large language models to build its payloads and mash its…
A stealer now hands its operator a ranked list of victims
Cisco Talos found the VOLTA infostealer feeding stolen data into three different AI models so it can tell buyers which…
A loader hid inside Windows update folders on Asian government PCs
Kaspersky found NetamLoader abusing AppDomainManager injection from a CAB file parked in SoftwareDistribution, on a Windows 10 build reserved for…
Five coding assistants let a web page reach past the sandbox
Forever Security found the embedded browsers in Cursor, Copilot, Claude Desktop, VS Code and Codex granted powers a normal browser…
Bedrock Data hands exposure fixes to whoever owns the dataset
Instead of piling findings into a central backlog, the platform tickets the data owner directly and reopens the case if…
Shufti wants to know which agent is really spending your money
The identity vendor has launched agent verification that ties every autonomous action to a real principal, a mandate and a…
Northstar raises $7M to map the combinations attackers hunt for
The startup has left stealth with a graph that connects identities, assets and vulnerabilities, then sends AI agents to close…
Ivanti’s exploited VPN chain lands two more flaws on the KEV list
CISA has added fresh Ivanti Connect Secure bugs to its exploited-vulnerability catalog, extending a chain Volexity tied to a root-level…
Pentagon treats base freezer failures as a suspected hack
The Pentagon is sorting through a run of cooler breakdowns that ruined perishable stock at stateside bases over the summer, and four officials now tell Reuters the incident is being treated as a suspected hack.
Germany’s AfD breach exposed more than 345,000 mail accounts
Have I Been Pwned has confirmed the scale of a September hack-and-leak against the German party, with over a terabyte…
Canonical ships fixes for a flawed cloud trust check
A client-authentication weakness in LXD and MicroCloud scores a maximum CVSS 10.0 and lets an attacker borrow a trusted identity…
A single hidden text can knock out an Android phone
A malformed WAP Push message crashes Android's telephony stack with no user interaction, and a flood of them can hold…
Spotlight
Oracle E-Business Suite probes began the day after patch day
Defused Cyber recorded exploratory exploits against an unauthenticated SQL injection that chains to remote code execution on affected servers.
Binance lost $6.3B after an engineer’s laptop was compromised
Researchers attribute the largest crypto theft on record to North Korea, with about $3B frozen on-chain and the exchange promising to cover losses.
Vapor Panda’s automated tooling hit 140 targets in eleven days
CrowdStrike says the China-linked group ran ARTEX at roughly 1,500 commands an hour across 200 organizations in 14 countries.
Short DDoS bursts doubled even as terabit floods collapsed
Cloudflare absorbed 18.2 million network-layer attacks in Q3, and the fastest growth came from small barrages short enough to slip past threshold alarms.
Features
Chainalysis says an AI-driven intruder read customer profile data
The blockchain analytics firm disclosed a break-in it attributes to offensive agentic techniques, with names and emails among the exposed…
A hacked TeamViewer host can now strike back at the viewer
TeamViewer's 15.83 release closes a high-severity memory bug that flips a remote support session against the technician holding it.
Apple warned spyware targets across 99 countries this week
A fresh round of threat notifications reached journalists and filmmakers days before final talks on the Pall Mall Process guidelines.
An unreleased Claude model wrote a working root exploit for Linux
Anthropic's research build chained a use-after-free in Multipath TCP into zero-click remote root in 53 minutes, and Ubuntu and Red…
A single shared IP fronted 1,200 lookalike shopping domains
Akamai found replacement storefronts appearing hours after takedowns, rebuilt from reused kits and payment pages that harvest card details.
Belgium took its tax portal down rather than let an intrusion spread
FOD Financien isolated infected elements and pulled MyMinfin, Tax-on-web and Biztax offline, pushing the filing deadline to November 16.