Archive
All articles, newest first. Page 6.
AI Agents Now Leave Forensic Traces: Two Scripts to Extract Them
The SANS FOR577 course integrated two Python scripts into its Day 5 material on October 8, 2026, for forensic analysis of residues lef…
Botnet Hides C2 in a GitHub Poem; AI Surfaces as Offensive Tool in South Korean Bank Breaches
Three developments define the week in threat intelligence: the PoeLLM botnet reconstructs its command-and-control IP from keywords hid…
Malware Now Targets Large Language Models: Cisco Talos Warning
Cisco Talos has documented 84 malware samples that manipulate LLM-based analysis systems. Techniques have evolved from deceptive comme…
A3 Malware: When Anti-Analysis Stops Fooling Humans and Starts Targeting AI Models
Cisco Talos documents 84 malware samples that embed natural-language instructions to hijack LLM-based automated analysis. The A3 techn…
Small Business Declines Security, Shuts Down After Ransomware: The Case
A U.S. construction firm turned down a cybersecurity proposal over cost. Three weeks later, ransomware encrypted its server and attach…
Pwn2Own Ireland 2026: The Collision Paradox on "Fully Patched" Devices
At Pwn2Own Ireland 2026, researchers earned $1.262 million for 98 zero-day vulnerabilities across 61 successful attempts. Ikotas Labs…
Apple Patches Actively Exploited iOS 26 Zero-Day: The 26.7.1 Update Is No Longer Optional
On September 28, 2026, Apple released iOS 26.7.1 to address CVE-2026-86950, an out-of-bounds write in the CoreGraphics framework that…
Belarusian Cyber Partisans Claim 2023 Breach of Russian Health Ministry
The Belarusian Cyber Partisans have confirmed they breached the Moscow Department of Health in 2023, partially corroborating a report…
iRhythm Technologies Exposes 360,000 Patients: The Four-Month Disclosure Gap
iRhythm Technologies began notifying victims on October 2, 2026, of a data breach that occurred between June 3 and June 8, 2026. The C…
FBI Arrests Third ShinyHunters Suspect: Third Arrest in 12 Days After FBIJobs.gov Breach
The FBI arrested a Canadian citizen in Pennsylvania on October 9, 2026, identifying them as a primary co-conspirator in the ShinyHunte…
P7 DarkSword: iOS Exploit Kit Evolves With Crypto Theft and Remote C2 Commands
iVerify has identified P7 DarkSword, a new variant of the DarkSword iOS exploit kit active in-the-wild since August 2026. The implant…
Qilin Member Arrested in Germany: Ransomware Machine Keeps Running
A 28-year-old Russian national extradited from Japan is jailed in Munich. Qilin operations continued uninterrupted, with over 450 vict…
AnyPwn Exposes Silent Fix Risk: Pre-Auth Root RCE in AnyDesk Linux
Researchers released AnyPwn, a pre-authentication exploit for AnyDesk Linux achieving root RCE. AnyDesk quietly patched the bug in Jun…
Adobe Patches PDF Zero-Day Exploited for Four Months: CVE-2026-34621
Adobe has fixed CVE-2026-34621, a zero-day vulnerability in its PDF products that was actively exploited from November 2025. Opening a…
CISA Sets Oct. 11 Deadline for 5 CVEs Exploited by Flax Typhoon
CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog, attributing active exploitation to the Chinese threat…
Q3 2026: Historic Ransomware Record — 11 Organizations Compromised in 26 Seconds
The third quarter of 2026 set a new all-time high for ransomware attacks. AI compresses the kill chain to hours, while the payment rat…
AhsayCBS: In-the-Wild Zero-Day RCE — Vendor Fix 10.3.4 Still Vulnerable
Two zero-day vulnerabilities in AhsayCBS are under active exploitation for unauthenticated remote code execution with SYSTEM privilege…
Ukraine Hikvision Exploit Spike: 9 Days of Pre-Kinetic Reconnaissance
GreyNoise detects a concentrated spike of CVE-2021-36260 exploit attempts against Hikvision DVRs in Ukraine from September 21 to Octob…
October 2026 Patch Tuesday: The Hidden Risk Behind the CVE Drop
With just 1–8 CVEs versus September’s 973, October 2026 looks quiet. But Office fragmentation and update channels conceal a more dange…
BPFDoor Hits Edge Devices: CISOs Can No Longer Trust the Silence
Rapid7 has tracked new variants of the BPFDoor backdoor targeting mail gateways and telecom appliances in South Korea and Taiwan. The…
Autonomous AI Agents Attack Infrastructure: The First Wave Is Just Noise
Talos Intelligence documents real-world AI swarm attacks on RubyGems, DSEWiki, and Hugging Face. Volume defines this generation, but s…
CISO Isolates Unpatchable Legacy Check-Printing Systems on Dedicated Network
A financial institution CISO, writing on the Cisco Talos blog, details how they mitigated risk from critical legacy check-printing sys…
ThreatsDay: When Cybercrime Eats Its Own and IDEs Become Arsenals
The October 8, 2026 ThreatsDay report documents a saturated ransomware-as-a-service market driving affiliate betrayal and an unprecede…
MatchBoil Updates Every 2 Minutes: UAC-0099's Tactical Facelift
ESET tracked MatchBoil's evolution from a one-shot downloader to a recurring delivery platform. The Russia-aligned APT UAC-0099 adopte…