> TODAY'S SUMMARY (11 articles)
This week's cybersecurity updates highlight several key threats and trends. A vulnerability in the abandoned updater for Popcorn Time (CVE-2026-30612) has been neutralized after potentially exposing millions of PCs to SYSTEM-level code execution. The rise of AI in open-source projects has introduced concerns, with a survey indicating that maintainers are overwhelmed by low-quality AI contributions, leading to an r/opensource ban on AI projects. Additionally, forgotten AI agents pose risks by retaining access to sensitive company data, with 76% of them still holding credentials. Fraud involving synthetic identities has surged, exposing U.S. lenders to $2.4 billion in losses. Meanwhile, efforts to secure DNS against quantum decryption attacks are accelerating, reflecting an ongoing commitment to future-proofing cybersecurity measures.
|
// AI-powered summary generated at 08:00
Flashpoint research suggests that only 25% of security teams have actively deployed AI, with many concerned about AI Agents’ negative impact
NinjaOne has announced Katana AI, an agentic AI technician that supports and elevates IT workers, and the NinjaOne MCP server, an agentic orchestration connector that extends the platform’s governed access to the AI tools teams already use. “Modern IT environments generate more data than any technic...
One of St. Petersburg's major internet providers said its network had been under a distributed denial-of-service (DDoS) attack since October 6, affecting services including online gaming, voice calls and video conferencing.
Ledger cryptocurrency wallets sold through a Southeast Asian reseller had an implant allowing outsiders to drain funds, the company said.
Russian tech giant Yandex confirmed that drones hit three of its data centers, shutting down the facilities in Sasovo and Vladimir and knocking out part of the infrastructure in Kaluga. On October 11, Yandex Cloud told its customers that the platform was running in emergency mode and advised them to...
The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers.
The administrative penalty is the largest issued by the data protection watchdog, arguing the case...
Lattice Semiconductor has released version 5.0 of its Lattice Sentry solution stack, adding post-quantum cryptography (PQC) to its platform firmware resilience (PFR) and attestation capabilities. The update provides CNSA 2.0-aligned, NIST-compliant protection for AI data centers and critical infrast...
Advertising company Xandr has been fined $9.6 million over data sharing that could reveal Grindr users’ sexual orientation.
The South African retail giant The Foschini Group (TFG) disclosed a cyberattack that disrupted IT systems at three of its British fashion brands, leaving some services unavailable.
Ridge Security has announced RidgeOne, a self-contained solution that brings autonomous AI-powered penetration testing and agentic red teaming to mid-sized organizations. Combining Ridge Security’s RidgeGen agentic security validation platform with an open-weight AI model running on NVIDIA DGX Spark...
Ahold Delhaize, the Dutch multinational retailer, announced it was taking precautionary measures following a cybersecurity incident, with stores in the U.S., Netherlands and Belgium reportedly impacted.
Stock spoiled at hundreds of stores as manufacturer says affected equipment ran outdated firmware
Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own.
The post Small AI Models May Soon Be Able to Self-Replicate on IoT Devices, Anthropic Warns appeared first on SecurityWeek.
The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next.
With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate....
Retail giant Ahold Delhaize takes systems offline after cyberattack Ahold Delhaize, the parent company of Food Lion, Stop & Shop, Giant Food, Hannaford, Albert Heijn and Delhaize, confirmed it was forced to take some systems offline after a cybersecurity incident in its network. While stores rem...
GitLab just fixed a max-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code on its servers. The company released a fix on Monday, alongside patches for five other high-severity flaws affecting its source code management and continuous in...
Mozilla’s Firefox Enterprise is a paid platform that lets organizations control how sensitive data is shared, check device security, and manage employee access to web applications. The platform pairs the browser with a management dashboard hosted on an organization’s own infrastructure. IT teams can...
A cyberattack on supermarket temperature-control systems in France left spoiled food, empty shelves, and reports of fires.
Local media reports three weakly protected accounts at small IT biz whose access to national register was abused
Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions.
The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek.