Give your agents freedom to do useful work by locking them down
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer’s Windows or WSL machine when the developer…
Spain, Denmark and the Netherlands win Europol 2026 Excellence Awards in Innovation
At the European Police Chiefs Convention on 29 September 2026, Europol announced the winners of its 2026 Excellence Awards in Innovation. Law enforcement…
Fortinet Releases Critical Security Updates for FortiOS, FortiManager, and FortiAnalyzer
Fortinet has announced coordinated security hardening updates for FortiOS, FortiManager, and FortiAnalyzer, scheduled for October 22, 2026. These updates…
Ransomware Attacks Rise as Rival Gangs Vie For Market Supremacy
Cybercriminal groups The Gentlemen and Qilin dominate ransomware attacks – and both are evolving their tactics in an attempt to outdo one another
Broadcom adds real-time scam detection to 3-D Secure authentication
Broadcom has announced the launch of Arcot Scam Defense, a new feature of Arcot by Broadcom, designed to block social engineering fraud during…
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed “anomalous activity” related to systems that store customer environment variables.…
Claude Security can now spot vulnerabilities that reappear in code
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software…
Splunk, SolarWinds Release Fresh Security Updates
Patched vulnerabilities could allow attackers to execute code, elevate privileges, and leak sensitive information.
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords,…
Workshop on Economics and Information Security (WEIS) Archive
There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It’s…
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns
A new CISA advisory warns of the threat posed by SafePay to businesses and critical infrastructure, and urges defenders to take action to mitigate the…
EU wants Booking.com to check out of its scam problem
Commission opens DSA probe into fake listings and phishing on the platform, says its fraud defenses ‘absolutely substandard’
Microsoft says October updates didn’t actually fix VPN issues
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. […]
Hackers Used AI-Generated Scripts to Break Into Government Linux Servers and Hunt for Secrets
Hackers used apparently AI-generated scripts to compromise government Linux infrastructure, harvest credentials and pursue sensitive databases and…
Splunk Patches Three Critical 9.9 Flaws and Two RCE Vulnerabilities
Splunk’s October 21 security updates address three critical CVSS 9.9 vulnerabilities and two authenticated RCE flaws. Here’s what administrators need to…
Amazon Bee Frontier and Bee Eclipse Raise Workplace Consent Concerns
Amazon’s new Bee AI devices can summarize conversations, but their recording controls raise consent questions for employers and meeting participants.
Atlassian Releases Massive Security Update Addressing 176 Flaw Entries in Jira and Confluence
Atlassian has released its October 2026 security bulletin, covering 176 flaw entries across products including Jira, Confluence, Bamboo, Bitbucket, and…
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn’t
You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not…
Top 10 Best Secure File Sharing Platforms in 2026 [Ranked & Scored]
Users share files the easiest way available your only real choice is whether the easiest way is also the governed one. The 2026 secure-sharing shortlist…
ARTEX AI Tool Linked to Cyberattacks on Japanese Companies
Researchers linked the ARTEX AI tool to cyberattacks targeting Japanese companies, while separate findings reveal how attackers exploit mobile apps and…
Top 10 Best Enterprise DRM & Information Rights Management Solutions in 2026 [Ranked & Scored]
Perimeters don’t follow files. The deal model emailed to a counterparty, the design doc shared with a contractor, the board pack synced to a trustee’s…
The Harness Is the Hard Part of Agentic Pentesting
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But…