The Latest

Google Chrome is making it easier to autofill online forms with more than just contact information and credit card numbers. For users with Personal Intelligence enabled, Gemini will now suggest items like order numbers, tracking information, membership IDs, and booking confirmations from Gmail messages when completing forms in Chrome.

Chrome expands autofill suggestions based on information from Gmail

Chrome's expanded autofill capabilities use Gemini to read your emails and surface suggestions, meaning you don't have to click back and forth between tabs or manually search for codes or confirmations in your inbox. When you click a form field that has a corresponding piece of data, a pop-up menu appears and indicates that an item is "Suggested by Gemini." You can click this to autofill the suggestion as well as open an additional menu to see the specific source (the original email) or remove the suggestion. The latter doesn't delete anything from Gmail; it simply dismisses the suggestion in Chrome.

As Android Police reports, Google started testing enhanced autofill in Chrome this summer using data from other connected apps like Google Photos. The feature currently rolling out is specific to Gmail and is coming first to U.S. users who have Personal Intelligence enabled on desktop as well as in the Android and iOS apps when using Gemini in Chrome.

Personal Intelligence may expose your Gmail data for targeted ads

When using enhanced autofill, remember that, thanks to a recent privacy policy update, connecting Gmail and other Google apps to Personal Intelligence may expose more of your data to ad personalization. Personal Intelligence likely hasn't changed what Google itself can access all that much, but now Google can use data from Gmail, Photos, and Drive to deliver targeted ads. That includes data you don't explicitly share in search or with Google's AI. Google says it does not send personally identifiable information to advertisers or scan Gmail for this data—however, linking Personal Intelligence to Google apps does potentially leave you more exposed.

In the blog post announcing the enhanced autofill feature, Google states that "sensitive data is encrypted" and that users can manage autofill, including enabling or disabling enhanced suggestions, via Chrome's settings.


from Lifehacker https://ift.tt/fmk9V0O

Three weeks after the attack that turned refrigeration units in French supermarkets into ovens overnight, similar cyberattacks have hit shops in other European countries and again caused refrigerated food to be spoiled.

European supermarkets cyberattacks

Belgium, Luxembourg and Sweden affected

“[In Belgium,] fridges and freezers have been affected at Delhaize, Carrefour and Spar, among others. The attackers remotely switched the units’ evaporators to defrost mode, causing the fridges to warm up,” Belgian news agency Belga reported today.

“The mechanism is said to be exactly the same as in the large-scale cyberattack on hundreds of shops in France in early October.”

Stephan Moelans, CEO of Sabcobel, a Belgian company that manufactures and installs industrial refrigeration equipment, told the agency that the attack started around midnight on Sunday, and that its technicians have been working “all night and morning to disconnect the affected units from the network.”

After the attack in France, most of its customers switched to managing the fridges over a secure internet connection, he added, and said that for a thorough fix of the vulnerability that allowed the attack, in addition to a software update, the refrigeration units have to be physically modified.

Delhaize supermarkets have also been hit in Luxembourg, RTL Today reported. Supermarket chains Colruyt and Intermarche confirmed that they have had “technical problems” at some of their stores, but did not say it was because of a cyberattack.

In Sweden, the Coop and Ica chains have been affected: the temperature on their freezers was turned up to 50 degrees (Celsius), The Local said.

An Ica spokesperson told Swedish newspaper Dagens Nyheter that a small number of stores that “have their connection outside Ica’s central network” were affected.

The root cause: Internet-exposed, unpatched systems

In October, French retail stores saw their frozen and chilled goods spoiled after an overnight attack on refrigeration control systems manufactured by Danfoss, Copeland, and Dixell, according to French cybersecurity agency Anssi.

The attack was made possible by remotely exploitable vulnerabilities in the monitoring systems’ internet-exposed management interfaces.

“I’ve confirmed with folks the impacted freezers in the countries impacted today are all [management] interface facing internet, same issue and vuln as last time. Many of the freezers are end of life and have no patch available, they’ve just been left online to quite literally rot,” security researcher Kevin Beaumont commented today.

As with the October attack, it’s still unclear who is behind these latest ones.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!


from Help Net Security https://ift.tt/2GA0F8w

We may earn a commission from links on this page.

October's ten most-streamed series are packed with your future favorite shows. There's a couple of modernizations of horror franchises for Halloween (Carrie and Crystal Lake), as well as new horror series Below and Phony. There's an excellent new superhero series Lanterns, sprawling family drama East of Eden, and new seasons of favorites Ted Lasso, Slow Horses, The Diplomat, and Mobland. So don't even try to tell anyone there's nothing on.

Carrie

Horror master Mike Flanagan (Haunting of Hill House, Midnight Mass) re-imagines Stephen King's tale of teenage telekinesis, taking the story from the 1970s to now, complete with cyber bullying, smart phones, and a modern sensibility. The core of the tale, though, remains the same, as does the titular character's bloody coming-of-age. Powered by a talented young cast that includes Siena Agudong as Susan and Summer H. Howell as the title character, Carrie is a trick-or-treat for horror fans. Stream Carrie on Prime.

East of Eden

Based on John Steinbeck's pillar of Western literature, East of Eden follows three generations of the hardscrabble Hamilton family and the upscale Trask family, farming and ranching clans in California's Salinas Valley. The show's production is a multigenerational story too: It was written and created by Zoe Kazan, whose grandpa Elia directed the 1955 film version of East of Eden. All respect to Elia Kazan, but Steinbeck's story is so massive, it needs a seven-part mini-series. East of Eden is the kind of sprawling, melodramatic story that episodic television was made for. Stream East of Eden on Netflix.

Crystal Lake

Like Carrie, Crystal Lake reimagines a horror classic—in this case, Friday the 13th—and expands the lore even beyond the 12 films in the franchise. If you've ever wondered how Pamela Voorhees, played here by Linda Cardellini, became a serial murderer, and how her son Jason ended up a relentless, camp-counselor-killing-machine who lives at the bottom of a lake, Crystal Lake has all the answers. In a lot of ways, this show is better than all of the movies. Stream Crystal Lake on Peacock.

Slow Horses

Apple TV's Slow Horses delivers a realistic, nuanced take on espionage by detailing the lives of the losers of British Intelligence. Instead of chiseled good guys and gals saving the world, the agents of Slough House are a team of dysfunctional, troubled souls trying to do the right thing (usually) in a morally gray world, just like real agents. Their leader, gruff, obnoxious Jackson Lamb, is played to perfection by Gary Oldman. Slow Horses has an almost perfect Rotten Tomatoes score over its first five seasons, and season 6 is setting new records. Stream Slow Horses on Apple TV+.

Lanterns

DC's TV revamp of Green Lantern details what happens when experienced Lantern Hal Jordan (Kyle Chandler) trains the new guy, John Stewart (Aaron Pierre), on how to wield the mysterious and powerful Green Lantern Ring. It's a reserved, neo-noir style take on the comic mythos, as the heroes investigate a series of murders tied to an extraterrestrial threat. Lanterns is pulling in a better than 90% fresh ratings from Rotten Tomatoes, so it's definitely worth a stream. Stream Lanterns on HBO Max.

Below

Created by Jesse McKeown and starring Josh Hartnett, Charlie Heaton, and Mackenzie Davis, Below is set in a Newfoundland fishing village beset with aquatic horror. When the Canadian government offers the residents of Snooks Arm a ton of money to relocate, no one really knows why, but ice fisherman Calvin Penney (Hartnett) suspects it has something to do with the monster he saw under the ice when he was a child. If you like taut creature feature style horror, check out Below. Stream Below on Netflix.

Ted Lasso

Season four of Ted Lasso sees the title character, played by Jason Sudeikis, returning to the UK to take on a new challenge: coaching the Lady Greyhounds, AFC Richmond's second-division women's football team. This multiple Emmy Award-winning series still has all the heart, humor, and positivity of the original run. Stream Ted Lasso on Apple TV+.

Phony

The mystery that drives creepy coming-of-age drama Phony is killer: Sonny Cooke, played by Sam Nivola, is a teenager with a very close relationship to his devoted single mother Ellen, played by Connie Britton. After a freak car accident, he wakes up convinced that his mom is an impostor. She looks the same, but there's something off about her in a way that Sonny can't describe, so he sets out to solve the mystery. Phony is rated over 90% fresh on Rotten Tomatoes. Stream Phony on Hulu.

The Diplomat

In season four of political thriller series The Diplomat, the Kate Wyler, played by Keri Russell, finds that diplomatic relations between the U.S. and the UK are starting to crumble, and so is her marriage. Meanwhile, U.S. president Grace Penn, played by Allison Janney, and VP Hal Wyler, played by Rufus Sewell, continue their conspiracy to steal a Russian super-weapon, nudging the nation toward war with our longtime adversary. In other words, it's an international mess, with a few powerful people keeping the world from descending into chaos. If you like political intrigue, this is the series for you. Stream The Diplomat on Netflix.

Mobland

Who doesn't love a sprawling organized crime drama? In Mobland, the crime is being organized in Great Britain, where two warring London crime families, the Harrigans and Stevensons, are locked in a battle for underworld power. In the middle of the crossfire is Harry Da Souza, a gritty fixer played to gruff perfection by Tom Hardy. Season 2 finds Da Souza in the unenviable position of holding together the Harrigan family on the verge of civil war. If you like backstabbing, scheming, murder, and other tropes of high-stakes crime thrillers, you'll like Mobland. Stream Mobland on Paramount+.


from Lifehacker https://ift.tt/RHcKYIP

In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents. He argues that agents should run under their own identity, with the person’s identity attached when acting on someone’s behalf. He covers where credential proxies go wrong, what the first ten lines of a command policy for a coding agent should say, and how to stop data from leaving through package installs or URL parameters. He also describes how red teams should test agent deployments.

AI agent access control

Should an agent get its own identity, borrow the identity of the human who launched it, or something in between? Walk me through how you’d decide for two cases: an agent that triages support tickets and one that pushes infrastructure changes.

Neither extreme. The deciding question is whether the agent is doing a job for the business or a task for one person.

If it’s doing a job for the business, it gets its own identity, with permissions scoped to that job. If it’s doing a task for one person, it still gets its own identity, but each request also carries the identity of the person who asked. The agent can then only do what both are allowed to do, and the logs show both names. Borrowing the person’s login outright is the option I’d rule out, because the agent’s actions become indistinguishable from the person’s, and it inherits everything that person can reach.

A ticket-triage agent is doing a job for the business. It works across every customer’s tickets and doesn’t belong to any one rep, so it runs as itself, with read access to the queue and write access only to routing and labels.

An infrastructure agent is usually doing a task for an engineer, so it carries that engineer’s identity alongside its own. But proposing a change and applying it should be separate permissions. The agent can open the change and run the plan. Applying it goes through the same review and pipeline a human’s change would.

Should agents hold secrets directly, or should they go through a vault or proxy that injects credentials at call time? Where have you seen the proxy approach go wrong?

Never hand an agent a long-lived secret. Past that, the question bundles two decisions worth separating: how long a credential lives, and whether the agent ever holds it.

Short-lived credentials limit how long a leaked one stays useful. A proxy that attaches the credential at call time limits whether it can leak at all, since the agent never sees it. The two work together, and the strongest setups do both: the proxy verifies the agent’s identity, obtains a short-lived credential scoped to that call, and attaches it on the way out.

For services that only accept static API keys, a proxy is the only way to keep the key out of the agent. If an agent does hold a short-lived token directly, check what sits next to it. A refresh token in the same environment is a long-lived secret by another name. Better still, tie the token to the machine or container that requested it, so a copy that leaks is useless anywhere else.

Neither control stops a hijacked agent from misusing access it legitimately has, and that’s where proxies go wrong. A proxy that attaches credentials to any request the agent makes is a confused deputy waiting for instructions. One that forwards the caller’s token downstream turns every hop into a place to steal it. One shared credential behind the proxy makes every agent look identical in the logs. And a vault on the same host as the agent hasn’t protected the secret, only moved it. A proxy doesn’t remove an agent’s authority. It concentrates it, so it needs per-agent identity, least privilege and a destination allowlist like anything else.

If you had to write the first ten lines of a command policy for a coding agent with terminal access, what would they say?

A short list of hard denies is a reasonable first step for a team just getting started. For an agent with a terminal, though, I’d write the policy as an allowlist, because a coding agent will always find the command you didn’t think to forbid. I’d also make sure every line is enforced by the harness rather than by asking the model to behave. Roughly:

1. The agent works inside one checked-out repository in a disposable environment and can’t read or write anything outside it.
2. It runs only approved commands: the project’s build, test, lint and format tools, read-only git, and file edits inside the repo. Anything else asks first.
3. No credentials live in its environment. Anything that needs one goes through a broker the agent can’t read.
4. It can’t open files that carry secrets, such as .env files, SSH keys or cloud credential files, even if one turns up in the workspace.
5. Network access is off except for the internal package mirror and the specific hosts this project needs.
6. Packages come only from the internal artifact repository, and adding a new dependency needs a human.
7. It can commit to its own branch and open a pull request. It can’t push to protected branches, force-push or merge.
8. Anything that changes shared infrastructure or data, such as an apply, a deploy, a migration or a delete, stops and asks.
9. It can’t escalate privileges or change its own policy, hooks or configuration.
10. Every command is logged with the agent’s identity and the task that triggered it, and a spend or runtime cap ends the session when it’s hit.

Several of these lines shouldn’t depend on the command policy at all. Branch protection belongs in version control, network rules in the firewall and credential access in the identity system, so they hold even if the agent finds a way around its own policy. None of this is new.

It’s the discipline we already apply to CI pipelines, applied to something that writes its own commands.

What should an agent be allowed to reach on the network by default? How do you stop data from leaving through an innocent-looking request, like a package install or a URL parameter?

I’d start every agent with no network access and work forward from what it holds. The test I use is whether a single agent combines private data, content from people you don’t control, and a way to send data out. With all three, one poisoned email or ticket is enough to move data out of the company. A research agent that reads the open web but can’t see anything internal can have fairly broad reach. A support agent reading customer email next to customer records shouldn’t have an open outbound path at all, and its replies should go through a channel someone controls.

When an agent does need the network, I’d deny by default, list exact hosts rather than wildcards, and enforce it somewhere the agent can’t edit. Package installs are where most allowlists quietly fall apart, because the public registries end up on the list. We’ve had internal artifact repositories for years for exactly this reason. Pointing agents at yours instead of the public registry closes most of that gap and gives you one place to hold back new releases or packages nobody has reviewed.

The URL parameter is the harder case, and I don’t think the network solves it. A plain GET to an approved host can carry data in its query string, and approving a host means trusting the platform, not everything people can write on it. Inspection is worth having for visibility, but I wouldn’t rely on it to catch injected instructions, since an attacker only needs the one variant the filter misses. What I trust more is design: once an agent has read untrusted content, it shouldn’t be able to send data out or take a consequential action without someone approving it.

How should a red team test an agent deployment? What does a good tabletop exercise for a hijacked agent look like?

I’d have a red team test the system around the model rather than the model itself. Assume an injection will eventually work, and measure what a hijacked agent can do from there: how far it got, which controls held, and how long it took anyone to notice. The known paths, such as reading its own credentials, reaching a host off the allowlist or editing its own configuration, should run as automated tests every time someone adds a tool or connector, because that’s when the exposure changes. That leaves the human red team free to hunt for the paths nobody has written a test for yet.

For the tabletop, I’d be careful about which incident you rehearse. The costliest agent incident I’ve seen this year was agents on one engineer’s account spending roughly $500,000 on cloud infrastructure in about 36 hours. That one was loud, and the bill eventually gave it away. A hijacked agent is built to stay quiet, reading the data it always reads and calling the systems it’s allowed to call, so rehearsing the loud case teaches the wrong instincts.

I’d run it in stages instead. A support agent processes a ticket carrying hidden instructions, and over the following week other customers’ records leave a few at a time inside its replies to the attacker. Reveal one clue at a time: a customer complaint, then an odd pattern in the agent’s logs, then the poisoned ticket itself. At each stage, ask the room what they’d do with only what they know. Can they tie the activity to one agent? Can they stop it without taking down support? Who decides, and how fast?

Then ask the question most teams can’t answer: after you end the session, how do you know it’s gone? If the attacker had the agent write an instruction into its memory, a shared configuration file or a reply template, the next session picks it up and starts again. Recovery means cleaning everything the agent could write to, not just revoking its credentials.

Download: The IT and security field guide to AI adoption


from Help Net Security https://ift.tt/utgZ6sn

Byoky is an open-source wallet for AI API keys, available as a Chrome and Firefox extension and as iOS and Android apps.

Users store their keys for OpenAI, Anthropic, Google Gemini and other providers in it, encrypted on their own device. Apps that want those keys ask the wallet for access, and the wallet sends each request to the provider itself. The app gets a session token. The key stays in the wallet.

Byoky AI API key wallet

Byoky goes after the habit of pasting a key into a web app’s settings page to try a new tool. “A key pasted into a settings page is a key you no longer control,” the project’s homepage says. Byoky copies the model of MetaMask, the crypto wallet that decentralized apps connect to: the app asks, the user approves, and one click revokes access.

Users set a master password and add their keys. Byoky encrypts them with AES-256-GCM, a standard cipher that also detects tampering, using a key derived from the password through 600,000 rounds of PBKDF2. That iteration count makes each guess slow for anyone who steals the encrypted vault and tries to crack the password. Byoky requires a password of at least 12 characters.

Developers keep the official Anthropic or OpenAI library and hand it a session key and a fetch function from Byoky’s SDK. Streaming, tool calls and image inputs pass through, according to the documentation. Users can cap spending per app, and the wallet logs every request locally with the app’s origin, the provider and the status.

The wallet supports 13 cloud providers plus local Ollama and LM Studio servers. It can also translate between Anthropic, OpenAI, Gemini and Cohere request formats, so a user can drag an app written for Claude onto a GPT key without the developer touching code.

Command-line agents such as OpenClaw, Claude Code and Hermes connect through a local proxy called the bridge. The bridge rejects requests that lack a bridge token, a check meant to stop other programs on the same machine from spending the keys. It also does something less advertised. When a third-party agent runs on a Claude Pro or Max subscription token, the bridge renames the agent’s tools and moves its system prompt so that Anthropic’s first-party detection accepts the request.

Byoky is available for free on GitHub.

Must read:

Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!


from Help Net Security https://ift.tt/hHO70dw

The group behind the Aur0ra ransomware has been using AI agents to move through victim networks, collect credentials and work its way up to domain administrator access, according to Sophos.

ransomware AI agents

AI-assisted intrusion workflow (Source: Sophos)

The company, which tracks the group as GOLD OGRE, recovered artifacts from the Cursor AI coding assistant in late August that show the attackers handing the agents VPN logins, proxy access, targets and objectives. The agents then mapped the network and Active Directory, hunted for passwords in network shares, documents and backups, and moved laterally with little input from the people directing them.

In some networks, the agents gained domain management access, and three of those victims were later named on Aur0ra’s data leak site. Breaking in and deploying the ransomware stayed under human control.

Prompts written in Russian

The researchers also obtained some of the operators’ instructions to the agents. In one, an operator said the Windows AD network needed testing and offered to set up a SOCKS5 proxy and user accounts for the agent.

Another instructed it, “Don’t try brute-forcing domain administrator accounts anymore. Try other, less noisy, methods and vectors.” A third asked it to find the backup servers, NAS servers and virtualization systems in the victim’s infrastructure.

Operator logs also contained keyboard slips typed in Cyrillic, which the company says suggest the operators are Russian speakers.

A red team cover story

To get around the guardrails built into the AI tools, the attackers described the intrusions as authorized red team activity or diagnostic testing. The attacks ran through Cursor’s Composer agentic coding model and models from Anthropic, xAI and Moonshot.

“Analysis indicates that the threat actors initially used Anthropic almost exclusively but then introduced other models. The shift may be related to the threat actors’ objectives, as they transitioned from building tools to conducting intrusions.,” Sophos noted.

The company’s Counter Threat Unit assesses with high confidence that GOLD OGRE used AI to test whether its tools could evade EDR products, then gave associates similar technology for Aur0ra attacks. The researchers consider it highly likely that other ransomware groups will build AI agents into their operations too.

Gambit Security and CloudSEK published their own analyses of Aur0ra operations, both apparently based on the same exposed open directory. Gambit’s report mentions a Claude 4.5-Sonnet agent being deployed in semi-automated attacks.

“AI can accelerate phases of the attack chain and reduce the level of technical aptitude needed to conduct an attack. Existing controls such as patching internet-facing devices, deploying phishing-resistant multi-factor authentication (MFA), and monitoring EDR alerts are still effective, but successful defense relies on a quick response,” Sophos concluded.


from Help Net Security https://ift.tt/1yAvKg8

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Week in review

r/opensource bans AI projects, and solo devs go down with them
Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or is intended for AI.” Moderator Wolvereness announced the rules in a post over the weekend.

AI slop is piling up highest on the biggest open-source projects
The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source contributors and maintainers, people running projects with more than 50 contributors estimated that close to a third of the code changes landing in their queue are low quality or AI-generated. Those maintainers now worry more about burning out than about the code itself.

Microsoft Authenticator vulnerability let rogue Android apps steal work account access
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything.

Several AI security market categories are headed for bigger platforms
In this interview with Help Net Security, Jonathan Care, Lead Analyst and Practice Lead AI at KuppingerCole Analysts, compares AI security startups to the early fraud market he helped define at Gartner. He explains which categories will survive as products and which will become features inside bigger platforms.

Private repos still leak secrets to Gheist, a stolen GitHub token campaign
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token, finds every repository that token can open, and plants a workflow in each one. The workflow prints the repository’s secrets into a log, and the attacker downloads it.

Bellini Capital CISO on AI security governance and the limits of patching faster
In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital and ConnectSecure, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He argues that “patch faster” is not enough and that teams need to cut exposure while remediation is pending.

CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster
CISA released ScubaGear v2.0 and ScubaGoggles v1.1.0, new versions of the open-source tools it publishes to check Microsoft 365 and Google Workspace settings against its security baselines. The agency calls ScubaGear v2.0 the most comprehensive update to that tool since its 2022 launch. ScubaGoggles, which launched in 2023, gets a new baseline and enhanced Gemini controls.

GitHub’s npm package firewall can block brand-new versions before they install
GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall.

Stolen staff logins are spreading attacks between K-12 school districts
Last school year, 808 K-12 school organizations got some unwelcome news. The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or credentials were circulating on underground and dark web marketplaces. That’s 808 of the center’s 6,116 K-12 members, and attackers are using those logins to get in the door and then reach the next district.

IT bosses are confident they’ve found the certificates they don’t know about
Forty percent of 500 senior IT and security leaders surveyed for certificate authority Sectigo said they are very prepared for monthly TLS certificate renewals because automated systems are already in place. Their more specific answers point elsewhere. Only 4% said their certificate management is already automated, and 61% said their organization had a certificate-related outage or incident in the past 12 months.

Qualys CISO on what security teams can do as exploit campaigns grow
In this Help Net Security interview, Nathan Smolenski, CISO at Qualys, talks about how security teams can handle the growing volume of AI-discovered vulnerabilities. He explains why CISOs should track the average window of exposure instead of standard MTTR, and why only a small share of disclosed flaws, under one percent in 2025, pose active risk.

Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop
Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk.

Fake IT help desk callers got by on little more than names and email addresses
Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware.

Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack
University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a substantial data breach.

Brotli bug reaches far beyond Node.js (CVE-2026-111497)
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node.js publicly disclosed it on October 21, 2026.

Tailscale fixes SSH flaws allowing lateral movement within tailnets
Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in the network gain more privileges on other machines that are part of it.

Compromised camera management software gives attackers a way into corporate networks
Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application.

Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday.

Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. Cisco has also confirmed that attackers are crashing its firewalls with a newly disclosed vulnerability.

LLM agent security needs more than guardrails
Madhu Shashanka, Chief Scientist at Concentric AI, explains why securing LLM tools and agents depends more on your data than on the model. Controls on model behavior, such as guardrails and injection detection, lower the rate of bad outcomes but never reach zero. Controls on what goes in are different, because you own the documents, systems, and credentials an agent can reach.

Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture
An AI SOC that starts with somebody else’s alert is already too late. Stellar Cyber collects and normalizes telemetry, detects suspicious activity, correlates evidence, builds cases, investigates incidents, triages findings, and drives response from the same security architecture. That gives people and AI access to the evidence behind the alert – not just the alert itself.

I underestimated how fast security teams would trust AI to act in the SOC
For most of her career, Aqsa Taylor has watched enterprises adopt new security platforms slowly. She expected AI adoption in security operations centers (SOCs) to follow the same pattern, particularly given strict compliance requirements. Instead, adoption moved faster than she expected as AI helped attackers shorten the time between initial compromise and damage.

What exactly is ISOC? And what does it mean for you?
Security teams often spend too much time moving between tools to piece together an incident. Integrated Security Operations Center (ISOC) solutions aim to reduce that work by bringing detection, investigation, and response together, while SIEM remains the system of record for security data. Stellar Cyber’s approach uses the same underlying data throughout this process, giving analysts and AI access to the evidence behind an alert.

Security pros reckon the biggest AI risk comes with an employee badge
Employees pasting company data into AI tools worry security teams more than AI-powered attacks do. AI-generated phishing, the attack they run into most often, made the list of top concerns for only a quarter of the 209 security professionals O’Reilly surveyed in September.

DreamHost incident triggers password resets, locks customers out of email and FTP accounts
DreamHost has brought its File Manager back online after an incident that disrupted several of its services, though some of its customers still can’t get into their email or FTP accounts until someone sets a new password for them.

Cyberattack on University of Copenhagen exposes data of 525,000 people
The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal data belonging to some 525,000 people.

Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support
Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents in which the external chat feature in Teams was abused.

Data breach at Sony-owned internet provider compromises 2.6 million customer records
Attackers who broke into the So-net member database made off with personal information belonging to more than 2.58 million current and former customers, along with the email passwords of 54,401 users, Sony Network Communications has disclosed.

FBI seizes Virtualine, bulletproof hosting provider that promised to shield criminals from police
The FBI has seized virtualine.net, the domain of a bulletproof hosting provider that laundered money for its criminal customers and kept a forum trading in child sexual abuse material online despite repeated warnings from police and child protection groups.

345,000 email addresses stolen in cyberattack on Germany’s far-right party AfD
Over 345,000 unique email addresses were exposed in the September 2026 breach at German far-right political party Alternative für Deutschland (AfD). Breach notification service Have I Been Pwned (HIBP) added the data to its database on 27 October, listing email addresses and email messages as the compromised information.

Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents
Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace.

Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. The flaw carries a CVSS score of 9.8 and affects the Application Object Library product in EBS versions 12.2.3 to 12.2.15. Oracle’s description in the NVD entry calls it an “easily exploitable vulnerability” open to an unauthenticated attacker over HTTP.

Yoba malware hides in fake desktop versions of ChatGPT and Claude
Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campaign, dubbed Yoba, for the past two months.

Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record
About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. The company found no evidence of a wallet private key leak and plans to publish a technical post-mortem once the investigation is complete.

Claude Code extension poisoned with persistent SSH backdoor
A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found.

Assad regime hacker who caused $136 billion market drop sentenced to 42 months
A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced.

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken
The OpenSSL project released version 4.1.0, adding support for DTLS 1.3 and listing four known bugs in the DTLS code that ships with it. DTLS is the variant of TLS built for datagram transports such as UDP, and version 1.3 is defined in RFC 9147.

Google open-sources the Elephant-Goldfish Model plugin its engineers use to catch AI coding mistakes
Google has open-sourced the Elephant-Goldfish Model plugin, an internal tool that makes an AI coding agent write and defend a design document before it touches any code. The plugin hands that document to fresh AI sessions that have never seen the design conversation and tells them to find what is wrong with it.

Synthetic identities leave US lenders with $2.4 billion in fraud exposure
Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the Age of Continuous Trust report. Eighty-one percent of suspected digital fraud in its network during the first half of 2026 occurred during account logins and financial transactions, highlighting risks that persist throughout a customer relationship.

Forgotten AI agents may still access sensitive company data
AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report. About 76% of enabled agents examined had not run in 60 days, leaving access available through inactive software.

Witness: Open-source framework for verifying how your software was built
Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it.

Anthropic details what stops Claude Duet from going rogue
Anthropic has outlined the security and privacy protections behind Claude Duet, its proactive AI agent that can monitor connected accounts and complete tasks while users are away. The safeguards include approval requirements, checks for sensitive information and infrastructure that keeps credentials outside the model’s reach.

Kali Linux 2026.3 ships kernel 7.1.5, brings wardriving to the TicWatch Pro 3
The Kali Linux team released version 2026.3 after overhauling the public build scripts it uses to produce every official image. The refreshed scripts share the same features, command-line arguments and, where possible, the same layout, so a pipeline written against an older script may need edits.

GPT-6.1 Terra meets OpenAI’s Critical cyber threshold, and it’s cheaper than GPT-5.6 Terra
OpenAI released GPT-6.1 Terra, a model that operates desktop software, to all Plus, Pro, Enterprise, and Edu users in ChatGPT Work and Codex, and to developers through its API as gpt-6.1-terra. API prices are 50 percent below those of GPT-5.6 Terra and GPT-6.1 Sol: $1 per million input tokens, $0.05 per million cached input tokens, and $5 per million output tokens. Tokens are the chunks of text a model reads and writes.

71% of vulnerability exploitation starts within a week of disclosure
Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape Report. The company reported an average of three days between public disclosure and exploitation of high-severity vulnerabilities, with 71% of tracked exploitation occurring within the first week.

Amutable Foundations is a Linux system with no SSH and no package manager
Amutable opened signups for the private preview of Amutable Foundations, a Linux system in which each machine sends a signed report of the software and configuration it runs, drawing on local hardware to make the report easier to verify. The company says its engineers write and maintain code in the kernel, in systemd and in image-building tools.

CISA lays out plan to push cyber adversaries out of US critical infrastructure
The Cybersecurity and Infrastructure Security Agency (CISA) has released CISA 2030: Defend, Harden, Prevail, a strategy to strengthen national security and the resilience of critical infrastructure. It addresses intersecting cyber, physical, and geopolitical threats that can disrupt essential services.

Breach victims discover their data was held by companies they’ve never heard of
Nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier, according to its Data Breach Outlook 2026. Businesses rely on outside providers to store information, process transactions and operate software. A breach at one of those providers can expose customer records across multiple organizations, including people who have never heard of the company holding their data.

NIST starts the countdown to retire quantum-vulnerable encryption
The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive federal systems. The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), explains which cryptographic methods need to be replaced, what organizations should consider and how the transition will unfold.

AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records
AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklist, or DNSBL, is a list that mail servers and other services consult when deciding whether to trust an address.

Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator
A Ukrainian national who participated in ransomware attacks targeting hospitals, government entities, law firms, and other businesses was sentenced to five years and 10 months in prison. Artem Stryzhak, 36, pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.

Upwind secures $400 million to protect AI across endpoints, code, and cloud
Upwind Security has raised $400 million in Series C funding to expand its cloud and AI security platform, bringing the company’s total funding to more than $800 million.

Shame and sleepless nights haunt scam victims long after the money is gone
Scams and identity theft hurt people in different ways, and recovering involves much more than getting money back, according to ITRC’s 2026 Consumer Impact Report. Scam victims often struggle with shame and self-blame, while identity theft victims can spend weeks of personal effort trying to repair the damage.

Ubuntu Core Desktop returns as Canonical’s plan for an immutable default desktop
Canonical has restarted work on Ubuntu Core Desktop, the immutable and attestable version of Ubuntu that the company says will over time become the default Ubuntu desktop. Jon Seager, Canonical’s VP of engineering, laid out the plan and admitted that the 2023 developer preview “fell short” of what the company had in mind.

Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws
Google’s Gemini 4 Carbon is a frontier AI model designed for software engineering and cybersecurity tasks, with safeguards built on those of its predecessor, Argon. Google says its teams have seen Carbon spend days investigating and fixing bugs across large codebases and low-level systems. The model was also trained to handle complex tasks and high-pressure situations.

Smart TVs can harbor unpatched security flaws and track what you watch
Smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices, according to Bitdefender’s 2026 IoT Security Landscape Report. The analysis covered approximately 10.4 million protected home routers between January and September.

Scammers rebuild fake shopping sites within hours of a takedown
One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026.

Open-weight AI model GLM-5.3 cheated its way to correct answers
Irregular evaluated Zhipu AI’s open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench, the company’s framework for measuring an LLM’s ability to plan and execute multistage attacks under realistic constraints.

Cybersecurity jobs available right now: October 27, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.


from Help Net Security https://ift.tt/DNPce5g