Blahalla

Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits

www.bleepingcomputer.com · 13 days ago

The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have been partially responsible for a May outage.

Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies

thehackernews.com · 13 days ago

The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia pages.

Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices

gbhackers.com · 13 days ago

Cling, an IoT botnet that disguises operator commands as Google STUN replies, blending malicious communications into routine NAT traversal traffic. Published October 1, the research documents exploitation of exposed networking devices and a command channel designed to exploit trust in familiar infrastructure.

Possible Vulnerability in Apple’s Automatic Reboot

www.schneier.com · 13 days ago

404Media is reporting (alternate link ) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn’t been used for 72 hours.

Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers

thehackernews.com · 13 days ago

In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around it fell short.

Cybersecurity M&A Roundup: 39 Deals Announced in September 2026

www.securityweek.com · 13 days ago

Significant cybersecurity M&A deals announced by Dragos, IBM, Palo Alto Networks, Kiteworks, and Upwind.

Pacing the AI frontier won’t solve agentic cybersecurity’s most urgent problems

www.csoonline.com · 13 days ago

When Anthropic CEO Dario Amodei urged other leading AI labs to “pace the frontier” last week, his calls for caution were echoed by other prominent voices in tech. Both Sam Altman and Elon Musk agreed with Amodei’s assessment that pausing AI development was essential to prevent the extinction of the human race.

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

www.securityweek.com · 13 days ago

Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign.

Android 17 Advanced Protection Adds Intrusion Logging, USB Security and Brute-Force Defense

gbhackers.com · 13 days ago

Google has expanded Android Advanced Protection with six security enhancements targeting spyware investigations, malicious USB connections, accessibility abuse, browser exploits, and repeated authentication failures. Announced on October 1, 2026, the update strengthens Android 17 defenses for journalists, officials, public figures, and security-conscious users.

Former Employee Sentenced for Damaging Employer’s Windows Network Infrastructure

gbhackers.com · 13 days ago

A former infrastructure engineer has been sentenced to 32 months in federal prison for damaging his employer’s computer network and demanding a ransom in Bitcoin. Daniel Rhyne, 59, of Kansas City, Missouri, received the sentence from U.S. District Judge Michael A. Shipp on September 28, 2026, in Trenton, New Jersey.

Asos customers receive ‘hack’ notification threatening to leak data

www.theguardian.com · 13 days ago

Push message claims fashion company’s data has been ‘fully compromised’, but website and app remain online Business live, latest updates Asos is investigating after users of its mobile app received a notification claiming hackers had “fully compromised” the online fashion retailer’s data.

Google’s bug bounty pause highlights growing AI vulnerability triage challenge

www.csoonline.com · 13 days ago

AI is accelerating the discovery of software vulnerabilities, but it is also creating a new bottleneck for defenders: deciding which machine-generated findings warrant investigation.

Apache Struts Vulnerabilities Enable Remote Code Execution, DoS and Data Disclosure

gbhackers.com · 13 days ago

Four Apache Struts vulnerabilities outlined in recent advisories expose affected applications to risks such as remote code execution, denial of service, and cross-user data disclosure. These issues impact legacy action mapping, decimal rendering, REST request processing, and localized message formatting. Fixes are available in Struts versions 7.4.0 and 6.12.0.

Blinder Tunnel Campaign Targets Iraqi Infrastructure

unit42.paloaltonetworks.com · 13 days ago

Iranian group used "Blinder Tunnel" to hit Iraqi critical infrastructure. Attackers deployed ShelbyLoader V2 malware via a 3-step chain exploiting Windows developer files and AppDomainManager hijacking. They misused GitHub API for C2.

More women are becoming breadwinners. What does that mean at home?

www.washingtonpost.com · 13 days ago

The share of women who make as much or more than their husbands has nearly tripled over the past five decades.

The AI app builder your team trusts has a root-level backdoor

www.csoonline.com · 13 days ago

The fastest-growing category of enterprise software right now is also the least scrutinized from a security standpoint. AI application platforms, tools that let teams build, connect and automate AI-powered workflows without writing much code, are landing in production environments faster than security teams can assess them.

IBM Patches Multiple Langflow OSS Flaws Including Two Critical RCE Vulnerabilities

gbhackers.com · 13 days ago

IBM disclosed 25 vulnerabilities in Langflow OSS versions 1.0.0 through 1.12.2, including two critical flaws (CVE-2026-104334 and CVE-2026-93674) allowing unauthenticated remote code execution. The vulnerability spectrum encompasses arbitrary file access (CVE-2026-97677) and sensitive data disclosure (CVE-2026-101329). Users must upgrade to version 1.12.3 to patch the identified risks.

8.8 Million Impacted by Data Breach at Denmark’s Central Person Register

www.securityweek.com · 13 days ago

Denmark's Central Person Register (CPR) confirmed a data breach, stating that hackers misused a private company's authorized access to steal personal records. The incident compromised the names, addresses, and CPR numbers of approximately 8.8 million registered individuals. CPR terminated the company's access and launched an investigation with relevant Danish authorities.

Nikkei discloses breaches of employees’ Microsoft, Google email accounts

www.bleepingcomputer.com · 13 days ago

Japanese publishing giant Nikkei disclosed two separate breaches affecting employee email accounts. Unknown attackers first accessed a Google Workspace account in late July, exposing personal data for 1,646 employees and partners. Separately, individuals used a compromised Microsoft 365 account to send 9,000 phishing emails targeting Nikkei staff and interviewees.

They told the world AI was dangerous. Now Trump’s allies are coming for them.

www.washingtonpost.com · 13 days ago

AI safety advocates recently warned about the technology’s increasing power. The Trump administration and its allies subsequently adopted some of these suggested policy ideas while actively working to marginalize the advocates themselves within Washington.

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

thehackernews.com · 13 days ago

Google ceased accepting product vulnerability reports for its open-source software bug bounty program starting October 1. Researchers can no longer submit flaws in core projects like Go, Angular, and Protocol Buffers for a reward. However, Google continues to accept reports detailing supply chain compromises.

In Race With U.S., China Struggles to Recruit Foreign A.I. Researchers

www.nytimes.com · 13 days ago

China’s booming artificial intelligence sector has given local researchers good reason to remain in the country, but it has yet to lure overseas scientists despite a government push.

In Race With U.S., China Struggles to Recruit Foreign A.I. Researchers

www.nytimes.com · 13 days ago

China's booming artificial intelligence sector keeps local researchers engaged but struggles to attract foreign scientists. Despite government initiatives, China has difficulty recruiting international experts to bolster its scientific workforce. This talent deficit highlights the country's struggle amid fierce global competition for top-tier AI talent.

Gears of War: E-Day Is Nostalgic With Rich Visuals

www.nytimes.com · 13 days ago

In Gears of War: E-Day, it’s fun to see the origins of beloved characters in grand scale, even if its play feels conservative.

What exactly is ISOC? And what does it mean for you?

www.csoonline.com · 13 days ago

Gartner recently released a new category of security tools: the Integrated Security Operations Center (ISOC). This new category acknowledges the need to expand beyond traditional SIEM tools in the creation of a security portfolio, though, as they note in the introductory report, Security Information and Event Management (SIEM) isn’t going anywhere.

Social Engineering Detection Moves Into the Live Conversation

www.securityweek.com · 13 days ago

Companies are pouring time and dollars into security awareness training, but little evidence shows it actually works against social engineering.

AI accelerates n-day attacks, as flaw disclosures and exploits double

www.csoonline.com · 13 days ago

Attackers are increasingly weaponizing already-disclosed flaws rather than new zero-days, and AI tools may be accelerating how quickly they do it. According to a report from Google’s Threat Intelligence Group (GTIG), attackers have exploited more vulnerabilities in the wild thus far this year than they did all of last year.

11 Best Adaptive / Risk-Based Authentication Tools Compared (2026): Features & Pricing

gbhackers.com · 13 days ago

Microsoft Conditional Access is the best adaptive engine for most workforces the deepest policy grammar at bundled cost while Duo wins pragmatic rollout, and in the fraud lane Kount (an Equifax company) and IBM Trusteer price consumer risk per event.

Engineer sentenced for locking over 3,000 devices on employer network

www.bleepingcomputer.com · 13 days ago

A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack.

12 Best Biometric Authentication Solutions Compared (2026): Features & Pricing

gbhackers.com · 13 days ago

iProov is the best high-assurance verification vendor the deepest liveness and injection-attack science while Entrust (Onfido) and Incode lead turnkey onboarding and NEC anchors accuracy at national scale. This comparison sorts 12 vendors by the job they actually do, because “biometric authentication” hides five different purchases with five different price sheets.

12 Best Authentication-as-a-Service (AaaS) Providers Compared (2026): Features & Pricing

gbhackers.com · 13 days ago

Auth0 (Okta’s developer line) remains the best AaaS for most teams the ecosystem and enterprise-credibility benchmark while Entra External ID and Amazon Cognito win the price-floor fight and Kinde leads the new value insurgents. This comparison prices 12 providers at three MAU scenarios, because free tiers flatter everyone and year-three bills tell the truth.

11 Best Cloud Directory Services Compared (2026): Features & Pricing

gbhackers.com · 13 days ago

Microsoft Entra ID is the best cloud directory for most organizations bundle gravity plus the clearest AD-exit road while JumpCloud wins the domainless package and Okta Universal Directory the neutral-hub lane.

Critical WatchGuard Endpoint Security Flaw Exposes Kernel and Process Memory

gbhackers.com · 13 days ago

Critical vulnerability CVE-2026-13043 affects WatchGuard/Panda endpoint security products via the pskmad.sys driver. This flaw enables a local, authenticated attacker to bypass driver authentication and access sensitive kernel and process memory. Exploitation permits reading page-sized chunks and dumping the memory of processes like LSASS, even on fully patched Windows 11.

12 Best Secrets Management Tools Compared (2026): Features & Pricing

gbhackers.com · 13 days ago

HashiCorp Vault remains the best dedicated secrets platform the dynamic-secrets benchmark, now under IBM while cloud-native stores win single-cloud estates on price and Akeyless leads the SaaS-vault alternative lane.

Atlassian CVE-2026-21589 Flaw Exposes Files in Jira and Confluence Data Center

gbhackers.com · 13 days ago

Atlassian has announced a critical vulnerability related to arbitrary file access that affects Jira Software Data Center and Confluence Data Center. This vulnerability, tracked as CVE-2026-21589, has a CVSS score of 9.3 and allows unauthenticated attackers to access specific files within the web root directories of the affected applications without needing valid credentials or accounts.

Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products

thehackernews.com · 13 days ago

A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.

FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach

thehackernews.com · 13 days ago

The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees. That's according to a report from Reuters, citing two sources familiar with the matter.

Midnight Blizzard Uses Captive Portals to Deliver CornFlake RAT and Steal Traveler Credentials

gbhackers.com · 13 days ago

Storm-2945, a Midnight Blizzard subcluster, has resumed CaptiveCrunch, an espionage campaign abusing hospitality Wi-Fi networks to infect travelers and compromise corporate accounts.

Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account

thehackernews.com · 13 days ago

Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in Denmark's national population register, the country's digitalization ministry said on October 5. They used a private Danish company's lawful right to look up records in the Central Person Register (CPR).

ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

thehackernews.com · 13 days ago

A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X.

South Korea Investigates Possible Use of A.I. in Hacks on Its Banks

www.nytimes.com · 13 days ago

The president said there were signs that such models were used in recent attacks on several banks involving customer data. Police are investigating.

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

gbhackers.com · 13 days ago

Citrix NetScaler Zero-Days Exploited, OpenAI Agent Swarm Hits Hugging Face, Pentagon Breach Hits 3M, ShinyHunters Leader Arrested, Anthropic MCP Flaw & More Welcome to this week’s edition of the GBHackers cybersecurity newsletter your weekly cybersecurity bulletin covering the 50 most important stories from September 28 to October 2, 2026.

ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes

gbhackers.com · 13 days ago

ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command execution with legitimate STUN infrastructure to support connectivity through network address translation.

Researcher Infiltrates Chinese Crime Syndicate Laundering Crypto for Lazarus Group

gbhackers.com · 13 days ago

Blockchain investigator ZachXBT has revealed that he infiltrated a Chinese organized crime syndicate believed to have laundered over $1 billion through cryptocurrency exploits linked to North Korea’s Lazarus Group.

Dell patches 18 critical flaws that could hand attackers the keys to storage and Kubernetes

www.csoonline.com · 13 days ago

Dell’s security team has had a busy week. The company has announced a slew of Common Vulnerabilities and Exposures (CVEs) impacting its Dell Container Storage Modules (CSM) and Dell System Update (DSU).

Despite ShinyHunters arrests after FBI jobs data breach, enterprises still have no answers about PeopleSoft risks

www.csoonline.com · 13 days ago

The theft of FBI employee data by hacking group ShinyHunters, and the subsequent shutdown of the FBI’s Peoplesoft-based jobs portal, is causing concern for enterprise users of the Oracle product, with analysts recommending extreme measures in response.

ShinyHunters’ exploitation of a new PeopleSoft zero-day hole threatens to change enterprise risk dynamics

www.csoonline.com · 13 days ago

A recent compromise of PeopleSoft by hacking group ShinyHunters is causing new concerns for enterprise users of the Oracle product, with analysts recommending extreme measures in response. Law enforcement has made some progress in its pursuit of the cyber criminals involved.

OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU

www.bleepingcomputer.com · 13 days ago

OpenAI is preparing to add invisible watermarks to text generated by ChatGPT and Codex in the European Union.

Tech workers who resigned tell New York City Council that AI is moving too fast

www.washingtonpost.com · 13 days ago

A hearing in New York brought together AI executives and former employees who say the industry is moving too fast.

ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

www.darkreading.com · 13 days ago

The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications.