Лингвист объяснила, почему связная речь ещё не доказывает наличие мыслей.

Мечта астрофизиков сбылась: свойства бездны теперь можно изучать в лаборатории.

Специалист сумел получить максимальные привилегии, даже не проходя авторизацию.

Всё начинается с обычной единицы, а дальше в игру вступает неожиданная хитрость с записью чисел.

Вредоносные инструкции могут годами оставаться незаметными, пока не появится секретный сигнал.

Поддержка Unstoppable Domains позволила незаметно заменить адрес получателя перед отправкой ATOM.

Правозащитники считают, что пользователи должны знать о скрытых языковых фильтрах и самостоятельно управлять их работой.

Разработчика предупреждали почти год, но опасные ошибки так и остались без исправлений.

В тестах нейросеть за 32 секунды нашла последние личные диалоги, подсчитала непрочитанные сообщения и пересказала их содержание.

Исходный код Kandinsky S2V опубликован под MIT, а обученные модели доступны для самостоятельного запуска и доработки.

Самый опасный враг VPN может находиться внутри самого смартфона.

Исследователи зафиксировали успешную атаку на Alpine Linux менее чем через девять часов после раскрытия уязвимости.

Даже самая осторожная из пяти систем не смогла полностью защититься от зрительных уловок.

Они поддерживают разные типы ловушек и приманок, интегрируются с SIEM, SOAR и другими средствами ИБ, автоматизируют создание и развёртывание ложных объектов.

Отдельные компании используют honeypot и приманки на базе специализированных или открытых решений.

Для удобства мы разделили все вошедшие в обзор решения на две категории — в соответствии с их архитектурой и ролью в защитном контуре.

Ловушки и приманки создаются автоматически, а их работу можно настроить под конфигурацию сети и особенности инфраструктуры компании.

R-Vision TDPR-Vision TDP — DDP-платформа, которая создаёт в сети взаимосвязанные ловушки и приманки для обнаружения атакующих.

Рынок ITSM в России растёт каждый год, но большинство компаний всё ещё используют системы только для регистрации заявок.

Эксперты обсудили, как отличить зрелое решение от классического сервис-деска, зачем нужна CMDB и что изменит ИИ.

Дмитрий Сёмин добавил, что ITSM позволяет повысить прозрачность: раскрыть, что выполняло ИТ, в какой срок и сколько это стоило в рублях.

Граница будет сдвигаться, и прогресс в области ITSM и low-code-платформ за последние шесть-девять месяцев очень заметен.

Илья Шабанов отметил, что основная проблема при новом внедрении — подходить к ITSM как к организационному проекту: формализовать процессы, понять, какие услуги оказывает ИТ.

Эксперты рынка обсудили, что изменилось в регуляторике КИИ, как проверять защиту на практике и что сделать до 1 марта 2027 года.

Он используется, если объект не найден в типовом перечне и в методике категорирования пока нет чётко зафиксированных особенностей по всем отраслям.

Константин Закатов:«К моменту проведения проверки уже всё должно быть готово и в актуальном состоянии — инфраструктура проинвентаризирована, настроена, грамотно работает.

Документация, процессы и категорирование — это важно, но выйти в поле и посмотреть, что происходит на практике, заглянуть в детали — обязательно».

Константин Закатов:«Следить за новыми технологиями, делать правильные выводы и не бояться — архитектурно…

Как развивались системы SGRC в России и GRC за рубежомНа международном рынке GRC-платформы существуют уже несколько десятилетий.

В августе компания опубликовала документ «Innovation Insight: Cyber GRC Streamlines Governance», а в апреле 2026 года представила новое исследование «Innovation Insight: Cyber GRC».

Три общих направления развития SGRC и Cyber GRCРазработчики SGRC и Cyber GRC всё чаще стремятся объединить технические данные, оценку рисков и управленческие процессы.

Поэтому SGRC и Cyber GRC теперь связывают информацию об активах и бизнес-процессах с угрозами, уязвимостями, результатами аудитов и реализованными мерами защиты.

SGRC и Cyber GRC как прослойка между источниками данных и …

Вместе с экспертами разбираем, что опаснее — «перезаложить» или «недозаложить» мощности, и как облака помогают бизнесу справляться с сезонными нагрузками.

ВведениеКогда-то сезонность в ретейле была предсказуемой: «красный океан» с сентября по декабрь, мёртвый сезон в январе и постепенный рост к лету.

Как на самом деле проверяют нагрузкуНиколай Минаков описывает, как это происходит в РИВ ГОШ:При расчётах нужно смотреть на механики рекламных акций и поведение пользователя в целом.

Позиция Николая Минакова такая: облака — не благо и не зло, а инструмент, который нужно правильно использовать.

Станислав Попов предупреждает, что дублирование не работает: расчёт на размещение копии в облаке как на…

Одно и то же число нужно и на основном слайде, и в summary, и в финальном выводе.

Гейты работают не с исходными данными, а с готовым артефактом: текстом, извлечённым из PDF, структурой слайдов и результатом рендера.

Общий смысл всех трёх групп один: отчёт выглядит готовым только после того, как прошёл гейты, а не после того, как отрисовался.

Теперь оно начинается не с вопроса «а всё ли вообще сошлось?», а с вопроса «правильно ли мы это интерпретируем?».

Где это не нужно и что не ловитЛегко прочитать всё предыдущее как «стройте CI для любой презентации».

Причём там обсуждалась реальная практика, в том числе и не вполне однозначный опыт.

В сочетании с языком Python и ИИ-моделью GigaChat от Сбера она позволяет создавать тестовые рассылки в электронной почте и мессенджерах.

Однако как для очень крупных, так и для совсем небольших компаний бесплатные продукты, скорее всего, не подойдут.

Одну из таких использовали и для организации обучения и тестирования сотрудников AM Live.

Это будет снижать их эффективность и, что хуже, создавать иллюзию защищённости и в итоге может приводить к возникновению инцидентов.

Linux-инфраструктура особенно выделяется своей сложностью как для атакующих, так и для ИБ-специалистов, защищающих её.

Его нужно проводить по каждой системе отдельно, и в крупной инфраструктуре с сотнями серверов это кардинально меняет экономику проверки.

Что изучать и на что обращать вниманиеПервое, с чего стоит начинать на каждой системе, — список процессов и сетевых соединений.

Специфика закрепления в Linux-системахЗлоумышленники используют специальный набор техник для закрепления в Linux-инфраструктуре, и часть из них сложно обнаружить стандартными средствами.

Проверка переменной LD_PRELOAD в «/etc/ld.so.preload» и в окружении подозрительных процессов — обязательный пункт аудита, которы…

Как и в других отраслях, использование ИИ — один из путей снижения издержек и роста производительности труда.

К тому же для ИТ-отрасли, которая активно предлагает продукты с ИИ, не использовать такие средства самой было бы просто нелогично.

Владимир Лавров поделился опытом использования ИИ как для оптимизации бизнес-процессов, так и для ускорения разработки.

Поэтому нужно сначала выстроить методологию, платформу и инфраструктуру, затем определить задачи для ИИ и только после этого масштабировать автоматизацию.

Некоторые показатели внедрения ИИ в российских компанияхТакже использование ИИ создаёт большие риски в сфере подготовки кадров.

Для ЦОДов такой механизм может ускорить запуск новых площадок, но не отменяет требования к непрерывности их работы.

Она также поможет ускорить ввод и не ждать строительства дополнительных электростанций и сетей.

При подключении по IV категории то оборудование, которое раньше служило аварийным резервом, берёт на себя роль второго потока обеспечения непрерывной работы объекта.

Надёжность всего дорожеКак именно IV категория надёжности в качестве сценария запуска ЦОДов повлияет на стоимость их сервисов, рынок пока только считает.

ВыводыIV категория надёжности не отменяет требования ЦОДа к непрерывности работы — она переносит часть задачи с внешней энергосистемы на самого оператора.

Выбор СУБД: универсальность против специализацииБудущее за универсальными СУБД, где есть и транзакционная, и аналитическая часть, или специализация останется?

Алексей Викулин согласился, что всё идёт от задачи, но большинство задач бизнеса соединяют потребность и в аналитике, и в транзакциях.

К SQL Server совместимость 98%, и к ним прилагаются компоненты инфраструктуры вроде Service Broker и SSRS (SQL Server Reporting Services).

Гарантию совместимости может дать только вендор прикладного решения, и идеальный вариант — когда вендоры СУБД и приложения работают в синергии.

Высокий порог входа требует от вендоров упрощения администрирования, развития инструментов управления СУБД и обучения спец…

Ретейл — цель номер одинНа ретейл приходится около 25 % всех утечек данных в России и 33 % в мире: больше, чем на любую другую отрасль.

У среднего ретейлера сотни интеграций, многие из которых давно забыты и не обновляются.

Полномочия сервиса рассчитываются централизованно и передаются в самом токене, а не зашиваются в конфигурацию.

Готовое решение обходится бизнесу выгоднее самописной логики на фронте и при этом делает вход проще, а не сложнее.

Он значительно усиливает защиту данных, передаваемых между аутентификатором и сервером, от перехвата и служит для входа в почту, CRM-систему и корпоративный VPN.

NAC перестал быть экзотикой: сегодня он определяет, кто и что попадает в корпоративную сеть, куда и на каких условиях.

Network Access Control перестал быть экзотикой и стал инструментом, который определяет, кто и что попадает в сеть, куда и на каких условиях.

Станислав Калабин согласился и добавил, что NAC всегда работает в комплексе с сетевым оборудованием и не может быть самостоятельным решением.

Появились разнородные устройства и несколько видов подключений, которые нужно контролировать, и без централизованного инструмента, который даёт картину и позволяет управлять, мониторить и реагировать, уже сложно.

Финальный опрос показал, планируют ли зрители усиливать контроль сетевого доступа по…

ВведениеПри выборе DLP-системы бизнесу приходится искать баланс между возможностями защиты и затратами на её внедрение и эксплуатацию.

Поэтому при выборе DLP важно учитывать не только стоимость лицензии и количество контролируемых каналов, но и совместимость с ИТ-инфраструктурой, потребление ресурсов, отказоустойчивость и возможности автоматизации.

«СёрчИнформ КИБ» работает на серверах под управлением Windows и Linux, контролирует ПК на Windows, Linux и macOS.

Управлять КИБ на любой инфраструктуре можно из десктоп-приложения и в единой веб-консоли в браузере с любого устройства.

«СёрчИнформ КИБ» поддерживает разные типы блокировок — по действиям, по контексту и по контенту.

Продукт относится к платформе «Р7-Офис», включённой в Реестр отечественного ПО, что позволяет применять его в госучреждениях и компаниях с госучастием.

Такой файл может включать около миллиона строк, однако «P7-Аналитика» позволяет обрабатывать огромные массивы данных без потери производительности.

Показатели выгружаются преимущественно из учётных и CRM-систем в виде таблиц данных и представляют собой числовые значения интересующей позиции учёта.

Загрузка показателейЧтобы загрузить табличный файл или подключить корпоративный источник данных (например, 1C или Битрикс24), нужно выбрать вкладку «Загрузка данных» в разделе «Настройки» главного меню программы.

Таким образом, пользователь может с…

ЛЮБОЙ PHP код атакующего будет выполнен внутри процесса PHP на твоем сервере, еще ДО того, как начнёт выполняться твой код.

Если PHP работает с правами администратора системы - то, "да простится тебе эта ошибка!".

А теперь давай посмотрим, что обычно разрешено процессу PHP на твоём сайте:Читать исходники сайта?

То тогдаЗлоумышленник всё ещё сможет выполнять код внутри твоего PHP (если php патч не установлен).

Возможности закрепиться на сервере у атакующего или не будет или щанс на это существенно снизится.

Очередной проект выходного дня: представляем произвольные данные (как номер криптокошелька, сид-фразу, номер карты, номер телефона и пр.)

Слово не из словаря или стоящее не на своем месте отбрасывается сразу, еще до проверки суммы, а опечатки программа исправляет сама.

Зная шаблон и номера слов, программа собирает число, проверяет контрольную сумму, отбрасывает номер варианта и получает цифры карты.

На каждое значение и номер варианта приходится около 1 200 возможных предложений, но правильное из них только одно, и какое именно – определяет контрольная сумма.

Почему 8 байт в предложении, а не 10 и не 48 байт – удобная единица.

Разберу её глазами компании-работодателя: дальше «вы» - это работодатель, а агентство - всегда третья сторона.

Сначала - что сделало агентство и в какой роли.

Первое - от имени соискателя действует кадровое агентство, с которым он заключил договор.

Сообщить кандидату об обработке вашей компанией может и агентство - важно, чтобы уведомление было именно о вас и его можно было подтвердить.

Рискуют обе стороны звонка: прежний работодатель - и те, кто спрашивал, то есть агентство и вы как заказчик проверки.

Взломали не инфраструктуру и не смарт-контракт, а провайдера, который мерил скорость загрузки его страниц.

А в блокчейне видно 985 несанкционированных выводов за тот же час, и все они прошли через официальный relayer Polymarket с валидными авторизациями кошелька.

Для браузера ничего не изменилось: правильный домен, тот же адрес, тот же origin, что у самого сайта.

Образец исследователи не запускали, так что это разбор кода, а не запись атаки.

С ИИ атак станет больше, и приходят они не в контракты, а в такие вот скрипты и подрядчиков.

И, что важнее, он хранится как хранилище, к которому можно делать запросы и из которого (якобы) берут данные языковые модели.

Столбцы — subject , predicate , relationshipId , relationshipPredicate и object , и в каждой строке есть ещё confidence , sources , sourceDuplicates и timestamp .

Шестьдесят одна бледная точка — та часть, которой никто не ждёт: люди, которых хранилище знает и не разместило.

Ему это и не нужно.

Год общения по каждому человеку, входящие и исходящие, звонки и дата последнего контакта по пяти мессенджерам — и, как и сказано в подзаголовке, ни слова текста.

Kata с QEMU потребовалось 7,09 секунды (в 31,7 раза дольше, чем runc), а с Cloud Hypervisor – 6,12 секунды (в 27,3 раза дольше).

При таком подходе компиляция Lua в gVisor занимала в 1,15 раза больше времени, чем в runc, в Kata с QEMU – в 1,39 раза, а с Cloud Hypervisor – в 1,48 раза.

На моей машине выполнение docker run --rm с командой true заняло 0,22 секунды с runc, 7,09 секунды с Kata 4.3 и QEMU (в 31,7 раза дольше) и 6,12 секунды с Kata и Cloud Hypervisor (в 27,3 раза дольше).

Для контейнера в простое суммарная PSS связанных с ним процессов составила 11,5 МиБ с runc, 48,6 МиБ с gVisor, 302 МиБ с Kata и QEMU и 199 МиБ с Kata и Cloud Hypervisor.

Создание виртуального окружения Python, уст…

Как устроена фильтрация и что работаетОбзор по состоянию на ноябрь 2026 г. Основан на практической настройке цепочки «РФ → Европа» и замерах из сети Ростелекома.

), идущие на IP, не принадлежащий владельцу домена, — режутся Маскировка под «крупный чужой сайт» перестала работать Сигнатуры протоколов Распознаются OpenVPN, WireGuard, IPsec/L2TP, PPTP, старый Shadowsocks и др.

Минусы: две аренды, на входном узле лежит часть рисков (IP с сайтом может попасть под блок вместе с VPN).

Не работает против: блокировки по IP и «заморозки» по адресу — пакеты всё равно идут на заблокированный адрес.

Сайт по умолчанию: на выходном узле настроить nginx default_server с нейтральным сайтом — его увидит всяки…

«Ночная консолидация угрозы»Неизвестный мастер«Ночная консолидация угрозы»Первая треть XXI векаЦифровая живопись, генеративная техникаРазмеры вариативны.

Художник последовательно разрушает границы между природным и технологическим, сакральным и утилитарным, съедобным и потенциально уголовно наказуемым.

Особого внимания заслуживает капюшон как центральный семиотический оператор произведения.

Если капюшон может существовать без хакера, то может ли хакер существовать без капюшона?

Его художественное значение определяется не тем, что именно делают изображённые существа, но тем, насколько убедительно они выглядят как существа, которым ни в коем случае нельзя доверять.

Почему нельзя застроить всё одинаковыми башнямиПравило одно: у каждого модуля есть своё назначение, как и у реального средства защиты.

Вопрос к защите тут простой: она ограничивает соединения или понимает, что по ним прислали?

Идея «опасность приходит снаружи» тут перестаёт работать, и появляются другие вопросы: куда можно дотянуться из этой точки сети и что считать нормальным поведением сотрудника?

Здесь защита зависит от того, как в компании устроена работа.

А тут приходится задуматься: если урона не видно, значит ли это, что всё в порядке?

Хотелось увидеть не только то, что помощник оставил на диске, но и то, что получил сервер модели (и оставил у себя).

Для теста, сторону провайдера представляет наш HTTP-сервер, который сохраняет историю чата из запросов к модели.

Если отправить те же запросы к модели в облачный сервис, содержимое получит уже его сервер.

Сервер не ищет файлы и не обрабатывает обрезанные результаты.

А именно, запрет в исходном запросе к модели не стал техническим ограничением клиента.

Уязвимость позволяет заставить сервер самостоятельно отправлять запросы туда, куда пользователь напрямую обратиться не может.

Что такое SSRF и откуда берётся проблемаSSRF относится к классу уязвимостей, при которых злоумышленник управляет запросами, выполняемыми серверной частью приложения.

Они используются для получения информации об экземпляре, его конфигурации и, в некоторых случаях, временных учётных данных.

Как правильно защищаться от SSRFУниверсальной проверки, которая решает все проблемы SSRF, не существует.

Как проверить приложение на SSRFДля проверки собственной инфраструктуры можно использовать специально созданное тестовое окружение.

Четвертый спецвыпуск «Хакера» — самый новый из наших бумажных сборников: в него вошли более 20 технических материалов за 2021–2022 годы, посвященные пентесту, поиску уязвимостей, реверсу и необычному железу.

Спецвыпуск #4 (2021–2022)Четвертый спецвыпуск, вышедший из типографии летом 2026 года, охватывает лучшие статьи «Хакера» за 2021–2022 годы.

В нашем магазине доступны и другие бумажные сборники «Хакера», но их запасы постепенно сокращаются: первые два спецвыпуска уже распроданы полностью, а дополнительных тиражей мы не планируем.

Поэтому, если какого-то номера не хватает в твоей коллекции, лучше не откладывать покупку в долгий ящик.

Как и в других номерах, статьи дополнены комментариями …

Представители Beget опубликовали новый отчет о восстановлении после масштабной кибератаки, произошедшей в начале текущей недели.

Восстановить все данные VPS также не удастся: файловые бэкапы сохранились примерно для половины пользователей.

Изначально в Beget заявляли, что в облачной инфраструктуре, включая VPS, S3 и Kubernetes, были потеряны все данные, а также настройки CDN и IP.

Первые такие работы должны начаться 7 ноября, и в течение примерно пяти дней в панели также планируют добавить возможность самостоятельно скачать свой бэкап.

Также в Beget сообщили, что сотрудничают с правоохранительными органами, сторонними ИБ-компаниями, ТЦИ/КЦ, НКЦКИ и другими госорганами.

На­доело гуг­лить, как в PowerShell сде­лать то и это?

Его мож­но уста­новить и на Linux, и на macOS.

Тог­да как до «шес­терки» пошик работал на .NET Framework и толь­ко в Windows.

PowerShell -- source winget pwsh # Либо найди в меню «Пуск» PowerShell версии 7Внеш­не работа с PowerShell очень похожа на работу с Bash.

То есть в PowerShell перечис­ляем свой­ства объ­ектов, а в Bash опи­сыва­ем, что делать с тек­стом.

Пользователям рекомендуют срочно обновить DSM, а также закрыть доступ к панели управления NAS из интернета.

CVE-2024-50629 (5,3 балла) дает возможность читать некоторые файлы на устройстве, а CVE-2024-10445 (4,3 балла) — записывать их.

Также, помимо установки патчей, в Synology советуют включить автоматические обновления.

Следует отметить, что предупреждение было опубликовано после многочисленных жалоб со стороны владельцев Synology NAS.

Эти баги позволяют удаленно читать и записывать произвольные файлы на устройстве, а также проводить DoS-атаки.

Министерство внутренней безопасности США (DHS) обязало федеральные органы исполнительной власти удалить продукты Acronis из своих систем до 27 января 2027 года.

Журналисты напоминают, что компания Acronis была основана в Сингапуре в 2003 году, а в настоящее время ее штаб-квартира находится в Шаффхаузене, Швейцария.

Так, в июле 2026 года американские власти запретили использовать продукты Acronis в информационных системах американских разведывательных ведомств, а позже аналогичные меры приняли Управление общих служб США (GSA) и Министерство обороны.

В этом отношении ситуация отличается от истории с «Лабораторией Касперского»: ее продукты сначала запретили использовать федеральным ведомствам …

Представители Apple заявили, что с выходом iOS 27.3, iPadOS 27.3, macOS 27.3 и visionOS 27.3 весь контент, которым пользователи делятся через общедоступные ссылки iCloud, будут проверять на наличие «вредоносных материалов».

При этом в компании пока не объяснили, что именно подпадает под это определение, и как будет работать такая проверка.

В компании подчеркивают, если пользователь делится материалами по общедоступной ссылке, они становятся доступны и Apple.

При этом в Apple не уточнили, что именно считается «вредоносным контентом», будут ли пользовательские материалы проверять автоматические системы, ИИ или живые модераторы.

Также в документации Apple отмечается, что компания может отклони…

В OpenAI рассказали о масштабном эксперименте, проведенном с еще не выпущенной ИИ-моделью, предназначенной для решения задач в области кибербезопасности.

В компании заявили, в ходе 30-часового запуска пайплайна ИИ-агенты динамически подтвердили сотни уязвимостей в ядре Linux, а также создали рабочие эксплоиты для локального повышения привилегий до уровня root.

Эксперимент обошелся компании в 1,2 млн долларов США в API-кредитах, а стоимость одной LPE-уязвимости составила примерно 1279 долларов США.

В общей сложности этот эксперимент стоил OpenAI 1 213 430 долларов США в API-кредитах, то есть примерно 1279 долларов США за обнаружение одной LPE-уязвимости.

В OpenAI предупреждают, что в ближайш…

Независимый ИБ-исследователь Озгюн Кюльтекин (Özgün Kültekin) обнаружил уязвимость *sshhole, которая возникает при взаимодействии OpenSSH и библиотеки musl libc.

Уязвимость, которой еще не присвоили идентификатор CVE, затрагивает Linux-системы с musl libc, где OpenSSH работает без PAM и разрешена парольная аутентификация.

То есть в первую очередь речь идет об Alpine Linux, однако проблема может затрагивать и другие системы, собранные с использованием musl, в том числе решения на базе Buildroot и Yocto.

Следует отметить, что разработчики OpenSSH и musl расходятся во мнениях о том, на чьей именно стороне находится ошибка.

Защиту от *sshhole добавили в OpenSSH 10.6p2, а разработчики Alpine уже…

МВД России сообщило о пресечении деятельности хак-группы VasyGrek, также известной как Fluffy Wolf.

Ее участников подозревают в атаках на российские и зарубежные компании, краже денег со счетов организаций, а также создании и распространении малвари.

Сообщается, что для атак группа использовала сеть фишинговых доменов, имитировавших финансовые и бухгалтерские сервисы, а также виртуальные серверы за рубежом.

Также в 2025–2026 годах арсенал группы пополнился загрузчиком PowerLoader, использующим методы обхода защитных решений, и шифровальщиком Pay2Key.

В рамках расследования сотрудники МВД установили личности участников группы и провели обыски по местам их проживания и в офисах, в ходе которы…

Разработчики менеджера паролей mSecure предупредили нынешних и бывших клиентов о кибератаке и рекомендовали как можно скорее сменить сохраненные пароли, заново настроить двухфакторную аутентификацию (2ФА) и удалить passkey.

Однако всем нынешним и бывшим клиентам рекомендовали немедленно защитить конфиденциальную информацию, хранящуюся в mSecure: сменить пароли, сбросить или заново зарегистрировать методы 2ФА, а также удалить существующие passkey.

Эти рекомендации вызвали недоумение и недовольство со стороны пользователей, которые начали требовать объяснений на форуме поддержки mSecure.

Другой пользователь, у которого в mSecure сохранено свыше 500 паролей, попытался выяснить, касается ли пре…

Прос­ледим зна­чение от поля std:: string до инс­трук­ций SUB , CMP и JBE , про­верим фла­ги в GDB и запишем под­твержден­ный вывод в Ghidra.

( 5 > = num - 5) " < < std : : endl ; } std : : cout < < " num = " < < num < < std : : endl ; std : : cout < < " num - 5 = " < < ( num - 5 ) < < std : : endl ; } while ( num !

Без­зна­ковые и зна­ковые условные перехо­ды исполь­зуют раз­ные ком­бинации этих фла­гов, поэто­му одна и та же пос­ледова­тель­ность битов может учас­тво­вать как в без­зна­ковом, так и в зна­ковом срав­нении.

Поэто­му нам нуж­ны и зна­чение в регис­тре, и инс­трук­ция, уста­новив­шая фла­ги, и условный переход, который эти фла­ги про­веря­ет.

Пос­ле это­го оста­новим­ся перед…

Российские владельцы Li Auto (бренд Lixiang) столкнулись с новой волной «угонов» мастер-аккаунтов.

Летом 2025 года мы писали, что мошенники взламывают мастер-аккаунты владельцев автомобилей Li Auto и требуют у жертв от 200 000 до 250 000 рублей за возврат доступа.

Представители Sinomach Auto, официального дистрибьютора Li Auto в России, подтвердили журналистам наличие проблемы.

Распространить это решение обещают и на машины, ранее ввезенные по параллельному импорту, однако точные сроки пока неизвестны.

Сейчас пострадавшим рекомендуют не платить злоумышленникам выкуп, фиксировать произошедшее, а также обращаться в полицию и поддержку Li Auto.

Мы пополнили запасы, и сейчас в магазине «Хакера» снова доступны все четыре дизайна фирменных бейсболок .

Если в прошлый раз нужный вариант закончился или ты просто откладывал покупку на потом, самое время наверстать упущенное.

Все бейсболки рассчитаны на долгую носку: плотная ткань хорошо держит форму, удобный регулятор на кнопке помогает подобрать комфортную посадку, а объемная вышивка выглядит аккуратно и хорошо держится со временем.

В коллекции представлены четыре варианта: два с нашим фирменным лого и два с надписью «Хакер».

Бейсболки «Хакера» — это:плотная ткань, которая хорошо держит форму;удобная регулируемая посадка;объемная вышивка;четыре варианта дизайна на выбор.

Выяснилось, что хакеры готовились к ограблению несколько месяцев и использовали сразу несколько точек входа: вредоносную версию Homebrew, фальшивые собеседования, кастомную малварь и внутренний ИИ-инструмент компании.

Согласно отчету Binance, первые следы атаки относятся еще к июню 2026 года.

20 октября хакеры использовали этот зараженный ноутбук и внутренний ИИ-инструмент Binance, чтобы получить доступ к машинам еще двух инженеров.

Также подчеркивается, что после атаки в Binance перестроили затронутую инфраструктуру кошельков и внутренний ИИ-инструмент, заменили скомпрометированные устройства и отозвали все связанные с ними учетные данные и токены.

Расследование инцидента еще продолжается,…

Разработчики Flipper One начали подготовку к запуску кампании на Kickstarter и открыли предварительные заказы на новый девайс.

Правда, пока покупателям предлагают не сам Flipper One, а купон за 20 долларов США, который позволит приобрести устройство на Kickstarter по сниженной цене.

В настоящее время купон на Flipper One стоит 20 долларов США, а ранняя цена устройства на Kickstarter заявлена на уровне 379 долларов США.

«Мы не хотим стать очередным скам-проектом, который так и не выпустил продукт», — объясняет Жовнер.

На текущем этапе доставка Flipper One будет доступна только для пользователей из США и стран Европы.

Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them.

Software security company Apiiro said yesterday that 1,122 public copies of that file hold at least one secret, though it did not test whether any still work.

The researchers' advice is to rotate first: change every password, token, and key the file has ever held, then clean up.

In 539 of the 1,105 repositories the researchers traced, a commit listing Claude as a co-author changed the file.

What Apiiro FoundApiiro's search of public GitHub found 104,185 copies of the file in 103,617 repositories, its research write-up shows.

Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it.

The researcher advises blocking web access to the site's wp-content/upgrade folder before updating.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its catalog of known exploited vulnerabilities earlier this week.

On sites that allow automatic background updates, WordPress installs the fix automatically, via the same updater and the same steps.

The researcher says the flaw goes back to WordPress 2.7, released in 2008, and that those sites should move to a supported version.

An unauthenticated attacker can supply an oversized password to access accounts that are deliberately configured without usable passwords, without having to steal credentials or SSH keys.

The sshd daemon then compares with the asterisk stored in the account's password field, leading to a successful login.

"A successful SSHole attack grants access with the compromised account's existing permissions," Safe Security said.

Alpine is also recommending that users investigate "Accepted password for" log entries involving accounts that should not accept password logins.

"Look in /var/log/messages for sshd lines reading Accepted password for an account that has no password (alpine, root, or any key-…

OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.

The artificial intelligence (AI) company said GPT‑6 Cyber is also better than its predecessors like GPT‑5.6 Cyber and GPT‑6 Astra when it comes to following task boundaries and avoiding exploiting out-of-scope services in 99.93% of cases, up from 94.49% for GPT-5.6 Cyber.

"With those prompts, GPT‑6 Cyber stayed within bounds 100% of the time."

OpenAI Reports New Misalignment IncidentsGPT-6 Cyber's promise to stay within "rules of engagement" comes as OpenAI disclosed three misalign…

A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store.

The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today.

His test virtual machine has since moved to the fixed build on its own, through Store auto-update.

The CVE record for the flaw, which the company also publishes, still lists Paint as affected only below 11.2605.91.0.

As recently as last week, the advisory gave 11.2605.91.0 as the fixed build, according to a forum question on Microsoft Q&A.

A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.

The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop.

That let an extension running on the site send Claude Desktop instructions as if the user had sent them.

The test was run with the browser and Claude Desktop on the same computer, and the researchers report no real attacks.

What Dispatch Users Can DoIn Claude Desktop, Dispatch is part of Cowork and appears in the left-side panel.

An update on Athena, and some unsolicited predictions on what's coming nextOn Saturday, Dario Amodei published We Must Pace the Frontier.

We joined Anthropic's Project Glasswing and are finding our own vulnerabilities, and I'll show you what that looks like.

The short version: I'm more worried than I was in May, and more sure about what to do about it.

And the advisory layer has nothing to work with, because CVEs don't get filed for things already fixed at head.

If you take one thing from this post, take this: the flood is coming, and the pipes were already full.

"We still encourage you, where necessary, to reset your password on other systems where you may be reusing credentials."

From there, users can reset their passwords and rotate API keys to register transactions.

"We are working around the clock to harden our systems and bring Reactor and Data Solutions back online," Chainalysis said.

"We will require additional protections to access accounts, including that every user will have to reset passwords and rotate API keys as appropriate.

It's unclear who is behind the attack, but Chainalysis notes it was similar to "many other tech platforms in recent weeks."

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week.

The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs.

The installer handles only two versions of that web server, cwpsrv 1.15.10 and 1.24.0.

Process: run ps aux | grep cwpsrv and look for unexpected helper processes started by cwpsrv.

In the researchers' example, the socket check found the backdoor on a server where the list of open ports looked normal.

Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required.

It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access.

Affected Products and FixesThe authorization bypass affects only the Email Security Gateway.

The Email Security Gateway is fixed in version 9.4.0.030 and later.

The Email Security Gateway was hit in the 2023 attacks by a group tracked as UNC4841, which exploited a different flaw, CVE-2023-2868, as a zero-day.

Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package.

The flaw comes from how sshd works with musl, the C library that Alpine is built on.

Non-Linux systems, Linux systems built on glibc, and systems that check passwords through PAM are not affected, said Damien Miller of the OpenSSH project.

Containers that do not run sshd, systems with PasswordAuthentication no , and cloud images set up through cloud-init, which writes that setting, are not affected.

Then set PasswordAuthentication no , check the configuration with sshd -t , and restart sshd.

Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT.

Content opened through this route was no longer subject to the same sandbox restrictions, providing a way to circumvent the protections of Lockdown Mode."

That said, the underlying issue is not limited to the Electron-based desktop environment, highlighting how weakness outside of the scope of the AI model can undermine AI security controls.

"The finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them."

"The hidden instruction could be delivered throu…

And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched.

One thing stands out this week: attackers don't always need to be smarter than the systems they're targeting.

They just need to find what was missed, left open, or trusted a little too much.

And with AI making some of that searching easier, the time between finding a problem and using it is getting shorter.

Others need a closer look at how people, tools, and systems are allowed to work together.

An exposure management platform should connect discovery with a clear priority, an appropriate response, and evidence that protection has improved.

Many Check Point Exposure Management customers remediate safely within one hour, because the context is complete and the safety checks are built in.

Check Point Exposure Management combines internal asset intelligence, external discovery, threat intelligence, and brand protection with prioritization, exploitability validation, and safe remediation.

Check Point Exposure Management carries asset and threat context into responses to vulnerabilities, control gaps, and external threats.

Book a demo to see how Check Point Exposure Management carries a…

October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows.

For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk of financial losses, data breaches, and costly operational disruption.

SkyW4lker phishkit attack overviewUncovering the Full Campaign in Seconds with Related Threat ContextOne phishing URL can reveal an entire threat operation.

Starting with a SkyW4lker sandbox session, researchers pivoted directly from Related Threat Context into TI Lookup to investigate IP address 198.23.223.185, revealing relat…

We uncovered a SlippyNunchucks DNS hijacking operation, abusing Sogou Input Method’s use of insecure HTTP communications.

Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used Chinese input method editors (IMEs) for typing Chinese characters on computers and mobile devices (see Figure 2).

Sogou Input Method uses specialized collections, known as cell dictionaries (细胞词库), to expand its vocabulary and improve Chinese text prediction.

Technical analysisAnalysis of the DNS hijackingAs part of Sogou Input Method’s brand promotion mechanism, SGTool.exe, one of its components, sends an HTTP request to the config.pinyin.sogou[.

Similar to the previous mechanism, this approa…

We presented our findings about the Gorbag APT group at the Virus Bulletin conference on October 14th, 2026; the full technical analysis is available in our white paper Gorbag: Orcs at the border published by Virus Bulletin.

Gorbag: Orcs at the border Read the full report PDFVictimology and geopolitical contextAll Gorbag targets identified by ESET Research are located in Ukraine, and the group’s targeting choices fall into three main areas that align closely with Russian wartime intelligence priorities.

Prime ReverseShell is derived from the publicly available PSSW100AVB repository on GitHub, with modifications to suit the operators’ needs.

Prime ReverseShell with a comment trying to fool A…

Effective SMB protection demands that vendors lead their customers through a clear onboarding process – and offer practical and transparent guidance during incident response engagements.

Understanding what a genuine threat to the organization is and what not to worry about is often beyond the capability of a small IT security team.

They are trusted by more SMBs than any other entity – including internal staff, industry peers, and governments – as a trusted source of cybersecurity guidance.

SMBs don’t want to hand over all control for threat protection.

The key for vendors is to ensure these experts are available at onboarding, to guide SMBs through configuration, activation and setup.

The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plansWith October coming to a close, ESET Chief Security Evangelist Tony Anscombe reviews some of the top cybersecurity stories that made the news over the month.

At the same time, he offers insights that the latest wave of incidents hold for your company's, or your own, cyber-defenses.

A data breach at Denmark’s Central Population Register (CPR) has exposed the personal information of 8.8 million people.

What are the lessons that businesses should take away from the latest cybersecurity news?

Watch Tony's video to find out, and be sure to check out the Se…

Amatera – which topped ESET’s infostealer detections in Latin America in the first half of 2026 but targets victims worldwide – shows what this professionalization looks like in practice.

Detected by ESET products as Win/PSW.Amatera, Amatera is a Windows infostealer written in C++ that was first observed in 2024.

Amatera has spread via compromised websites, search engine ads, targeted emails, fake documents, SVG files, and ClickFix via fake CAPTCHAs.

In Latin America, Amatera topped ESET’s infostealer detections in the first half of 2026, ahead of Formbook, Vidar, Lumma Stealer, SnakeStealer, and Rhadamanthys.

A developer maintains the product, and other actors distribute it via compromised…

In the age of AI, all of this was reported within a single “Cybersecurity Black Week,” an exceptionally eventful seven-day period amid an already turbulent Black October.

The name refers to two memory-safety vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5.4 through 8.5.11.

The same decoder is compiled into the Python Brotli and brotlicffi packages as well as into other HTTP software, which led researchers to rename the issue HTTP2Shell.

Cutting through the noiseCybersecurity Black Week showed that a severity score rarely tells the whole story.

For the leaked kernel flaws, that window opened before any fix existed, and for end-of-life PHP versions, …

ESET APT Activity Report Q2 2026–Q2 2026 summarizes notable activities of selected advanced persistent threat (APT) groups documented by ESET researchers between April and September 2026.

They represent only a subset of the cybersecurity intelligence made available to customers of ESET Threat Intelligence APT Reports.

In Southeast Asia and Oceania, China-aligned threat actors ran campaigns that appear to support Chinese law enforcement efforts against organized crime in the region.

Finally, we identified several cases of APT groups using AI and large language models (LLMs) at various stages of their operations.

Threat actors used AI primarily to accelerate tasks that would otherwise require…

The news prompted security advisories from government agencies and sent website owners scrambling to apply the patches, with some sites even going offline as a precaution.

This is because on an unpatched server, an attacker can exploit the vulnerabilities to run their own code without logging in.

As three out of four websites globally are estimated to use PHP in some capacity, its ubiquity helps create an environment ripe for abuse; indeed, initial attempts to exploit the flaws – discovered by AI and dubbed PHP2Shell – weren't long in coming.

Here's what to know about CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little mo…

The following day, at 09:28, a new binary was delivered to the machine: the MythicRatatoskr backdoor.

This blogpost focuses primarily on the analysis of the MythicRatatoskr backdoor, the Yggdrasil network that hosts its C&C server, and the accompanying SOCKS5 server.

Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr.

MythicRatatoskr main configurationThe MythicRatatoskr configuration is stored in a file at a hardcoded path.

NetworkIP Domain Hosting provider First seen Details b479:2771:8df4:b5e b:d007:63b0[:]2838 N/A N/A 2025‑07‑17 MythicRatatoskr C&C server within the Yggdrasil network.

In some cases, the scam ad may take you to a fake e-commerce site which covertly harvests your card details.

What happens if I’ve fallen victim to a scam ad?

Scam ads are getting easier to generate thanks to AI, and can look increasingly professional, even including video content.

Can I get my money back if I paid through a scam ad?

What should I do if I’ve fallen victim to a scam ad?

This is email bombing.

What is email bombing?

Sometimes called “form bombing,” “list bombing” or “subscription bombing,” email bombing attacks usually follow the same pattern.

There’s no silver bullet to prevent email bombing.

Has my email account been hacked if it’s full of sign-up emails?

Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safeScammers love a pretext.

And with Medicare Open Enrollment, they have a perfect opportunity to exploit victim expectations, masking their fraud under the cover of legitimate activity.

Work through the following steps:Call or contact Medicare at Medicare.gov or 800-633-4227 to report the incident.

So slow down this Open Enrollment season and verify every request for personal and medical details.

Frequently Asked Questions (FAQs)When is Medicare Open Enrollment?

Data breach notifications are telling victims less than ever.

As the volume of data breach incidents increases, there’s a growing chance that you’ll be caught up in one.

Example of a data breach notice with a detailed explanation of the situation (for more, head over here)How do you interpret a breach notice?

For that reason, you should never click through on any unsolicited breach notification email or message.

Change your logins (if relevant) and consider credit monitoring and a credit freeze.

Later, in June 2026, ESET telemetry registered further MATCHBOIL samples, this time at a company in the energy sector.

MATCHBOIL then performs three HTTPS requests to the C&C server; each with a different purpose:The first request receives a numeric value from the C&C server.

2024 samplesThe earliest MATCHBOIL samples that we have seen have compilation timestamps from 2024.

]pro N/A 2025‑11‑10 MATCHBOIL C&C server hidden behind Cloudflare.

]com N/A 2025‑08‑12 MATCHBOIL C&C server hidden behind Cloudflare.

The platform also asks for the creator’s YouTube channel URL, which it uses to retrieve public information and generate a seemingly personalized experience.

How to stay safeIf you’re a social media influencer yourself, your Google account can be much more than “just” access to a YouTube channel.

Run Google’s Security Checkup, or open Security & sign-in in your Google account, and review recent security events and signed-in devices.

If you’re a YouTube creator yourself, you realize that your reputation ultimately defines your success.

A Google account can then sit at the center of your business: email, files, contacts, and the YouTube channel itself.

AI agents work toward a goal and choose their own steps, which makes them harder to catch.

Second wave of refrigeration cyberattacks hits European supermarketsThree weeks after the attack that turned refrigeration units in French supermarkets into ovens overnight, similar cyberattacks have hit shops in other European countries and again caused refrigerated food to be spoiled.

AI agents scale and speed up Chinese-linked attacksA China-nexus espionage group used AI agents to attack more than 200 organizations in 11 days, CrowdStrike said last week.

November 2026 Patch Tuesday forecast: Old software continues to biteStill working through October’s Patch Tuesday updates, or ready for another ro…

An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned.

The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2 on November 5.

It takes one connection, works every time, and needs no retries,” the Alpine Linux team wrote in its security advisory.

“Our first observed attempt arrived less than nine hours after CVE publication, and we’ve confirmed successful root access on a Previdian honeypot running real Alpine Linux and OpenSSH,” he told Help Net Security.

“on alpine’s official aws and azure images that’s t…

The exits came from six addresses on 26 of those 30 days, and 28 separate residential proxy services offered the route.

Residential proxy services sell access to everyday devices, letting customers send traffic through them so it appears to come from that device’s network.

Its staff spotted the activity while looking through the company’s Residential Proxy Observatory, simply by requesting global rotating access through the proxy services.

To rule out a fluke, they checked the addresses against other proxy detection services, whose public IP pages independently flag them as residential proxy exits.

Or at least some that are providing residential proxy access to botnets,” security researcher…

OpenAI has introduced GPT-6 Cyber, a version of GPT-6 Astra trained to find software vulnerabilities, test how attackers could exploit them, and help develop fixes.

Vulnerability research and security testingOpenAI used GPT-6 Cyber to help secure its systems, including the infrastructure used to train its AI models.

Researchers used GPT-6 Cyber alongside other OpenAI models to develop and validate exploits demonstrating how a critical Brotli vulnerability could allow remote code execution in affected applications.

Cybersecurity benchmark resultsOpenAI evaluated GPT-6 Cyber on tasks requiring it to understand software, identify vulnerabilities, and develop working exploits.

In the separate E…

Cyber Security Summit 2026 in Sarajevo will examine the practical security questions organizations face when a supplier, network device or critical digital service fails: what breaks, who decides, and how quickly can operations recover?

The sixth Cyber Security Summit, organized by the e-Transformacija Association, will take place on November 18–19, 2026 at the Hills Congress Center Sarajevo.

Its program places these questions alongside post-quantum cryptography, AI-enabled threats, network security, data-center resilience and incident recovery.

Cyber Security Summit 2026 will address that strategic challenge through Ilijana Vavan’s session, Redefining Resilience: Cybersecurity Strategy in …

“Industrial refrigeration and cold-chain monitoring systems protect food, medicine, and other temperature-sensitive products, making them attractive targets for malicious cyber actors,” he noted.

Unpatched and exposed controllersAccording to the agencies, hackers target electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities, and may exploit weaknesses in controllers that are unpatched or reachable from the internet.

Firmware should be kept up to date, and devices the vendor no longer supports should be retired and replaced.

A wave of attacks in EuropeSince October, Help Net Security has reported on a series of attacks on ref…

In October, one zero-day CVE-2026-96951 was confirmed exploited; it was a Windows Shell security feature bypass impacting Windows 10, Windows 11 and Windows Server.

PHP released a security advisory on October 21st regarding the vulnerabilities and the related PHP software versions that had been fixed.

They also included a fix for the Smart App Control broken by the October Windows update.

Updates from AppleApple released major security updates for all its supported operating systems on October 26th.

For example, the security update for its latest version, macOS Golden Gate 27, addressed 183 unique CVEs.

Luckily, certification documents (e.g., Security Target in CC or Security Policy in FIPS-140) are usually up to around 100 pages, not 300.

When certification documents become searchable, which question can a buyer answer in minutes that previously took a consultant or days of reading?

Sec-certs is an open-source tool and website that turns public certification documents into a searchable, linked dataset.

Buyers come when they’re looking for products that use a specific technology, and then they compare the certification documents of those products.

That is described in the Security Target (or Security Policy), and the certification report summarises it.

87% of those same respondents say their organization needs a better way to approve, monitor and control how AI gets used.

More than half say their AI can act unsupervisedConversational AI and virtual agents top the autonomy list at 59%.

87% say AI initiatives need faster authorization to stay competitive, and 91% of that same group say the approach to approving, monitoring and controlling AI needs to be more effective.

Another 37% say AI has confused who owns a decision.

I understand the security implications.”The governance gapOn AI security, 30% say strengthening is needed and another 40% say moderate.

Development accounts and tools create security blind spotsSoftware development spans code repositories, review systems, build pipelines and connected applications.

Of the developers holding the most unused permissions, 88% could access repositories their organizations classified as business-critical, including those supporting production services, payment systems and regulated workloads.

Non-human identities outnumber developers eight to oneService accounts, bots, connected applications and access tokens allow tools to retrieve code, run builds and deploy software.

Across the pooled dataset, non-human identities with repository access outnumbered human developers with repository access eigh…

A phishing page imitating a rental marketplace (Source: Fortra)The timing is deliberate, since “cybercriminals know that travelers are more likely to click quickly as a trip approaches,” Fortra’s Elyse Neumann wrote in a blog post on the findings.

Visitors are told their reservation is unconfirmed, their payment has not been processed or their booking will be canceled.

These warnings “may push travelers to click before checking the website address or confirming the reservation through an official channel,” Neumann cautioned.

A login page with familiar sign-in optionsOne phishing site impersonated a global experiences and lodging platform, using a lookalike address (confirm-[redacted].rooms-…

Cyberhaven has introduced Agentic Data Security (ADS), to help CISOs, data security teams, insider risk teams, and AI governance leaders say yes to AI agents without losing control of their data.

Agentic Data Security shows security teams what every AI agent does with company data, who it is acting for, where the data goes next, and stops sensitive data before it leaves.

Agentic Data Security gives them the confidence to deploy agents while keeping control of the data itself, not just the tooling that touches it.”Agentic Data Security is the latest module in Cyberhaven Flow, the unified data security platform that uses data lineage, AI, and autonomous protection to deliver data loss prevent…

Rubrik has announced Rubrik-Hosted Protection for On-Premise Unstructured Data.

The offering is built on Rubrik’s Network Attached Storage (NAS) Cloud Direct service.

When unstructured data is lost or locked by ransomware, the applications that depend on it stop operating.

Rubrik-Hosted Protection for On-Premise Unstructured Data addresses the protection and the hardware sourcing challenges.

Rubrik runs the storage, capacity and updates, allowing security teams to manage policy and recovery in Rubrik Security Cloud without managing the infrastructure underneath.

Vercel, the popular cloud platform for building and hosting websites and web applications, has announced the rollout of Device Bound Session Credentials (DBSC) and the launch of Vercel Security Review in public beta.

Making stolen session cookies worthlessDevice Bound Session Credentials is a security technology designed to limit the consequences of an infostealer infection and to thwart attackers’ session hijacking attempts.

Aside from stealing authentication credentials, modern info-stealing malware such as Lumma, RedLine, and Vidar can also steal browser cookies.

Session cookies are especially valuable because they are issued after login, including after multi-factor authentication.

Verc…

Arkose Labs has expanded Arkose Agent Trust Manager to help businesses control agentic traffic.

The need is urgent given Arkose Labs’ State of Agentic AI Trust Q3 report found that personal AI agents identify themselves less than 3% of the time.

Introducing Arkose Agent ID: Arkose Labs is introducing Agent ID, which follows the agent, not the IP: a stable identifier for each agent that holds when it rotates networks, ships a new build, or appears across many accounts.

Arkose Labs is introducing Agent ID, which follows the agent, not the IP: a stable identifier for each agent that holds when it rotates networks, ships a new build, or appears across many accounts.

Agent Trust Manager already …

News story: “Scientists discover a bizarre Jurassic ‘squid’ unlike anything ever seen.”

Scientists have identified the “fattest” belemnite ever discovered, a bizarre, barrel-shaped squid relative that lived in Wyoming’s ancient seas 160 million years ago. The exceptionally rare fossils reveal a creature unlike anything previously known, potentially a predator of smaller squid-like animals and a surprising survivor of a supposedly vanished family.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered...

This is fascinating:

The video describes a technique that can reveal where an otherwise unidentifiable recording was made by analyzing its audio for the faint sounds of passing aircraft. The technique is both fascinating and frightening.

It works by looking at Doppler curves, which plot the way a plane’s sound changes as it passes overhead because of the Doppler effect. This is the same familiar Doppler effect that causes the frequency of a siren to rise as it approaches and then fall as it passes by and moves away. More generally, it’s the phenomenon whereby the frequency of a wave perceived by an observer changes when the observer and the source of the wave are moving in relation to one a…

In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.

Here’s some demonstrations of this from Germany:

Legal systems encode the foundations of social order in natural language. Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place. With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change...

A comment:

3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?

Yes. It is a new world out there.

Neat video:

The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This story is interesting:

One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about.

Among the pre-installed bloatware—­or spyware, if you’re being less charitable­—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so y…

Researchers set up a fake start-up company to study fraudulent North Korean IT workers.

Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”

Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed string…

Interesting research:

TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it. One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked.

...

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys:

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237...

PHP maintainers have released two critical vulnerabilities:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

The vulnerabilities:...

There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS).

Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.

Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him:

Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026.

[…]

According to Cellebrite, AU: is a “next-generation AFU vector that is more resilient to Apple’s OS changes”

works with Stolen Device Protection enabled, which tightens USB restrictions

is enabled by a dedicated appliance with a stated range (!) of about 8 meters...

Interesting research:

Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the trade-off, answering in milliseconds but only for categories they were trained on. Neither improves with exposure. We study what changes when a solver improves with use. Our system pairs a fine-tuned YOLOv8 detector with an open-weight VLM behind a confidence-based router, and runs entirely from screenshots and operating-system input events, with no browser automation…

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today.

There are dozens of residential proxy providers with varying degrees of legitimacy, many of them based in China or Russia.

From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer.

“Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.

We caught this by chance, simply by requesting global rotating access through the…

As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.

The GTIG report calls out a number of residential proxy providers whose software development kits were routinely downloaded by devices infected by the XCPE botnet.

Another provider linked to the botnet was NetNut, a once sprawling residential proxy company operated by the publicly-traded Israeli company Alarum Technologies.

In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, saying the company was res…

Earlier today, PHP released an emergency security update to fix two critical bugs that can allow an attacker to execute code of their choosing on a vulnerable server.

Reuters reports that government websites in Europe and elsewhere went offline today after the PHP vulnerabilities were disclosed.

Wiz said that prior to the PHP bugs being publicly disclosed, the company worked with the PHP team, Calif and OpenAI to measure the size of the problem and coordinate patch verification and disclosure.

The PHP zero-day vulnerabilities are being tracked by their CVE numbers, CVE-2026-109618 and CVE-2026-109619, and they affect all web servers running PHP 5.4 or later.

“A vulnerability in core PHP rea…

According to the FBI, ShinyHunters has extorted more than $70 million from victims so far this year.

He also said Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and is not a shareholder.

In 2020, Aon aquired Cytelligence, a security consulting firm where Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing partner.

Experts say ransomware victims are typically directed by their insurance provider to work with a specific incident response firm.

But that ransom payment did not stop future extortion attempts using the same stolen data.

The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise.

The blockchain data-crunching firm Chainalysis said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy.

“Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis wrote in an October 8 blog post.

Sanders said the U.K. sanctions on Cryptomus are important because Canada’s sanctions against the platform were ultimately unenforceable and uncollectible.

“A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders wrote on LinkedIn.

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software.

CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.

Windows 10 users might be wondering if they can still expect security updates after this month.

Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback.

Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.

The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters.

The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.

Another shared that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas.

According to LinkedIn, Cypher was co-founded by a Canadian man named Edward Dubrovsky, who is now associated with another Canadian security firm called CyberSteward.

According to the FBI, the group has extorted more than $70 million from victims so far this year.

The Dutch daily RTL reported on Sept. 29 that investigators suspect Van der Stap tried to orchestrate at least two murders.

According to RTL, the murders were allegedly to be committed abroad, and there are indications Van der Stap gave the order for these attacks.

In an interview with KrebsOnSecurity on September 9, Van der Stap described his new role as “offensive security lead” at the Dutch cybersecurity company Neo Security, saying the job involved probing client networks for security vulnerabilities.

Korper said Dutch forensic investigators visited his office on September 15, the night Van der ⁠Stap was arrested in a dramatic police raid that reportedly involved flash bang grenades.

“Y…

Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters.

Van der Stap is currently employed as offensive security lead at the Dutch company Neo Security, which did not respond to requests for comment.

But not long after that interview, the Dutch hacker abruptly stopped replying to messages.

One source said a colleague of theirs personally witnessed Dutch authorities carting items out of Van der Stap’s residence.

Speaking with reporters from Bloomberg in 2024, Van der Stap said that singular focus in turn fueled his desire to carry out cyberattacks.

A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.

Kiberphant0m claimed to have hacked into more than dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business, and publicly extorted these companies in exchange for a promise not to publish the stolen data.

Less than a month later, Wagenius was arrested and charged in two separate federal indictments, and soon pleaded guilty to all counts in both cases.

In 2019, Schuchm…

In February 2024, Radaris was sued by Atlas Data Privacy Corp, a company that has been pursuing data brokers alleged to be violating a New Jersey statute called Daniel’s Law.

KrebsOnSecurity doubled down and showed how the Lubarsky brothers built and operated Radaris and other data broker companies using a fictitious CEO’s name.

All told, the New Jersey court has so far transferred 14 domain names from the Radaris family of companies to Atlas.

Sherman said federal lawmakers have long faced intense lobbying by the technology industry against more restrictive U.S. data privacy laws, but that many powerful industries are now working against passing comprehensive data privacy legislation.

The l…

Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever.

This month’s patch bundle obliterates the software giant’s previous record set in July, when it released updates for at least 570 security vulnerabilities.

Among the more serious critical flaws this month is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10.

And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month.

Enterprise Windows admins will want to keep an eye on askwoody.com for news of any updates that appear…

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada.

Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards.

Some of the records list their “source” as “CDL,” presumably short for “commercial drivers license.

Also, only some of those who helped with this research said they showed their drivers license at the airport on the day of their travel.

Baldwin said the Nexus identity theft service presents multiple serious security and privacy threats, noting that state-issued drivers licenses are commonly used as proof of one’s ide…

The malware allows TeamPCP’s hackers to steal credentials that let them publish malicious versions of those software development tools, too.

“TeamPCP has stated the competition is a recruiting opportunity and they intend to purchase all meaningful access harvested from participants’ campaigns,” the security firm Dataminr wrote.

Deadcatx3, a nickname that has been flagged by multiple security firms as an alias used by TeamPCP.

Charlie Eriksen is a security researcher at Aikido Security who has closely followed TeamPCP’s cybercrime campaigns.

“They managed to wake up Microsoft to the fact that they had become negligent in terms of security,” Eriksen said.

It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day.

Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you.

“It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said.

DecryptAds reports that Between Digital is collecting ad data on approximately 55,000 partner websites.

Bear in mind that ad blockers often do little to block ads and/or tracking that occurs from within mobile apps that users have chosen to instal…

More than 41,000 people working for the US Department of Homeland Security, including ICE agents, have had their details published online by a group of hacktivists.

As TechCrunch reports, the leaked records include the names, job titles, work email addresses, phone numbers, abd office locations.

More than half of the leaked records relate to US Customs and Border Protection (CBP) employees, typically found at airports, seaports, and land border crossings.

Around 10,000 ICE employees have had their records breached, and almost 1,000 members of the Cybersecurity and Infrastructure Security Agency (CISA).

The leaked data has been published online, under the title "Icepick", and can be either d…

Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico's Health Sciences Center (HSC) this week. Read more in my article on the Fortra blog.

You are suffering a little bit, not that our listeners will be able to tell, but if anyone sees you on video.

Well, everything's a little bit political, but this is fundamentally a cybersecurity podcast.

And it won't necessarily come back and say, "I don't think you should be doing this," or, "Have you sought some help?"

Maybe we should turn a little bit to what organisations can actually do about it.

I'm going to do it the following Thursday, or I'm going to do it some other time, or I'm going to create an account that doesn't go back to me, but I can still support my favourite places.

A Ukrainian man has been sentenced to 70 months in a US prison for his role in a series of ransomware attacks.

He was also an early affiliate of the Hive ransomware-as-a-service (RaaS) operation which targeted businesses and, in particular, organisations working in healthcare.

The FBI later warned that Hive had extorted US $100 million from businesses and organisations globally in a period of just 18 months.

The DOJ said that the operation saved corporate victims of Hive over US $130 million in ransom payments.

At the time I speculated that the take-down of Hive may lead to the identification and possible apprehension of some of those involved in Hive ransomware attacks.

Germany's far-right AfD (Alternative für Deutschland) party has confirmed that it has suffered a security breach, after a hacker published what appear to be hundreds of thousands of the controversial political party's internal emails.

Earlier this week, the AfD admitted that its hosting provider had been hacked in September, and that some of its mailboxes had been copied.

What is unusual is that the leaked emails are not published on the site directly.

Indeed, party sources told the media that although the leaked emails appeared to be authentic, the AI-generated summaries appeared to contain several inaccuracies.

The full corpus of 281 GB of stolen messages and files has been made available…

Smashing Security, episode 489, How a Brand New Crypto Wallet Came with a Spy Inside, with Graham Cluley and special guest Lianne Potter.

So a bit of a War of the Roses thing going on there with that reference to Burnham.

What I'm going to do is I'm going to describe things, and the more dangerous the thing is, the faster it will click.

But I'm going to say it's probably dodgy, but oh, the curiosity would get the better of me.

But I'm actually in the same boat as most people because this film has been censored for nearly half a century.

A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang.

As BBC News reports, detectives have linked the man to the 2024 attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient.

The suspect, who has been named by German media only as "Vladimir K" was originally detained in May in Japan, after he travelled there on holiday.

The incident is said to have crippled Synnovis’s IT systems, and caused a critical shortage of O-type blood in hospitals.

No ransom was paid by Synnovis, a decision the firm made jointly with the NHS trusts to which it provides services.

The official @GardaInfo and @GardaTraffic Twitter accounts of Garda Síochána were accessed by an unauthorised third party who posted cryptocurrency-related messages on Wednesday evening, potentially reaching hundreds of thousands of users.

The messages claimed that followers were eligible to claim free cryptocurrency through an airdrop.

The problem, however, is not just that a hacker found themselves with the ability to post fraudulent messages posing as the Irish police.

The Garda is not the only police force to have ever suffered a security breach on its Twitter account.

In 2022, the official Twitter account of the Philadelphia Police Department was compromised and used to post what appea…

Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.

How a ransomware negotiator ended up arrested at his own conference, with Graham Cluley and special guest Paul Ducklin.

I don't know if you know that.

And then I became a freelancer and then I thought, oh boy, I'm going to open the doors to everybody.

And he is the Canadian co-founder of a ransomware negotiator firm called— I don't know how to pronounce this.

There's no breach so unimportant that you can just say, don't worry folks, carry on, nothing to see here.

The hacker behind a high-profile string of leaks involving the upcoming release of the Grand Theft Auto (GTA) 6 videogame has threatened to release a complete, playable build.

CyberLeek says that if the GTA 6 game is released on physical disk, and a public apology is made, it will step back from its threats.

As ever, videogame fans should be very wary of believing anybody who offers a download of a supposedly leaked game.

Besides which, the real, genuine GTA 6 is due to be released on video game platforms on 19 November.

It is not worth infecting your computer, or losing money on a dodgy crypto coin, just to see it a few weeks early.

Zhang is charged alongside 34-year-old Xu Zewei with malicious cyber activity against US computer systems between February 2020 and June 2021.

The following the year the pair allegedly exploited vulnerabilities in Microsoft Exchange Server to steal further information.

Furthermore, if findings by security firm SentinelOne are to be believed, Zhang's Shanghai Firetech filed multiple software patents about extract data from computers.

Xu, for instance, was arrested at Milan airport in July 2025 and extradited to the United States in April this year.

China's Foreign Ministry opposed Xu's extradition, accusing the United States of fabricating charges against him.

But do you actually know whether both of them can do the job?

Now, I don't know how good a swimmer you are, Danny.

I don't know about you, but I'm having 3 or 4 calls a day from an unknown number.

And I would imagine a company like Hack The Box has got great visibility as to what is actually going on out there.

And so I think that's the unique part here is it truly does have a pressure-tested element to it.

N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow. Read more in my article on the Fortra blog.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 0a7de8efb1deabad49fbee29c6d22416Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-05T23:00:38+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: aa9e3a5508a8c1eb76c504b058249cd2Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-03T18:00:26+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 0d697b7db0e95a6580b88e9a4b8e961fServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-02T16:00:13+03:00Config id: 339Faithfully yours, nginx.

Вопреки распространенному заблуждению, в эпоху цифры люди не перестали любить книги — просто их уже давно читают не только на бумаге.

Год назад мы также рассказывали про вредоносные «книги» на турецком и арабском языках.

Зачастую эти поддельные сайты полностью функциональны: на них точно так же можно искать и скачивать книги, и дизайн практически неотличим от оригинала.

Одна из самых простых рекомендаций — пользоваться официальными книжными магазинами, и не только по соображениям авторских прав.

Таким образом вы защитите свои данные и деньги и сможете спокойно скачивать и читать вашу любимую литературу.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: c37d2c17b96ad93f72f21acf52f07186Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-29T16:00:22+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 4e5cae3ff5837cf370c8bf305d03c2b0Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-30T14:00:34+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: d6b768fbc443335b282efe8a58868231Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-26T15:00:14+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 6e1eb2ff9ba52d21e2eb9108c143beafServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-23T17:00:39+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 704ec22d9a79fd07b89340a5c2d02b67Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-22T23:00:36+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 0bd9145f797a3fff09593e8e6fc88bd4Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-21T20:00:35+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: a48e6a868074b4c2b77295af18788714Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-20T17:00:12+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 65c81bea022dea0314bb3ec1fb8b3228Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-15T14:00:29+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: bf1172655ea8738416272c1b910c4a23Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-14T17:00:37+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 8c474b40de23335e23a81b4f71096fa2Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-13T18:00:32+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 986285ee7f9fbca30f009118870a630eServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-09T19:00:10+03:00Config id: 335Faithfully yours, nginx.

The AI traffic shift is inwardIt is tempting to think of enterprise AI security as controlling employee access to public LLMs.

That independent view becomes more valuable as agents operate faster, across more systems, with less human supervision.

It needs context about non-human identities, agents, models, tools and delegated authority, along with visibility into emerging protocols such as MCP, A2A and model APIs.

Because the consequence of an AI agent’s decision is not a prompt or a model response.

When that action crosses the network, security has an opportunity to observe it—and enforce a boundary.

Cisco Firewall customers running software 10.1 automatically have SnortML.

Together, Snort signatures and machine learning work to defend firewall customers from emerging AI-driven threats.

Note: Customers using Cisco Firewall version 10.1 and using the security over connectivity policy have SnortML enabled by default.

Customers now have more than 10 Splunk detections to defend against PHP2Shell post-exploit activity, including detections specific to Cisco Firewalls.

Cisco Firewalls block malicious PHP2Shell attack traffic while Splunk gives SOC teams visibility into PHP2Shell post-exploit activity.

AI Transit connects specialized AI environments to the SD-WAN fabricThat customer requirement is what Cisco AI Transit is designed to address.

Connecting AI environments with Cisco AI TransitWhat is Cisco AI Transit?

Cisco AI Transit is designed to connect specialized AI environments to an enterprise’s existing Cisco SD-WAN fabric.

AI Transit builds on that foundation to connect specialized AI environments, including NeoClouds, private and sovereign AI clouds, and enterprise AI factories.

AI Transit is designed to connect workloads in NeoClouds, private and sovereign AI clouds, and enterprise AI factories to an existing Cisco SD-WAN fabric.

The velocity of vulnerabilities being discovered using Frontier AI and OpenWeight models such as Cisco Anteras is unprecedented and defenders need more time.

Virtual Patching vs. Live Protect (Shielding)Live Protect is a differentiating capability – we are not built the same.

The workload in the environment still sits vulnerable and that’s where Secure Workload can be expanded to drive controls based on CVE directly in the workload using native capabilities and once patched the control disappears.

Shielding with Live ProtectShielding with Live Protect is different.

Live Protect buys you time on the infrastructure boxes themselves without forcing an emergency upgrade window.

Infrastructure access has an identity problemPicture an infrastructure administrator pushing a configuration update across hundreds of switches during a maintenance window.

Introducing Cisco Privileged Infrastructure AccessToday, Cisco is introducing Privileged Infrastructure Access, a faster, more secure way to keep the network moving by enabling network administrators and agents to perform critical work through a secure, identity-bound connection.

For customers using Cisco ISE and TACACS+, Privileged Infrastructure Access can draw on the policy and device context they already manage to govern access to Cisco routers and switches.

That brings Cisco network context into the privileged acces…

The data bears this out: in Splunk’s State of Security 2025 report, 78% of respondents said their security tools are dispersed and disconnected.

Closing that gap takes integrated identity, network, and endpoint context, plus the ability to act on it automatically.

That’s the idea behind combining SentinelOne’s runtime protection with Cisco Security and Splunk.

SentinelOne Runtime Protection and CWP in ActionSentinelOne Cloud Workload Protection (CWP) delivers autonomous, real-time threat detection and response across containers, Kubernetes, virtual machines, and serverless workloads.

Cisco Security extends that protection across identity, network, and perimeter, and Splunk gives your SOC on…

Upstream capacity: the projects you depend on can deliver new capabilities and critical fixes fast.

Upstream capacity is the one almost nobody puts on a roadmap because it sits outside your organization.

In most organizations, upstream capacity has none of those.

What This Looks Like in PracticeFor Cisco, part of the answer was becoming a Premier Sponsor of the OpenSSL Foundation in August 2025.

Tomáš Mráz, CTO of the OpenSSL Foundation, describes the impact:“Cisco’s support for the OpenSSL Foundation allowed us to fund an additional senior software engineer to improve the OpenSSL Library code.

CSDL continues, and does moreThe Cisco Secure Development Lifecycle (CSDL) is built on more than 400 software security requirements that validate products before they are released, with engagements at key stages of development.

Cisco open-sourced it and donated it to the Coalition for Secure AI (CoSAI).

Our secure software guidance skill is in development, carrying Cisco-specific security requirements into the development workflow.

Project CodeGuard and the secure software guidance skill also act as evaluators in the development pipeline, backing hard gates.

To date we have not found a novel issue that was not already covered by an existing software security requirement.

The Splunk .conf network brought a new detection that we hadn’t seen before: Flawed AMMYY.

There is also a Remote Access Tool (RAT) called Flawed AMMYY that was developed from leaked AMMYY source code, and is directly used as malware.

One of the key value propositions of EVE is that it can use granular session fingerprinting to differentiate between similar but distinct applications like AMMYY and Flawed AMMYY.

Let’s dig into the events we saw for Flawed AMMYY and some of the details that EVE had to look at.

Our EVE detections for Flawed AMMYY came in pairs with identical timestamps, as seen above, all from a single IP.

The event Network Operations Center (NOC) managed the venue network, providing our SOC firewalls with dedicated SPAN feeds directly from their core switches.

Inside Cisco Cloud Control, that story comes together in Unified Events.

While Splunk drives active investigations in the SOC, administrators maintain firewall health directly within Cloud Control.

The Horizon: Cisco Cloud Control & AI CanvasSecurity is now natively built into Cisco Cloud Control, the unified operations platform that brings Networking, Security, Observability, and Cloud into one consistent environment.

Without replacing individual product controllers, Cisco Cloud Control unifies inventory, topology, actions, identity, …

However, assessing whether a zero-day vulnerability was exploited in the past essentially involves going back in time.

Relying on standard logs or “Conditional / Selective PCAP” systems during a zero-day investigation leaves the Security Operations Center (SOC) team blind.

There is also a secondary benefit: if a breach occurred using an newly disclosed zero-day vulnerability, the attacker is likely to have been very sophisticated.

Replay The Relevant Historical Traffic Against The New Intrusion RulesOn the Firewall Threat Defense (FTD), we configured a dedicated interface for the Endace traffic replays.

Rapid retrospective packet replay transforms zero-day triage by delivering direct forens…

The .conf26 Agentic SOC was not a simulated demo or a scripted lab.

Powered by the Cisco Cloud Control management platform, Splunk Enterprise Security (ES), Cisco Security telemetry, Cisco Talos Intelligence, and Endace continuous packet capture, our joint team of Cisco, Splunk, Endace, and Jamf engineers demonstrated what multi-agent threat detection, investigation, and response (TDIR) delivers at enterprise scale.

Watch it come to life in David Bombal’s Interview at the Agentic SOC.

“The Agentic SOC is not about replacing human defenders with autonomous black boxes.

AcknowledgementsOur thanks to the engineers who built the Agentic SOC and the Humans who provided decision making expertise.

Splunk .conf26 gave us the opportunity to operate a live Agentic Security Operations Center (SOC) in the middle of the Splunk community.

Splunk ES as the SOC data platformSplunk ES served as the primary analyst workspace and evidence system for the SOC.

Building the Triage Agent Dashboard in an AfternoonOnce the data was flowing and the agent was active, we built an operations dashboard in an afternoon.

The team preserved a path from telemetry to finding, from finding to agent analysis, and from agent analysis to an analyst decision.

Dashboard SnapshotThe following values are a snapshot from the displayed Triage Agent operations dashboard and should be read as event-environment observations…

The Cisco Secure Firewall 200 Series brings enterprise-grade protection and connectivity to distributed branches in a compact form factor.

The Encrypted Visibility Engine (EVE) uses AI and machine learning to analyze encrypted traffic, including TLS 1.3, without requiring full decryption.

The Secure Firewall 220 model delivers up to 1.5 Gbps of throughput with next-generation firewall capabilities enabled in a compact form factor for smaller branches.

The Secure Firewall 200 Series helps meet these demands with intelligent threat protection, encrypted traffic visibility, resilient connectivity, and centralized management.

Explore the Secure Firewall 200 Series to build a more resilient, man…

Architecting the Future: The Four Pillars of Agentic SecuritySecuring agentic AI requires a new strategic framework.

Pillar 2: Core ProtectionDelivered by: Cisco AI DefenseCisco AI Defense provides specialized protection for the AI models themselves and their operational environment.

AI Inventory & Validation: This solution catalogs all deployed AI models and continuously validates their integrity against supply chain risks.

Pillar 4: ObservabilityDelivered by: SplunkSplunk provides the unified intelligence platform required to monitor and respond to agentic AI at scale.

Splunk ingests logs, events, and telemetry from Duo, Secure Access, AI Defense, and other infrastructure points, creating…

The threat actor that Microsoft Threat Intelligence tracks as Storm-3358 is a Cambodia-based intrusion cluster that primarily targets financial organizations in Southeast Asia, in addition to a smaller number of large financial organizations globally.

See:Endpoint activity — Microsoft Defender for EndpointEndpoint alerts help security teams identify and investigate suspicious activity on devices.

The dashboard provides users with a unified view of AI security posture by aggregating security, identity, and data risk across Microsoft Defender, Microsoft Entra, and Microsoft Purview.

See:Microsoft Defender detectionsMicrosoft Defender customers can refer to the list of applicable detections be…

Microsoft Threat Intelligence has observed threat actors using an agentic AI offensive framework to search public GitHub repositories for exposed secrets, including credentials, application credentials, and AI inference-related API keys across multiple applications and cloud services.

Additionally, the threat actor attempted to validate stolen Azure resources, including compromised Azure AI services, as identified using Defender for Cloud’s AI threat protection.

Multiple public reports have documented threat actors using agentic AI tools to compromise credentials for AI services, sometimes to run the same agentic AI workflow.

Learn moreFor the latest security research from the Microsoft Thr…

We’re announcing a new on-premises security initiative, bringing together guidance, migration, and product investments.

The post New investments to reduce on-premises security risk appeared first on Microsoft Security Blog.

Organizations can tune and validate policies before enforcing them broadly, while upcoming integration with Microsoft Intune, Microsoft Entra, and Microsoft Agent 365 is intended to extend governance and attribution across the enterprise.

New Microsoft Defender Experts MDR experiences in the Microsoft Defender portal bring ongoing expert work into focus with a consolidated overview page with updated navigation and visibility into hunts.

Improve security posture with Microsoft Security Exposure ManagementPrioritize foundational security controls with Secure NowAI-enabled attacks can take advantage of familiar weaknesses, including excessive permissions, unprotected authentication flows, and …

Tycoon2FA-linked phishing email volume (January 2026 – July 2026)This blog provides a view of email threat activity across Q3 2026, examining shifts in phishing techniques, malicious payloads, business contact impersonation (BCI), and Teams-based threats.

QR code phishing attacksQR code phishing ended Q3 far below the levels seen during its early-year surge.

The decline continued through September despite the broader increase in email threats, leaving monthly QR code volume 86% below its March peak.

]org Email address Sender address used for both observed lure variations 2026-09-21 2026-09-21 Nuevo orden de compra – 21092026.pdf.uu File name RAR attachment used in the purchase order variati…

The campaign uses trojanized Inno Setup-style installers to distribute multiple monetized software payloads, referred to by the delivery system as “offers”, during a single installation session.

Offer execution callback and payload delivery – The runner contacts rotating infrastructure using a repeatable d=inno and r=offer_execution callback pattern.

This stage converted the fake-download execution chain into installed software and recurring execution across three monetization branches: proxy and network-resource monetization, compute-resource monetization, and adware-style utility monetization.

Microsoft Defender XDR detectionsMicrosoft Defender detects and blocks campaign-linked payloads …

Microsoft has been named a Leader in the inaugural 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms.

We believe this recognition reflects Microsoft’s approach to helping organizations manage, secure, and scale their AI investments through Microsoft Agent 365.

Figure 1: Gartner, Magic Quadrant for AI Agent Management Platforms, October 27, 2026.

Agent 365 also integrates agents built using supported open-source frameworks with the Agent 365 software development kit (SDK).

Gartner, Magic Quadrant for AI Management Platforms, Andrei Razvan Sachelarescu, Lucas Kobat, Gilbert van der Heiden, Max Goss, October 27, 2026.

Local code execution: Code or command execution requiring local access or an existing foothold.

Impact, exposure and where to focusTwo things determine a vulnerability’s value to a threat actor: impact and exposure.

Within cloud environments, Defender CSPM Attack Path Analysis adds detailed context about internet exposure, vulnerabilities, network connections, identities, and permissions across Azure, AWS, and Google Cloud.

ReferencesSources cited or linked in the submitted draft:Learn MoreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories and insights from the Microsoft Threat Intelligence com…

It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence.

All applicable platforms: Stop confirmed malicious SSH and retry processes and remove their temporary .stk_ identity files after collection.

Follow-up Investigation and recoveryReview telemetry after the extension loaded for SSH key acceptance, tunnel processes, local SSH sessions, command execution, and file activity.

Microsoft Defender XDR detectionsMicrosoft Defender XDR customers can refer to the list of applicable detections below.

Tactic Observed activity Microsoft Defender coverage Execution Execution of suspicious shell scripts to support backdoor activity.

Both incidents followed a shared entry and execution pattern before diverging into two AD CS abuse paths.

Host discovery and AD CS assessmentThe staged components queried Windows version information, network configuration, and running processes.

Case 2: Help desk impersonation led to PetitPotam authentication coercion, ESC8 relay to AD CS, certificate-based Kerberos authentication, and customer-led device isolation.

NTLM relay reaches AD CS Web EnrollmentThe attacker relayed the domain controller’s NTLM authentication to AD CS Web Enrollment.

Search for Teams support impersonation, portable Bun or Java runtimes, AD CS certificate abuse, NTLM relay, ESC1, ESC8, and certificate-based Kerberos…

Today, we’re proud to share thatMicrosoft has been named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises (Doc #US54123526, September 2026).

On top of that foundation, we continue to strengthen what Defender can see:Richer endpoint signals: Defender provides more than 200 native event types for threat hunting.

Microsoft named a Leader by IDC Read the 2026 IDC MarketScape to learn why IDC named Microsoft a Leader in Worldwide Modern Endpoint Security for Enterprises.

Read the reportTo learn more about Microsoft Security solutions, visit our website.

Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on c…

Microsoft Threat Intelligence assesses the overall adoption of AI across North Korean threat actors as high, with threat actors such as Jade Sleet, Coral Sleet, and Jasper Sleet demonstrating an established use of AI across all operational workflows, alongside increasing adoption across the broader North Korean threat actor set.

This blog breaks down how North Korean threat actors are utilizing AI across their operations, reflecting a broader trend of threat actors incorporating AI into their attack chains.

Stages of AI adoption by North Korean threat actorsNorth Korean threat actors are increasingly integrating generative and agentic AI platforms into their operations, but the rate and mat…

And we have to rethink how we defend that enterprise as attackers use AI to move faster and operate at greater scale.

For CISOs: Defending differentlyYour second job is to defend differently than you have historically done.

The same capabilities that make attacks faster can make defense faster, with agents working alongside your analysts to investigate and respond.

Prepare for an agent-driven workplace Explore Work Trend Index insights on the changing role of agents at work and the trends shaping how organizations operate.

Explore the Work Trend IndexIf you’re building with AI, bring your security team in early and have the identity and data conversation.

Compromised package distributionThe compromised LiteLLM 1.107.0 release delivered malicious Python startup files to environments where the package was installed.

Onboard supported developer workstations, build agents, and AI gateway servers to Microsoft Defender for Endpoint, and enable Microsoft Defender Antivirus real-time and cloud-delivered protection where supported.

Microsoft Defender XDR detectionsAs of October 22, 2026, the following Microsoft Defender Antivirus signatures and Microsoft Defender for Endpoint alerts were available for activity associated with the compromised LiteLLM 1.107.0 release.

Microsoft Defender XDR Threat analyticsInside the LiteLLM 1.107.0 supply chain compro…

Microsoft Defender XDR provides detections and hunting queries for suspicious Microsoft Graph activity and activity associated with known threat infrastructure.

Microsoft Threat Intelligence has identified threat actors across multiple geographic regions leveraging the ARTEX framework.

Preserve available Microsoft Entra sign-in and audit records, Microsoft Purview Audit records, SIEM data, and previously configured Microsoft Graph telemetry.

Suspicious sign-in from verified nation-state threat actor infrastructure Steal Application Access TokenA sign-in was observed from a known threat actor IP address.

We recommend promptly investigating this alert, as a threat actor might already be using…

Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them.

Early experiments revealed a significant volume of "benign" prompt injection text, which illustrates the complexity of distinguishing between functional threats and harmless content.

Many prompt injections were found in research papers, educational blog posts, or security articles discussing this very topic.

(Source: GitHub/swisskyrepo)When searching for prompt injections naively, the majority of detections are benign content – false positives in our case.

Malicious: ExfiltrationWe were able to observe a small number of prompt injections that aim at theft of data.

Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities.

Following our previous discussion on "Deploying Rust in Existing Firmware Codebases", this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware.

Hook-up Rust to modem firmwareBefore building the Rust DNS library, we defined several Rust unit tests to cover basic arithmetic, dynamic allocations, and FFI to verify the integration of Rust with the existing modem firmware code base.

Pixel modem firmware already has a well-tested and specialized global memory allocation system to…

This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.

Session theft typically occurs when a user inadvertently downloads malware onto their device.

Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server.

How DBSC WorksDBSC protects against session theft by cryptographically binding authentication sessions to a specific device.

The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the correspondi…

Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini.

In our previous blog “Mitigating prompt injection attacks with a layered defense strategy”, we reviewed the layered architecture of our IPI defenses.

Synthetic data generationAfter we discover, curate, and catalog new attacks, we use Simula to generate synthetic data expanding these new attacks.

We partition the synthetic data described above into separate training and validation sets to ensure performance is evaluated against held-out examples.

This process leverages the newly generated synthetic attack data described on this blog, to create a robust, end-to-end evalu…

2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉!

Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer.

Vulnerability Reward Program 2025 in NumbersWant to learn more about who’s reporting to the VRP?

Tip: Want to be informed of new developments and events around our Vulnerability Reward Program?

Follow the Google VRP channel on X to stay in the loop and be sure to check out the Security Engineering blog, which covers topics ranging from VRP updates to security practices and vulnerability des…

To stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC).

To bring these critical protections to the wider developer community with minimal friction, the transition will be supported through Play App Signing.

Play App Signing leverages Google Cloud KMS, which helps ensure industry-leading compliance standards, to secure signing keys.

Empower Developers : The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and application.

: The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and …

Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers.

Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group.

Since MTC technology shares significant architectural similarities with CT, these operators are uniquely qualified to ensure MTCs are able to get off the ground quickly and successfully.

The Chrome Quantum-resistant Root Program will operate alongside our existing Chrome Root Program to ensure a risk-managed transition that maintains the highest levels of security for all users.

First, we…

For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.

As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead.

Expanding Scam Detection for Calls to Samsung DevicesTo help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud.

Scam Detection for phone calls on Google Pixel devices is available in the U.S., Australia, Canada, India, Ireland, and the UK.

Powered by Gemini’s on-device model, Scam Detection provides intelligent protection against scam calls while ensuring that…

Upgrading Google Play’s AI-powered, multi-layered user protectionsWe’ve seen a clear impact from these safety efforts on Google Play.

As Android’s built-in defense against malware and unwanted software, Google Play Protect now scans over 350 billion Android apps daily.

This proactive protection constantly checks both Play apps and those from other sources to ensure they are not potentially harmful.

Looking aheadOur top priority remains making Google Play and Android the most trusted app ecosystems for everyone.

Thank you for being part of the Google Play and Android community as we work together to build a safer app ecosystem.

That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.

Today, we're announcing a powerful set of theft protection feature updates that build on our existing protections, designed to give you greater peace of mind by making your device a much harder target for criminals.

These updates are now available for Android devices running Android 16+.

More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts.

This feature is now getting a new dedicated enable/disable toggle in settings,…