Blahalla

12 Best IAM Solutions Compared (2026): Features & Pricing

gbhackers.com · 17 days ago

For workforce identity, Microsoft Entra ID is the best pick for M365-gravity organizations (bundled economics are decisive) and Okta the best neutral anchor for mixed-SaaS estates. Developer-facing login is a different purchase FusionAuth and Descope lead that lane.

10 Best Container Registry Security Tools Compared (2026): Features & Pricing

gbhackers.com · 17 days ago

The best container registry security stack in 2026 starts free Harbor (CNCF registry with built-in scanning) and Grype/Trivy (open-source scanners) are production-grade at $0 with Snyk the best paid pick for developer-led remediation and Aqua/JFrog Xray the best enforcement graduations.

Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action

www.securityweek.com · 17 days ago

CVE-2026-104286 is a critical-severity path traversal vulnerability that could allow attackers to write arbitrary files to the system.

China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks

gbhackers.com · 17 days ago

A China-linked threat actor known as TA419 has targeted U.S. artificial intelligence policy specialists through highly customized credential-phishing operations. This campaign, which involves impersonation, adversary-in-the-middle infrastructure, and a modified Browser-in-the-Browser toolkit, aims to steal Microsoft 365 sessions.

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools

thehackernews.com · 17 days ago

Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. With malicious Android applications abusing the API serving as the main conduit for malware and financial fraud, the tech giant said the move would block a major attack pathway.

16-Year-Old Suspected KillSec Ransomware Leader Arrested in International Operation

gbhackers.com · 17 days ago

International law enforcement authorities have arrested three suspects linked to the KillSec ransomware group, including a 16-year-old who is alleged to be the operation’s administrator and primary operator. This coordinated action, announced on October 1, involved agencies from nine countries and was supported by Eurojust and Europol.

Tren de Aragua ATM Jackpotting Network Linked to $40.7 Million in U.S. Losses

gbhackers.com · 17 days ago

The U.S. Treasury Department has sanctioned a Tren de Aragua (TdA)-linked financial network accused of using malware-driven ATM jackpotting attacks to steal an estimated $40.73 million from U.S. financial institutions.

FTC Investigates OpenAI and Anthropic Over Consumer Risks From Advanced AI Models

gbhackers.com · 17 days ago

The U.S. Federal Trade Commission (FTC) has initiated a broad investigation into OpenAI, Anthropic, and other leading artificial intelligence developers to examine potential consumer harm arising from advanced AI systems.

New Infostealer Can Steal Passwords, Cards, Cookies and Wi-Fi Keys From Windows PCs

gbhackers.com · 17 days ago

A Python-based infostealer builder that enables threat actors to generate customized Windows payloads capable of stealing browser credentials, payment-card data, session cookies, Discord tokens, Wi-Fi passwords and extensive system information.

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

thehackernews.com · 17 days ago

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.

Fortinet FortiMail Path Traversal Flaw Actively Exploited to Compromise Servers

gbhackers.com · 17 days ago

Fortinet has disclosed a critical vulnerability in FortiMail that attackers are actively exploiting to compromise vulnerable email security appliances. This flaw, tracked as CVE-2026-104286, has a CVSS v3.1 score of 9.8. It enables unauthenticated attackers to write arbitrary files to the underlying system via specially crafted HTTP or HTTPS requests.

Apache HTTP Server Flaws Enable Remote Code Execution and Denial-of-Service Attacks

gbhackers.com · 17 days ago

Apache HTTP Server administrators are urged to apply security updates following the disclosure of multiple vulnerabilities affecting Apache HTTP Server 2.4. These vulnerabilities include flaws that could allow for remote code execution (RCE), server crashes, memory exhaustion, and other denial-of-service (DoS) conditions.

U.S. Arrests Company Owner Accused of Shipping $300 Million in Restricted GPU Servers to China

gbhackers.com · 17 days ago

U.S. authorities have arrested Greg Lui, a 38-year-old California-based technology company owner, on allegations of orchestrating the illegal export of more than $300 million in advanced GPU-equipped servers to China through a network of overseas transshipment companies.

Fortinet warns of critical FortiMail flaw exploited in zero-day attacks

www.bleepingcomputer.com · 17 days ago

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices.

Alleged KillSec Ransomware Mastermind a 16-Year-Old

www.darkreading.com · 17 days ago

Law enforcement from multiple countries collaborated to disrupt a cybercrime operation that has claimed some 500 victims worldwide in the past two years.

Autonomous AI agents tried to hack US, Canadian government websites

www.bleepingcomputer.com · 18 days ago

Autonomous AI agents using aggressive strategies attempted to hack U.S. and Canadian government websites to find school and divorce statistics.

Microsoft says threat actors are ahead in the early AI race

www.bleepingcomputer.com · 18 days ago

Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace.

Amazon Settles Lawsuit Over Claims of Slow Deliveries to Low-Income Areas

www.nytimes.com · 18 days ago

The tech giant will refund $7.25 million in Prime membership fees to affected customers and pay an additional $1 million to settle the suit brought by the District of Columbia.

OpenAI says rogue agents may have breached more than 100 organizations

www.washingtonpost.com · 18 days ago

The disclosure expands the extent of known rogue activity and raises further questions about the extent to which AI makers are maintaining control over their newest models.

Zero Trust Creator Says Model Holds Firm Against AI-Assisted Attacks

www.securityweek.com · 18 days ago

Fifteen years after coining the framework, John Kindervag insists zero trust still works in the AI era, if you get the implementation right.

Osavul Lands $10 Million to Spot Hostile Intent Across Cyber, Physical Domains

www.securityweek.com · 18 days ago

Hybrid risk intelligence company Osavul has raised $10 million in a Series A funding round led by 33N Ventures.

Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers

thehackernews.com · 18 days ago

Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site.

ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories

thehackernews.com · 18 days ago

This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the lesson running through the list. Attackers do not always need a brilliant new trick.

Swedish Company Uses A.I. Likeness of Greta Garbo in Ad

www.nytimes.com · 18 days ago

An ad produced by the manufacturing company SKF Group featured a digital version of the Swedish American actress, who died in 1990. Not all viewers found the replica convincing.

Who’s to Blame When A.I. Goes Rogue?

www.nytimes.com · 18 days ago

Many think artificial intelligence companies should be held liable for their runaway technology.

How to Spot a Compromised MikroTik Router

ifritnoises.org · 18 days ago

A blue-team writeup on detecting a compromised MikroTik from its own config. Seven techniques, each with the collection command, the artifact it leaves behind, and a triage step. Feedback welcome.

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

thehackernews.com · 18 days ago

Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC" markers present in the injected content.

Enterprises Struggle to Prepare for AI and Quantum Threats, PwC Says

www.securityweek.com · 18 days ago

PwC’s survey found that only 22% of leaders would use fully autonomous AI for cyber defense, while just 21% are implementing quantum-resistant security measures.

Hacker Conversations: Rob Juncker, a Knock at the Door and a Moral Compass

www.securityweek.com · 18 days ago

Rob Juncker is chief product and technology officer at Mimecast. Is he a hacker? “Unequivocally yes,” he says.

Police dismantle KillSec ransomware gang allegedly led by 16-year-old

www.bleepingcomputer.com · 18 days ago

An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator.

Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader

www.securityweek.com · 18 days ago

Police took control of KillSec’s leak site and secured at least 110 terabytes of data stolen from victims.

The Day-One Hole in Zero Trust Architecture

www.bleepingcomputer.com · 18 days ago

Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued.

Insights from the 2026 Microsoft Digital Defense Report

www.microsoft.com · 18 days ago

Read highlights from the 2026 Microsoft Digital Defense Report, which reflects a security environment that continues to grow more interconnected.

Preparing governments for an era of interconnected cyber risk

blogs.microsoft.com · 18 days ago

According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025.

Kiteworks patches max severity code injection vulnerability

www.bleepingcomputer.com · 18 days ago

Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution.

Google makes Gemini 4 AI model available to a trusted few

www.csoonline.com · 18 days ago

Google has unveiled a new frontier AI model after months of delay. Gemini 4 Argon is designed to handle complex, long-horizon workloads spanning software engineering, enterprise knowledge work such as legal and financial analysis, and cybersecurity. But only a few organizations can get their hands on it for now.

Cisco SD-WAN Manager hit by zero-day admin access attack

www.csoonline.com · 18 days ago

Cisco’s SD-WAN management software has been letting some attackers walk through an authentication check without having to prove who they are. The company says it has now fixed the flaw that was allowing it. The affected platform, Cisco Catalyst SD-WAN Manager, is used to configure and operate software-defined network deployments.

r/netsec monthly discussion & tool thread

www.reddit.com · 18 days ago

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links. Rules & Guidelines Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary. Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.

AI Has Changed Attack Speed, Not Security Fundamentals

www.securityweek.com · 18 days ago

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.

Elon Musk to return his attention to government, advise Pentagon on future of war

www.washingtonpost.com · 18 days ago

Musk will join Anduril founder Palmer Luckey and former House Speaker Newt Gingrich on a panel for what the Defense Department is calling Project Meridian.

TerminalFix Attacks Deploy Lorem Ipsum Loader to Create Covert Tunnels Into Corporate Networks

gbhackers.com · 18 days ago

A newly tracked intrusion set, STAC4924, is using TerminalFix social-engineering lures to deploy the Lorem Ipsum Loader and establish covert reverse tunnels into enterprise environments. The activity shifts the familiar ClickFix model from the Windows Run dialog to Windows Terminal, increasing the likelihood that victims execute complex PowerShell payloads without recognizing the risk.

Next.js ImageResponse Vulnerability Lets Remote Attackers Execute Code Through SVG Content

gbhackers.com · 18 days ago

A critical vulnerability in Next.js could let unauthenticated remote attackers execute code on affected servers by supplying crafted input that gets rendered into SVG content during dynamic image generation. This issue, tracked as GHSA-vcvr-r3jv-pc5j, affects the Node.js implementation of ImageResponse in the next/og package. The flaw impacts Next.js versions 16.2.0 to 16.3.5.

Warlock Ransomware Hits Large Spanish, Portuguese Orgs

www.darkreading.com · 18 days ago

A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places.

Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure

www.securityweek.com · 18 days ago

Under certain conditions, CVE-2026-73570 can be exploited via specially crafted emails without user interaction.

Inside Binance Founder Changpeng Zhao’s Life After Prison

www.nytimes.com · 18 days ago

Changpeng Zhao, jailed in the United States for a financial crime and pardoned by President Trump, is now living a gilded life in the United Arab Emirates.

Axios Flaws Let Attackers Bypass Proxy Controls and Trigger SSRF Attacks

gbhackers.com · 18 days ago

Axios maintainers have disclosed several high-severity security vulnerabilities that could allow attackers to bypass proxy and DNS controls in server-side applications, potentially enabling server-side request forgery (SSRF) against internal services and cloud metadata endpoints. The most critical issue, tracked as GHSA-3pq3-5fj3-cg6v, affects Axios’s HTTP/2 request path.

How Financial Services Companies Can Modernize Their Software Supply Chain

thehackernews.com · 18 days ago

Security leaders in financial services frequently face a conflict where security teams demand vulnerability elimination. Engineering groups respond by citing difficult platform upgrades, high costs for regression testing, and restrictive change-freeze calendars. As a result, organizations often grant temporary exceptions or compensatory controls rather than eliminating core vulnerabilities.

China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor

gbhackers.com · 18 days ago

A China-nexus cyber-espionage campaign that compromised approximately 350 endpoints across Asia using a previously undocumented Rust-based Windows backdoor called Antino. The activity cluster, tracked as UAT-11587, targeted government, defense, diplomatic, policy, academic and civil-society organizations in at least eight countries between September 2025 and July 2026.

Kevin Mandia’s Armadin Raises $255 Million at $2.5 Billion Valuation

www.securityweek.com · 18 days ago

The Series B brings the AI-powered offensive security startup’s total funding to roughly $445 million only seven months after its public launch.

Microsoft enables Windows settings backup by default for orgs

www.bleepingcomputer.com · 18 days ago

Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2.