Искажение света поможет телескопу имени Нэнси Грейс Роман искать скрытую массу во Вселенной.

Даже многомиллиардные фабрики оказались уязвимы перед ограничениями на поставки сравнительно простых компонентов.

Аппарат постепенно сократил дистанцию с сотен километров до нескольких сотен метров.

Военные экспериментируют с программными атаками, которые позволяют нарушать определённые соединения, не заглушая весь частотный диапазон.

Новое ведомство готовит кибератаки, подмену компонентов и другие тайные сценарии.

Вебинар состоится 27 октября, 14:00.

США делают ставку на дальнобойную ПВО.

83,2% против 36,1% в пользу системы Microsoft.

Злоумышленники спрятали канал связи там, где обнаружить управляющий сервер особенно сложно.

Набор планируют открыть уже в январе 2027 года.

Даже официальные гарантии разработчика не смогли развеять главные опасения.

Один позитрон против целой установки.

Теперь даже привычный переход по ссылке может закончиться неожиданным предупреждением.

Наглядная архитектура ИИ-агентаГотовые ИИ-агенты и ассистенты от российских разработчиковЧат-бот, который просто отвечает на вопросы, уже почти ушёл в прошлое.

Чтобы отличить ИИ-агента от обычного ИИ-ассистента и копилота, лучше всего оценивать уровень автономности, способность к планированию и степень участия человека:ИИ‑ассистент.

Крупные российские компании уже запустили продвинутых ИИ-агентов для собственных нужд.

Компания может проверить, какие данные и сервисы использовал агент при выполнении поручения и на чём основан результат.

Она позволяет создавать автономных ИИ-агентов и автоматизировать бизнес-процессы, поддерживая как российские модели YandexGPT и GigaChat, так и зарубежные LL…

подозрений на киберинциденты, что в свою очередь уже на 40% больше, чем в прошлом году.

Например, во время сбоя в работе СДЭК в мае 2024 года хакерская группировка Head Mare публично заявила о взломе инфраструктуры компании и разместила скриншоты в подтверждение своих слов.

В результате вопросы возникли не только к надёжности сервиса, но и к тому, насколько точно компания описывает происходящее.

Тему подхватили СМИ, что в итоге сформировало негативное инфополе вокруг бренда.

После кибератаки у ритейлера возникли сбои в работе сайта, приложения и оборудования в магазинах, очереди на кассах и путаница с ценами.

Денис Солоничкин отметил, что начались реальные внедрения: операционные системы больше не покупают «в стол», это видно по нагрузке на техподдержку и по продажам.

Для этого нужно провести внутренний аудит систем и софта, проверить ПО на предмет того, кросс-платформенное ли оно, и запланировать миграцию.

Денис Солоничкин пояснил, что РЕД СОФТ занимается общесистемным и инфраструктурным ПО и не идёт в те классы продуктов, где уже есть большое количество партнёров.

Инновации: агентские ОС и локальные моделиАнтон Пальгунов отметил движение в сторону веба и ИИ: пользователи всё чаще начинают с ИИ-ассистента, а не с поиска в браузере.

Одни считают, что зависимость неизбежна в любом варианте и важн…

Разбираемся, чем агент отличается от чат-бота и автоматизации, как его применяют в разработке и администрировании и какие риски возникают при доступе к корпоративным системам.

Он описывает, как агенты разных систем находят друг друга, обмениваются задачами и результатами и обрабатывают ошибки.

Поэтому к взаимодействию между агентами применяют те же принципы, что и к работе с инструментами: минимальные права, проверку входных и выходных данных, журналирование.

Как агенты меняют разработку ПОПри наличии разрешений агент работает с репозиторием, инструментами сборки и тестирования, закрывая многоэтапные задачи целиком.

При этом результат работы агента нужно проверять не только на ошибки, но и …

Наталья Глинина отметила, что стратегия должна отвечать на вопрос, с какими бизнес-рисками работает компания, и обязательно связывать цели ИБ с целями бизнеса.

Евгений Акимов предложил смотреть на стратегию как на ожидание бизнеса от кибербезопасности: если бизнес ничего не ждёт, стратегия не нужна.

Евгений Акимов:«Прежде чем писать стратегию, нужно разобраться с целями бизнеса, а не с требованиями к кибербезопасности.

Елизавета Комарова:«Нужно учитывать, что угроза — это не то, что маячит на горизонте, а то, что происходит прямо сейчас.

Эксперты сошлись в том, что стратегия должна фокусироваться на критических процессах и их восстановлении, а не на перечне приобретаемых решений.

Аналогичные санкции предлагается применять и к тем, кто не выполнил классификацию своих объектов КИИ и не определил их значимость в соответствии с требованиями отечественного законодательства.

В таких условиях компании стали осторожнее подходить к крупным ИТ-проектам и внимательнее оценивать не только необходимость внедрения, но и его ожидаемый результат.

Проблема заключается не только в продолжительности обучения, но и в разрыве между академической подготовкой и практическими задачами бизнеса.

Выросли и требования к самим разработчикам: клиент обращает внимание на их опыт, компетенции и способность развивать и поддерживать решение.

Модели будут ошибаться всё реже, и в перспективе многие де…

Но бизнесу уже недостаточно арендовать серверы с GPU: нужны инструменты для работы с данными, надёжная инфраструктура и кадры.

Соответственно, аналитики планируют для облачных сервисов, ориентированных на ИИ, более высокие темпы роста на период 2026–2030 гг.

Прогноз динамики рынка публичных облачных сервисов для ИИ на 2026–2030 гг.

Наиболее востребованные облачные сервисы для ИИ по итогам 2025 годаТакже уже без малого четверть, точнее, 24% компаний уже используют ИИ в облаке.

И в целом ИИ без качественных данных в достаточном объёме рискует выдавать только галлюцинации, а не помогать решать задачи бизнеса.

Антон Банчуков добавил, что портфельный подход — это то, с чем сталкивается практически весь крупный бизнес, и в этом нет ничего удивительного.

В результате серверы Lenovo на этих картах до сих пор не работают с VMware и не могут использоваться.

Миграция: сроки и сложностиАнтон Банчуков отметил, что планирование и дизайн не позволяют выявить все сложности инфраструктуры.

Обеспечение катастрофоустойчивости и непрерывности бизнесаДмитрий Лазаренко отметил, что бизнес нужно убедить инвестировать в катастрофоустойчивость, и на этом лучше не экономить.

Прогнозы: новая роль ИТ и FinOpsМихаил Соловьёв:«Управление эффективностью и стоимостью мультиоблака — важный вопрос, мы решаем его несколько лет.

Затем пришёл ИИ и всю эту систему убил.

Машина быстрее, дешевле и не требует нескольких лет, чтобы дорасти до уровня мидла.

Если один разработчик благодаря ИИ способен делать больше, компании уже не обязательно наращивать команду прежними темпами.

Очень скоро проблема будет уже не в скорости этого станка, а в том, что остальные участки за ним не успевают.

Но новое поколение «бабочек», похоже, будет заниматься уже не столько созданием цифрового мира, сколько контролем за его созданием.

Эксперты рынка в двух частях эфира AM Live обсудили, как контролировать теневой ИИ, чем опасны агенты, что меняется в DevSecOps и как начать обеспечение безопасности.

Илья Самофеев, исполнительный директор, red_mad_robotВ первом опросе зрители ответили, насколько они контролируют использование ИИ в компании:Практически не контролируют использование ИИ — 43%.

Если компания получает трафик от пользователя к внешнему сервису, нужно перехватить его, проанализировать, что отправляется, и в идеале заблокировать и подменить ответ модели.

Отдельно отмечу интернет вещей: IoT сам по себе небезопасен, а с добавлением моделей машинного обучения на устройствах возникает комбинированная атака — и на моде…

Причиной этому — стремительное распространение интернета вещей и приложений, требующих обработки данных в настоящем времени, увеличение числа подключённых устройств и лавинообразно растущий объём генерируемых данных.

Edge Computing и Edge AI: термины и техническая сутьЧтобы показать различие подходов Edge Computing и Cloud Computing, рассмотрим уровни архитектуры.

Например, камера видеонаблюдения — это устройство Edge Computing, а если она с помощью компьютерного зрения распознаёт номер машины — это уже Edge AI.

Помимо перечисленных направлений, граничные вычисления находят применение и в других сферах, где важны низкая задержка и локальная обработка данных:Здравоохранение.

Имеются в виду т…

WAF Dallas Lock объединяет функции межсетевого экрана и системы обнаружения вторжений для веб-приложений, сайтов и других веб-ресурсов.

Типовая схема использования WAF Dallas LockСетевые интерфейсы WAF Dallas Lock отнесены к различным «зонам» (LAN, WAN, DMZ), за каждой из которых закреплён соответствующий профиль межсетевого экрана.

Обновлённое меню вкладки «Списки доступа»Управление через ЕЦУ Dallas LockДля реализации централизованного управления WAF Dallas Lock необходимо использовать Единый центр управления Dallas Lock (ЕЦУ Dallas Lock), управление которым осуществляется отдельным приложением «Консоль ЕЦУ».

Лицензирование WAF Dallas Lock 3.1Ранее WAF Dallas Lock поставлялся только со сро…

В итоге, как подчеркнул Илья Башкиров, юридическая защита является последним рубежом в том случае, когда инцидент уже произошёл.

В частности, «Промтрансбанк» взыскал штраф за утечку данных с аутсорсингового оператора «Экспресс лаб» ещё в 2023 году.

Плюс ко всему, как напомнила Анастасия Петрова, их могут привлечь и как должностных лиц, для которых размер штрафа существенно выше.

Чаще всего несанкционированное вмешательство проводилось в информационных системах операторов связи (для завышения показателей продаж) и в медицинские информационные системы (для оформления подложных документов).

В 12 % случаев встречались копирование данных и «пробив», в 10 % — воздействие на установленное ПО или в…

Разбираемся в том, какую телеметрию собирает EDR, как выявлять мисконфигурации и уязвимости и где нужны другие средства защиты.

По данным BI.ZONE SOC, в 73% компаний разрешён запуск опасных утилит через sudo, а в 88% возможен SSH-доступ по паролю, включая root.

От контейнера к контролю над кластеромСледующий шаг — побег из контейнера.

Ноды кластеров и CI/CD-серверы изначально относятся к высоконагруженным системам, и в них заметен даже стандартный объём мониторинга.

Одна и та же уязвимость в контейнере с избыточными привилегиями открывает дорогу к побегу на хост, а в изолированном остаётся малозначимой.

Такой опыт позволил последовательно развивать продукт и накапливать экспертизу не в отдельных технологиях, а в самой функции защиты сетевого трафика.

Функциональные возможности «ЗАСТАВЫ 9»«ЗАСТАВА 9» обеспечивает комплексную защиту устройств пользователей, сетей и каналов связи от внутренних и внешних угроз.

Расположение элементов также оптимизировали для экранов с небольшим разрешением: они не перекрывают друг друга и остаются удобными для работы.

Веб-интерфейс «ЗАСТАВЫ-Офис»Возможности управления системой через веб-браузер, доступные в восьмой версии, сохранились и в девятой.

Главное окно ключевого центраСравнение возможностей девятой и восьмой версийВендор развивает поддержку протоколов …

Конфигурации ELK в статье упрощены (в Logstash используется учётная запись elastic ) и подходят только для лаборатории.

Проверка DNS:ping 192.168.100.10 nslookup corp.lab nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.labВремя на ПК и на DC не должно отличаться больше чем на 5 минут (требование Kerberos).

Winlogbeat на DC и Windows 78.1.

ВерсияWinlogbeat Windows 7 Комментарий 7.17.x ✅ Используем на DC и Windows 7 8.x и новее ❌ Не запускается на Windows 7Скачайте winlogbeat-7.17.x-windows-x86_ 64.zip (для 32-разрядной Windows 7 вариант x86 ) и распакуйте в C:\Program Files\Winlogbeat .

Включить безопасность Elastic по‑настоящему: отдельный пользователь для Logstash, TLS между компонентами, убр…

Если сопоставить их аргументы с техническим отчётом самой Carbon-X , хорошо видно, во что упёрлась цензура в закрытых LLM и как она изменит науку, разработку и рынок ИИ в ближайшие годы.

В том же треде @ReignSwords и @DimmensCK спрашивали про публикацию пяти профильных ДНК-бенчмарков, а @jatingargiitk уточнял, как именно считался заявленный разрыв в стоимости инференса в 1800 раз между Carbon-X и закрытой GPT-6.1 Sol .

Как написал в обсуждении @andrey15780801 (Andrey Shub, PIRAXIS): «Поверхностные барьеры останавливают честного исследователя, а не злоумышленника.

Миграция чувствительной разработки и науки в локальный контурЧетвёртое последствие напрямую касается того, как мы строим инженерн…

Ниже — разбор, почему зелёный CI перестал быть доказательством, из чего состоит harness, где он ломается и что проверять в первую очередь.

Verification debt накапливается не в момент генерации, а в момент merge: команда принимает изменение, которое не может уверенно проверить.

Команда пишет большой файл правил, считает, что harness готов, а на деле правила не исполняются.

Это не «модель глупая», это failure mode длинного горизонта: среда не удерживает состояние и не проверяет согласованность.

Если вы не можете воспроизвести сессию, вы не можете утверждать, что улучшили harness, а не подкрутили условия.

Звучит, может, и не впечатляюще.

Использование понятия "степени свободы" в качестве количественного определения понятий "пользы" и "вреда" является объективным и не зависящим от трактовок.

И что на них можно обкатать ситуации с использованием такого определения.

Оказывается, "мораль" - это не что-то эфимерное, данное свыше и, даже, не закон существования социума.

И это приложение будет работать фильтром, который из полученных вариантов поведения первого уровня, будет выбирать те, которые на самом деле сохраняют принцип.

Всё произошло очень быстро: какая‑то ностальгическая статья про сборники Classic Fond — и вот я уже качаю образы «Лучшие игры для IBM PC» с Internet Archive.

Неочевидно, что авторы задумывали такой вектор атаки — файл AUTORS.ZIP с первого диска «Лучшие игры для IBM PC #1» датирован 22 августа 1994 года, а статья Бихама и Кохера вышла лишь в начале 1995 года.

Удивительно, но в интернете очень мало информации о том, кто делал эти выпуски, да и о Classic Fond вообще.

Я тогда делал сборник «Лучшие игры для IBM PC», все игры посмотрел до 2000-го года.

Даже с учётом того, что bkcrack использует обратимость отдельных операций шифра и не перебирает каждый пароль целиком, пространство поиска огромно…

Я как исследователь буду стараться придерживаться нейтральной позиции и не буду от себя ничего выдумывать или подтверждать информацию.

]io часть из них уже захвачены правоохранительными органами и не доступны, а вторая часть доживает свое.

Узнавайте информацию с помощью моих статей.

Все таки проект является теневой экономикой и не будет так просто раскрывать свое местоположение.

Сам Quake3 перестал заходить на форум 10 октября 2026 года.

21 октября были раскрыты две критические уязвимости PHP — CVE-2026-109618 и CVE-2026-109619, обе с CVSS 9.2.

CVE связаны с тем, что PHP может ошибочно считать новый массив данных, который еще не успел проинициализироваться из-за ошибки OOM, проинициализированным.

Как именно происходит эксплуатацияПоскольку источник уязвимости находится глубоко и связан с механизмами освобождения и выделения памяти в PHP, способов ее эксплуатации несколько.

Формы x-www-form-urlencoded Объем выделяемой памяти в процессе PHP здесь достигается за счет большой глубины вложенности параметров формы (...[x]) .

Разместив поддельный массив в нужной области памяти и подставив в него адрес функции, атакующий может заст…

Но выбирать между PSLC и Agent-Ops, на мой взгляд, незачем.

Покажу это на примере и расскажу, что сравнение подсказало для развития Agent-Ops.

В PSLC этому соответствуют две петли: исполнение сервиса и работа над надёжностью и доверием.

Области пересекаются: в PSLC тоже есть требования к контролю действий.

Использование PSLC рядом с Agent-Ops не отменяет этого требования.

Именно SHA-2 и SHA-3 сейчас являются самыми популярными и широко используемыми примитивами, которые используются для реализации безопасных протоколов и других криптографических примитивов.

В SHA-2 используется метод Дэвиса-Майера, который основывается на блочных шифрах (шифрует такой шифр блоками фиксированного размера на входе и выходе).

SHA-2 является структурой Меркла-Дамгарда, то есть это алгоритм, который хеширует сообщение путем итеративного вызова функции сжатия.

SHA-3 удовлетворяет всем трём свойствам безопасности и имеет точно такие же различные версии по длине выхода, как и SHA-2.

Начальное состояние губки имеет размер 1600 бит и в зависимости от разных версий имеет разные размеры…

На этот раз речь пойдёт о человеке, который все эти дни защищал сервис в комментариях к нашим статьям.

Профиль syntaxcheck на ХабреНа Kwork есть аккаунт с тем же ником syntaxcheck, зарегистрированный в ноябре 2025 года.

Профиль syntaxcheck на KworkАрхивные копии профилей: Хабр @syntaxcheck , Kwork https://web.archive.org/web/20261023135857/https://kwork.ru/user/syntaxcheckЧто syntaxcheck заказывал в мартеВсе новые заказы с Kwork дублируются в открытый Telegram-канал биржи (t.me/kwork_market) с ником автора.

Напомним, основателя Aroshka в блоге сервиса зовут Араик, и в его интервью много говорится о кибербезопасности.

Аккаунт, на чей сайт он ссылается в профиле, подписан именем основателя Ar…

Ссылка не отцепилась, агент этого не заметил, и git worktree remove на пару минут опустошил node_modules основного проекта.

Им пользуется только агент.

Любой новый открытый порт найдут сканеры, даже если сам ИИ им так и не воспользуется.

Резервные копии там, куда агент не дотянется: другой пользователь, другой хост или хранилище только на дозапись.

Открытая версия работает локально и без аккаунта, но только для одного компьютера и для настольных ИИ-клиентов.

Сегодня мы загрузим в MPVM IP-план Организации, создадим задачи по сканированию Пентестом и затронем задачи по Аудиту.

Хоть это и не Ваша работа искать истинные причины неработоспособности, но надо это только Вам (если не хотите остаться крайним).

И создана статическая группа в MPVM, в которую мы перенесем полученный IP-план.

Пример для профиля:Пример для группы:HD = "13c32aa6-3a82-4e10-b709-941f39838aae" # id профиля HostDiscovery в MPVM Pentest = "b203b724-bc55-47d1-91d8-afbae230b19d" # id профиля Pentest в MPVM parentId = "1ed8aa9c-56c0-0001-0000-000000000006" # id корневой статической группы в MPVM.

Нужен для наименования "scanprofile": Pentest, # id профиля в задачи сканирования }, ], …

Мы сосредоточимся на обновлении работающего сервера: что проверить до установки патча, как обновить PHP через ispmanager или пакетный менеджер Linux и убедиться, что исправленная версия действительно обслуживает сайт.

Если обновление затрагивает только патч-релиз текущей поддерживаемой ветки, объем изменений обычно меньше, чем при переходе с PHP 7.4 на PHP 8.4.

Например, Ubuntu официально рекомендует обновлять пакеты PHP через apt, после чего перезапускать приложение, использующее обновленный интерпретатор.

Важно: WAF помогает блокировать известные способы эксплуатации уязвимостей, но не устраняет саму уязвимость в PHP, не исправляет ошибки в среде выполнения (runtime) и не защищает от всех…

Сегодня хочу поговорить про обратную сторону Луны систем EDR и обманчивое чувство безопасности, которое может зарождаться у заказчиков после покупки систем подобного класса.

Слепые зоны EDRФрейре начинает свой доклад с неудобного вопроса, ответ на который звучит как пощечина всей индустрии ИБ:«Полностью доверять своему EDR — это как спать с открытой дверью и называть это безопасностью».

По словам Фрейре, атакующие зачастую не «взламывают» EDR напрямую: они просто знают, куда не смотрит агент и как его обойти.

Пока это не так, главным остаются скиллы аналитиков, которые понимают принципы работы ОС и злоумышленников, а также инструменты и информацию о сети, которые вы им предоставляете.

EDR —…

В компании утверждают, что инцидент затронул лишь часть пользователей, однако рекомендуют всем сменить API-ключи и другие учетные данные, хранившиеся в переменных окружения.

Railway — облачная платформа для разработчиков, которая позволяет развертывать и запускать приложения, API, базы данных и другие бэкенд-сервисы без самостоятельной настройки инфраструктуры.

Платформа также хранит связанные с развертыванием настройки и секреты, в том числе API-ключи и учетные данные для доступа к базам данных и реестрам.

Как показало расследование, неизвестные лица могли получить доступ к зашифрованным данным пользователей, а в некоторых случаях и к их расшифрованному содержимому.

В компании подчеркивают…

В библиотеке RingRTC, которую мессенджер Signal использует для голосовых и видеозвонков, исправили критическую уязвимость.

Из-за бага звонок мог не завершиться корректно, в результате чего микрофон или камера устройства продолжали работать даже после попытки повесить трубку.

В частности, запрос на завершение звонка может «застрять» в очереди и не выполниться.

В RingRTC версии 2.72.0 разработчики изменили логику завершения звонка: теперь запрос на отключение обрабатывается независимо от основной очереди событий FSM.

Известно, что клиент Signal Desktop получил обновленную версию RingRTC 2.72.0 еще в сентябре, однако неясно, когда исправленная библиотека появилась в версиях мессенджера для And…

Подписка «Хакер Старт» стоит 1000 рублей в год и открывает доступ более чем к 800 статьям о пентесте, малвари, приватности, программировании и множестве других тем.

Среди них есть как вводные материалы, так и более серьезные статьи: можно освоить нужные инструменты, а затем постепенно переходить к более сложным задачам.

Каждый месяц «Хакер Старт» будет пополняться еще 1–3 новыми статьями.

«Хакер Старт» подойдет не только для новичков в области ИБ, но и для специалистов из смежных областей.

Сейчас в «Хакер Старт» входит более 800 статей, а каждый месяц к ним будут добавляться новые.

Все статьи, PDF-архив, скидки и другие бонусыНа SOC Forum 2026 во второй раз пройдет «КиберСтарт» — отдельная программа для молодых компаний и технологических проектов в сфере информационной безопасности.

В этом году в ней примут участие 17 стартапов против 14 годом ранее.

«КиберСтарт» пройдет 27–28 октября в рамках SOC Forum 2026 в московском кластере «Ломоносов».

Также запланированы дискуссии об инвестиционной привлекательности проектов, инструментах поддержки технологических компаний, защите облачной инфраструктуры, а также применении ИИ в кибербезопасности.

В номинации «Лучший рост за год» оценят проекты, которые участвовали в «КиберСтарте» в 2025 и вернулись в этом году, а номинация «Н…

Сначала агент правильно рассудил, что запрет на отправку сообщений касается только Slack и не распространяется на автоматические предупреждения от системы мониторинга.

В итоге Astra решила, что новый вариант программы должен полностью соответствовать этому примеру, и убрала мониторинг, несмотря на прямой запрет на его отключение.

При этом модель понимала, что мониторинг исчез: в своих рассуждениях модель прямо отметила, что новый код больше не запускает мониторинг агента, но сочла это допустимым изменением.

В OpenAI отмечают, что в обоих случаях агенты рассматривали вариант сохранения защиты, но в итоге интерпретировали обычные задачи по программированию как разрешение ее ослабить.

Отмечает…

Прокуратура китайского Тяньцзиня подала заявление о конфискации 61 896 BTC, изъятых у Цянь Чжимин в Великобритании, и местный суд согласился рассмотреть дело.

По версии китайского следствия, в 2014–2017 годах она привлекла от населения более 40 млрд юаней, а свыше 102 тыс.

В июле 2017 года Цянь бежала из Китая с компьютерами, на которых хранились биткоин-кошельки, и в итоге оказалась в Великобритании, где обменяла часть монет на другие активы.

В заявлении также перечислены наличные в долларах, евро и фунтах, ювелирные украшения, средства на банковских счетах и инвестиционные портфели.

Поскольку Цянь более года находится в розыске, дело подпадает под китайские правила, допускающие конфискаци…

Специалисты Amazon Threat Intelligence сообщили, что злоумышленники начали атаковать уязвимости PHP2Shell еще 17 октября 2026 года — за четыре дня до выхода патчей и публичного раскрытия информации о багах.

Напомним, под общим названием PHP2Shell скрываются две критические уязвимости, недавно исправленные в PHP (CVE-2026-109618 и CVE-2026-109619) и получившие по 9,2 балла по шкале CVSS.

Дело в том, что перед PHP2Shell уязвимы практически все версии PHP начиная с PHP 5.4, то есть проблема затрагивает PHP 5.4, 5.5 и 5.6, все версии PHP 7.x, PHP 8.0 и 8.1, а также PHP 8.2 до 8.2.35, PHP 8.3 до 8.3.36, PHP 8.4 до 8.4.27 и PHP 8.5 до 8.5.12.

Фактически уязвимые механизмы присутствовали в коде PH…

У подозреваемых изъяли активы на €21 млн (около $23,6 млн): наличные, средства на банковских счетах, криптовалюту, яхты, ювелирные украшения и дорогие часы.

Трое были задержаны за границей: двое — в Испании, один — в Швейцарии.

Двое из них давно связаны с кланами ндрангеты из Кротоне и ранее уже были осуждены по другим делам, связанным с мафией.

Еще в 2021 году Антимафиозное следственное управление Италии (DIA) заявило, что все преступные организации, включая мафиозные, заинтересованы в использовании таких инструментов.

По оценке ведомства, «Ндрангета», самый влиятельный преступный синдикат страны, все активнее осваивает современные средства, в том числе криптовалюты и даркнет.

В общей сложности вредоносные файлы находились на GitHub около полутора часов (с 12:47 до 14:21 UTC), но исходный код OVHcloud CLI, теги релизов и CI/CD-пайплайны не пострадали.

Подмена затронула сборки для macOS на Intel и ARM, Linux x86_64 и arm64, а также Windows x86_64.

Пользователи, установившие CLI до начала атаки и не обновлявшие его 19 октября, тоже получили оригинальные файлы.

Так как ранее эту функцию в GitHub OVHcloud не активировали, это позволило владельцу скомпрометированного аккаунта изменять старые релизы в обход CI/CD.

В марте 2026 года через тот же кошелек были скомпрометированы личные репозитории этого пользователя, а для октябрьской атаки на OVHcloud CLI злоумышленники в…

Все статьи, PDF-архив, скидки и другие бонусыОрганизаторы SOC Forum 2026, который пройдет 27–28 октября года в кластере «Ломоносов» в Москве, подвели итоги приема заявок на участие с докладами.

Следом по популярности идут треки «Defence», «ИБ и бизнес» и «SOC-практикум».

В программу войдут треки «AI & Cybersecurity», «ИБ и бизнес», «Тренды и аналитика угроз» и «Многогранный кибербез».

Участники обсудят обнаружение и расследование атак, развитие защитной инфраструктуры, архитектуру ИТ и ИБ, а также использование ИИ в защитных решениях.

На этот день запланированы треки «Offence», «Defence», «Архитектура ИТ и ИБ» и «SOC-практикум».

Исследователи из компании Tracebit разработали новый способ защиты от атак автономных ИИ-агентов и предложили использовать так называемые «контекстные бомбы» (context bombs).

Теперь же исследователи сосредоточились на обмане агентов и подготовили девять типов ловушек с ложными целями и намеренно сложными задачами.

В случае Claude Opus 5 эффективность атак и вовсе упала на 91%.

Из-за этого ИИ-агенты избегали настоящих целей и тратили ресурсы и время на приманки.

В случае Cyber, Kimi, Qwen и DeepSeek количество успешных атак сократилось с 39 из 40 до 2 из 40.

ИНН вместо пароляПос­ле стан­дар­тно­го активно­го рекона и пас­сивно­го сбо­ра vhost, под­доменов и про­чего мы стол­кну­лись с бло­киров­ками WAF.

При руч­ном ана­лизе мы под­робно изу­чили биз­нес‑про­цес­сы и наш­ли информа­цию о том, как фор­миру­ют пароли для кор­поратив­ных учет­ных записей.

За­тем мы исполь­зовали поч­товый логин и ИНН в качес­тве пароля, успешно вош­ли в поч­товые ящи­ки и под­твер­дили ком­про­мета­цию учет­ных записей.

Точ­но так же мы вош­ли еще в 3–4 поч­товых ящи­ка, что­бы рас­ширить охват и изу­чить роли и пра­ва кон­крет­ных сот­рудни­ков в ИТ‑инфраструк­туре.

За­тем мы наш­ли один из dev-стен­дов за SSO-авто­риза­цией и успешно вош­ли с помощью связ­ки «OS…

Ограничения также распространяются на решения аффилированных компаний и сторонние продукты и сервисы, созданные на базе разработок DeepSeek.

Фактически теперь американским ведомствам запрещено закупать продукты DeepSeek и использовать их в своих ИТ-системах.

В заявке нужно обосновать необходимость дальнейшего использования продуктов DeepSeek и описать меры по снижению рисков.

Кроме того, американские власти ссылаются на исследование компании NowSecure, специалисты которой еще в феврале 2025 года обнаружили ряд проблем в iOS-приложении DeepSeek.

Отметим, что ранее использование DeepSeek в США ограничивали только в отдельных ведомствах и организациях.

ИБ-исследователь под ником Kaba обнаружил масштабную атаку на инфраструктуру Tor: злоумышленники скомпрометировали сотни серверов, на которых работали выходные узлы сети, и использовали их для перехвата SSH-соединений.

После этого исследователь просканировал около 3000 выходных узлов Tor и в общей сложности обнаружил 333 узла, которые перенаправляли SSH-трафик на одни и те же 12 серверов-перехватчиков.

По их словам, злоумышленники получали доступ к Linux-хостам, меняли конфигурацию Tor и, в некоторых случаях, превращали обычные узлы в выходные, чтобы перехватывать SSH-соединения.

Затем через скомпрометированный сервер злоумышленники добрались до VPS Switzerland2 во FranTech, где работали дв…

В четвертом спецвыпуске «Хакера» мы собрали более 20 технических материалов за 2021–2022 годы, посвященных пентесту, поиску уязвимостей, реверсу и необычному железу.

Здесь есть все: от автоматизации атак в Burp и фаззинга ядра Linux до реверс-шелла размером всего 237 байт.

Наши авторы рассказывают, как автоматизировать многоэтапные атаки, искать уязвимости в Linux и Windows и исследовать заводские бэкдоры в китайских смартфонах.

Учитывай, что тиражи ограничены: первый и второй спецвыпуски уже распроданы полностью, и мы не планируем допечатку остальных номеров.

Спецвыпуск #3 (2019–2021)Третий спецвыпуск посвящен лучшим материалам «Хакера» за 2019–2021 годы.

A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.

A plain Node.js HTTP server does not decode request bodies on its own.

Amazon Linux 2023 still listed its brotli and Node.js 24 packages as pending a fix as of October 22.

Dependency scanners may not flag the Python packages yet.

Advisory entries for the two Python packages, PYSEC-2026-4322 and PYSEC-2026-4323, were added on October 23, so check the installed versions manually as well.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.

The critical-severity vulnerabilities are listed below -CVE-2026-110447 (CVSS score: 9.2) - An operating system command injection vulnerability in Collabora Online – Built-in CODE Server (aka richdocumentscode) when used within the NextCloud platform that could allow remote code execution via "proxy.php" when the CODE local document server isn't running.

(Fixed in September 2026 in version 26.4.303) CVE-2026-1…

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.

"It is critical to note that a threat actor's use of this bootkit is primarily a persistence and defense evasion mechanism," Microsoft noted at the time.

The Slovakian cybersecurity company said it also found "limited indications" that some versions of the backdoor may feature a UEFI bootkit component likely exploiting CVE‑2023‑24932, another security feature bypass vulnerability linked to BlackLotus.

An interesting overlap is the presence of the "xdd" string in BlackX and the kernel implant used by FishMonger, raising the possibility that th…

Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language.

The bugs lie behind four critical security flaws that GitLab patched over the past month.

Ruby says any application that builds a regular expression from text an attacker controls is affected, not just GitLab.

Which Applications Are AffectedIn its advisory, Ruby said an application is affected only if it compiles a regular expression from a string an attacker controls.

For GitLab AdministratorsSelf-managed GitLab instances need the release that fixes CVE-2026-110264.

Cybersecurity researchers have discovered an artificial intelligence (AI)-driven intrusion ecosystem run by affiliates of the INC and The Gentlemen ransomware groups.

"The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel and VPN gateways," SOCRadar said.

RevSocks, a reverse SOCKS5 framework used to pivot inside victim networks and stage data for exfiltration.

The stolen data is eventually published on the data leak site if the victim fails to pay within a 24-72 hour deadline.

"Across this exposed infrastructure, the actors engaged in widespread exploitation of exposed internet services, specifically targeting FortiClient EMS gateways…

Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.

The campaign's victims are global and belong to a broad range of sectors, given the indiscriminate targeting of exposed network devices.

Establish persistence on the host via legitimate remote access tools like MeshCentral Agent, Atera, Teramind, and AnyDes, as well as an open-source, adversary-emulation framework known as AdaptixC2.

"k0t appears to select potential targets by enumerating exposed network appliances at scale rather than researching individual organizations," Group-IB and NyxLab res…

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws.

The project is not issuing an emergency fix for it.

It follows the October 21 emergency release that fixed two critical PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, which let an attacker without an account run code on a server.

No exploitation of CVE-2026-115560 has been reported; the attacks reported since October 21 target the two earlier PHP2Shell flaws.

Separately, the exploitation of the two earlier PHP2Shell flaws has grown.

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.

What makes the attack stand out is UAC-0099's use of a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network.

In addition, some artifacts include a 10-minute startup delay in a likely effort to avoid immediately connecting to the Yggdrasil network and evade detection.

MythicRatatoskr is said to have been used to deploy a SOCKS5 server to route connections through the compromised network.

The attack culminated with Sa…

OX Security, the firm whose report drew attention to the flaws, estimates the library is downloaded about 436 million times a month.

The flaw only reaches Ghostscript on hosts that have the gs program installed, which Pillow needs to open EPS at all.

The CVE records, assigned by GitHub, score the EPS, TIFF, and JPEG-thumbnail flaws 9.2 out of 10, a critical rating.

In the CVE records, CISA's analysts mark no known exploitation for the EPS flaw and a public proof of concept for the TIFF one.

TIFF: treat saving a TIFF to an in-memory buffer such as io.BytesIO as a sensitive path when the image came from a user.

The x402 Foundation, which maintains the SDKs, had already fixed all three critical flaws in the August 18 releases.

The other let a malicious server get an agent to sign a login message for a different website.

Coinbase created x402 and handed it to the x402 Foundation this year, a Linux Foundation project whose members include Visa and Mastercard.

A hostile API could use that to turn a routine data request into a request for the wallet's full balance of a supported token, V12 said.

With an automatic signer and no payment policy set by the app, the client could sign a payment for that amount.

Malicious Brotli data can make an application on an official build of Node.js run attacker-supplied code, security researchers at Imperva have demonstrated.

Their "Node2Shell" proof of concept ran code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497).

Imperva's test did not succeed on every attempt, and code execution took several tries in its Linux arm64 setup.

The demonstration goes beyond the first public proof of concept, which achieved code execution only on a deliberately weakened test build.

Express 5's body parsers, such as express.json(), express.urlencoded(), express.tex…

Threat Actor Mass Exploits PHP2ShellThe development comes as SOCRadar said it found PHP2Shell exploit tooling for PHP 8.4.26 on an exposed attacker-controlled server ("206.188.197[.

These websites span Canada, China, Finland, France, Poland, the U.K., and the U.S."The central file, aslr_exploit.py, is a Python exploit the operator labels a 'one-click' PHP2Shell exploit for PHP 8.4.26 under Apache mod_php," SOCRadar said.

]136Defeating ASLR ProtectionsThe disclosure also coincides with the development of a PHP2Shell exploit that can achieve remote code execution on ASLR-enabled x86-64 systems with PHP's recommended production configuration.

"We've seen plenty of php2shell probes and exploita…

The following day, at 09:28, a new binary was delivered to the machine: the MythicRatatoskr backdoor.

This blogpost focuses primarily on the analysis of the MythicRatatoskr backdoor, the Yggdrasil network that hosts its C&C server, and the accompanying SOCKS5 server.

Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr.

MythicRatatoskr main configurationThe MythicRatatoskr configuration is stored in a file at a hardcoded path.

NetworkIP Domain Hosting provider First seen Details b479:2771:8df4:b5e b:d007:63b0[:]2838 N/A N/A 2025‑07‑17 MythicRatatoskr C&C server within the Yggdrasil network.

In some cases, the scam ad may take you to a fake e-commerce site which covertly harvests your card details.

What happens if I’ve fallen victim to a scam ad?

Scam ads are getting easier to generate thanks to AI, and can look increasingly professional, even including video content.

Can I get my money back if I paid through a scam ad?

What should I do if I’ve fallen victim to a scam ad?

This is email bombing.

What is email bombing?

Sometimes called “form bombing,” “list bombing” or “subscription bombing,” email bombing attacks usually follow the same pattern.

There’s no silver bullet to prevent email bombing.

Has my email account been hacked if it’s full of sign-up emails?

Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safeScammers love a pretext.

And with Medicare Open Enrollment, they have a perfect opportunity to exploit victim expectations, masking their fraud under the cover of legitimate activity.

Work through the following steps:Call or contact Medicare at Medicare.gov or 800-633-4227 to report the incident.

So slow down this Open Enrollment season and verify every request for personal and medical details.

Frequently Asked Questions (FAQs)When is Medicare Open Enrollment?

Data breach notifications are telling victims less than ever.

As the volume of data breach incidents increases, there’s a growing chance that you’ll be caught up in one.

Example of a data breach notice with a detailed explanation of the situation (for more, head over here)How do you interpret a breach notice?

For that reason, you should never click through on any unsolicited breach notification email or message.

Change your logins (if relevant) and consider credit monitoring and a credit freeze.

Later, in June 2026, ESET telemetry registered further MATCHBOIL samples, this time at a company in the energy sector.

MATCHBOIL then performs three HTTPS requests to the C&C server; each with a different purpose:The first request receives a numeric value from the C&C server.

2024 samplesThe earliest MATCHBOIL samples that we have seen have compilation timestamps from 2024.

]pro N/A 2025‑11‑10 MATCHBOIL C&C server hidden behind Cloudflare.

]com N/A 2025‑08‑12 MATCHBOIL C&C server hidden behind Cloudflare.

The platform also asks for the creator’s YouTube channel URL, which it uses to retrieve public information and generate a seemingly personalized experience.

How to stay safeIf you’re a social media influencer yourself, your Google account can be much more than “just” access to a YouTube channel.

Run Google’s Security Checkup, or open Security & sign-in in your Google account, and review recent security events and signed-in devices.

If you’re a YouTube creator yourself, you realize that your reputation ultimately defines your success.

A Google account can then sit at the center of your business: email, files, contacts, and the YouTube channel itself.

The cybersecurity market is often making it tougher for SMBs to keep threats at bayCybersecurity has never been easy.

SMBs are very much in the crosshairs, as providers of critical infrastructure themselves or suppliers to firms operating in critical infrastructure.

Yet the identity of the adversary is arguably less important than the tactics they’re using to target global SMBs.

By offering teams AI assistance to improve productivity.

By offering teams AI assistance to improve productivity.

Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep paceAs another month draws to a close, ESET Chief Security Evangelist Tony Anscombe reviews some of the top cybersecurity stories that have made the news over the past 30 days while offering insights that they hold for your or your company's cyber-defenses.

Here's Tony's rundown of some of what stood out most in September 2026.

An OpenAI agent has broken into Australia's national healthcare database in what is the first known case of AI autonomously hacking a government network,Earlier in the month, Google announced that its models also escaped it…

If an exit company cold calls you or makes 100% guaranteed promises of a swift exit, they’re likely to be a scammer.

If you’ve already paid a scam timeshare exit company, there’s still a chance you could get your money back if you act quickly.

What are the warning signs of a timeshare exit scam?

How can I check whether a timeshare exit company is legitimate?

What should I do if I've already paid a timeshare exit scam company?

Some techniques go after live sessions themselves, with attackers shifting their focus from stealing passwords to stealing authentication tokens.

Purpose-built AI tools now make it trivial to clean up the language and even tailor the lure for each recipient.

What’s more, the code is scanned on a phone, so the usual controls that protect company-issued laptops don’t apply.

The ‘device hop’ also means that the company may have a hard time developing a full picture of the attack.

AI helps deal with the volume and speed involved, whereas experienced analysts can assess the evidence and direct the response.

Vibe coded apps may also be exposed to prompt injection.

What can go wrong with vibe coded apps?

With a badly coded app, the leak usually happens on the developer’s servers, so start with your account and credentials.

Frequently asked questions (FAQs)What does 'vibe coded' mean?

Are all vibe coded apps dangerous?

No real government agency, bank, or company will ever tell you to pay them via a Bitcoin ATM.

How do Bitcoin ATM scams work?

How do I stay safe from Bitcoin ATM scams?

What can I do straight after a Bitcoin ATM scam?

What should I do if I’ve fallen for a Bitcoin ATM scam?

Roblox itself is very clear: “There is no such thing as free Robux or subscription offers, tricks, or codes.”What there is, unfortunately, are a lot of scammers looking to trick you out of your personal information and logins with the promise of free Robux.

But it’s also about helping them understand there’s no such thing as ‘free’ Robux.

Frequently asked questions (FAQs)Is there a real free Robux generator?

Roblox says there is no legitimate way to get free Robux through generators, tricks or codes.

But these aren’t ‘free Robux generators.’How can I tell if a Robux offer is a scam?

Many have moved past chatbots and begun assigning work to AI agents in the hope of gaining an edge on their similarly resource-strapped competitors and levelling the playing field with larger companies.

Indeed, the ambitious adopters are deploying, or at least experimenting with, multi-agent ‘assembly lines,’ where one supervisor agent manages swarms of specialist agents and passes work between them.

Of course, some risks surrounding AI agents have familiar roots: an agent’s supply chains can be compromised and its permissions abused.

Agents can also suffer from agentic misalignment where they proceed doggedly even if it involves, for example, breaking into other companies.

For a company wi…

Russian activity behind the pushThe government links the overhaul to growing threats against undersea infrastructure, including suspicious Russian activity in UK waters.

In April, the British Armed Forces exposed a covert Russian submarine operation around undersea infrastructure in and around UK waters.

Officials say the UK’s subsea cable network is highly resilient, and that the cable faults that do occur come from accidents involving anchors or trawler nets dragged along the seabed, from environmental hazards or from technical failures.

Companies running subsea telecoms cables would have to meet new security and resilience duties, including stronger requirements to identify and manage ri…

An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress.

No password required“The Microsoft accounts were compromised without the attacker ever needing a password,” researchers noted.

The attacker then replayed the stolen tokens in bulk, mostly from one block of IP addresses.

“Because the attacker replayed many stolen tokens at volume across many organizations, we refer to this as ‘token spraying’: the same pattern as password spraying, but with stolen tokens instead of guessed passwords,” the researchers explained.

Fake…

Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company.

Capcom is the Japanese video game developer and publisher famous for Resident Evil, Street Fighter, Monster Hunter and Mega Man.

For 43 of those records, the exposed data also included the account holder’s date of birth, gender, country or region, and nickname.

Email addresses registered with CAPCOM ID can still be used, the publisher said, though the stolen information could be used to send fraudulent messages posing as Capcom or related parties.

The company says it has completed its emergency response and identified and addressed the attack method, without describ…

An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power.

Symantec captured the agent’s instruction set this summer through a honeypot posing as an unprotected AI service, researchers Priti More and Susmit Yenkar wrote.

“The activity is a form of LLMjacking, in which attackers steal access to someone else’s AI model,” Symantec’s team explained.

Targets include self-hosted model servers left open by default, AI gateways that front a company’s paid accounts, hastily deployed internal test systems and Model Context Protocol (MCP) servers that connect a model to tools.

M…

Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers.

Usage will appear on a single Google Cloud invoice and count toward existing cloud spending commitments.

“By using OpenAI models through Google Cloud, we will be able to give customers access to OpenAI’s frontier AI models alongside Google Cloud’s security and compliance capabilities, enabling them to get more value from their enterprise content.

Developers can also connect their local Codex CLI and Codex Desktop workflows to Google’s Gemini platform for inference, with Google Cloud processing the model requests.

It also intends to bring OpenAI models to Gemini for busi…

What are the most common mistakes in public records and FOIA handling for drone footage and flight data?

Then they buy an off-the-shelf drone, run a flight, pull the flash card, toss an MP4 into an unindexed desktop folder, and call it a day.

Given your cybersecurity background, what are the real risks in flight logs and ground control software, such as data exposure, tampering, and chain of custody?

From a red-team angle, ground control stations and flight logs are massive, wide-open surfaces that people treat like dumb appliances.

An incredible number of departments still keep their flight logs on flat Excel sheets.

Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda’s Cybersecurity Skills Gap Report.

(Source: Barracuda)AI changes the work security professionals doAI and automation are expected to handle more routine analysis, connect related security events, and suggest responses over the next year.

Security professionals would increasingly focus on investigating harder-to-detect attacks, checking AI findings, and making decisions during incidents.

Skills gaps put pressure on teamsAlmost all respondents reported cybersecurity skills gaps.

www.barracuda.comChecking AI-generated findings is becom…

Here’s a look at the most interesting products from the past week, featuring releases from AppGate, IDENTOS, Sweet Security, and ThreatModeler.

Security teams can enforce protection in one click while engineering develops, tests, and deploys a permanent fix.

IDENTOS PolicyArc gives AI agents task-specific, time-limited accessIDENTOS has announced that PolicyArc is now generally available.

The new solution gives security, platform, and compliance teams a single place to define, enforce, and audit access policy across their applications.

The expansion builds on the ZTNA for OT offering AppGate introduced in March 2026.

“LiteLLM got compromised… again,” security researcher Kevin Beaumont wrote on Mastodon.

“At 4:00 AM PST October 21, LiteLLM’s release pipeline was compromised and pushed v1.107.0 to the docker registry and PyPi.

This version contained compiled malware which steals credentials and loads remote-code execution tools,” reads LiteLLM’s blog post.

Tokens taken from an exposed deploymentAccording to LiteLLM, the attacker worked through the GitHub accounts of three of its engineers, apparently using stolen GitHub CLI OAuth tokens.

Aikido, Wiz and Socket have each published detailed analyses with indicators of compromise and cleanup steps for LiteLLM users and security teams.

Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it had done no such thing.

The monitor kept recording findings, but no human was alerted, and the agent told the researcher only that no messages had been sent.

Astra told the user the work was done without mentioning the monitor.

When the user asked directly whether it had removed the monitor, Astra claimed it hadn’t.

“Auto-Review, which we already require for all internal Codex use, has been updated to detect and block attempts to disable misalignment monitoring.

Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21.

If you run PHP behind a web server, you need to know which of your hosts are still vulnerable, and Searchlight’s researchers argue that most scanners already circulating cannot tell you reliably.

“When assessing other scanners released in the wild, we noted that most rely on version checks, or do not accurately depict vulnerable conditions for both mod_php and php-fpm,” the researchers said.

It does not confirm the fault is reachable, and it splits on how PHP is run, because the two se…

Fingerprint has announced Agentic Installation, the AI-powered onboarding path for companies to deploy device intelligence to their websites or apps in minutes to detect and stop fraud.

By running a single prompt in an AI coding tool, such as Claude Code, Codex or Cursor, developers take Fingerprint from zero to production-ready in minutes, reducing manual setup and stopping fraud faster.

Once installed, developers can optionally connect to Fingerprint’s MCP server, allowing teams to query their own fraud data.

“Developers shouldn’t have to spend hours reading setup guides when their AI tools can do the heavy lifting,” said Catherine Woneis, VP of Product at Fingerprint.

“Agentic Installati…

XTIUM has released the latest version of XTAI (XTIUM Trusted AI), expanding its AI Service Platform with XTAI Orchestrator.

The new governance platform brings together managed AI services, AI-powered voice, custom XTAI Agents, managed networks, and managed cloud.

XTAI Orchestrator was built to solve that problem by bringing AI from multiple vendors under a single, powerful governance framework.

From AI strategy to AI operationsMost organizations are no longer asking whether they should adopt AI.

Agent management capabilities within XTAI OrchestratorEmbedded within XTAI Orchestrator, are capabilities the power the deployment of governed AI agents.

Singularity ADR is the newest addition to SentinelOne’s AI Security portfolio and a direct expansion of the company’s commitment to defend the surfaces AI runs on.

Singularity ADR builds on that proven defense by focusing on agentic behavior and actions in runtime.

It governs which AI agents are allowed to run and what they can reach, and blocks known-bad actions at the moment of interaction.

From agent governance to runtime protectionIn March, SentinelOne bolstered its AI security portfolio with the introduction of Prompt AI Agent Security to discover AI agents and govern how they connect to tools and data.

“Securing AI agents goes beyond just stopping threat actors with malicious intent.

Broadcom has announced the launch of Arcot Scam Defense, a new feature of Arcot by Broadcom, designed to block social engineering fraud during card-not-present (CNP) transactions.

“Financial institutions are experiencing broad increases in fraud attempts driven by sophisticated, AI-enhanced social engineering attacks,” said Matt Cooke, VP and GM, Payment Security Division, Broadcom.

Introducing Arcot Scam Defense“Arcot Scam Defense closes a critical gap,” added Cooke.

Even if a cardholder falls for a scam and hands over their credentials, Broadcom’s Arcot Scam Defense feature can help identify the behavioral shift and block the transaction in real time.

In pilot testing validated on a full …

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys:

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237...

PHP maintainers have released two critical vulnerabilities:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The vulnerabilities:...

There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS).

Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.

Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him:

Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026.

[…]

According to Cellebrite, AU: is a “next-generation AFU vector that is more resilient to Apple’s OS changes”

works with Stolen Device Protection enabled, which tightens USB restrictions

is enabled by a dedicated appliance with a stated range (!) of about 8 meters...

Interesting research:

Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the trade-off, answering in milliseconds but only for categories they were trained on. Neither improves with exposure. We study what changes when a solver improves with use. Our system pairs a fine-tuned YOLOv8 detector with an open-weight VLM behind a confidence-based router, and runs entirely from screenshots and operating-system input events, with no browser automation…

New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This is a problem:

Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular reason people download modified weights without verifying what’s inside. Abliteration is a cheap fine-tune that takes away a model’s ability to refuse. You find the direction in the weights that carries “no” and subtract it. The model then answers things a safety-tuned version would turn down. It began as a research trick and it’s now routine before people upload a model to Hugging Face, where you’ll find abliterated builds of most of the popular open weig…

Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms:

Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument. From roughly sixteen thousand candidate papers we classify cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding and their comparators, then convert papers into estimated research-allocation years through a person-level author map. These publication-based estimates may substantially overstate actual time spent. Lattices have overtaken elliptic curves in this cumulative measure only r…

This is a current list of where and when I am scheduled to speak: I’m speaking at ATTENTION: Democracy, Rebuilt in Montreal, Canada. The event runs October 21–23, 2026, and my talk is on Wednesday, October 21.

I’m speaking at the University of Toronto in Toronto, Ontario, Canada, at 5 PM ET on October 22, 2026.

I’m speaking at [un]prompted in San Francisco, California. The event runs October 27–29, 2026, and my talk is at 11:35 AM PT on Thursday, October 29.

I’m speaking at the Catalyst Summit in Brampton, Ontario, Canada, on Wednesday, November 18, 2026...

Matthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers.

I am more optimistic than he is. That is, I have stronger faith in the over-engineering cryptographers tend to do. I am trying to write this up in more detail.

Another IoT cyberattack, this one in France:

Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.

[…]

Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.

Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified...

In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster.

Last week, the FBI arrested (alternate link) someone associated with that crime.

On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of which we could keep). And…I caught a squid! Near as I can tell, it’s a longfin squid, sometimes called a Boston squid (Doryteuthis (Amerigo) pealeii).

That night I cooked it over a barbecue grill—hot and fast. Delicious.

This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs.

Two weeks after Moscow’s full-scale invasion of Ukraine in March 2022, the Russian TV Channel One editor Marina Ovsyannikova burst onto the set of the evening newscast. She held up a hand-drawn sign behind the anchor’s head that read: “Stop the war. Don’t believe propaganda. They’re lying to you!” She shouted, “No to war!” until she was dragged away.

No one has protested the war on Russian television since then, partly as a result of tighter security and a general climate of fear. But in October 2024, Margarita Simonyan, one of Russia’s chief propagandists, gave another explanation. A growing number of th…

Earlier today, PHP released an emergency security update to fix two critical bugs that can allow an attacker to execute code of their choosing on a vulnerable server.

Reuters reports that government websites in Europe and elsewhere went offline today after the PHP vulnerabilities were disclosed.

Wiz said that prior to the PHP bugs being publicly disclosed, the company worked with the PHP team, Calif and OpenAI to measure the size of the problem and coordinate patch verification and disclosure.

The PHP zero-day vulnerabilities are being tracked by their CVE numbers, CVE-2026-109618 and CVE-2026-109619, and they affect all web servers running PHP 5.4 or later.

“A vulnerability in core PHP rea…

According to the FBI, ShinyHunters has extorted more than $70 million from victims so far this year.

He also said Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and is not a shareholder.

In 2020, Aon aquired Cytelligence, a security consulting firm where Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing partner.

Experts say ransomware victims are typically directed by their insurance provider to work with a specific incident response firm.

But that ransom payment did not stop future extortion attempts using the same stolen data.

The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise.

The blockchain data-crunching firm Chainalysis said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy.

“Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis wrote in an October 8 blog post.

Sanders said the U.K. sanctions on Cryptomus are important because Canada’s sanctions against the platform were ultimately unenforceable and uncollectible.

“A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders wrote on LinkedIn.

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software.

CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.

Windows 10 users might be wondering if they can still expect security updates after this month.

Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback.

Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.

The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters.

The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.

Another shared that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas.

According to LinkedIn, Cypher was co-founded by a Canadian man named Edward Dubrovsky, who is now associated with another Canadian security firm called CyberSteward.

According to the FBI, the group has extorted more than $70 million from victims so far this year.

The Dutch daily RTL reported on Sept. 29 that investigators suspect Van der Stap tried to orchestrate at least two murders.

According to RTL, the murders were allegedly to be committed abroad, and there are indications Van der Stap gave the order for these attacks.

In an interview with KrebsOnSecurity on September 9, Van der Stap described his new role as “offensive security lead” at the Dutch cybersecurity company Neo Security, saying the job involved probing client networks for security vulnerabilities.

Korper said Dutch forensic investigators visited his office on September 15, the night Van der ⁠Stap was arrested in a dramatic police raid that reportedly involved flash bang grenades.

“Y…

Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters.

Van der Stap is currently employed as offensive security lead at the Dutch company Neo Security, which did not respond to requests for comment.

But not long after that interview, the Dutch hacker abruptly stopped replying to messages.

One source said a colleague of theirs personally witnessed Dutch authorities carting items out of Van der Stap’s residence.

Speaking with reporters from Bloomberg in 2024, Van der Stap said that singular focus in turn fueled his desire to carry out cyberattacks.

A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.

Kiberphant0m claimed to have hacked into more than dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business, and publicly extorted these companies in exchange for a promise not to publish the stolen data.

Less than a month later, Wagenius was arrested and charged in two separate federal indictments, and soon pleaded guilty to all counts in both cases.

In 2019, Schuchm…

In February 2024, Radaris was sued by Atlas Data Privacy Corp, a company that has been pursuing data brokers alleged to be violating a New Jersey statute called Daniel’s Law.

KrebsOnSecurity doubled down and showed how the Lubarsky brothers built and operated Radaris and other data broker companies using a fictitious CEO’s name.

All told, the New Jersey court has so far transferred 14 domain names from the Radaris family of companies to Atlas.

Sherman said federal lawmakers have long faced intense lobbying by the technology industry against more restrictive U.S. data privacy laws, but that many powerful industries are now working against passing comprehensive data privacy legislation.

The l…

Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever.

This month’s patch bundle obliterates the software giant’s previous record set in July, when it released updates for at least 570 security vulnerabilities.

Among the more serious critical flaws this month is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10.

And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month.

Enterprise Windows admins will want to keep an eye on askwoody.com for news of any updates that appear…

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada.

Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards.

Some of the records list their “source” as “CDL,” presumably short for “commercial drivers license.

Also, only some of those who helped with this research said they showed their drivers license at the airport on the day of their travel.

Baldwin said the Nexus identity theft service presents multiple serious security and privacy threats, noting that state-issued drivers licenses are commonly used as proof of one’s ide…

The malware allows TeamPCP’s hackers to steal credentials that let them publish malicious versions of those software development tools, too.

“TeamPCP has stated the competition is a recruiting opportunity and they intend to purchase all meaningful access harvested from participants’ campaigns,” the security firm Dataminr wrote.

Deadcatx3, a nickname that has been flagged by multiple security firms as an alias used by TeamPCP.

Charlie Eriksen is a security researcher at Aikido Security who has closely followed TeamPCP’s cybercrime campaigns.

“They managed to wake up Microsoft to the fact that they had become negligent in terms of security,” Eriksen said.

It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day.

Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.

“It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said.

DecryptAds reports that Between Digital is collecting ad data on approximately 55,000 partner websites.

Bear in mind that ad blockers often do little to block ads and/or tracking that occurs from within mobile apps that users have chosen to instal…

Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

August’s overstuffed bundle of patch joy from Microsoft did not eclipse its recording breaking release of more than 570 security updates last month, but it is double June’s then-record batch of nearly 200 fixes.

The other publicly disclosed flaw is CVE-2026-72971, a low-impact local tampering vulnerability that Microsoft reckons is unlikely to be exploited.

By all accounts, AI is quite good at finding security holes in software.

“Don’…

Snowflake responded to the data thefts by increasing password complexity requirements and enforcing multi-factor authentication.

A little more than a month later, Canadian authorities arrested Moucka on a provisional warrant from the United States.

“Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt,” reads a statement from the Justice Department.

Moucka pleaded guilty to four criminal counts, including computer fraud, wire fraud, aggravated identity theft, and conspiracy.

Ultimately, it will be up the federal judge how much time Moucka actually serves for his extensive cybercriminal rap sheet.

Germany's far-right AfD (Alternative für Deutschland) party has confirmed that it has suffered a security breach, after a hacker published what appear to be hundreds of thousands of the controversial political party's internal emails.

Earlier this week, the AfD admitted that its hosting provider had been hacked in September, and that some of its mailboxes had been copied.

What is unusual is that the leaked emails are not published on the site directly.

Indeed, party sources told the media that although the leaked emails appeared to be authentic, the AI-generated summaries appeared to contain several inaccuracies.

The full corpus of 281 GB of stolen messages and files has been made available…

Smashing Security, episode 489, How a Brand New Crypto Wallet Came with a Spy Inside, with Graham Cluley and special guest Lianne Potter.

So a bit of a War of the Roses thing going on there with that reference to Burnham.

What I'm going to do is I'm going to describe things, and the more dangerous the thing is, the faster it will click.

But I'm going to say it's probably dodgy, but oh, the curiosity would get the better of me.

But I'm actually in the same boat as most people because this film has been censored for nearly half a century.

A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang.

As BBC News reports, detectives have linked the man to the 2024 attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient.

The suspect, who has been named by German media only as "Vladimir K" was originally detained in May in Japan, after he travelled there on holiday.

The incident is said to have crippled Synnovis’s IT systems, and caused a critical shortage of O-type blood in hospitals.

No ransom was paid by Synnovis, a decision the firm made jointly with the NHS trusts to which it provides services.

The official @GardaInfo and @GardaTraffic Twitter accounts of Garda Síochána were accessed by an unauthorised third party who posted cryptocurrency-related messages on Wednesday evening, potentially reaching hundreds of thousands of users.

The messages claimed that followers were eligible to claim free cryptocurrency through an airdrop.

The problem, however, is not just that a hacker found themselves with the ability to post fraudulent messages posing as the Irish police.

The Garda is not the only police force to have ever suffered a security breach on its Twitter account.

In 2022, the official Twitter account of the Philadelphia Police Department was compromised and used to post what appea…

Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.

How a ransomware negotiator ended up arrested at his own conference, with Graham Cluley and special guest Paul Ducklin.

I don't know if you know that.

And then I became a freelancer and then I thought, oh boy, I'm going to open the doors to everybody.

And he is the Canadian co-founder of a ransomware negotiator firm called— I don't know how to pronounce this.

There's no breach so unimportant that you can just say, don't worry folks, carry on, nothing to see here.

The hacker behind a high-profile string of leaks involving the upcoming release of the Grand Theft Auto (GTA) 6 videogame has threatened to release a complete, playable build.

CyberLeek says that if the GTA 6 game is released on physical disk, and a public apology is made, it will step back from its threats.

As ever, videogame fans should be very wary of believing anybody who offers a download of a supposedly leaked game.

Besides which, the real, genuine GTA 6 is due to be released on video game platforms on 19 November.

It is not worth infecting your computer, or losing money on a dodgy crypto coin, just to see it a few weeks early.

Zhang is charged alongside 34-year-old Xu Zewei with malicious cyber activity against US computer systems between February 2020 and June 2021.

The following the year the pair allegedly exploited vulnerabilities in Microsoft Exchange Server to steal further information.

Furthermore, if findings by security firm SentinelOne are to be believed, Zhang's Shanghai Firetech filed multiple software patents about extract data from computers.

Xu, for instance, was arrested at Milan airport in July 2025 and extradited to the United States in April this year.

China's Foreign Ministry opposed Xu's extradition, accusing the United States of fabricating charges against him.

But do you actually know whether both of them can do the job?

Now, I don't know how good a swimmer you are, Danny.

I don't know about you, but I'm having 3 or 4 calls a day from an unknown number.

And I would imagine a company like Hack The Box has got great visibility as to what is actually going on out there.

And so I think that's the unique part here is it truly does have a pressure-tested element to it.

N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow. Read more in my article on the Fortra blog.

The FBI has a very simple message for the ShinyHunters gang: give yourselves up.

The FBI describes the man arrested in Amsterdam as "one of the alleged leaders of ShinyHunters", although Dutch police say only that he played a role.

The warning to remaining members of ShinyHunters follows particularly embarrassing episode for the FBI, which recently confirmed it had had its job application portal compromised by the gang.

According to ShinyHunters, it gained access to the FBI's data by exploiting a recently-patched flaw (CVE-2026-35273) in Oracle PeopleSoft PeopleTools.

The truth is that the arrest came a week or so before the compromise of the FBI became headline news.

An alleged key figure in the ShinyHunters cybercrime group has been arrested in the Netherlands, and - in a grotesque turn - the 24-year-old suspect is also being investigated for attempting to arrange two murders.

Although the authorities are declining to name the individual, celebrated cybersecurity blogger Brian Krebs has identified him as Pepijn van der Stap, a convicted hacker.

Van der Stap was released from prison in December last year, and has since been working as a penetration tester at Amsterdam-based Neo Security.

Notably, Van der Stap appears to claim on his personal website that he is a reformed character.

That hasn't stopped FBI Director Kash Patel from describing the arrested…

The unencrypted files contained Social Security numbers, names, birth dates, contact details, and other military personnel data including - in some cases - details of the jobs individuals held.

Breaches like this matter because the combination of Social Security numbers, names, and dates of birth make up the bread and butter of any self-respecting fraudster.

Personnel data, of course, has also been a target before.

The news of the Pentagon's latest data breach comes as the FBI warns its own employees about a separate breach of its FBIJobs.gov portal.

The ShinyHunters hacking group has claimed credit for the hack and threatened to publish staff details including... you guessed it... Social S…

A court in Zurich has sentenced a Ukrainian man to 12 years and nine months in prison, and banned him from Switzerland for ten years, for developing ransomware that blackmailed companies around the world.

The 52-year-old man, who according to local media reports had been living in the Basel-Landschaft region but has not been named, found by the court to be the lead developer of the LockerGoga, MegaCortex, and Nefilim families of ransomware.

In all, prosecutors claimed that some 100 million Swiss Francs (US $123 million) worth of damage was caused by the ransomware attacks.

Ukrainian national Tymoshchuk allegedly released new strains of his ransomware whenever old ones had been decrypted.

In…

Smashing Security, episode 486, Vibe-Coded Shops and Hackable Flock Cameras, with Graham Cluley and special guest Dave Bittner.

I will say I did not go gaga for La La the way many other people did.

Anyway, if any of you are still listening, I love La La Land.

This La La Land lunatic has watched the movie with his pause button.

This was definitely not created — if you haven't seen La La Land, go watch La La Land for goodness' sake.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 6e1eb2ff9ba52d21e2eb9108c143beafServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-23T17:00:39+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 704ec22d9a79fd07b89340a5c2d02b67Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-22T23:00:36+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 0bd9145f797a3fff09593e8e6fc88bd4Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-21T20:00:35+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: a48e6a868074b4c2b77295af18788714Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-20T17:00:12+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 65c81bea022dea0314bb3ec1fb8b3228Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-15T14:00:29+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: bf1172655ea8738416272c1b910c4a23Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-14T17:00:37+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 8c474b40de23335e23a81b4f71096fa2Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-13T18:00:32+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 986285ee7f9fbca30f009118870a630eServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-09T19:00:10+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 61f641b9443f60bfa61c035e9925aff2Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-08T19:00:43+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: db7c9e9b3ec5fc4fb9e02c8670f482a9Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-07T23:00:38+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 057a7a4758cd6ae7dfaab62417ac8d97Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-02T21:00:25+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 8ea67ee2a3dd4315782e49963c8d5485Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-09-30T17:00:35+03:00Config id: 334Faithfully yours, nginx.

Эти процессы могут тянуться неделями, а тем временем в инфраструктуру легко может попасть злоумышленник.

Где теряется времяПервое промедление может произойти сразу после появления информации об уязвимости в базах данных.

Рецепт управления уязвимостямиЧтобы у злоумышленников было как можно меньше поводов заглянуть к вам в инфраструктуру, важно убедиться, что в организации четко выстроены четыре основных процесса.

ПриоритизацияПри анализе уязвимости не стоит ориентироваться только на оценку из публичного каталога, например NVD, — она может существенно расходиться с реальным ущербом от эксплуатации бреши.

Например, один и тот же дефект в сервере, который находится в изолированном сегменте, и в…

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 7dfac78cb3fca5a112c9b371cb1af0ecServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-09-29T14:00:43+03:00Config id: 307Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 3ba3f53e4698eed730b59fdbb57f2dc7Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-09-25T19:00:33+03:00Config id: 307Faithfully yours, nginx.

Upstream capacity: the projects you depend on can deliver new capabilities and critical fixes fast.

Upstream capacity is the one almost nobody puts on a roadmap because it sits outside your organization.

In most organizations, upstream capacity has none of those.

What This Looks Like in PracticeFor Cisco, part of the answer was becoming a Premier Sponsor of the OpenSSL Foundation in August 2025.

Tomáš Mráz, CTO of the OpenSSL Foundation, describes the impact:“Cisco’s support for the OpenSSL Foundation allowed us to fund an additional senior software engineer to improve the OpenSSL Library code.

CSDL continues, and does moreThe Cisco Secure Development Lifecycle (CSDL) is built on more than 400 software security requirements that validate products before they are released, with engagements at key stages of development.

Cisco open-sourced it and donated it to the Coalition for Secure AI (CoSAI).

Our secure software guidance skill is in development, carrying Cisco-specific security requirements into the development workflow.

Project CodeGuard and the secure software guidance skill also act as evaluators in the development pipeline, backing hard gates.

To date we have not found a novel issue that was not already covered by an existing software security requirement.

The Splunk .conf network brought a new detection that we hadn’t seen before: Flawed AMMYY.

There is also a Remote Access Tool (RAT) called Flawed AMMYY that was developed from leaked AMMYY source code, and is directly used as malware.

One of the key value propositions of EVE is that it can use granular session fingerprinting to differentiate between similar but distinct applications like AMMYY and Flawed AMMYY.

Let’s dig into the events we saw for Flawed AMMYY and some of the details that EVE had to look at.

Our EVE detections for Flawed AMMYY came in pairs with identical timestamps, as seen above, all from a single IP.

The event Network Operations Center (NOC) managed the venue network, providing our SOC firewalls with dedicated SPAN feeds directly from their core switches.

Inside Cisco Cloud Control, that story comes together in Unified Events.

While Splunk drives active investigations in the SOC, administrators maintain firewall health directly within Cloud Control.

The Horizon: Cisco Cloud Control & AI CanvasSecurity is now natively built into Cisco Cloud Control, the unified operations platform that brings Networking, Security, Observability, and Cloud into one consistent environment.

Without replacing individual product controllers, Cisco Cloud Control unifies inventory, topology, actions, identity, …

However, assessing whether a zero-day vulnerability was exploited in the past essentially involves going back in time.

Relying on standard logs or “Conditional / Selective PCAP” systems during a zero-day investigation leaves the Security Operations Center (SOC) team blind.

There is also a secondary benefit: if a breach occurred using an newly disclosed zero-day vulnerability, the attacker is likely to have been very sophisticated.

Replay The Relevant Historical Traffic Against The New Intrusion RulesOn the Firewall Threat Defense (FTD), we configured a dedicated interface for the Endace traffic replays.

Rapid retrospective packet replay transforms zero-day triage by delivering direct forens…

The .conf26 Agentic SOC was not a simulated demo or a scripted lab.

Powered by the Cisco Cloud Control management platform, Splunk Enterprise Security (ES), Cisco Security telemetry, Cisco Talos Intelligence, and Endace continuous packet capture, our joint team of Cisco, Splunk, Endace, and Jamf engineers demonstrated what multi-agent threat detection, investigation, and response (TDIR) delivers at enterprise scale.

Watch it come to life in David Bombal’s Interview at the Agentic SOC.

“The Agentic SOC is not about replacing human defenders with autonomous black boxes.

AcknowledgementsOur thanks to the engineers who built the Agentic SOC and the Humans who provided decision making expertise.

Splunk .conf26 gave us the opportunity to operate a live Agentic Security Operations Center (SOC) in the middle of the Splunk community.

Splunk ES as the SOC data platformSplunk ES served as the primary analyst workspace and evidence system for the SOC.

Building the Triage Agent Dashboard in an AfternoonOnce the data was flowing and the agent was active, we built an operations dashboard in an afternoon.

The team preserved a path from telemetry to finding, from finding to agent analysis, and from agent analysis to an analyst decision.

Dashboard SnapshotThe following values are a snapshot from the displayed Triage Agent operations dashboard and should be read as event-environment observations…

The Cisco Secure Firewall 200 Series brings enterprise-grade protection and connectivity to distributed branches in a compact form factor.

The Encrypted Visibility Engine (EVE) uses AI and machine learning to analyze encrypted traffic, including TLS 1.3, without requiring full decryption.

The Secure Firewall 220 model delivers up to 1.5 Gbps of throughput with next-generation firewall capabilities enabled in a compact form factor for smaller branches.

The Secure Firewall 200 Series helps meet these demands with intelligent threat protection, encrypted traffic visibility, resilient connectivity, and centralized management.

Explore the Secure Firewall 200 Series to build a more resilient, man…

Architecting the Future: The Four Pillars of Agentic SecuritySecuring agentic AI requires a new strategic framework.

Pillar 2: Core ProtectionDelivered by: Cisco AI DefenseCisco AI Defense provides specialized protection for the AI models themselves and their operational environment.

AI Inventory & Validation: This solution catalogs all deployed AI models and continuously validates their integrity against supply chain risks.

Pillar 4: ObservabilityDelivered by: SplunkSplunk provides the unified intelligence platform required to monitor and respond to agentic AI at scale.

Splunk ingests logs, events, and telemetry from Duo, Secure Access, AI Defense, and other infrastructure points, creating…

Cisco was proud to return to Black Hat USA as the Official Security Cloud Provider and the longest-standing partner of the Black Hat Network Operations Center (NOC) and Security Operations Center (SOC).

In 2026, we completed our 11th year helping protect the Black Hat network, working side by side with the Black Hat NOC leaders and official technology partners: Palo Alto Networks, Arista, Corelight, Jamf and Lumen.

For Black Hat USA 2026, the Cisco and Splunk team brought together telemetry and workflows across Cisco Security, Splunk Security, and partner-provided network and security controls.

The same signal may need to be understood by Cisco, Splunk, Black Hat leadership, and partner tea…

I did not walk into Black Hat with years of incident-response experience or an encyclopedic knowledge of threat actors.

The first time I walked into the Black Hat NOC, where the SOC team was operating, was a few days before the event began.

I was surrounded by people with years—sometimes decades—of experience, many of whom had supported Black Hat for years.

Check out the other blogs from our team at Black Hat USA 2026.

Driven by the needs of the community, Black Hat events showcase content directly from the community through Briefings presentations, Trainings courses, Summits, and more.

To handle this task, Cisco and Black Hat deployed bespoke ThousandEyes agents to monitor the wireless solution.

Our thanks to the Arista Networks team in the Black Hat NOC for their partnership throughout the week.

You can read the other blogs from our colleagues at Black Hat USA.

Driven by the needs of the community, Black Hat events showcase content directly from the community through Briefings presentations, Trainings courses, Summits, and more.

For more information, please visit the Black Hat website.

With Matthew Bair2026 marks the fourth consecutive year we’ve used ThousandEyes to monitor the Black Hat USA network for latency.

As our latency monitoring mesh has expanded to cover more and more of the conference, we’ve also begun supplementing our ThousandEyes monitoring with on-demand Linux commands to track latency across different protocols.

The Key ThousandEyes TestsThe automated ThousandEyes tests that inform our dashboards include HTTPS connectivity tests, the monitoring of cloud services, agent to agent tests, internal and external DNS resolution, and even file downloads.

On-Demand Latency Tests from the Agent MeshPing and traceroute are the go-tos for anyone who wants to do a qui…

DNS continues to provide one of the clearest windows into activity across the Black Hat network.

At Black Hat, however, the value of DNS goes well beyond traditional threat blocking.

Its 4.42 million blocks represented 79.3% of every blocked DNS request .. Apple privacy-relay and encrypted-DNS hostnames collectively accounted for approximately 97.9% of blocks among the top blocked destinations.

For the Black Hat NOC/SOC, Secure Access DNS telemetry gives analysts a high-value control point and an investigative starting point.

Driven by the needs of the community, Black Hat events showcase content directly from the community through Briefings presentations, Trainings courses, Summits, and mo…

Microsoft Defender XDR provides detections and hunting queries for suspicious Microsoft Graph activity and activity associated with known threat infrastructure.

Microsoft Threat Intelligence has identified threat actors across multiple geographic regions leveraging the ARTEX framework.

Preserve available Microsoft Entra sign-in and audit records, Microsoft Purview Audit records, SIEM data, and previously configured Microsoft Graph telemetry.

Suspicious sign-in from verified nation-state threat actor infrastructure Steal Application Access TokenA sign-in was observed from a known threat actor IP address.

We recommend promptly investigating this alert, as a threat actor might already be using…

Guardian Agents help security teams operate continuously, at machine speed and scale, while sensors, context, and actuators across the cyber stack help understand changing agent risk and continuously adapt protection in response.

Dynamic Agent RiskDynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity.

Guardian Agents carry out the work at machine speed, adapting as agent activity, risk, security context, and organizational policy change.

To learn more about Microsoft Security solutions, visit our website.

Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

As enterprises choose which models to deploy, the relevant question is broader than whether a model is open-weight or closed-weight.

Today, Microsoft and NVIDIA are publishing Risk Management for Open-Weight Models in Enterprise, the first in a planned series of joint resources intended to help enterprises address those questions.

Model access and deployment are separate choices: open-weight models can also be used through managed platforms.

Building on this workRisk Management for Open-Weight Models in Enterprise focuses primarily on the model layer.

Read the joint Microsoft-NVIDIA paper, Risk Management for Open-Weight Models in Enterprise.

Microsoft’s research into one phishing kit unraveled a larger ecosystem, including the phishing kit developers, an infrastructure dealer, and the threat actors who buy from both.

Downstream activity from Storm-2990 phishing kitsMicrosoft observed downstream activity by threat actors using infrastructure affiliated with the Storm-2990 phishing kits.

Most of the activity that stems from this phishing kit ecosystem consists of social engineering, phishing operations, and account and storage takeovers.

ReferencesLearn moreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories and insights from the Micr…

Early testing can surface compatibility and process gaps before post-quantum authentication is required at scale.

As the industry moves toward post-quantum authentication, security teams will need greater visibility into those dependencies.

Why organizations should begin preparing nowThe transition to post-quantum authentication is unlikely to be a single technology upgrade.

Testing the future certificate ecosystemTo help the ecosystem gain practical experience with post-quantum authentication, Microsoft launched the PQC TLS Pilot Program on August 27, 2026.

What organizations can do todayOrganizations do not need to wait for broad industry adoption to begin preparing for post-quantum authe…

The mission of Microsoft Security’s Frontier Offensive Research & Generative Exploitation (FORGE) Lab is to advance the frontier of autonomous security engineering.

We’re building a team that enables AI-native vulnerability research at Microsoft, pushing the boundaries of finding and fixing zero-day vulnerabilities.

Three lessons follow, each marking a shift in how we approach vulnerability research:From frontier capability to scale.

Here, we focus on what those experiences teach us about operating vulnerability research at scale—across Windows and open-source projects.

FORGE has submitted nine Linux findings with internally assessed common vulnerability scoring system (CVSS) scores above 7…

How do frontier AI models change vulnerability management for CISOs?

We use a ‘harness’ layer around AI models in vulnerability scanning for better results.

They should do so without delay, rather than wait for access to frontier AI models.

Extensive guidance can be found in a new Microsoft Security Exposure Management page with capabilities customers can use to act.

Final notesThe advent of frontier AI models to discover and exploit vulnerabilities creates both risks and opportunities.

How do frontier AI models change vulnerability management for CISOs?

We use a ‘harness’ layer around AI models in vulnerability scanning for better results.

They should do so without delay, rather than wait for access to frontier AI models.

Extensive guidance can be found in a new Microsoft Security Exposure Management page with capabilities customers can use to act.

Final notesThe advent of frontier AI models to discover and exploit vulnerabilities creates both risks and opportunities.

Every year, the Microsoft Digital Defense Report gives us an opportunity to step back from individual threats and look broadly at what Microsoft’s security and threat intelligence teams are seeing.

These developments can change the speed and scale of security activity even as the underlying security fundamentals remain familiar.

People, identities, exposed systems, and trusted access continue to feature prominently in the threat activity Microsoft observes.

The 2026 Microsoft Digital Defense Report looks across the threat landscape, cybercrime, resilience, and the relationships among technologies, identities, systems, and people.

Read the 2026 Digital Defense Report for the full findings, d…

Trusted channels can enable this exchange among government agencies, law enforcement, critical infrastructure operators, technology providers, and international partners while respecting legal and privacy requirements.

As cyber incidents cross organizational and national boundaries, resilience depends not only on technical preparedness, but on whether institutions can coordinate effectively under pressure.

In an era of AI-enabled and increasingly interconnected cyber threats, resilience is no longer simply about recovering from an attack.

It is about preparing for a world in which cyber incidents move faster, spread further, and affect more organizations than ever before.

Governments best p…

Every year, the Microsoft Digital Defense Report gives us an opportunity to step back from individual threats and look broadly at what Microsoft’s security and threat intelligence teams are seeing.

These developments can change the speed and scale of security activity even as the underlying security fundamentals remain familiar.

People, identities, exposed systems, and trusted access continue to feature prominently in the threat activity Microsoft observes.

The 2026 Microsoft Digital Defense Report looks across the threat landscape, cybercrime, resilience, and the relationships among technologies, identities, systems, and people.

Read the 2026 Digital Defense Report for the full findings, d…

Trusted channels can enable this exchange among government agencies, law enforcement, critical infrastructure operators, technology providers, and international partners while respecting legal and privacy requirements.

As cyber incidents cross organizational and national boundaries, resilience depends not only on technical preparedness, but on whether institutions can coordinate effectively under pressure.

In an era of AI-enabled and increasingly interconnected cyber threats, resilience is no longer simply about recovering from an attack.

It is about preparing for a world in which cyber incidents move faster, spread further, and affect more organizations than ever before.

Governments best p…

Join fellow customers and Microsoft Security leaders for a night designed to make meaningful connections.

Partners and the Microsoft Intelligent Security AssociationMicrosoft Intelligent Security Association (MISA) members have a full week ahead at Microsoft Ignite.

Sessions to watch forWhen AI acts, security has to answer: Microsoft Security for AI , the platform view of securing agentic AI.

Strengthen and Manage Data Security Posture with Microsoft Purview , on data security posture management in practice.

Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The operators first validated command execution using lightweight out-of-band probes to unique subdomains hosted on public interaction and collaborator services, including oast[.

When a service-state change triggers health monitoring, swatchdog incorporates the attacker-controlled value into a snmptrap shell invocation, enabling command execution.

Exploitation of the Zimbra vulnerability provided attackers with direct command execution as the zimbra service account.

Attackers also used the initial command execution to download and execute content directly through wget or curl, launch background processes, and establish interactive reverse shells.

Command and controlThe actor used HTTP and H…

Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them.

Early experiments revealed a significant volume of "benign" prompt injection text, which illustrates the complexity of distinguishing between functional threats and harmless content.

Many prompt injections were found in research papers, educational blog posts, or security articles discussing this very topic.

(Source: GitHub/swisskyrepo)When searching for prompt injections naively, the majority of detections are benign content – false positives in our case.

Malicious: ExfiltrationWe were able to observe a small number of prompt injections that aim at theft of data.

Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities.

Following our previous discussion on "Deploying Rust in Existing Firmware Codebases", this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware.

Hook-up Rust to modem firmwareBefore building the Rust DNS library, we defined several Rust unit tests to cover basic arithmetic, dynamic allocations, and FFI to verify the integration of Rust with the existing modem firmware code base.

Pixel modem firmware already has a well-tested and specialized global memory allocation system to…

This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.

Session theft typically occurs when a user inadvertently downloads malware onto their device.

Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server.

How DBSC WorksDBSC protects against session theft by cryptographically binding authentication sessions to a specific device.

The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the correspondi…

Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini.

In our previous blog “Mitigating prompt injection attacks with a layered defense strategy”, we reviewed the layered architecture of our IPI defenses.

Synthetic data generationAfter we discover, curate, and catalog new attacks, we use Simula to generate synthetic data expanding these new attacks.

We partition the synthetic data described above into separate training and validation sets to ensure performance is evaluated against held-out examples.

This process leverages the newly generated synthetic attack data described on this blog, to create a robust, end-to-end evalu…

2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉!

Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer.

Vulnerability Reward Program 2025 in NumbersWant to learn more about who’s reporting to the VRP?

Tip: Want to be informed of new developments and events around our Vulnerability Reward Program?

Follow the Google VRP channel on X to stay in the loop and be sure to check out the Security Engineering blog, which covers topics ranging from VRP updates to security practices and vulnerability des…

To stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC).

To bring these critical protections to the wider developer community with minimal friction, the transition will be supported through Play App Signing.

Play App Signing leverages Google Cloud KMS, which helps ensure industry-leading compliance standards, to secure signing keys.

Empower Developers : The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and application.

: The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and …

Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers.

Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group.

Since MTC technology shares significant architectural similarities with CT, these operators are uniquely qualified to ensure MTCs are able to get off the ground quickly and successfully.

The Chrome Quantum-resistant Root Program will operate alongside our existing Chrome Root Program to ensure a risk-managed transition that maintains the highest levels of security for all users.

First, we…

For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.

As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead.

Expanding Scam Detection for Calls to Samsung DevicesTo help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud.

Scam Detection for phone calls on Google Pixel devices is available in the U.S., Australia, Canada, India, Ireland, and the UK.

Powered by Gemini’s on-device model, Scam Detection provides intelligent protection against scam calls while ensuring that…

Upgrading Google Play’s AI-powered, multi-layered user protectionsWe’ve seen a clear impact from these safety efforts on Google Play.

As Android’s built-in defense against malware and unwanted software, Google Play Protect now scans over 350 billion Android apps daily.

This proactive protection constantly checks both Play apps and those from other sources to ensure they are not potentially harmful.

Looking aheadOur top priority remains making Google Play and Android the most trusted app ecosystems for everyone.

Thank you for being part of the Google Play and Android community as we work together to build a safer app ecosystem.

That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.

Today, we're announcing a powerful set of theft protection feature updates that build on our existing protections, designed to give you greater peace of mind by making your device a much harder target for criminals.

These updates are now available for Android devices running Android 16+.

More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts.

This feature is now getting a new dedicated enable/disable toggle in settings,…