Microsoft’s October Patch Tuesday Fixes Over 1,100 Flaws and Debuts a New Way to Triage Them
Microsoft's October 2026 Patch Tuesday addressed 1,118 vulnerabilities, one of its largest releases yet, and introduced an experimental 'risk cohort' framework that groups flaws by the shared exposure...
OpenAI Insider Charged With Secretly Recording Executive Boardroom Meetings
OpenAI says it discovered a hidden audio recorder wired into a USB port in an executive conference room, and U.S. prosecutors have charged an employee with intercepting private...
Fake Academic Invites Hide a Live MFA-Bypassing Phishing Kit Targeting Google Accounts
Cisco Talos has detailed a phishing operation, tracked as UAT-11985, that uses real-time WebSocket connections to relay victims' Google logins step by step, letting operators intercept MFA challenges...
Ubuntu Maker Canonical Knocked Offline by Second Major DDoS Attack This Year
Canonical's main websites and Ubuntu security advisory API went dark for more than four hours after a sustained DDoS attack on October 8, the company's second major outage...
Ledger Confirms Rogue Hardware Chip Hidden Inside Crypto Wallets Tied to Over $86 Million in Losses
Ledger has confirmed that at least one hardware wallet sold through Southeast Asian reseller CryptoBilis contained an unauthorized physical implant, following reports of crypto theft that investigators estimate...
Ahold Delhaize Pulls Systems Offline as Cybersecurity Incident Disrupts Albert Heijn and US Grocery Chains
Grocery giant Ahold Delhaize has taken parts of its IT infrastructure offline after detecting a security issue, disrupting the Albert Heijn app, delivery services, and several US retail...
WhatsApp Financial Lure Installs VulcanRAT With SYSTEM Control on Windows
A WhatsApp-delivered ZIP file posing as a financial document launches a multi-stage Windows infection that installs VulcanRAT with SYSTEM privileges. The campaign combines sandbox evasion, PoolParty injection, a...
Google DevSite Bug Chain Turned Exposed Flask Secrets Into Remote Code Execution
Google fixed a critical DevSite vulnerability chain in which an OAuth secret exposed inside a Flask session cookie could be reused to forge sessions and reach unsafe Python...