Складной iPhone научили притворяться компьютером.

Шесть нулевых дней за час поставили точку в репутации Danfoss.

Отсутствие публичного PoC больше не гарантирует защиту от атак.

Даже важные договоры и отчёты рискуют потерять привычный вид.

Подростки не спешат осваивать интернет.

Hydrogen уже в бесплатных тарифах: модель выбирается автоматически

ИИ научился «забывать» лишнее и решил по такому принципу 97% математических задач

Атакующие собирали облачные токены, SSH-ключи, конфигурации Kubernetes и доступы к популярным нейросетям.

Специалисты подозревают, что новые HTML-виджеты позволяют незаметно запускать вредоносный код.

От «Рэмбо» до пользовательских роликов, почему закон о ценностях ставит в тупик даже самих депутатов.

Нейросеть показала, насколько дешёвым стал поиск опасных ошибок.

Неисправности сетевой инфраструктуры нарушили передачу информации между диспетчерскими центрами и экипажами.

Иностранная речь, незнакомые улицы и меню — больше не проблема.

Обзор лучших сервисов для обнаружения дипфейков.

Программа с открытым кодом оказалась связана с компрометацией IIS и операциями внутри AWS.

Как обеспечить защиту ИТ-контура при внедрении ИИ — и защищаться от него самого?

Сергей Жидков возражает: сотрудников надо учить безопасной работе с ИИ, а не ограничивать запретами.

А вот когда часть презентаций и визуальных материалов начали делать с помощью ИИ и отказались от услуг подрядчиков, эффект стал измеряться деньгами.

На конференции Orion soft анонсировала StarScale AI — платформу для оценки затрат на ИИ и экономической отдачи от его внедрения.

Отдельно система оценивает, сколько рабочего времени удалось сэкономить благодаря ИИ, и пересчитывает эти часы в деньги с учётом стоимости труда сотрудников.

Китайский обвал и распродажа акций американских техногигантов заставили инвесторов усомниться не в способностях ИИ, а в цене обещанного будущего. Разбираемся, что меняется в экономике технологий, почему эксперты спорят о следующем этапе их развития и к чему готовиться российскому бизнесу. 1. Введение2. Счёт за будущее3. Большие мозги против маленьких4. Дешёвые нейросети — дорого5. А если поставщик исчезнет?6. ВыводыВведениеНейросети не стали глупее, серверы не остановились, а разработчики не объявили об отмене технологической революции. Но на биржах в конце октября что-то отчётливо хрустнуло. В Китае индекс STAR50, куда входят в том числе производители полупроводников и участники ИИ-индустр…

Почему так происходит и что с этим делать владельцам сайтов?

Существуют международные центры, например Let's Encrypt и DigiCert, и национальные, в том числе российские.

Это особенно важно, поскольку механизмы отзыва сертификатов не всегда работают идеально.

Если у компании десятки сайтов, серверов и приложений, эту процедуру приходится повторять многократно — и это было чувствительно ещё до сокращения срока действия сертификатов.

Система должна следить за сроками действия сертификатов и сообщать администратору, если обновление не удалось.

Эксперты обсудили, где экосистемный подход даёт заказчику реальную экономию и как не угодить в новый вендор-лок.

Главное — понимать, зачем они нужны, и если завтра уйдёт вендор, как быстро и с какими затратами компания сможет перестроиться.

Главное — насколько они взаимоувязаны и совместимы, выстроены ли их жизненные циклы и не ломается ли один компонент при обновлении другого.

До сих пор основную угрозу видели в том, что злоумышленники найдут уязвимость и проникнут в инфраструктуру, и защищались от этого.

Надежда здесь и на разработчиков, которые будут совершенствовать подходы к созданию и обеспечению безопасности своего ПО, и на регуляторов, которые будут глубже исследовать эти проблемы и…

Kaspersky Endpoint Detection and Response Expert (Kaspersky EDR Expert) предоставляет специалистам ИБ единую картину событий на рабочих станциях и серверах, позволяя видеть развитие атаки, а не отдельные срабатывания средств защиты.

Архитектура Kaspersky EDR Expert ранее и сейчасФункциональные возможности Kaspersky EDR Expert 8.1Для управления Kaspersky EDR Expert используется мультиязычный веб-интерфейс OSMP.

Новый подход позволил отказаться от использования двух отдельных консолей для администрирования и для расследования/реагирования и управлять несколькими продуктами из единой консоли.

Права доступа в Kaspersky EDR Expert 8.1Рисунок 5.

Граф развития атакиИнцидент, сформированный в Kaspe…

Для повышения уровня защищённости клиентов, использующих Kaspersky MDR, «Лаборатория Касперского» в последнем обновлении продукта сделала доступной интеграцию с Kaspersky Digital Footprint Intelligence, системой для мониторинга и анализа цифрового следа организации, входящей в состав комплексного решения Kaspersky Threat Intelligence.

За счёт интеграции Kaspersky MDR и Kaspersky DFI аналитики сервис-провайдера предупреждены о том, какие учётные записи представляют повышенную опасность для инфраструктуры заказчика.

Другие изменения в Kaspersky MDRКроме интеграции Kaspersky MDR и Kaspersky DFI, в сервисе улучшена операционная видимость за счёт уведомлений о состоянии активов.

ВыводыИнтеграция…

Это стало предметом для обсуждения на сессии «Антифрод с ИИ: безопасность без вторжения в приватность» конференции SOC Forum 2026.

Заметим, что на конференции «Проверка на прочность.

Особое внимание вице-президент «Билайна» обратил на то, что в качестве средства противодействия им плохо работают программы повышения осведомлённости сотрудников (Security Awareness).

Не исключено и то, что такие атаки уже случались и в России, но о них пока не объявляли публично.

Найти же им альтернативу трудно, поскольку использование публичных ИИ-моделей чревато утечками данных и, как следствие, регуляторными рисками.

47% — рост направления мониторинга, реагирования и управления ИБ, куда входят SIEM, SOAR и SGRC, по данным «Инфосистемы Джет».

Функции SGRC-систем (Источник: RTM Group)GRC (Governance, Risk and Compliance — управление, риски и соответствие требованиям) используют для управления рисками, политиками и проверками в разных областях организации.

Помимо SGRC в системе есть модули ITAM (управление ИТ-активами), SAM (управление лицензиями), SOAR (автоматизация реагирования), UEBA (анализ поведения пользователей).

Работает в облачном режиме (SaaS) и в варианте In-House для установки в инфраструктуре организации.

Поэтому при выборе важно смотреть не только на название продукта, но и на состав модулей…

Так что далеко не случайно, что тема использования ИИ в разных её аспектах стала ключевой на SOC Forum.

В департаменте киберразведки компании Ф6/F6 особо обратили внимание на то, что в текущем году кардинально изменилась ситуация с использованием ИИ прогосударственными группировками.

Использование ИИ позволяет злоумышленникам быстрее и в больших объёмах создавать фишинговые домены, массово генерировать поддомены и наполнять сайты контентом.

Он позволяет блокировать доступ к внешним ИИ-моделям, которые сотрудники часто используют бесконтрольно и не ставя в известность ИТ и ИБ, защищает от промпт-инъекций и потенциально опасных действий ИИ-агентов.

Подобные инциденты уже имели место, в том чи…

Для тех, кто активно пользуется ИИ и не хочет вносить нейросеть в статью расходов, локальная модель может стать альтернативой платной подписке.

После установки модели не нужно платить за каждый запрос, если обработка действительно проходит локально и приложение не использует платные внешние сервисы.

Единственное ограничение в том, что сама модель не получает свежую информацию из интернета и не может обращаться к онлайн-сервисам без подключения.

У неё есть режимы с акцентом на рассуждения и на обычный диалог, поэтому можно выбирать между более подробным анализом и быстрыми ответами.

Узнайте, где они хранятся, и не вставляйте в запросы пароли, секретные ключи и другие данные, которые не нужны…

Они поддерживают разные типы ловушек и приманок, интегрируются с SIEM, SOAR и другими средствами ИБ, автоматизируют создание и развёртывание ложных объектов.

Отдельные компании используют honeypot и приманки на базе специализированных или открытых решений.

Для удобства мы разделили все вошедшие в обзор решения на две категории — в соответствии с их архитектурой и ролью в защитном контуре.

Ловушки и приманки создаются автоматически, а их работу можно настроить под конфигурацию сети и особенности инфраструктуры компании.

R-Vision TDPR-Vision TDP — DDP-платформа, которая создаёт в сети взаимосвязанные ловушки и приманки для обнаружения атакующих.

Рынок ITSM в России растёт каждый год, но большинство компаний всё ещё используют системы только для регистрации заявок.

Эксперты обсудили, как отличить зрелое решение от классического сервис-деска, зачем нужна CMDB и что изменит ИИ.

Дмитрий Сёмин добавил, что ITSM позволяет повысить прозрачность: раскрыть, что выполняло ИТ, в какой срок и сколько это стоило в рублях.

Граница будет сдвигаться, и прогресс в области ITSM и low-code-платформ за последние шесть-девять месяцев очень заметен.

Илья Шабанов отметил, что основная проблема при новом внедрении — подходить к ITSM как к организационному проекту: формализовать процессы, понять, какие услуги оказывает ИТ.

Эксперты рынка обсудили, что изменилось в регуляторике КИИ, как проверять защиту на практике и что сделать до 1 марта 2027 года.

Он используется, если объект не найден в типовом перечне и в методике категорирования пока нет чётко зафиксированных особенностей по всем отраслям.

Константин Закатов:«К моменту проведения проверки уже всё должно быть готово и в актуальном состоянии — инфраструктура проинвентаризирована, настроена, грамотно работает.

Документация, процессы и категорирование — это важно, но выйти в поле и посмотреть, что происходит на практике, заглянуть в детали — обязательно».

Константин Закатов:«Следить за новыми технологиями, делать правильные выводы и не бояться — архитектурно…

Как развивались системы SGRC в России и GRC за рубежомНа международном рынке GRC-платформы существуют уже несколько десятилетий.

В августе компания опубликовала документ «Innovation Insight: Cyber GRC Streamlines Governance», а в апреле 2026 года представила новое исследование «Innovation Insight: Cyber GRC».

Три общих направления развития SGRC и Cyber GRCРазработчики SGRC и Cyber GRC всё чаще стремятся объединить технические данные, оценку рисков и управленческие процессы.

Поэтому SGRC и Cyber GRC теперь связывают информацию об активах и бизнес-процессах с угрозами, уязвимостями, результатами аудитов и реализованными мерами защиты.

SGRC и Cyber GRC как прослойка между источниками данных и …

Вместе с экспертами разбираем, что опаснее — «перезаложить» или «недозаложить» мощности, и как облака помогают бизнесу справляться с сезонными нагрузками.

ВведениеКогда-то сезонность в ретейле была предсказуемой: «красный океан» с сентября по декабрь, мёртвый сезон в январе и постепенный рост к лету.

Как на самом деле проверяют нагрузкуНиколай Минаков описывает, как это происходит в РИВ ГОШ:При расчётах нужно смотреть на механики рекламных акций и поведение пользователя в целом.

Позиция Николая Минакова такая: облака — не благо и не зло, а инструмент, который нужно правильно использовать.

Станислав Попов предупреждает, что дублирование не работает: расчёт на размещение копии в облаке как на…

В прошлом месяце Сет Ларсон, специалист по безопасности в Python Software Foundation (PSF), опубликовал график количества уязвимостей по годам, на котором заметен значительный рост в 2026 году.

В связи с этим Anthropic профинансировала должность специалиста по безопасности.

Теперь к команде Python Software Foundation присоединится Бретт Смит в качестве специалиста по безопасности (Security Developer).

Он будет работать с Ларсоном (Security Developer‑in‑Residence) и Майком Фидлером (инженер по безопасности PyPI).

Расширение позволит команде заняться новыми проектами — например, масштабированием системы автоматического карантина в PyPI и оптимизацией рабочих процессов PSRT для обработки возро…

Пакет с меткой выхода не провалится в основную таблицу и не уйдёт с адреса входного сервера, даже пока панель ещё не заметила проблему.

Два выхода на один и тот же сервер, скажем AmneziaWG и SOCKS5 поверх одного адреса, — это один путь, а не два.

Подключаться к серверу можно и по IPv4, и по IPv6, но адреса клиентов и маршрутизация — только v4.

Установка идёт от root, Docker ставится, если его нет:curl -fsSL https://raw.githubusercontent.com/r-slashslash/AWG-Router/main/install.sh | bashУстановщик спрашивает, чем управлять (найденным сервером или новым), какой движок ставить и как заходить в панель, и в конце показывает ссылку и пароль.

Сложность не в самих деталях, а в том, чтобы собрать их…

Она была обнаружена в драйвере Common Log File System (CLFS) Windows.

В уязвимости используется меры защиты, введённые Microsoft в октябре 2025 года для предотвращения атак на аутентификацию, нацеленных на проблемы в безопасности в драйвере CLFS.

Хотя SignDrop нельзя использовать против всех компьютеров с Windows, Nightmare Eclipse протестировал уязвимость на Windows 11 26H2, Windows 11 26H2 Experimental и Windows Server 2025 Experimental и подсчитал, что уязвимостью подвержено 80% установок Windows.

Ранее Nightmare Eclipse выложил в открытом доступе уязвимость нулевого дня в Microsoft Defender под названием BigDiskBuster (Windows Defender Update Denial of Service Vulnerability).

Уязвимость…

ИИ-фильтр Роскомнадзора за 2,27 млрд рублей: что известно, а что пока только догадки13 ноября 2026 года Forbes, а за ним Meduza, 3DNews и SecurityLab сообщили, что Роскомнадзор внедрил систему фильтрации трафика на основе машинного обучения.

Разберём, что в нём названо прямо, что добавляют эксперты, и где начинаются догадки.

Отдельно в программе на 2026 год указаны ещё 3,99 млрд рублей на установку и модернизацию ТСПУ и 6,2 млрд рублей на оборудование (3DNews, SecurityLab, 13.11.2026).

Для чего нужна система, по версии изданий3DNews пишет, что система предназначена для поиска средств обхода блокировок, в том числе VPN, и сайтов с запрещённым содержимым.

Те же эксперты называют вероятными ло…

Uber уведомила тысячи водителей о том, что их персональные данные и информация об удостоверениях были похищены в результате октябрьского инцидента.

В компании заявили, что после этого начали оповещать затронутых водителей о том, что их персональные данные хранились у данного подрядчика.

В Uber не уточнили, сколько именно клиентов пострадало в результате утечки и какое количество водителей получили соответствующие уведомления.

Это уже второй за текущий год случай утечки данных в Uber.

Ранее компания сообщила об инциденте в своем подразделении грузоперевозок Uber Freight — ответственность за кражу данных в том случае взяла на себя группировка, занимающаяся вымогательством.

Вдумайтесь: продукт одной корпорации взламывают с помощью инструментов другой корпорации, и последняя на этом еще и зарабатывает, так как токены на дороге не валяются.

Я-то их, конечно, в итоге сжег, потому что по своей тупости использовал вместо скрепки фольгу, но вопрос не в этом.

Это позволяло вызвать переполнение буфера и запустить любой сторонний код еще до того, как консоль успевала проверить цифровую подпись системы.

Только был один пароль, который никто так и не нашел, его раскрыл сам разработчик из Argonaut Games Мартин Пайпер.

Потому что это чит, это сервисный код, который превращает диск с игрой в своеобразный загрузочный диск, который отключал чип проверки лицензии.

Причем в Hubble видно, что запрос все так же шел через DNS-прокси Cilium:attacker -> 169.254.25.10:53 (host) dns-request proxy DROPPED (DNS Query db.shop.svc.cluster.local.

Строки Source pod просто нет, поэтому выяснить через UI, кто именно открывал сокет за host , не получится.

Tetragon: кто стоит за hostTetragon привязывает события к поду по cgroup, а не по сетевому namespace.

Узел host на карте после исправления никуда не денется, и ребра host → frontend и host → backend останутся — это пробы kubelet.

Снять потоки Hubble: через Relay (предварительно проверив в hubble status , все ли ноды на связи) или прямо с агентов на нодах получателей.

Несколько недель я не мог управлять вентилятором удалённо, пока поддержка снимала бан.

Поддельный сертификат, который пройдёт такую проверку, я, скорее всего, сделать не смогу, и к моему серверу вентилятор просто не подключится.

И нам всё ещё нужен довольно надоедливый MitM-стенд, чтобы вентилятор подключался к нам, а не к Coway.

И точно: следующим шагом он стянул приложение Coway с телефона, декомпилировал его и начал сопоставлять исходный код с логами Bluetooth.

Полную полезную нагрузку ИИ мне так и не показал, но я видел её в промежуточном выводе скриптов, которые он писал.

В хостинг‑провайдере Beget инженерам удалось восстановить значительную часть инфраструктуры, но впереди ещё много работы.

Рассказываем, что работает сейчас и над чем мы ещё продолжаем работать.

Для клиентов, чьи сайты уже восстановлены, открыли раздел поддержки в панели управления — cp.beget.com/supportВыделенные серверыВосстановлена работа 94% выделенных серверов.

Продлить домен можно в панели управления в разделе «Домены и поддомены».

Панель управленияБольшая часть функциональности панели управления уже доступна, включая Файловый менеджер.

Как проводилось тестированиеСравнивала Strix и PentAGI.

Коротко о Strix и PentAGIStrix и PentAGI — open‑source LLM‑агенты для пентеста, которые сами ставят себе задачи для достижения цели, запускают инструменты, генерируют PoC и анализируют результаты.

TL;DRStrix и PentAGI сами планируют проверки, запускают инструменты, пишут скрипты и готовят отчёты.

Управление контекстом у Strix и PentAGIУправление контекстом у Strix и PentAGI построено примерно одинаково:Обрезать вывод инструментов до того, как он попадет в историю.

Если вы собрались писать свой собственный инструмент, учитывайте архитектурные проблемы обоих решений: разрастание общей памяти у Strix и деградация сжатия у PentAGI.

13 ноября 2026 года Федеральное управление гражданской авиации США (FAA) приостановило вылеты самолётов из аэропортов по всей стране из‑за сбоя в системе связи.

Министр транспорта США Шон Даффи сообщил, что сбой затронул все центры управления воздушным движением в США.

В международном аэропорту Сан-Диего статус рейсов меняется с «задержан» на «отменен» после того, как в пятницу вечером Федеральное управление гражданской авиации (FAA) ввело экстренный общенациональный запрет на вылеты.

По данным FlightAware, в США были задержаны около 7,9 тысячи рейсов, ещё более 1300 отменены.

Международные рейсы, направлявшиеся в США, принимали в индивидуальном порядке.

Что находилось внутри архиваАрхив содержал README.md , contract.docx и полноценную директорию .git с историей репозитория, несколькими ветками и локальными настройками.

Хук post-checkout автоматически запускается после переключения ветки через git checkout или git switch .

Если репозиторий доверенный и Git действительно выполняет такую проверку, появляется возможность запуска вредоносного фильтра.

Если Git вызывает скрипт с соответствующим интерпретатором, выполнение может происходить через поставляемую вместе с Git оболочку.

Мы привыкли считать, что git status - это безопасная команда, которая просто показывает состояние репозитория.

Ответ Павла Дурова о виджетах TelegramПеревод постаПо поводу предполагаемого удалённого выполнения кода в новых виджетах Telegram для Android и Windows.

Заодно движок виджетов перенесли в отдельный изолированный процесс без доступа к файлам Telegram и сети.

13 ноября Telegram Info сообщил, что виджеты в чатах перестали работать, и предположил, что их отключили из-за уязвимостей.

Разве что не вкладывайте div глубже 1024 уровней, но вы, надеюсь, и не собирались.

В первой статье я бы теперь уточнил, что на Android виджеты работают в отдельном процессе, а фильтр системных вызовов пока в режиме аудита.

Это не обзор разделов, а история решений: что выбрал, во что это обошлось и где ошибся.

Первый — php tests/run.php , 160 проверок, проходит примерно за 20 секунд и не требует ничего, кроме PHP.

Бюджет скорости и доступность в браузерных тестахPHP-тесты не видят вёрстку и не исполняют JavaScript.

«Один бот» значит «один сценарий», а не одна машина и не один владелец.

Нашёл через nft list ruleset | grep -nE '^table|hook ' — там видно все таблицы и в каком порядке они цепляются к хукам.

репозиториев GitHub для кражи секретов GitHub Actions и учётных данных облачных сервисов при помощи вредоносных рабочих процессов.

Злоумышленники использовали тысячи взломанных аккаунтов GitHub для создания запросов на слияния в репозиториях, к которым эти учётные записи имели доступ.

взломанных аккаунтов GitHub, чтобы проверить, есть ли у них права на запись в 61,7 тыс.

На заключительном этапе хакеры быстро отменили внесение изменений и удалили записи рабочих процессов и журналы.

Владельцам репозиториев рекомендовали проверить ветку wfx‑docs, запрос на слияние probe и пробелы в номерах выполнения рабочих процессов.

Все статьи, PDF-архив, скидки и другие бонусыБумажная подшивка «Хакера» за 2026 год почти завершена: три ежеквартальных номера уже напечатаны и доступны в нашем магазине , а четвертый и заключительный выпуск — уже на подходе.

Ежеквартальный «Хакер» #4На 240 полосах заключительного ежеквартального номера собраны практические руководства, эксперименты с железом, исследования уязвимостей и технические разборы.

Кроме того, в журнал войдут подборки утилит для пентестинга, администрирования и кодинга, практические кейсы атак, исследования уязвимостей и разборы защит, а также материалы о сетевой разведке и криптографии.

Все номера 2026 годаПока четвертый журнал готовится к выходу, первые три части…

Специалисты компании N-able отключили облачные инстансы платформы N-central по всему миру, а также рекомендовали клиентам временно отключить и локальные серверы.

По словам Бейлса, при поиске багов он использовал ИИ и тестировал уязвимости в N-central Appliance 2026.4.0.31.

После публикации информации о багах Able2Shell с исследователем связались руководители N-able, попросив его удалить репозиторий и сотрудничать с компанией.

Так, в одном случае для этого используется хранимая XSS, которая срабатывает, когда администратор просматривает вредоносные метаданные обновления, а в другом — отдельная уязвимость повышения привилегий для пользователя nable.

Представители N-able подчеркивают, что в ве…

Японский удостоверяющий центр GlobalSign готовится к очередному массовому отзыву SSL/TLS-сертификатов российских организаций.

Напомним, что летом текущего года GlobalSign начал принудительно отзывать сертификаты российских организаций после изменения требований международного консорциума CA/Browser Forum, который определяет правила выпуска и отзыва сертификатов безопасности.

При этом поначалу HARICA стал альтернативой для части российских организаций, которые лишились сертификатов GlobalSign.

Однако позднее греческий удостоверяющий центр тоже начал отзывать сертификаты.

Также сертификат могут отозвать из-за требований законодательства страны, где работает удостоверяющий центр, или после жал…

Мы прой­дем весь путь: от устрой­ства экс­трен­ных служб в ОС и внут­реннос­тей AppOpsService до трех бай­пасов и обхо­да политик SELinux.

В Android есть Privacy controls: в штор­ке быс­трых нас­тро­ек мож­но заб­локиро­вать мик­рофон и камеру гло­баль­но, для всех при­ложе­ний сра­зу, нев­зирая ни на какие выдан­ные раз­решения.

Это логич­но: в экс­трен­ной ситу­ации дис­петчер дол­жен тебя слы­шать и парано­идаль­ный тум­блер в штор­ке не дол­жен сто­ить поль­зовате­лю жиз­ни.

AppOpsService: разрешения поверх разрешенийДа­же если ты пишешь софт под Android не пер­вый год, есть боль­шая веро­ятность, что с AppOpsService ты вжи­вую не стал­кивал­ся.

Этот тег показы­вает, какой имен­но модул…

Выяснилось, что злоумышленники сумели расшифровать секреты примерно для 1,85% (около 100 000) рабочих пространств, а затем использовали похищенные данные для работы с ИИ-сервисами на общую сумму примерно 740 000 долларов США.

Если ИИ-провайдеры не вернут пострадавшим деньги, в Railway обещают покрыть расходы самостоятельно.

Railway — облачная платформа для разработчиков, которая позволяет развертывать и запускать приложения, API, базы данных и другие бэкенд-сервисы без самостоятельной настройки инфраструктуры.

Платформа также хранит связанные с развертыванием настройки и секреты, в том числе API-ключи и учетные данные для доступа к базам данных и реестрам.

Теперь каждая сборка Railway запус…

Связанные с Северной Кореей хакеры за последние 18 месяцев похитили крипты на сумму свыше $400 млн с помощью схемы социальной инженерии FaceStealer.

Злоумышленники приглашали жертв на видеовстречи и с помощью заранее записанных роликов и дипфейков выдавали себя за их знакомых.

Предположительно, доступ к ним и репозиториям нужен для последующих атак на цепочку поставок ПО.

Дополнительно злоумышленники использовали созданные с помощью ИИ видео с известными представителями криптоиндустрии.

В ФБР подчеркивают, что схема эксплуатирует доверие к привычным платформам видеосвязи и знакомым людям.

Все статьи, PDF-архив, скидки и другие бонусыПредставители Sega сообщили об утечке данных, произошедшей из-за взлома стороннего сервиса для email-рассылок Arara.

В результате атаки в руках злоумышленников оказались email-адреса 2,2 млн подписчиков 11 рассылок, связанных с продуктами и сервисами Sega и Sega Fave.

Специалисты Sega и Arara еще продолжают расследование инцидента, но пока не обнаружили подтверждений того, что похищенные данные уже используются злоумышленниками.

Помимо кражи данных, злоумышленники использовали доступ к сервису Arara для рассылки вредоносного спама.

Среди других крупных жертв этой атаки:сеть ресторанов MOS Burger (7,5 млн email-адресов), сеть кинотеатров Shochiku …

Минцифры включило в «белые списки» уже около 900 ресурсов, которые должны оставаться доступными при ограничениях мобильного интернета.

По словам главы ведомства Максута Шадаева, в настоящее время количество ресурсов в перечне приблизились к техническому пределу, и бесконечно расширять его не получится.

Сейчас в перечень входят 900 ресурсов, и, по словам министра, их количество уже приблизилось к техническому пределу, который могут поддерживать операторы связи.

Минцифры ранжирует сервисы по популярности среди российских пользователей и постепенно добавляет в перечень самые востребованные из них.

Кроме того, по словам министра, в Минцифры намерены изменить подход к формированию «белых списков…

Представители TRON, эмитента стейблкоина USDT Tether и аналитической компании Chainalysis объявили о создании Digital Crime Task Force (DCTF).

Группа будет выявлять противоправную активность с использованием USDT в сети TRON, отслеживать связанные с преступлениями кошельки и помогать правоохранительным органам быстрее замораживать средства.

Новое партнерство появилось после запуска T3 Financial Crime Unit — аналогичного объединения компаний TRON и Tether с аналитической компанией TRM Labs.

В сентябре в Tether заблокировали около $39,3 млн на десяти адресах Tron, связанных с площадкой Xinbi Guarantee.

В июле в Tether заморозили USDT в 131 кошельке, связанном с ISIS-K, после включения адресов…

С 6 по 11 ноября с кошельков, связанных со взломом Bitget, вывели 1052,34 BTC стоимостью около $78,61 млн.

Перемещения связаны с сентябрьской атакой на биржу: после уточнения состава похищенных активов в Bitget оценили ущерб в $387,5 млн.

За шесть дней средний объем исходящих переводов составил 175,39 BTC, или около $13,1 млн в сутки.

Другие 267,46 BTC стоимостью $19,84 млн сначала прошли через новые адреса, при этом было совершено от одного до шести промежуточных переводов.

Как заявили в Bitget, речь шла об уточнении последствий уже произошедшего инцидента, а не о новых несанкционированных выводах.

Эксперты «Лаборатории Касперского» опубликовали исследование атак группировки Arra Ghouls, которую специалисты F6 отслеживают под названием Mimbrob.

Если раньше эти хакеры в основном атаковали частных пользователей с помощью стилеров и банковских троянов, с апреля 2026 года они переключились на организации в России и Беларуси.

По данным специалистов, от активности Arra Ghouls пострадали уже 18 организаций из телекоммуникационного, промышленного, ИТ- и финансового секторов, а также сферы оптовой торговли.

Внутри такого архива может содержаться легитимный исполняемый файл Chromium, и в том же каталоге находится вредоносная DLL.

Исследователи отмечают, что пример Arra Ghouls показывает, наскол…

В ноябре разработчики Microsoft устранили более 1200 уязвимостей в продуктах компании.

Следует отметить, что суммарно в ноябрьском бюллетене Microsoft фигурируют 1259 CVE, включая 165 уязвимостей в сторонних компонентах.

Если не принимать последние во внимание, в этот «вторник обновлений» вошли патчи для 1094 багов.

Единственной уязвимостью нулевого дня на этот раз стала CVE-2026-124194, обнаруженная в Microsoft Outlook и получившая 6,5 балла по шкале CVSS.

Напомним, что в октябре разработчики исправили около 1400 уязвимостей, а в общей сложности с начала 2026 года инженеры компании устранили уже более 5200 багов.

И если облачная инфраструк­тура про­изво­дите­ля еще худо‑бед­но защище­на, то железо час­то оста­ется без прис­мотра: отла­доч­ные пор­ты, откры­тый SWD, UART без пароля.

Ме­тоды аппа­рат­ного воз­дей­ствия (voltage glitching и clock glitching) я не при­менял — для них нуж­но спе­циали­зиро­ван­ное лабора­тор­ное обо­рудо­вание.

SoC — высоко­уров­невый, на нем сто­ит кас­томный Linux, который стро­ит мар­шру­ты, обща­ется с обла­ком и управля­ет всей логикой убор­ки.

Вто­рая — «кас­томный Linux на SoC; FreeRTOS на MCU», то есть про­шивок две, они незави­симы и повер­хность ата­ки у каж­дой своя.

На обратной сто­роне пла­ты R2205-MB-A1 сто­ит мик­росхе­ма флеш‑памяти SPI NAND XT26G02ELGIG, …

В компании подчеркивают, что инцидент удалось изолировать, и другие системы Maersk в ходе атаки не пострадали.

При этом пока в Maersk не сообщают, какую именно систему скомпрометировали хакеры, когда произошла атака и какие данные в итоге были похищены.

Хакеры требуют выкуп в размере 5 млн долларов США в биткоинах и дали компании 30 дней на выполнение своих требований.

В Maersk пообещали уведомить клиентов, если в ходе расследования будут выявлены новые последствия инцидента.

Также в компании предупредили о возможном фишинге: пользователям рекомендуют не доверять письмам и сообщениям об инциденте и проверять их подлинность через привычные каналы связи с Maersk.

По предварительным данным, злоумышленники использовали шифровальщик, который нарушил работу облачной инфраструктуры и клиентских сервисов провайдера.

Представители ESTT заявляли, что от атаки пострадали кластеры виртуализации и системы управления облачной инфраструктурой, но выделенные физические серверы клиентов и развернутые на них кластеры инцидент не затронул — они продолжали работать в штатном режиме.

В результате пострадали кластеры виртуализации и системы управления облачной инфраструктурой ESTT, что привело к нарушению работы клиентских сервисов», — говорилось в первом заявлении провайдера.

Сообщается, что все виртуальные серверы восстановлены, а специалисты технической поддержки уж…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a high-severity security flaw impacting UnrealIRCd, an open-source Internet Relay Chat (IRC) server, to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation.

The addition comes nearly a week after UnrealIRCd's project leader, developer, and maintainer, Bram Matthys (aka Syzop), released UnrealIRCd 6.2.7.1 to address multiple security vulnerabilities identified with the help of artificial intelligence, including CVE-2026-114713.

"We are seeing bad guys exploiting this issue on the internet right now," Matthys said.

"Hopefully everyone has hot-patched or updated their server…

A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server.

Any code run this way has the rights of the operating system user that runs PostgreSQL.

It does not include the SQL for the final step, which makes the server run a command.

The project's security advisory describes the attacker only as someone who can create objects, without saying which privileges that takes.

None of these sources says whether an account with only default privileges can go beyond the crash to run code.

One of them, Mior, can also modify a VM's memory and fake the signed report confirming which software it runs.

Researchers showed both in lab tests on AMD EPYC server processors.

SEV-SNP brings confidential computing to AMD EPYC server processors.

The Mior team says updated firmware that mitigates the flaw is already out, and the Skyfall team says new microcode has been released.

For the five EPYC server lines listed above, the bulletin lists only that patch, due in November.

The campaign involves luring targets with invitations to video meetings delivered from stolen accounts belonging to prior victims.

Set up the meeting: Should the target express interest, the attacker sends a Calendly invite via Telegram to schedule the video meeting.

Should the target express interest, the attacker sends a Calendly invite via Telegram to schedule the video meeting.

More than 900 victim webcam video recordings used by the threat actors to impersonate victims in follow-on attacks have been seized by the FBI.

Using Microsoft Visual Studio Code (VS Code) tasks.json configuration files to automatically trigger the execution of malicious code when the project is opened in VS Code.

Three Trezor Safe 5 wallets bought from the reseller CryptoBilis contain an implant, an extra circuit board that can copy their recovery phrases, hardware wallet maker Trezor said yesterday.

Do not set up an unused wallet from the reseller, and never type an existing recovery phrase into one.

Keep the wallet and contact Trezor Support, which offers a new Trezor wallet to anyone who bought from the reseller since March.

Version 2.13.1 was released for the Safe 7, Safe 5, Safe 3 and Model T, according to the company's firmware changelog.

Trezor wallets are self-custodial, so it cannot see anyone's balance.

Turning off the model may not stop the workAn AI agent is usually part of a larger system.

It may need to stop active and queued runs, revoke the credentials they use, disable access to tools and restrict network paths.

OWASP’s AI Agent Security guidance recommends least-privilege tool access, explicit authorization for sensitive operations, audit trails and ways to interrupt or roll back agent operations.

An effective response starts with knowing which credentials an agent can use and how to revoke its access.

These controls support containment alongside tested procedures for stopping workflows, terminating sessions and restricting network access.

A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan.

People using the hacked operators' own networks may also have been targeted, but the company could not see that traffic.

That left two explanations: someone outside was faking those networks' signaling addresses, or equipment inside each network had been taken over.

If the test text reached the hacked equipment instead of the phone, the attackers knew they were getting that person's texts.

In several hacked operators, SilentAir attacks happened during a known Liminal Panda infection.

Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks.

Criminals used SEO poisoning to push those sites high in search results.

The takedown is part of Operation Endgame, an international police campaign against malware criminals use to access victims' computers.

The stolen data is also being shared with services including Have I Been Pwned and the Shadowserver Foundation.

Even after police seize the data, criminals may still have the stolen logins, the police say in their frequently asked questions.

An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously unreported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA.

The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader follow-up wave on November 2, 2026, that targeted organizations across multiple countries and sectors.

"PHP2Shell provided initial access, followed by privilege escalation through the DynamicCLI interface, tracked as CVE-2026-123039," Check Point said.

]204 targeted Israeli organizations through vulnerable Mobile Access…

The following actions have been applied to Hosted environments -Legacy API is turned off by default in the product.

"N-able N-central 2026.4 HF1 updates legacy components of the Agent and Probe, which changes how the two communicate," it said.

"As such, upgrading both Agents and Probes in your N-central server is a MUST to ensure all managed devices are communicating and patched."

The compromised N-central servers are concentrated across the U.S., South Africa, Canada, the U.K., Germany, France, and Sweden.

Applying Hotfix 2 is not enough on its own: 19 of the victims here were already running it."

Attackers are using fake websites, stolen access, and trusted tools to get into places they shouldn't be.

Still, plenty of things are going wrong in ways that shouldn't be this easy.

AI is showing up on both sides, making attacks easier to build while helping researchers find problems faster.

The good news is that some of these threats are being stopped, and defenses are slowly catching up.

The bad news is that fixing a bug, removing a file, or blocking an attacker doesn't always mean the problem is gone.

Public exploit code released earlier this week claims that a local Windows user can gain SYSTEM privileges through the Common Log File System driver.

To reduce that exposure, Microsoft added an authentication check to CLFS log files in updates for Windows 11 25H2, 26H1, and Windows Server 2025 shipped in October 2025.

According to the proof-of-concept code, a standard user prepares a CLFS log and container with paths the user controls.

The exploit was tested on Windows 11 26H2, a Windows 11 26H2 Experimental build, and Windows Server 2025 Experimental, according to the repository.

Systems are affected when the CLFS authentication registry mode is set to 0 (enforced) or 1 (learning).

A critical flaw in Red Hat Quay allows an attacker who can access a Quay registry to read and overwrite private container images in every repository.

The flaw lets an attacker add their own key to the keys Quay trusts, with no expiry date.

With those tokens, an attacker can retrieve private images and any secrets or credentials stored within them.

Red Hat lists every version of Quay 3 and Quay 5 as affected by both flaws.

For CVE-2026-123710, its guidance names standalone installs, Quay deployed by the Quay Operator on OpenShift, and the mirror registry for Red Hat OpenShift as affected.

Citrix has released patches for multiple critical security flaws impacting NetScaler ADC, Citrix NetScaler Gateway, and NetScaler Console that could lead to denial-of-service (DoS) or an authentication bypass.

(All NetScaler ADC and NetScaler Gateway deployments)(CVSS score: 9.3) - A memory overflow vulnerability in Packet Processing can lead to unpredictable or erroneous behavior or DoS.

(All NetScaler ADC and NetScaler Gateway deployments) CVE-2026-107407 (CVSS score: 9.3) - A memory overflow vulnerability in SMPP traffic can lead to unpredictable or erroneous behavior or DoS.

(NetScaler configured with DNS Load Balancing over HTTPS) CVE-2026-107410 (CVSS score: 9.3) - A memory overflow i…

Cybersecurity researchers have found that lookalike domains masquerading as artificial intelligence (AI) tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches.

The third pathway sends users to a search-hijack extension family with 16 live Chrome Web Store listings and 972,000 declared users.

Some of the AI lookalike domains are listed below -cloude[.

]ai"), which redirects the browser to a browser extension called Quick Search that's available on the Chrome Web Store.

Quick Search is part of a larger set of 16 extensions, including GPT for Chrome, which has 80,000 users.

Key points of this blogpost: GTA VI launches on November 19 th , 2026, for PlayStation 5 and Xbox Series X|S.

Before taking a closer look at the scams tied to GTA VI, let’s establish what Rockstar has actually announced.

Others used the name to push fake GTA VI builds (more on this below).

What’s really inside a “free GTA VI” downloadWhile alleged GTA VI footage has circulated online, security researchers have found no evidence of a genuine playable leaked copy being distributed.

Also remember that professional graphics, GTA VI artwork, trailers, and trust badges do not prove that a shop is legitimate.

On a compromised Exchange server, the most interesting activity is not always the message that arrives in a user’s inbox.

Instead – adding insult to injury – the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure.

The Cereal toolkit demonstrates Turla’s ability to carry out a slow, careful, long-term intrusion built around Microsoft Exchange servers.

CerealNeuron runs on the compromised Exchange server and passively listens for incoming web requests on paths that look like ordinary Exchange traffic.

ConclusionThe Cereal toolset is a carefully constructed instrument for long-term, stealthy cyberespionage.

We uncovered a SlippyNunchucks DNS hijacking operation, abusing Sogou Input Method’s use of insecure HTTP communications.

Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used Chinese input method editors (IMEs) for typing Chinese characters on computers and mobile devices (see Figure 2).

Sogou Input Method uses specialized collections, known as cell dictionaries (细胞词库), to expand its vocabulary and improve Chinese text prediction.

Technical analysisAnalysis of the DNS hijackingAs part of Sogou Input Method’s brand promotion mechanism, SGTool.exe, one of its components, sends an HTTP request to the config.pinyin.sogou[.

Similar to the previous mechanism, this approa…

We presented our findings about the Gorbag APT group at the Virus Bulletin conference on October 14th, 2026; the full technical analysis is available in our white paper Gorbag: Orcs at the border published by Virus Bulletin.

Gorbag: Orcs at the border Read the full report PDFVictimology and geopolitical contextAll Gorbag targets identified by ESET Research are located in Ukraine, and the group’s targeting choices fall into three main areas that align closely with Russian wartime intelligence priorities.

Prime ReverseShell is derived from the publicly available PSSW100AVB repository on GitHub, with modifications to suit the operators’ needs.

Prime ReverseShell with a comment trying to fool A…

Effective SMB protection demands that vendors lead their customers through a clear onboarding process – and offer practical and transparent guidance during incident response engagements.

Understanding what a genuine threat to the organization is and what not to worry about is often beyond the capability of a small IT security team.

They are trusted by more SMBs than any other entity – including internal staff, industry peers, and governments – as a trusted source of cybersecurity guidance.

SMBs don’t want to hand over all control for threat protection.

The key for vendors is to ensure these experts are available at onboarding, to guide SMBs through configuration, activation and setup.

The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plansWith October coming to a close, ESET Chief Security Evangelist Tony Anscombe reviews some of the top cybersecurity stories that made the news over the month.

At the same time, he offers insights that the latest wave of incidents hold for your company's, or your own, cyber-defenses.

A data breach at Denmark’s Central Population Register (CPR) has exposed the personal information of 8.8 million people.

What are the lessons that businesses should take away from the latest cybersecurity news?

Watch Tony's video to find out, and be sure to check out the Se…

Amatera – which topped ESET’s infostealer detections in Latin America in the first half of 2026 but targets victims worldwide – shows what this professionalization looks like in practice.

Detected by ESET products as Win/PSW.Amatera, Amatera is a Windows infostealer written in C++ that was first observed in 2024.

Amatera has spread via compromised websites, search engine ads, targeted emails, fake documents, SVG files, and ClickFix via fake CAPTCHAs.

In Latin America, Amatera topped ESET’s infostealer detections in the first half of 2026, ahead of Formbook, Vidar, Lumma Stealer, SnakeStealer, and Rhadamanthys.

A developer maintains the product, and other actors distribute it via compromised…

In the age of AI, all of this was reported within a single “Cybersecurity Black Week,” an exceptionally eventful seven-day period amid an already turbulent Black October.

The name refers to two memory-safety vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, affecting PHP versions 5.4 through 8.5.11.

The same decoder is compiled into the Python Brotli and brotlicffi packages as well as into other HTTP software, which led researchers to rename the issue HTTP2Shell.

Cutting through the noiseCybersecurity Black Week showed that a severity score rarely tells the whole story.

For the leaked kernel flaws, that window opened before any fix existed, and for end-of-life PHP versions, …

ESET APT Activity Report Q2 2026–Q2 2026 summarizes notable activities of selected advanced persistent threat (APT) groups documented by ESET researchers between April and September 2026.

They represent only a subset of the cybersecurity intelligence made available to customers of ESET Threat Intelligence APT Reports.

In Southeast Asia and Oceania, China-aligned threat actors ran campaigns that appear to support Chinese law enforcement efforts against organized crime in the region.

Finally, we identified several cases of APT groups using AI and large language models (LLMs) at various stages of their operations.

Threat actors used AI primarily to accelerate tasks that would otherwise require…

The news prompted security advisories from government agencies and sent website owners scrambling to apply the patches, with some sites even going offline as a precaution.

This is because on an unpatched server, an attacker can exploit the vulnerabilities to run their own code without logging in.

As three out of four websites globally are estimated to use PHP in some capacity, its ubiquity helps create an environment ripe for abuse; indeed, initial attempts to exploit the flaws – discovered by AI and dubbed PHP2Shell – weren't long in coming.

Here's what to know about CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little mo…

The following day, at 09:28, a new binary was delivered to the machine: the MythicRatatoskr backdoor.

This blogpost focuses primarily on the analysis of the MythicRatatoskr backdoor, the Yggdrasil network that hosts its C&C server, and the accompanying SOCKS5 server.

Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr.

MythicRatatoskr main configurationThe MythicRatatoskr configuration is stored in a file at a hardcoded path.

NetworkIP Domain Hosting provider First seen Details b479:2771:8df4:b5e b:d007:63b0[:]2838 N/A N/A 2025‑07‑17 MythicRatatoskr C&C server within the Yggdrasil network.

In some cases, the scam ad may take you to a fake e-commerce site which covertly harvests your card details.

What happens if I’ve fallen victim to a scam ad?

Scam ads are getting easier to generate thanks to AI, and can look increasingly professional, even including video content.

Can I get my money back if I paid through a scam ad?

What should I do if I’ve fallen victim to a scam ad?

This is email bombing.

What is email bombing?

Sometimes called “form bombing,” “list bombing” or “subscription bombing,” email bombing attacks usually follow the same pattern.

There’s no silver bullet to prevent email bombing.

Has my email account been hacked if it’s full of sign-up emails?

Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safeScammers love a pretext.

And with Medicare Open Enrollment, they have a perfect opportunity to exploit victim expectations, masking their fraud under the cover of legitimate activity.

Work through the following steps:Call or contact Medicare at Medicare.gov or 800-633-4227 to report the incident.

So slow down this Open Enrollment season and verify every request for personal and medical details.

Frequently Asked Questions (FAQs)When is Medicare Open Enrollment?

Data breach notifications are telling victims less than ever.

As the volume of data breach incidents increases, there’s a growing chance that you’ll be caught up in one.

Example of a data breach notice with a detailed explanation of the situation (for more, head over here)How do you interpret a breach notice?

For that reason, you should never click through on any unsolicited breach notification email or message.

Change your logins (if relevant) and consider credit monitoring and a credit freeze.

OpenAI began rolling out ChatGPT Wallet, which lets ChatGPT agents pay for purchases with a stand-in card number, so the user’s card details are not shared with the agent or the merchant.

OpenAI built it with American Express, Mastercard, and Visa.

OpenAI says some websites may block agent purchases without meaning to, and fraud systems may flag legitimate ones, which ends in declines or cancellations.

It also asks them to work with their payment and risk providers on spotting agent purchases.

Luke Gebb, who heads global innovation at American Express, called the wallet the company’s “first American Express Agentic Commerce Experiences integration.” For now, access is limited to ChatGPT Pro…

Cynet researchers followed a “GTA 6 EXE file download” link from a Google Colab notebook to a ZIP archive and found a WARDEN Stealer loader inside.

The malware takes saved passwords, browser cookies, Steam and Roblox credentials, and cryptocurrency wallet data from the machine it runs on.

A Google Colab notebook promotes a fake GTA 6 executable download (Source: Cynet)Grand Theft Auto VI launches November 19 with no PC version.

A download page and a file manager measure different things, so the size mismatch proves little by itself.

The binary contains no game engine, no game assets, and no Rockstar signatures.

Apple published details of Secure Exclaves, a security architecture designed to protect camera and microphone data during background processing.

Apple says data processed and analyzed within Secure Exclaves cannot be accessed by the main operating system, apps, or the company itself.

The company uses Secure Exclaves for person recognition on HomeView, as well as for Siri Recap and Live Rewind.

Isolation prevents the main operating system from extracting or modifying data processed within Secure Exclaves.

What comes nextApple said it will continue hardening Secure Exclaves through AI-accelerated vulnerability research and broader formal verification coverage.

Europol and police in 14 countries arrested 354 dark web vendors and buyers in Operation TorNado, which ran from May 2025 to October 2026.

Investigators went after people who had traded on five marketplaces that were already offline: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door.

Seized money (Source: Europol)The people who used those markets were still exposed after the sites went dark.

Police also went after vendors and buyers on forums, single-vendor shops and encrypted messaging services, and carried out hundreds of house searches.

The same assessment says marketplaces are splitting into platforms that each focus on one kind of crime.

OpenAI is bringing AI agents into more of the software security process with Daybreak, pairing web application penetration testing with tools that investigate vulnerabilities and develop fixes.

The two offerings, Red Team and Defense Factory, connect the work of finding security weaknesses with patching and retesting them.

Red Team tests applications and verifies fixesDaybreak Red Team, offered through an early-access program, uses coordinated agents to examine application source code and context, investigate potential attack paths and confirm vulnerabilities.

Validate reported vulnerabilities (Source: OpenAI)Once a patch is ready, Red Team can test whether it blocks the exploit.

Agents inv…

North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and Teams calls filled with webcam footage of earlier victims.

It has seized more than 900 of those recordings, and on November 12 it warned crypto and web3 workers and open-source maintainers about the scheme.

The FBI ties the activity to the group tracked as Sapphire Sleet, BlueNoroff and APT38, among other names.

The hackers take over earlier victims’ Telegram, LinkedIn, Slack and Discord accounts, read their chat histories, and message the victims’ contacts about catching up or an investment.

“The quality of the deepfakes only needs to be good enough …

Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in.

Device code phishing abuses a real Microsoft sign-in flow.

Clicking “Continue” started a Microsoft device code request on the attacker’s backend.

It then started a fresh device code session and tried again.

Where the business doesn’t need device code authentication, restrict or monitor it through conditional access.

Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that reached onboarding over one year.

Over the year, 2,429 of them made contact, 1,100 reached an interview or later, and 27 reached onboarding, meaning offer letters, background checks, equipment requests, or first-day IT setup.

Of the 27 that reached onboarding, 18 were in process elsewhere at the same time, and one was finishing onboarding paperwork at one company while chasing jobs at seven others.

At 42 of them, at least one moved on to an interview or offer, and at four, a persona reached onboarding.

The third had about 14 million source-…

An MCP server configured to run one fixed release on an administrator’s workstation ran with 15 different sets of dependencies over five weeks, with its configuration untouched.

The same pattern in the fieldCorelight reviewed 35 MCP servers from two vendor catalogs and its lab.

The MCP Servers I maintain are reviewed nightly for vulnerabilities.

If one is found, it’s updated the next morning, with a change log.”“For the 23 public MCP servers that I found, I notified the maintainers and/or services that share them.

In another case, the vendor is completely repackaging their MCP server,” Lagermann said.

94% of surveyed enterprises experienced at least one digital sovereignty challenge in the past three years, according to IBM’s Digital Sovereignty Index.

The report defines digital sovereignty as an organization’s ability to retain control and provide credible evidence of that control across critical AI, technology, operations and data.

The index placed 26% of enterprises in its highest maturity tier, Leading Digital Sovereignty.

During their most challenging sovereignty incident, 33% of enterprises reported being able to demonstrate exit fully and credibly, without significant follow-up.

This includes the ability to replace a provider, model or system while maintaining business continuity.

Google has built its Gemini-powered intelligent eyewear to stop taking photos and video when someone covers or tampers with the outward-facing recording light.

Wearers face a different exposure, because glasses that see what they see also capture menus, street signs, and the faces of strangers.

Google Shopping and Ads policies ban promoting products that disable or hide recording lights on smart glasses.

Enforcement runs through the terms of serviceBefore using the glasses, wearers must agree not to record people without permission, not to record in sensitive places, and not to cover the light.

Google may disable the glasses of anyone who breaks those terms, and setup requires an 18+ Google…

EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows computers.

Once NetSupport is running, an attacker can reach any file the logged-in user can reach.

Three keys and you’re doneClickFix is a social engineering trick that gets users to pass a fake check by running a command themselves.

How the links probably got outThe researchers worked from the infrastructure side and did not see how victims reached the pages.

The pages still gave them away: they used the same fake Zillow template, the same encoded IP and download path, and the same NetSupport deployment.

The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs.

Most of those code execution bugs are memory errors or type confusion, where PostgreSQL handles a value as the wrong data type.

Some fixes need a reindexSeveral bug fixes require work after the new binaries are in place.

PostgreSQL 14 is doneVersion 14.25 is the final release of PostgreSQL 14, which gets no further security or bug fixes.

The project also shipped PostgreSQL 19 RC 2, with general availability planned for November 19.

Anthropic has released a self-hosted version of Claude Managed Agents.

Companies can run the agent harness, sandboxes, credentials, and session history in their cloud or on-premise.

What the customer runs nowIn the self-hosted setup, the customer operates three things: the Managed Agents server, its PostgreSQL database, and the workers where agents run their shell and file tools.

They apply whether Anthropic hosts everything, the customer hosts only the sandbox, or the customer hosts all of it.

Managed Agents also keeps a log of every step an agent takes: each tool call it made and what it got back.

Picus Security has announced Picus Autonomous Penetration Testing, an agentic pentesting capability that puts AI agents on the offensive: they think like attackers, chain real exploits toward an organization’s crown jewels, and prove what a breach would look like, under governance the agent cannot override.

“Every security leader now faces an attacker who never sleeps, never waits for a change window, and gets smarter every month,” said Volkan Erturk, CTO of Picus Security.

And because the engine runs on the Picus agent customers already have, with no dependency on Active Directory, there is nothing new to deploy.

executes real exploit chains end to end, with an agentic engine deciding ever…

Climate change is the issue.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This essay is adapted from a keynote speech delivered at the DEF CON 34 conference in Las Vegas on August 7, 2026. The essay originally appeared in CyberScoop.

I want to talk about AI hacking. There are three aspects: people hacking AI systems, people using AI to hack other systems, and AIs hacking systems on their own, not even maliciously. The last two matter more than the first. The third is the weirdest and potentially the most destabilizing.

I started writing about this in 2021 and in my 2022 book, A Hacker’s Mind. Back then I said it was mostly still science fiction, but not stupid science fiction. We’re seeing it more and more, especially in the past year. The trends I’m describing d…

Penlink’s Webloc is an application that locates people using information from the weather, gaming, email, and religious apps on their phone. It’s sold to the police.

The tool collects vast quantities of location data from smartphones via commonly used weather, gaming, email and religious apps. It can build a detailed picture of where a smartphone has been over the past 12 months, and update the data hourly, showing the movements of people on a near real-time basis. Law enforcement officers can use Webloc to zero in on a map and look at all phones that were present at a specific place and time, analyzing “billions of location data points,” according to company documents reviewed by Bloomberg…

It’s hard to believe how lucrative this crime can be:

According to a press release from the United States attorney’s office for the southern district of New York, three men ­ Jacob Soall, Sharon Hazan, and Guy Sheetrit ­ were arrested for using AI to alter and impersonate the voices and images of executives and attorneys at various companies in order to convince employees to send over large payments. Soall and Hazan were arrested in Spain over the summer, while Sheetrit was arrested in the United Kingdom in September. The alleged fraud took place between 2024 and 2026...

It’s a bad one, and it’s been in the code for a decade:

A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

“Oversized” means longer than 256 bytes. Details.

Slashdot thread. And another news article.

Two weeks ago, I attended the [un]prompted AI security conference in San Francisco. It was an excellent event: three days of very dense talks about all aspects of AI security. (My talk was about integrous AI, and I will post it when it is online.)

AI security can be divided into three broad topics. It’s important for researchers to understand which one they are working on. And it’s important for us as a community to work on them all. They are: security of AI, security with AI, and security from AI. [un]prompted had good talks about all three...

News story: “Scientists discover a bizarre Jurassic ‘squid’ unlike anything ever seen.”

Scientists have identified the “fattest” belemnite ever discovered, a bizarre, barrel-shaped squid relative that lived in Wyoming’s ancient seas 160 million years ago. The exceptionally rare fossils reveal a creature unlike anything previously known, potentially a predator of smaller squid-like animals and a surprising survivor of a supposedly vanished family.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered...

This is fascinating:

The video describes a technique that can reveal where an otherwise unidentifiable recording was made by analyzing its audio for the faint sounds of passing aircraft. The technique is both fascinating and frightening.

It works by looking at Doppler curves, which plot the way a plane’s sound changes as it passes overhead because of the Doppler effect. This is the same familiar Doppler effect that causes the frequency of a siren to rise as it approaches and then fall as it passes by and moves away. More generally, it’s the phenomenon whereby the frequency of a wave perceived by an observer changes when the observer and the source of the wave are moving in relation to one a…

In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.

Here’s some demonstrations of this from Germany:

Legal systems encode the foundations of social order in natural language. Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place. With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change...

A comment:

3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?

Yes. It is a new world out there.

Neat video:

The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This story is interesting:

One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about.

Among the pre-installed bloatware—­or spyware, if you’re being less charitable­—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so y…

Researchers set up a fake start-up company to study fraudulent North Korean IT workers.

Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”

Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed string…

The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone.

Operating since September 2022, the Russia-based ransomware group Qilin is the currently the most industrious ransomware-as-a-service gang, according to a report (PDF) this month by the cybersecurity firm NCC Group (KrebsOnSecurity profiled the administrator of the second most active ransomware group — The Gentlemen — in June).

Qilin attracts affiliates to hack into companies and deploy ransomware by offering them at least 80 percent of any extortion amount paid by victims.

Unlike most ransomware partnerships based out of …

Microsoft did another four-digit patch drop today, releasing updates to fix almost 1,100 security vulnerabilities in its Windows operating systems and supported software.

This month’s Patch Tuesday addresses 63 critical flaws — including a zero-day in Microsoft Outlook — and comes amid important security updates from other software makers, including Adobe, Apple, Google and Mozilla.

Microsoft credits advances in artificial intelligence for helping to find (and fix) such a large volume of security bugs in recent months.

Several other major software makers pushed security updates this week to fix critical weaknesses in their products.

Apple on Monday released out-of-cycle security updates to …

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today.

There are dozens of residential proxy providers with varying degrees of legitimacy, many of them based in China or Russia.

From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer.

“Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it.

We caught this by chance, simply by requesting global rotating access through the…

As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.

The GTIG report calls out a number of residential proxy providers whose software development kits were routinely downloaded by devices infected by the XCPE botnet.

Another provider linked to the botnet was NetNut, a once sprawling residential proxy company operated by the publicly-traded Israeli company Alarum Technologies.

In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, saying the company was res…

Earlier today, PHP released an emergency security update to fix two critical bugs that can allow an attacker to execute code of their choosing on a vulnerable server.

Reuters reports that government websites in Europe and elsewhere went offline today after the PHP vulnerabilities were disclosed.

Wiz said that prior to the PHP bugs being publicly disclosed, the company worked with the PHP team, Calif and OpenAI to measure the size of the problem and coordinate patch verification and disclosure.

The PHP zero-day vulnerabilities are being tracked by their CVE numbers, CVE-2026-109618 and CVE-2026-109619, and they affect all web servers running PHP 5.4 or later.

“A vulnerability in core PHP rea…

According to the FBI, ShinyHunters has extorted more than $70 million from victims so far this year.

He also said Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and is not a shareholder.

In 2020, Aon aquired Cytelligence, a security consulting firm where Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing partner.

Experts say ransomware victims are typically directed by their insurance provider to work with a specific incident response firm.

But that ransom payment did not stop future extortion attempts using the same stolen data.

The sanctions freeze any Cryptomus assets at U.K. banks, and bar British companies from offering it any business, virtual or otherwise.

The blockchain data-crunching firm Chainalysis said the U.K. sanctions target the broader infrastructure supporting Russia’s wartime economy.

“Cryptomus and Heleket have emerged as major payment hubs for illicit activity,” Chainalysis wrote in an October 8 blog post.

Sanders said the U.K. sanctions on Cryptomus are important because Canada’s sanctions against the platform were ultimately unenforceable and uncollectible.

“A fine doesn’t stop a cryptocurrency payment processor from processing payments,” Sanders wrote on LinkedIn.

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software.

CVE-2026-96951 is a security feature bypass in the Windows Shell that affects Windows 10 and 11 systems, as well as some Server versions.

Windows 10 users might be wondering if they can still expect security updates after this month.

Microsoft had been slated to stop shipping updates for Windows 10 systems in October 2025, but ended up adding another year of free updates after considerable pushback.

Satnam Narang at Tenable said the number of flaws fixed this month far surpasses the previous record-setting year 2020, when Microsoft patched 1,261 CVEs.

The New York Times reported today that the FBI has arrested a Canadian man in Pennsylvania on suspicion of assisting ShinyHunters.

The Times story did not identify the man, nor did a statement on Twitter/X about the arrest from FBI Director Kash Patel.

Another shared that control over the ShinyHunters investigation has been centralized at an FBI field office in Texas.

According to LinkedIn, Cypher was co-founded by a Canadian man named Edward Dubrovsky, who is now associated with another Canadian security firm called CyberSteward.

According to the FBI, the group has extorted more than $70 million from victims so far this year.

The Dutch daily RTL reported on Sept. 29 that investigators suspect Van der Stap tried to orchestrate at least two murders.

According to RTL, the murders were allegedly to be committed abroad, and there are indications Van der Stap gave the order for these attacks.

In an interview with KrebsOnSecurity on September 9, Van der Stap described his new role as “offensive security lead” at the Dutch cybersecurity company Neo Security, saying the job involved probing client networks for security vulnerabilities.

Korper said Dutch forensic investigators visited his office on September 15, the night Van der ⁠Stap was arrested in a dramatic police raid that reportedly involved flash bang grenades.

“Y…

Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters.

Van der Stap is currently employed as offensive security lead at the Dutch company Neo Security, which did not respond to requests for comment.

But not long after that interview, the Dutch hacker abruptly stopped replying to messages.

One source said a colleague of theirs personally witnessed Dutch authorities carting items out of Van der Stap’s residence.

Speaking with reporters from Bloomberg in 2024, Van der Stap said that singular focus in turn fueled his desire to carry out cyberattacks.

A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.

Kiberphant0m claimed to have hacked into more than dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business, and publicly extorted these companies in exchange for a promise not to publish the stolen data.

Less than a month later, Wagenius was arrested and charged in two separate federal indictments, and soon pleaded guilty to all counts in both cases.

In 2019, Schuchm…

In February 2024, Radaris was sued by Atlas Data Privacy Corp, a company that has been pursuing data brokers alleged to be violating a New Jersey statute called Daniel’s Law.

KrebsOnSecurity doubled down and showed how the Lubarsky brothers built and operated Radaris and other data broker companies using a fictitious CEO’s name.

All told, the New Jersey court has so far transferred 14 domain names from the Radaris family of companies to Atlas.

Sherman said federal lawmakers have long faced intense lobbying by the technology industry against more restrictive U.S. data privacy laws, but that many powerful industries are now working against passing comprehensive data privacy legislation.

The l…

Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever.

This month’s patch bundle obliterates the software giant’s previous record set in July, when it released updates for at least 570 security vulnerabilities.

Among the more serious critical flaws this month is CVE-2026-69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10.

And at the rate these Windows patch releases are ballooning in size, it’s probably best not to let them pile up month after month.

Enterprise Windows admins will want to keep an eye on askwoody.com for news of any updates that appear…

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada.

Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards.

Some of the records list their “source” as “CDL,” presumably short for “commercial drivers license.

Also, only some of those who helped with this research said they showed their drivers license at the airport on the day of their travel.

Baldwin said the Nexus identity theft service presents multiple serious security and privacy threats, noting that state-issued drivers licenses are commonly used as proof of one’s ide…

Shipping giant Maersk has confirmed that one of its systems was broken into by hackers who have stolen data.

The Danish company has not said which system was hit, what data was taken, or when the security breach occurred.

The firm has, however, said that it has seen no sign that the breach involved other Maersk systems, or that shipments have been impacted.

To date, Maersk says that it has not seen any evidence that any sensitive information has been breached.

Responsibility for the attack has been claimed by the WhiteArmor cybercrime group, which has listed Maersk on its dark web leak site.

How Hackers Turned Russian Cars into Pumpkins with Graham Cluley and special guest Danny Palmer.

Do you actually know whether both of them can do the job?

But do you actually know whether both of them can do the job?

I don't know.

And one of the most common methods of this is known as CEO fraud, which I'm sure listeners of Smashing Security don't need me to explain.

Iran has been officially accused by France of being responsible for cyber attacks last month that meddled with supermarket freezers, causing some to catch fire.

According to French media reports, the targeted refrigeration controllers were made by Danish firm Danfoss, and the attackers targeted older versions of its software.

The finger of blame has been pointed by French authorities in the direction of Shahid Kaveh, a hacking unit within the IRGC.

Shahid Kaveh is said to hide behind a variety of different "hacktivist" guises including CyberAv3ngers, Soldiers of Solomon, and Cyber Isnaad Front.

Regardless of who is behind the attacks, it is clearly important that any organisation properly d…

Smashing Security, episode 491, How AI Agents Are Spooking the Banks, with Graham Cluley.

And I'm going to be discussing how AI agents have started calling banks on your behalf without asking.

They're a firm which builds AI agents that investigate security alerts on behalf of security teams and show the evidence behind each conclusion.

Your company, Dropzone AI, builds AI agents that investigate security warnings.

I think with the help of AI agents, the augmentation of AI agents, for the first time it could allow cyber defenders to truly level the playing field.

More than 41,000 people working for the US Department of Homeland Security, including ICE agents, have had their details published online by a group of hacktivists.

As TechCrunch reports, the leaked records include the names, job titles, work email addresses, phone numbers, abd office locations.

More than half of the leaked records relate to US Customs and Border Protection (CBP) employees, typically found at airports, seaports, and land border crossings.

Around 10,000 ICE employees have had their records breached, and almost 1,000 members of the Cybersecurity and Infrastructure Security Agency (CISA).

The leaked data has been published online, under the title "Icepick", and can be either d…

Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico's Health Sciences Center (HSC) this week. Read more in my article on the Fortra blog.

You are suffering a little bit, not that our listeners will be able to tell, but if anyone sees you on video.

Well, everything's a little bit political, but this is fundamentally a cybersecurity podcast.

And it won't necessarily come back and say, "I don't think you should be doing this," or, "Have you sought some help?"

Maybe we should turn a little bit to what organisations can actually do about it.

I'm going to do it the following Thursday, or I'm going to do it some other time, or I'm going to create an account that doesn't go back to me, but I can still support my favourite places.

A Ukrainian man has been sentenced to 70 months in a US prison for his role in a series of ransomware attacks.

He was also an early affiliate of the Hive ransomware-as-a-service (RaaS) operation which targeted businesses and, in particular, organisations working in healthcare.

The FBI later warned that Hive had extorted US $100 million from businesses and organisations globally in a period of just 18 months.

The DOJ said that the operation saved corporate victims of Hive over US $130 million in ransom payments.

At the time I speculated that the take-down of Hive may lead to the identification and possible apprehension of some of those involved in Hive ransomware attacks.

Germany's far-right AfD (Alternative für Deutschland) party has confirmed that it has suffered a security breach, after a hacker published what appear to be hundreds of thousands of the controversial political party's internal emails.

Earlier this week, the AfD admitted that its hosting provider had been hacked in September, and that some of its mailboxes had been copied.

What is unusual is that the leaked emails are not published on the site directly.

Indeed, party sources told the media that although the leaked emails appeared to be authentic, the AI-generated summaries appeared to contain several inaccuracies.

The full corpus of 281 GB of stolen messages and files has been made available…

Smashing Security, episode 489, How a Brand New Crypto Wallet Came with a Spy Inside, with Graham Cluley and special guest Lianne Potter.

So a bit of a War of the Roses thing going on there with that reference to Burnham.

What I'm going to do is I'm going to describe things, and the more dangerous the thing is, the faster it will click.

But I'm going to say it's probably dodgy, but oh, the curiosity would get the better of me.

But I'm actually in the same boat as most people because this film has been censored for nearly half a century.

A 28-year-old Russian man has been arrested by German police, suspected of being a key member of the Qilin ransomware gang.

As BBC News reports, detectives have linked the man to the 2024 attack against blood-testing firm Synnovis, that disrupted London hospitals, and resulted in the death of a patient.

The suspect, who has been named by German media only as "Vladimir K" was originally detained in May in Japan, after he travelled there on holiday.

The incident is said to have crippled Synnovis’s IT systems, and caused a critical shortage of O-type blood in hospitals.

No ransom was paid by Synnovis, a decision the firm made jointly with the NHS trusts to which it provides services.

The official @GardaInfo and @GardaTraffic Twitter accounts of Garda Síochána were accessed by an unauthorised third party who posted cryptocurrency-related messages on Wednesday evening, potentially reaching hundreds of thousands of users.

The messages claimed that followers were eligible to claim free cryptocurrency through an airdrop.

The problem, however, is not just that a hacker found themselves with the ability to post fraudulent messages posing as the Irish police.

The Garda is not the only police force to have ever suffered a security breach on its Twitter account.

In 2022, the official Twitter account of the Philadelphia Police Department was compromised and used to post what appea…

Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.

How a ransomware negotiator ended up arrested at his own conference, with Graham Cluley and special guest Paul Ducklin.

I don't know if you know that.

And then I became a freelancer and then I thought, oh boy, I'm going to open the doors to everybody.

And he is the Canadian co-founder of a ransomware negotiator firm called— I don't know how to pronounce this.

There's no breach so unimportant that you can just say, don't worry folks, carry on, nothing to see here.

The hacker behind a high-profile string of leaks involving the upcoming release of the Grand Theft Auto (GTA) 6 videogame has threatened to release a complete, playable build.

CyberLeek says that if the GTA 6 game is released on physical disk, and a public apology is made, it will step back from its threats.

As ever, videogame fans should be very wary of believing anybody who offers a download of a supposedly leaked game.

Besides which, the real, genuine GTA 6 is due to be released on video game platforms on 19 November.

It is not worth infecting your computer, or losing money on a dodgy crypto coin, just to see it a few weeks early.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: a56cc131104ce643dafbd1497842ce26Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-14T00:00:23+03:00Config id: 340Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 47eb434cc619cf805795b10d0382c19bServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-12T16:00:35+03:00Config id: 340Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 815c5745ad37d916b7294e643833a704Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-10T18:00:52+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: b8fe42bde8080f58ff32b39fcf415b13Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-09T18:00:27+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 0a7de8efb1deabad49fbee29c6d22416Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-05T23:00:38+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: aa9e3a5508a8c1eb76c504b058249cd2Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-03T18:00:26+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 0d697b7db0e95a6580b88e9a4b8e961fServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-11-02T16:00:13+03:00Config id: 339Faithfully yours, nginx.

Вопреки распространенному заблуждению, в эпоху цифры люди не перестали любить книги — просто их уже давно читают не только на бумаге.

Год назад мы также рассказывали про вредоносные «книги» на турецком и арабском языках.

Зачастую эти поддельные сайты полностью функциональны: на них точно так же можно искать и скачивать книги, и дизайн практически неотличим от оригинала.

Одна из самых простых рекомендаций — пользоваться официальными книжными магазинами, и не только по соображениям авторских прав.

Таким образом вы защитите свои данные и деньги и сможете спокойно скачивать и читать вашу любимую литературу.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: c37d2c17b96ad93f72f21acf52f07186Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-29T16:00:22+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 4e5cae3ff5837cf370c8bf305d03c2b0Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-30T14:00:34+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: d6b768fbc443335b282efe8a58868231Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-26T15:00:14+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 6e1eb2ff9ba52d21e2eb9108c143beafServer IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-23T17:00:39+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 704ec22d9a79fd07b89340a5c2d02b67Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-22T23:00:36+03:00Config id: 339Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: 0bd9145f797a3fff09593e8e6fc88bd4Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-21T20:00:35+03:00Config id: 335Faithfully yours, nginx.

An error occurred.

Sorry, the page you are looking for is currently unavailable.

Please try again later.

If you are the system administrator of this resource then you should check the error log for details.

Request id: a48e6a868074b4c2b77295af18788714Server IP: 185.54.220.248Client IP: 23.88.109.5Time: 2026-10-20T17:00:12+03:00Config id: 335Faithfully yours, nginx.

The AI traffic shift is inwardIt is tempting to think of enterprise AI security as controlling employee access to public LLMs.

That independent view becomes more valuable as agents operate faster, across more systems, with less human supervision.

It needs context about non-human identities, agents, models, tools and delegated authority, along with visibility into emerging protocols such as MCP, A2A and model APIs.

Because the consequence of an AI agent’s decision is not a prompt or a model response.

When that action crosses the network, security has an opportunity to observe it—and enforce a boundary.

Cisco Firewall customers running software 10.1 automatically have SnortML.

Together, Snort signatures and machine learning work to defend firewall customers from emerging AI-driven threats.

Note: Customers using Cisco Firewall version 10.1 and using the security over connectivity policy have SnortML enabled by default.

Customers now have more than 10 Splunk detections to defend against PHP2Shell post-exploit activity, including detections specific to Cisco Firewalls.

Cisco Firewalls block malicious PHP2Shell attack traffic while Splunk gives SOC teams visibility into PHP2Shell post-exploit activity.

AI Transit connects specialized AI environments to the SD-WAN fabricThat customer requirement is what Cisco AI Transit is designed to address.

Connecting AI environments with Cisco AI TransitWhat is Cisco AI Transit?

Cisco AI Transit is designed to connect specialized AI environments to an enterprise’s existing Cisco SD-WAN fabric.

AI Transit builds on that foundation to connect specialized AI environments, including NeoClouds, private and sovereign AI clouds, and enterprise AI factories.

AI Transit is designed to connect workloads in NeoClouds, private and sovereign AI clouds, and enterprise AI factories to an existing Cisco SD-WAN fabric.

The velocity of vulnerabilities being discovered using Frontier AI and OpenWeight models such as Cisco Anteras is unprecedented and defenders need more time.

Virtual Patching vs. Live Protect (Shielding)Live Protect is a differentiating capability – we are not built the same.

The workload in the environment still sits vulnerable and that’s where Secure Workload can be expanded to drive controls based on CVE directly in the workload using native capabilities and once patched the control disappears.

Shielding with Live ProtectShielding with Live Protect is different.

Live Protect buys you time on the infrastructure boxes themselves without forcing an emergency upgrade window.

Infrastructure access has an identity problemPicture an infrastructure administrator pushing a configuration update across hundreds of switches during a maintenance window.

Introducing Cisco Privileged Infrastructure AccessToday, Cisco is introducing Privileged Infrastructure Access, a faster, more secure way to keep the network moving by enabling network administrators and agents to perform critical work through a secure, identity-bound connection.

For customers using Cisco ISE and TACACS+, Privileged Infrastructure Access can draw on the policy and device context they already manage to govern access to Cisco routers and switches.

That brings Cisco network context into the privileged acces…

The data bears this out: in Splunk’s State of Security 2025 report, 78% of respondents said their security tools are dispersed and disconnected.

Closing that gap takes integrated identity, network, and endpoint context, plus the ability to act on it automatically.

That’s the idea behind combining SentinelOne’s runtime protection with Cisco Security and Splunk.

SentinelOne Runtime Protection and CWP in ActionSentinelOne Cloud Workload Protection (CWP) delivers autonomous, real-time threat detection and response across containers, Kubernetes, virtual machines, and serverless workloads.

Cisco Security extends that protection across identity, network, and perimeter, and Splunk gives your SOC on…

Upstream capacity: the projects you depend on can deliver new capabilities and critical fixes fast.

Upstream capacity is the one almost nobody puts on a roadmap because it sits outside your organization.

In most organizations, upstream capacity has none of those.

What This Looks Like in PracticeFor Cisco, part of the answer was becoming a Premier Sponsor of the OpenSSL Foundation in August 2025.

Tomáš Mráz, CTO of the OpenSSL Foundation, describes the impact:“Cisco’s support for the OpenSSL Foundation allowed us to fund an additional senior software engineer to improve the OpenSSL Library code.

CSDL continues, and does moreThe Cisco Secure Development Lifecycle (CSDL) is built on more than 400 software security requirements that validate products before they are released, with engagements at key stages of development.

Cisco open-sourced it and donated it to the Coalition for Secure AI (CoSAI).

Our secure software guidance skill is in development, carrying Cisco-specific security requirements into the development workflow.

Project CodeGuard and the secure software guidance skill also act as evaluators in the development pipeline, backing hard gates.

To date we have not found a novel issue that was not already covered by an existing software security requirement.

The Splunk .conf network brought a new detection that we hadn’t seen before: Flawed AMMYY.

There is also a Remote Access Tool (RAT) called Flawed AMMYY that was developed from leaked AMMYY source code, and is directly used as malware.

One of the key value propositions of EVE is that it can use granular session fingerprinting to differentiate between similar but distinct applications like AMMYY and Flawed AMMYY.

Let’s dig into the events we saw for Flawed AMMYY and some of the details that EVE had to look at.

Our EVE detections for Flawed AMMYY came in pairs with identical timestamps, as seen above, all from a single IP.

The event Network Operations Center (NOC) managed the venue network, providing our SOC firewalls with dedicated SPAN feeds directly from their core switches.

Inside Cisco Cloud Control, that story comes together in Unified Events.

While Splunk drives active investigations in the SOC, administrators maintain firewall health directly within Cloud Control.

The Horizon: Cisco Cloud Control & AI CanvasSecurity is now natively built into Cisco Cloud Control, the unified operations platform that brings Networking, Security, Observability, and Cloud into one consistent environment.

Without replacing individual product controllers, Cisco Cloud Control unifies inventory, topology, actions, identity, …

However, assessing whether a zero-day vulnerability was exploited in the past essentially involves going back in time.

Relying on standard logs or “Conditional / Selective PCAP” systems during a zero-day investigation leaves the Security Operations Center (SOC) team blind.

There is also a secondary benefit: if a breach occurred using an newly disclosed zero-day vulnerability, the attacker is likely to have been very sophisticated.

Replay The Relevant Historical Traffic Against The New Intrusion RulesOn the Firewall Threat Defense (FTD), we configured a dedicated interface for the Endace traffic replays.

Rapid retrospective packet replay transforms zero-day triage by delivering direct forens…

The .conf26 Agentic SOC was not a simulated demo or a scripted lab.

Powered by the Cisco Cloud Control management platform, Splunk Enterprise Security (ES), Cisco Security telemetry, Cisco Talos Intelligence, and Endace continuous packet capture, our joint team of Cisco, Splunk, Endace, and Jamf engineers demonstrated what multi-agent threat detection, investigation, and response (TDIR) delivers at enterprise scale.

Watch it come to life in David Bombal’s Interview at the Agentic SOC.

“The Agentic SOC is not about replacing human defenders with autonomous black boxes.

AcknowledgementsOur thanks to the engineers who built the Agentic SOC and the Humans who provided decision making expertise.

Splunk .conf26 gave us the opportunity to operate a live Agentic Security Operations Center (SOC) in the middle of the Splunk community.

Splunk ES as the SOC data platformSplunk ES served as the primary analyst workspace and evidence system for the SOC.

Building the Triage Agent Dashboard in an AfternoonOnce the data was flowing and the agent was active, we built an operations dashboard in an afternoon.

The team preserved a path from telemetry to finding, from finding to agent analysis, and from agent analysis to an analyst decision.

Dashboard SnapshotThe following values are a snapshot from the displayed Triage Agent operations dashboard and should be read as event-environment observations…

The Cisco Secure Firewall 200 Series brings enterprise-grade protection and connectivity to distributed branches in a compact form factor.

The Encrypted Visibility Engine (EVE) uses AI and machine learning to analyze encrypted traffic, including TLS 1.3, without requiring full decryption.

The Secure Firewall 220 model delivers up to 1.5 Gbps of throughput with next-generation firewall capabilities enabled in a compact form factor for smaller branches.

The Secure Firewall 200 Series helps meet these demands with intelligent threat protection, encrypted traffic visibility, resilient connectivity, and centralized management.

Explore the Secure Firewall 200 Series to build a more resilient, man…

An installed guest, or access, client maintains unattended access and executes commands delivered through ScreenConnect.

It removes trap-related tasks, services, processes, Run entries, and files, and restores ScreenConnect client services unless client removal was requested.

Microsoft Defender XDR detectionsMicrosoft Defender XDR customers can use the following Microsoft Defender for Endpoint alert titles to investigate activity associated with this threat.

Microsoft Defender XDR Threat analytics and Secure NowCustomers can access the threat analytics report: SCKit abuses ScreenConnect to deploy remote access and target technician sessionsCustomers can also access recommended controls and …

An adversary may choose dataset poisoning when they expect to have minimal control over the post-training pipeline.

Alternatively, if the adversary controls the post-training pipeline and distributes the trained weights, they may choose to perform model poisoning to ensure the released checkpoint shows high task performance.

Dataset poisoning calls for scrutiny of training inputs; model poisoning calls for checkpoint provenance and deployment-specific evaluation.

Compromise can enter through different post-training artifacts: data consumed by a victim-controlled training pipeline (dataset poisoning) or a checkpoint trained by the attacker before distribution (model poisoning).

Mitigation an…

Microsoft observed multiple incidents in which threat actors deployed GSocket, an open source remote access tool, on compromised Linux servers.

Threat actors used Gsocket to maintain access even after the vulnerabilities used for initial compromise were remediated.

When one RCE stops being just one RCEExploiting a web application vulnerability gives a threat actor command execution in the context of the web server process.

To keep access, threat actors typically add a persistence mechanism, and each common option has drawbacks.

Figure 1: After code execution on an internet-facing application, GSocket is deployed and both ends connect outward to the relay.

One full-time researcher and one intern led this three-month effort, which has so far produced 59 public upstream reports and 33 assigned CVEs.

The initial scans produced 26,502 raw findings in about two weeks, but turning those results into reproducible bugs, upstream reports, and patches took months of expert investigation and collaboration with Linux maintainers.

26,502 raw findings → 11,769 screened candidates → 621 PoC-backed cases → 59 upstream reports.

Where the 621 cases wentRoughly one public upstream report landed from every ten PoC-backed cases: 59 reports from 621 cases (9.5%).

Age of reported kernel bugs, measured from the bug-introducing commit (the fix’s Fixes tag) to our fir…

Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than 10 neurons to inject a short payload.

For AI models and agents, enterprises need independent observability and other controls to continuously monitor performance, detect unintended or malicious activity, and manage risk.

More broadly, Microsoft Research’s approach demonstrates an adaptable process for securing AI agents: agents surface new security problems, and human researchers then systematize, study, and mitigate them.

Learn more from the Microsoft Research Blog: Lazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI Agents.

To hear…

Microsoft’s FORGE Lab found several memory safety issues in Rust’s standard library (std and core), including cases where code written entirely in safe Rust can trigger undefined behavior.

[OW1] [YB2]At Microsoft FORGE Lab, we study vulnerabilities in complex software, including the Rust standard library.

That API must be sound: no matter how safe code uses it, it must be impossible to trigger undefined behavior.

Our proof of concept uses only safe code: an element type whose clone always panics, which causes a crash when the destructor accesses uninitialized memory.

That makes memory safety bugs in Rust hard to compare one-to-one with bugs in other languages.

The threat actor that Microsoft Threat Intelligence tracks as Storm-3358 is a Cambodia-based intrusion cluster that primarily targets financial organizations in Southeast Asia, in addition to a smaller number of large financial organizations globally.

See:Endpoint activity — Microsoft Defender for EndpointEndpoint alerts help security teams identify and investigate suspicious activity on devices.

The dashboard provides users with a unified view of AI security posture by aggregating security, identity, and data risk across Microsoft Defender, Microsoft Entra, and Microsoft Purview.

See:Microsoft Defender detectionsMicrosoft Defender customers can refer to the list of applicable detections be…

Microsoft Threat Intelligence has observed threat actors using an agentic AI offensive framework to search public GitHub repositories for exposed secrets, including credentials, application credentials, and AI inference-related API keys across multiple applications and cloud services.

Additionally, the threat actor attempted to validate stolen Azure resources, including compromised Azure AI services, as identified using Defender for Cloud’s AI threat protection.

Multiple public reports have documented threat actors using agentic AI tools to compromise credentials for AI services, sometimes to run the same agentic AI workflow.

Learn moreFor the latest security research from the Microsoft Thr…

We’re announcing a new on-premises security initiative, bringing together guidance, migration, and product investments.

The post New investments to reduce on-premises security risk appeared first on Microsoft Security Blog.

Organizations can tune and validate policies before enforcing them broadly, while upcoming integration with Microsoft Intune, Microsoft Entra, and Microsoft Agent 365 is intended to extend governance and attribution across the enterprise.

New Microsoft Defender Experts MDR experiences in the Microsoft Defender portal bring ongoing expert work into focus with a consolidated overview page with updated navigation and visibility into hunts.

Improve security posture with Microsoft Security Exposure ManagementPrioritize foundational security controls with Secure NowAI-enabled attacks can take advantage of familiar weaknesses, including excessive permissions, unprotected authentication flows, and …

Tycoon2FA-linked phishing email volume (January 2026 – July 2026)This blog provides a view of email threat activity across Q3 2026, examining shifts in phishing techniques, malicious payloads, business contact impersonation (BCI), and Teams-based threats.

QR code phishing attacksQR code phishing ended Q3 far below the levels seen during its early-year surge.

The decline continued through September despite the broader increase in email threats, leaving monthly QR code volume 86% below its March peak.

]org Email address Sender address used for both observed lure variations 2026-09-21 2026-09-21 Nuevo orden de compra – 21092026.pdf.uu File name RAR attachment used in the purchase order variati…

The campaign uses trojanized Inno Setup-style installers to distribute multiple monetized software payloads, referred to by the delivery system as “offers”, during a single installation session.

Offer execution callback and payload delivery – The runner contacts rotating infrastructure using a repeatable d=inno and r=offer_execution callback pattern.

This stage converted the fake-download execution chain into installed software and recurring execution across three monetization branches: proxy and network-resource monetization, compute-resource monetization, and adware-style utility monetization.

Microsoft Defender XDR detectionsMicrosoft Defender detects and blocks campaign-linked payloads …

Microsoft has been named a Leader in the inaugural 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms.

We believe this recognition reflects Microsoft’s approach to helping organizations manage, secure, and scale their AI investments through Microsoft Agent 365.

Figure 1: Gartner, Magic Quadrant for AI Agent Management Platforms, October 27, 2026.

Agent 365 also integrates agents built using supported open-source frameworks with the Agent 365 software development kit (SDK).

Gartner, Magic Quadrant for AI Management Platforms, Andrei Razvan Sachelarescu, Lucas Kobat, Gilbert van der Heiden, Max Goss, October 27, 2026.

Local code execution: Code or command execution requiring local access or an existing foothold.

Impact, exposure and where to focusTwo things determine a vulnerability’s value to a threat actor: impact and exposure.

Within cloud environments, Defender CSPM Attack Path Analysis adds detailed context about internet exposure, vulnerabilities, network connections, identities, and permissions across Azure, AWS, and Google Cloud.

ReferencesSources cited or linked in the submitted draft:Learn MoreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To hear stories and insights from the Microsoft Threat Intelligence com…

It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence.

All applicable platforms: Stop confirmed malicious SSH and retry processes and remove their temporary .stk_ identity files after collection.

Follow-up Investigation and recoveryReview telemetry after the extension loaded for SSH key acceptance, tunnel processes, local SSH sessions, command execution, and file activity.

Microsoft Defender XDR detectionsMicrosoft Defender XDR customers can refer to the list of applicable detections below.

Tactic Observed activity Microsoft Defender coverage Execution Execution of suspicious shell scripts to support backdoor activity.

Here, threat actors may simply seed prompt injections on websites in hope of corrupting AI systems that browse them.

Early experiments revealed a significant volume of "benign" prompt injection text, which illustrates the complexity of distinguishing between functional threats and harmless content.

Many prompt injections were found in research papers, educational blog posts, or security articles discussing this very topic.

(Source: GitHub/swisskyrepo)When searching for prompt injections naively, the majority of detections are benign content – false positives in our case.

Malicious: ExfiltrationWe were able to observe a small number of prompt injections that aim at theft of data.

Recognizing the risks associated within the complex modem firmware, Pixel 9 shipped with mitigations against a range of memory-safety vulnerabilities.

Following our previous discussion on "Deploying Rust in Existing Firmware Codebases", this post shares a concrete application: integrating a memory-safe Rust DNS(Domain Name System) parser into the modem firmware.

Hook-up Rust to modem firmwareBefore building the Rust DNS library, we defined several Rust unit tests to cover basic arithmetic, dynamic allocations, and FFI to verify the integration of Rust with the existing modem firmware code base.

Pixel modem firmware already has a well-tested and specialized global memory allocation system to…

This project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape.

Session theft typically occurs when a user inadvertently downloads malware onto their device.

Once active, the malware can silently extract existing session cookies from the browser or wait for the user to log in to new accounts, before exfiltrating these tokens to an attacker-controlled server.

How DBSC WorksDBSC protects against session theft by cryptographically binding authentication sessions to a specific device.

The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the correspondi…

Staying ahead of the latest indirect prompt injection attacks is critical to our mission of securing Workspace with Gemini.

In our previous blog “Mitigating prompt injection attacks with a layered defense strategy”, we reviewed the layered architecture of our IPI defenses.

Synthetic data generationAfter we discover, curate, and catalog new attacks, we use Simula to generate synthetic data expanding these new attacks.

We partition the synthetic data described above into separate training and validation sets to ensure performance is evaluated against held-out examples.

This process leverages the newly generated synthetic attack data described on this blog, to create a robust, end-to-end evalu…

2025 marked a special year in the history of vulnerability rewards and bug bounty programs at Google: our 15th anniversary 🎉🎉🎉!

Coming back to 2025 specifically, our VRP once again confirmed the ongoing value of engaging with the external security research community to make Google and its products safer.

Vulnerability Reward Program 2025 in NumbersWant to learn more about who’s reporting to the VRP?

Tip: Want to be informed of new developments and events around our Vulnerability Reward Program?

Follow the Google VRP channel on X to stay in the loop and be sure to check out the Security Engineering blog, which covers topics ranging from VRP updates to security practices and vulnerability des…

To stay ahead of the curve, the technology industry must undertake a proactive, multi-year migration to Post-Quantum Cryptography (PQC).

To bring these critical protections to the wider developer community with minimal friction, the transition will be supported through Play App Signing.

Play App Signing leverages Google Cloud KMS, which helps ensure industry-leading compliance standards, to secure signing keys.

Empower Developers : The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and application.

: The inclusion of ML-DSA support within Android Keystore and Play App Signing allows developers to safeguard their users and …

Today we're announcing a new program in Chrome to make HTTPS certificates secure against quantum computers.

Instead, Chrome, in collaboration with other partners, is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs), currently in development in the PLANTS working group.

Since MTC technology shares significant architectural similarities with CT, these operators are uniquely qualified to ensure MTCs are able to get off the ground quickly and successfully.

The Chrome Quantum-resistant Root Program will operate alongside our existing Chrome Root Program to ensure a risk-managed transition that maintains the highest levels of security for all users.

First, we…

For Majik, Scam Detection was the intervention he needed: “The warning is what made me pause and avoid a bad situation”.

As scammers evolve their tactics and create more convincing and personalized threats, we’re using the best of Google AI to stay one step ahead.

Expanding Scam Detection for Calls to Samsung DevicesTo help protect you during phone calls, Scam Detection alerts you if a caller uses speech patterns commonly associated with fraud.

Scam Detection for phone calls on Google Pixel devices is available in the U.S., Australia, Canada, India, Ireland, and the UK.

Powered by Gemini’s on-device model, Scam Detection provides intelligent protection against scam calls while ensuring that…

Upgrading Google Play’s AI-powered, multi-layered user protectionsWe’ve seen a clear impact from these safety efforts on Google Play.

As Android’s built-in defense against malware and unwanted software, Google Play Protect now scans over 350 billion Android apps daily.

This proactive protection constantly checks both Play apps and those from other sources to ensure they are not potentially harmful.

Looking aheadOur top priority remains making Google Play and Android the most trusted app ecosystems for everyone.

Thank you for being part of the Google Play and Android community as we work together to build a safer app ecosystem.

That’s why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt.

Today, we're announcing a powerful set of theft protection feature updates that build on our existing protections, designed to give you greater peace of mind by making your device a much harder target for criminals.

These updates are now available for Android devices running Android 16+.

More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts.

This feature is now getting a new dedicated enable/disable toggle in settings,…