THEMETASEC

Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims

Named “Volta-Autodoxer,” the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.

Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities. The post Syrian Hacker Gets Prison Time in US After Over a Decade on the Run appeared first on SecurityWeek.

Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539

Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical security flaw, tracked as CVE-2026-118539, in its Commerce Core module. The vulnerability is caused by missing authorization checks. “This module enables you to sell goods and […]

TThe Hacker News Vuln

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a

TThe Hacker News Vuln

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed. The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.

TThe Hacker News General

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

Threat actors are launching about 8,226 network-layer distributed denial-of-service (DDoS) attacks per hour, Cloudflare revealed Thursday. The web infrastructure and security company said it autonomously mitigated 18.2 million network-layer (L3) DDoS attacks and 14.4 trillion HTTP DDoS requests in the third quarter of 2026. That amounts to 197,400 attacks per day, or one attack every 0.44

Choosing a WAAP in 2026: 3 questions that separate the shortlist

One platform or four Your WAF renewal is coming up. The API team has its own tooling in mind, the fraud team wants a bot product, and someone in networking owns DDoS. Four controls, four consoles, four sets of policies in front of the same applications. That is the situation a Web Application and API Protection platform, or WAAP, exists to replace: one service in front of the application portfolio that handles the WAF, API security, bot management, DDoS, and client-side script protection together. The category is settled. What changed in 2026 is the evidence. Buyers now have certified test data that measures how well these platforms stop attacks and how often they stop legitimate traffic by mistake, and the two numbers together tell you more than any feature list. What the test data shows The SecureIQLab Cloud WAAP v5.0 validation, an AMTSO-certified test published in August 2026, ran 12 enterprise platforms through 1,608 attack scenarios and 1,487 legitimate-traffic scenarios. Complete Security Scores ran from a perfect 100% for the top product down to roughly 61% for the weakest. The spread inside a typical shortlist is that wide, and a shortlist drawn up in 2023 or 2024 may no longer describe the products on it. The second number matters as much as the first. A platform that blocks every attack and also blocks legitimate requests cannot stay in blocking mode for long, and false positive avoidance varied almost as widely across the same twelve products. Those percentage points become alerts, tuning hours, and exceptions your team carries every day. 3 questions for every vendor on the list Ask for API coverage protocol by protocol. REST is one protocol among several in a modern estate; GraphQL, SOAP, WebSockets, and gRPC all carry production traffic, and the v5.0 results showed coverage varying widely by protocol inside a single product, with WebSockets the weakest area across the group. A headline API score hides that. Ask how long it takes to reach a tuned, low false-positive state on your traffic, and measure it over two full weeks of real traffic during the proof of value. Time to protection and tuning effort are the costs you pay after the contract is signed. Ask how the deployment and licensing model behaves as the portfolio grows. Each delivery model, SaaS, native in-cloud, or reverse proxy, has its own latency and onboarding profile, and each licensing unit, request, bandwidth, or application, bends the cost curve differently as traffic grows. Model 24 to 36 months of growth with each vendor, starting from your own traffic baseline. Where Imperva fits Imperva, part of Thales, delivers Cloud WAF, Advanced Bot Protection, API Security, DDoS Protection, and Client-Side Protection as one platform, with one policy model and one set of analytics across all of them, deployable as SaaS, on your own infrastructure, or natively inside the public cloud. In the SecureIQLab v5.0 cycle, Imperva was the only vendor of the twelve tested to record a perfect 100% Complete Security Score, and it paired that with a 100% false positive avoidance score, the lab’s measure of legitimate traffic passed untouched. It was Imperva’s fifth consecutive Leader-category placement in the series, and the lab awarded it the Secure by Default rating in the same cycle. Forrester named Imperva a Leader in The Forrester Wave™: Web Application Firewall Solutions, Q1 2025. An honest aside: no one platform suits every environment. If your dominant requirement is a developer-centric edge platform or raw DDoS scrubbing capacity above everything else, weigh those needs explicitly, and validate any shortlist, Imperva included, against your own traffic in a proof of value. The full comparison The complete buyer’s guide on the Imperva blog compares seven WAAP vendors on security efficacy, API protection, bot defense, operational efficiency, and cost, with analyst standing and verified peer ratings for each, and ends with a proof-of-value checklist you can take into your next evaluation. Read Best WAAP Solutions for Enterprise Application Security: How to Choose the Right Platform in 2026 before you renew anything. Then go back to the four consoles and decide how many you still need.

AI-generated code security shows first significant improvement in a year

According to Tech Radar, security in code generated by frontier artificial intelligence models has improved for the first time in a year, with vulnerability rates decreasing from 44% to 38%.

Anthropic files for initial public offering amid broader tech market volatility

Coverage from Silicon Angle indicates that Anthropic has officially filed paperwork for an initial public offering, marking a significant moment for the artificial intelligence industry.

Sophisticated malware targets government-specific windows systems in Asia

As noted by The Record, suspected nation-state hackers have developed sophisticated malware designed to target a customized version of Windows used by government agencies in Asia.

GCHQ faces scrutiny over lost storage drives and data handling failures

The Government Communications Headquarters is facing significant criticism after an annual report revealed that thousands of storage drives containing sensitive information have been lost for years, with further coverage provided by The Register.

Organizations face security risks from excessive AI autonomy

As reported by Tech Radar, businesses are increasingly delegating critical security decisions to artificial intelligence, creating significant vulnerabilities due to a lack of oversight and control.

Moldova investigates massive cyberattack on national identity infrastructure

As reported by Biometric Update, a significant cyberattack on the digital government infrastructure of Moldova has resulted in the exposure of personal data linked to approximately 750,000 national identification numbers.

Fake cryptocurrency trading app steals funds from Solana wallets

A malicious application named Padre Terminal, which previously appeared on the Apple App Store, was identified as a cryptocurrency drainer responsible for stealing approximately $23,000 from 27 Solana wallets, according to a recent report by Bleeping Computer.

“Black October” for AI Developer Platforms

A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale.

Linux security advisory (AV26-1108)

China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days

Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. The post China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days appeared first on CyberScoop.

Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries

Yoba malware uses fake ChatGPT and Claude apps to sideload malware through signed installers and deploy a cryptocurrency miner. Check Point Research has spent two months tracking a campaign it calls Yoba, which uses the popularity of AI tools to spread a custom malware chain. The attackers build fake GitHub projects that pose as AI […]

Anthropic VS code extension on Cursor backdoored for nearly 12 hours

It's still unknown how attackers got access to Anthropic's verified Cursor account.

SSchneier on Security Policy

Friday Squid Blogging: Bigfin Squid Off California Coast

Neat video: The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Mrfoofoo, Binance, Polymarket, Silent Train, robosurance, privacy, and Josh Marpet - SWN #629

TThe Record Breach

DOJ raises privacy concerns over potential sale of Character.AI chats

The DOJ’s Executive Office for U.S. Trustees said a consumer privacy ombudsman is needed to advise the court on how to regulate what data from Character.AI can be sold and under what terms.

A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines.

U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 is a critical security flaw that could let attackers run code on […]

DDark Reading General

Devs Hit by Trojanized Claude Code Extension for Cursor

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

Identifying election domain threats before they become attacks

Election domain research highlights impersonation risks and the need to distinguish threats from false alarms.

DDark Reading Policy

Behind the Scenes of How Operation Blackout Went Down

A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.

Drupal Commerce Core access bypass flaw exploited in attacks

Attackers exploit critical Drupal Commerce Core flaw to bypass access controls and manipulate orders.

TThe Record Breach

Fashion retailer Resolve says hackers stole payment card information

The company, billing itself as “the next-generation fashion retailer for Millennial and Generation Z consumers,” said a recent hack exposed customer payment card numbers.

$6.3 Billion Stolen from Binance in Attack Attributed to North Korea

Binance links a $6.3 billion crypto theft to a compromised DevOps laptop, with North Korean hackers blamed by blockchain analysts. Binance was investigating suspicious transfers that early estimates put at up to $5.8 billion. A day later, multiple media outlets reported that the largest cryptocurrency exchange had linked the theft of about $6.3 billion to […]

Why identity governance demands executive attention

The identity landscape you’re responsible for looks nothing like it did just a few years ago. Employees and contractors now share the enterprise with service accounts, machine identities, and a fast-growing population of AI agents — all accessing business systems and data. Every one of those identities represents an access decision, and every access decision is now a potential point of accountability that lands on your desk. Regulators and boards want proof. They expect security leaders to show who, or what, has access to critical systems and how that access is being governed. But when human and nonhuman identities (NHIs) change faster than manual processes can keep up, proof becomes much harder to produce. Foundry research ranks identity security among the top cybersecurity priorities for 2026, reflecting a shift in how leadership views risk: Identity has evolved from operational detail to executive concern. “The last 15 years of digital transformation has resulted in credential sprawl across the tech stack of every organization,” says Bryan Kelley, AVP, Agentic Technology Specialists at SailPoint. “Whether it’s your own trusted agents or another organization’s rogue agent, they will find and abuse these exposed credentials, API keys, tokens, and secrets to carry out their given goals.” When accountability becomes personalSecurity leaders must demonstrate that identity governance is working, not simply that policies exist. They need a real-time view of each identity and the permissions it holds as business needs change. Leaders can also face personal and professional consequences when a breach or a compliance failure occurs. Boards and regulators may expect the C-suite to show that appropriate controls and oversight were in place at the time. AI agents add to that exposure as they gain access to enterprise resources and take on more autonomous roles. This is why NHIs need the same rigor, visibility, and controls as human identities. The shift to continuous compliance Quarterly or annual access reviews capture a moment in time, but it’s all the other moments in between that present a problem. Between reviews, employees can change roles, contractors can leave, and new identities such as AI agents can gain access. Security teams may not catch outdated permissions or active orphaned accounts until the next review. When identity data lives in separate systems, security teams struggle even more to maintain a current view of access across the enterprise. Continuous identity security makes oversight part of daily operations. Rather than waiting for the next review, an identity governance platform can help validate access as conditions change, automating low-risk approvals and flagging higher-risk access for review. Governance activity also creates an ongoing record of how access was approved and whether policies were applied consistently, so teams don’t have to reconstruct that history when auditors or regulators ask for evidence. Building an adaptive identity security programA continuous approach is made up of three core capabilities. First, organizations need to discover and unify identities to create a centralized view of access. Second, lifecycle management, policy enforcement, and access validation become always-on activities rather than periodic projects. Finally, organizations need to maintain evidence of governance activity so they can demonstrate compliance and respond when issues arise. This approach helps security leaders keep up with constant identity changes while meeting rising expectations for accountability. Learn how continuous identity security can help strengthen oversight and audit readiness.

Apple notifications alert victims in 99 countries about mercenary spyware infections

The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. The post Apple notifications alert victims in 99 countries about mercenary spyware infections appeared first on CyberScoop.

TThe Hacker News General

Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide

Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously. The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in

California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment

Los Angeles County officials told CyberScoop they received multiple grand jury subpoenas investigating alleged election fraud. States and civil groups call it a federal power play. The post California officials confirm grand jury subpoenas as states, civil groups brace to protect elections from federal encroachment appeared first on CyberScoop.

TThe Record Breach

Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach

The state’s Department of Education (FLDOE) said on Thursday it became aware of a data breach involving the Florida Student Financial Aid website on October 19.

MongoDB security advisory (AV26-1107)

New Framework Puts Ransomware Resilience for AI Systems in Focus

RAID-AI aims to help organizations assess their security preparation for ransomware attacks targeting AI systems

HashiCorp security advisory (AV26-1106)

Drupal security advisory (AV26-1105)

DDark Reading Vuln

L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.

Cloud incident response: what changes when you do not own the host

SSchneier on Security Malware

Bloatware in Aftermarket Auto Parts

This story is interesting: One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about. Among the pre-installed bloatware—­or spyware, if you’re being less charitable­—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so your passenger can entertain themselves with PDFs on the go...

TThe Hacker News Breach

TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them

TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host. A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depending on the platform, may also run

Defense contractor pleads guilty to aiding North Korean remote worker scheme

The 62-year-old allowed co-conspirators to use his identity and top secret security clearance to apply for almost 100 jobs last year. The scheme’s success rate was limited. The post Defense contractor pleads guilty to aiding North Korean remote worker scheme appeared first on CyberScoop.

CAASM and CMDB: two inventories that answer different questions

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week. The post PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress appeared first on SecurityWeek.

Measuring asset coverage across security tools

This month in security with Tony Anscombe – October 2026 edition

The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans

Operationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit

Key Takeaways CISA AA26-194A provides actionable guidance to improve the security of Internet-facing Cisco routers against real-world attack techniques. The advisory focuses on configuration hardening and security hygiene, rather than a single vulnerability or CVE. Manually validating advisory recommendations across enterprise networks is difficult, time-consuming, and prone to inconsistencies. Qualys Policy Audit transforms advisory guidance […]

Centralized or federated cloud security: who owns the decision

In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak

Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware. The post In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak appeared first on SecurityWeek.

A clean code review does not mean a safe runtime

Here are four ways to make exploitation harder and more expensive for attackers.

A data subject request is a discovery capability test

Syrian hacker who served Assad regime gets 42 months in US prison

Ahmad Umar Agha is best known for posting a fake Associated Press tweet claiming President Obama was injured in a White House bombing. The post Syrian hacker who served Assad regime gets 42 months in US prison appeared first on CyberScoop.

TThe Record Breach

Syrian Electronic Army hacker gets prison time for attacks on Western targets

Ahmad Umar Agha, known online as “Th3Pr0,” was sentenced Thursday in federal court in Virginia to 42 months behind bars for his role in a conspiracy that was organized by former Syrian President Bashar al-Assad's closest advisers.

Japan Airlines data breach exposes 92,000 customer records

DDark Reading Vuln

Undead Software Projects Continue to Raise Security Risks

A security firm patched a decade-old app to prevent the takeover of millions of machines, highlighting that abandoned domains remain a boon to attackers.