The Hacker News #1 Trusted Source for Cybersecurity News

From AI-generated images to restricted satellite data, the systems used to verify what’s real online are struggling to keep up. Asymmetric Security traces rogue OpenAI AI agent activity that probed government sites, accessed staging servers, and evaded sandbox limits. AI agents probing US and Canadian https://medicalcases.eu/10-top-cybersecurity-predictions-for-2019/ government sites made SQL injection attempts while seeking data, but investigators found no evidence of compromise.

Rey, whose real name is Saif ‌al-Din Khader, is said to have been brought into custody on September 29, 2026, and cooperating with the U.S. A suspected member of the ShinyHunters digital extortion group, who goes by the online alias “Rey,” has been allegedly detained by authorities in Jordan, Reuters reported , citing three people familiar with the matter. Customers can check if their NetScaler deployment meets the precondition by reviewing their configuration for entries matching the following – SAML SP – add authentication samlAction SAML IdP – add authentication samlIdPPro…

• Reports about supply chain compromises are still accepted, and reports filed before October 1 are not affected.
• OneTrust’s latest research shows that 86% of organizations had at least one AI-related incident last year, but only 27% slowed or paused their AI rollout.
• They email something from a personal account, then upload a file to a cloud drive, then plug in a USB stick two weeks later.
• For the past decade, cybersecurity has been built on assuming the breach.
• Revision 4 of NIST’s operational technology security guide is open for public comments until November 30.

A recent industry incident response report puts the global median dwell time at 14 days, up from 11 the year before, quietly reversing a run of steady improvement that had held for close to a decade. Most security teams know that dwell time matters. The explosion of privileged credentials and lack of adequate visibility or oversight can be attributed to growth, whether due to migration to the cloud, mergers and acquisition, the increased use of contractors, or simple organic business growth.

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

We are talking about fixing known problems, not judgment calls about unfamiliar risk. – AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Known as Rey, the suspect is reportedly helping the FBI identify and locate other members of the extortion group. More than 730 cyber breaches affected over 270 million Americans last year, costing an average of $10 million per breach. See how practitioners are securing, investigating, and deploying AI in the real world.

• There will be a spreadsheet of products and owners that somebody builds over a weekend, a notification template that goes to legal for review, probably a consultant on a two-week engagement.
• The Windows maker said an authenticated attacker can exploit this flaw to gain unauthorized access to other users’ mailboxes within the same organization and read email messages and attachments.
• Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software.
• According to new research from CrowdStrike, 80% of modern cyberattacks are identity-driven , leveraging compromised credentials.
• Over roughly two years, Yu has worked across hardware and cloud TEE deployments, privacy-preserving financial-data analysis, and private AI inference.
• Customers can check if their NetScaler deployment meets the precondition by reviewing their configuration for entries matching the following – SAML SP – add authentication samlAction SAML IdP – add authentication samlIdPPro…

“Some developers are using Full Disk Access in ways that could put users at risk, https://www.cs-coding.com/category/cybersecurity-information-security/ exposing everything on their systems—including files, mail, messages, and even browsing history – without users’ full knowledge and understanding,” Apple said in a post. Dell warns that a critical DSU flaw lets attackers run code as root. Skills, plugins, hooks, repository instructions, and MCP servers can influence what the agent reads, which tools it selects, what commands it runs, and where enterprise data is sent.

Huntress researchers highlighted a new ransomware variant, named Settra, and the post-compromise techniques used in two recent attacks Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling . The journey starts with detection, because organizations first need to understand what credentials exist, where they live, and what they can access. Atlassian’s cloud products affected by the flaw have already been patched, and cloud customers do not need to take any action. In some configurations, it may contain sensitive files, which raises the risk, according to Atlassian.

He is co-founder of Rena Labs , which develops infrastructure for confidential AI training and inference using trusted execution environments (TEEs), hardware-isolated environments designed to limit the surrounding host’s access while code and data are processed. But AI systems https://allzone.eu/cybersecurity-poses-big-challenges-but-new-cloud-approaches-hold-promise/ now connect to more data, applications, and business processes, and they often act with less human oversight. ISO helps set up the right processes, ownership, controls, and risk methods for an organization.

The agents are said to have been testing edits in ” sandbox … “The unauthorized bot activities included edits to our wikis, some unsuccessful attempts to exploit a public note-taking tool we host, and heavy traffic,” the Foundation said in a post. Until then, Apache OpenOffice users can block the attack by turning off Java in the program’s settings, or by… Chrome users were caught off guard by a 4-GB Google AI model baked into Chrome, sparking privacy concerns. As dozens of cities end contracts for its controversial license plate readers, Flock is rolling out a voluntary severance program, WIRED has learned. Your conversations with AI chatbots are both highly personal and deeply vulnerable to surveillance.