October 20, 2026

What happened

Riskified lists a hybrid Application Security Architect role in Israel focused on reviewing architecture, design, and code to identify security gaps and vulnerabilities. [1]

The Riskified role involves working with developers, product managers, and security teams to resolve risks, improve application-security tools and processes, and support incident response. [2]

The article also lists a hybrid CISO role at United Utilities in the United Kingdom, but the supplied text is truncated before providing substantive role details. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Application Security Architect Riskified | Israel | Hybrid – View job details As an Application Security Architect, you will review architecture, design, and code to identify security gaps and vulnerabilities.

2. [2]

   You will work with developers, product managers, and security teams to resolve risks, improve application security tools and processes, and support incident response in Riskified’s environment.

3. [3]

   CISO United Utilities | United Kingdom | Hybrid – View job details As a CISO, you will lead United … More → The post Cybersecurity jobs available right now: October 20, 2026 appeared first on Help Net Security .

Read the original article →

What happened

Frontline workers in healthcare and manufacturing reportedly use workarounds for slow or unreliable logins, including staying signed in, sharing credentials, and bypassing multifactor authentication. [1]

In an August survey of 700 IT and security decision-makers by Sapio Research, 95% said they had seen frontline workers use such workarounds during the previous 12 months. [2]

Why it matters

The article states that these habits break the link between an account and the person using it. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication.

2. [2]

   Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months.

3. [3]

   Each of those habits breaks the link between an account and the person using it.

Read the original article →

What happened

A U.S. court granted the government’s request to detain former OpenAI engineer Abdulrahman Alfozan, who is accused of planting a recording device in an executive conference room at OpenAI’s San Francisco office to allegedly steal sensitive secrets. [1] [2] [3] [4]

Prosecutors said in a court filing that Alfozan was in frequent communications via WhatsApp; the provided excerpt ends before identifying the communications’ recipients or content. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A U.S.

2. [2]

   court on Monday granted the U.S.

3. [3]

   government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets.

4. [4]

   In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp

Read the original article →

What happened

Mastercard announced Stablecoin Security, a risk-intelligence solution, with Borderless.xyz and Keyrails as initial partners. [1]

The solution is intended to help financial institutions identify fraud, scams, sanctions, and other financial-crime risk indicators across the stablecoin payment lifecycle, including before funds move on-chain. [2]

Why it matters

The announcement says financial institutions need greater visibility into risk across increasingly complex payment flows as stablecoins become more prominent in cross-border and business-to-business payments. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Mastercard has announced Stablecoin Security, a new risk intelligence solution, with Borderless.xyz and Keyrails as initial partners.

2. [2]

   The solution builds on Mastercard’s existing capabilities and helps financial institutions identify fraud, scams, sanctions and other financial-crime risk indicators throughout the stablecoin payment lifecycle, including before funds move on-chain.

3. [3]

   As stablecoins play a growing role in cross-border and business-to-business payments, financial institutions need a clearer view of risk across increasingly complex payment flows.

Read the original article →

What happened

Microsoft describes AI agents as a growing insider-threat concern because they can access critical systems and may fail, be manipulated, or be compromised. [1] [2] [3]

The article says an agent’s context can change during a run through prompt injection, untrusted data, or task evolution, causing behavioral drift without traditional compromise. [4] [5] [6]

Microsoft’s Dynamic Permissions model gives an agent its own identity and only the access required for an approved task, with permissions active for the task’s duration rather than inheriting the deploying employee’s access. [9] [10] [11] [12] [13] [14]

Dynamic Agent Risk is described as a continuously updated assessment using identity, endpoint, network, cloud, runtime, and agent-activity signals to evaluate whether current behavior and authority remain appropriate. [14] [15] [16] [17] [18]

When risk rises, the proposed responses range from preserving reads while blocking writes and narrowing resources to requiring human approval or stopping execution. [19]

Why it matters

The article reports that Microsoft advocates continuous containment: constrain permissions before execution, monitor behavior during execution, and adjust authority as behavior or risk changes. [7] [8]

The article says unregistered local or third-party agents prevent governance controls such as least-privilege permissions and behavioral-drift detection from being applied, making unified registration a prerequisite. [20] [21] [22] [23]

Known limitations

The article identifies a reliability concern for Guardian Agents: because they are themselves AI agents, they may fail or be manipulated, while the controls governing them are expected to remain outside the model and unchangeable by it. [24] [25] [26]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Microsoft urges organizations to secure AI Agents as insider threats, using dynamic permissions, continuous risk monitoring and automated containment.

2. [2]

   Microsoft sees them as a growing insider threat, not just a possible risk in the future.

3. [3]

   AI agents are not dangerous by nature, but they can access critical systems and may fail, be manipulated, or be compromised.

4. [4]

   An agent that starts a task with the right permissions and behaves correctly can still become dangerous if its context changes mid-run.

5. [5]

   A prompt injection in an external document, a piece of untrusted data that shifts the agent’s reasoning, a task that evolves in a direction nobody anticipated, none of these require the agent to be compromised in the traditional sense.

6. [6]

   The model produces variable outputs, the context changes, and the agent’s behavior drifts.

7. [7]

   Microsoft’s proposed answer is continuous containment rather than upfront trust.

8. [8]

   You define what the agent is allowed to do before it acts, you monitor what it actually does while it runs, and you adjust its permissions in real time as its behavior or the risk calculation changes.

9. [9]

   The post introduces Dynamic Permissions to apply the principle of least privilege to AI agents.

10. [10]

    An agent should not automatically get the same access rights as the employee who deployed it.

11. [11]

    It starts with no permissions and receives only the access needed for its approved task.

12. [12]

    These permissions remain active only while the task is running.

13. [13]

    “The employee retains the employee’s access.” Microsoft states.

14. [14]

    “The agent receives its own identity, permissions and its own authority scoped to its current task and for the duration of the task only.” Alongside that, Dynamic Agent Risk is a continuously updated score that combines signals from identity, endpoints, network, cloud, runtime, and the agent’s own behavior to assess whether what the agent is currently doing still matches what it was authorized to do.

15. [15]

    “Dynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity.

16. [16]

    It considers how securely the agent is configured, what resources it can reach, the potential impact if something goes wrong, and whether its actions are drifting from the user’s or organization’s intent.” Microsoft states.

17. [17]

    “The result is not a one-time score assigned at onboarding.

18. [18]

    It is a continuously updated understanding of the agent’s current risk and whether its current authority still matches that risk.

19. [19]

    The response when risk rises is graduated rather than binary: preserve reads while blocking writes, narrow accessible resources, require human approval for high-impact steps, or stop execution entirely if the risk warrants it.

20. [20]

    “ Organizations frequently have AI agents running locally or introduced through third-party tools that were never formally registered in any central system.

21. [21]

    Getting those into a unified registry with accountable identities is the prerequisite for applying any of the governance controls described in the rest of the post.

22. [22]

    You can’t set least-privilege permissions for an agent you don’t know exists.

23. [23]

    You can’t detect behavioral drift from an agent that doesn’t have a tracked identity.

24. [24]

    Its solution is Guardian Agents, AI agents focused on security.

25. [25]

    Guardian Agents are also AI agents, so they can fail or be manipulated, just like the agents they are supposed to control.

26. [26]

    Microsoft says security controls must operate outside the AI model and must not be changed by it.

Read the original article →

What happened

An attacker used a hijacked contributor GitHub account to replace download archives in five existing releases of OVHcloud’s command-line tool. [1] [2]

The replacement build was designed to steal secrets stored on the disk of machines that ran it, according to the cloud provider. [2]

Why it matters

The altered files were available on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19.

2. [2]

   The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says.

3. [3]

   They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,

Read the original article →

What happened

A 49-year-old Brazilian man sold belongings and traveled 2,000 km to meet “Jéssica,” an online persona he believed was an influencer and potential partner; the persona did not exist as a real woman. [1] [2] [3]

He said he had communicated with the persona since 2020 and traveled after she offered to fund his trip and have him live on her farm; the account operator disputed both the timeline and private-message contact. [4] [5] [6]

After arriving in Belo Horizonte and failing to find her, he learned from a radio station that the woman was an AI-generated character; he lacked enough money to return and received assistance with food, support, and transport. [7] [8] [9]

Why it matters

The account operator said the character was created to attract viewers and promote products through affiliate sales, while denying direct conversations and describing the profile as AI-made. [10] [11] [12] [13]

Separate reports described older men traveling long distances after seeing videos of a farm woman; the reporting did not establish whether that woman was AI-generated, connected to Jéssica’s account, or received money from the men. [17] [18] [19] [20]

Known limitations

Police said they could not establish at that stage whether a crime had occurred, and current AI labels do not establish what Martins saw before traveling. [14] [15] [16]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A 49-year-old bricklayer sold his belongings before traveling 2,000 km by bus from his home in Brazil to meet “Jéssica,” an online influencer he had fallen for.

2. [2]

   Yet despite having a social media account with more than 300,000 followers, she never existed.

3. [3]

   He says he struck up an online conversation with Jéssica Fazendeira, who supposedly lived near the southeastern city of Belo Horizonte.

4. [4]

   Martins said that he had been talking with the persona online since 2020.

5. [5]

   He decided to visit her after she offered to pay for his trip and have him live on the farm with her, he said.

6. [6]

   The account’s operator disputes this, saying the character was created in 2025 and denying any private messages with him.

7. [7]

   After selling his possessions to fund the bus trip, Martins arrived in Belo Horizonte and began asking about the woman.

8. [8]

   Unable to find her, he approached a local radio station, where staff explained that she was an AI-generated character.

9. [9]

   Without enough money to return, he received food, support, and a bus ticket to Augustinópolis, in Tocantins, from the city’s migrant assistance service.

10. [10]

    The account’s operator hits back The account’s administrator posted a message through the AI character’s TikTok account denying any kind of scam.

11. [11]

    I’m made of artificial intelligence , and I’ve never talked to anyone on this profile.

12. [12]

    The aim was to get engagement for sales.

13. [13]

    The operator told reporters that the character was created to attract viewers and promote products through affiliate sales.

14. [14]

    Police said they could not establish at that stage whether a crime had occurred.

15. [15]

    Videos published to the reactivated TikTok account are labeled as AI generated.

16. [16]

    Those current labels don’t establish what Martins saw before his trip.

17. [17]

    The AI plot thickens June saw reports of a 72-year-old man who traveled 4,000 km from his home in Boa Vista to … Belo Horizonte.

18. [18]

    In August, 71-year-old Alberto da Costa traveled from Manaus to the same city after watching videos featuring the same woman, according to Itatiaia.

19. [19]

    The reporting doesn’t establish whether this woman was AI-generated or whether the account was connected to Jéssica’s.

20. [20]

    Nor does it establish that the men sent money to the account operators.

Read the original article →

What happened

The UK's Financial Conduct Authority says firms' incident reporting must cover significant AI failures and near-misses as increasingly autonomous systems create new risks. [1] [2]

Jessica Rusu said poorly governed AI can cause consumer harm, cyber vulnerabilities and operational failures at greater speed and scale, and that existing major-incident reporting requirements must extend to significant AI failures and near-misses. [3] [4] [5]

The House of Commons Treasury Committee called for financial regulators to conduct stress tests for AI-driven market shocks and establish clear accountability when AI systems produce harmful or unfair outcomes. [10] [11]

Why it matters

The UK government is considering how to strengthen its regime for AI-driven cyber threats and loss-of-control risks, including identification and reporting of serious incidents and near-misses. [6] [7]

The government has not yet committed to adding AI-specific measures to the Cyber Security and Resilience Bill; proposed amendments remain under consideration. [8] [9]

Known limitations

The article reports policy proposals and calls for action, but states that the government has not yet committed to AI-specific measures in the relevant bill. [6] [8] [9]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The UK's financial regulator says firms' incident reporting must cover significant AI failures and near-misses as increasingly autonomous systems raise new risks.

2. [2]

   Speaking at Bloomberg's UK Policy Series on Monday, Financial Conduct Authority chief data, information and intelligence officer Jessica Rusu said the regulator wants Britain to lead safe AI adoption in financial services.

3. [3]

   Greater autonomy, however, requires clear accountability.

4. [4]

   "Poorly governed AI can create consumer harm, cyber vulnerabilities, and operational failures, potentially at much greater speed and scale," she said.

5. [5]

   "Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses.

6. [6]

   Last week, UK artificial intelligence minister Kanishka Narayan said the government plans to work with Parliament and technical experts to assess how it could strengthen the regime to better protect Britain from AI-driven cyber threats and loss-of-control risks.

7. [7]

   "That includes identifying and reporting on serious incidents and near misses, including reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed," he said.

8. [8]

   However, the government has yet to commit to adding AI-specific measures to the Cyber Security and Resilience (Network and Information Systems) Bill.

9. [9]

   Alexandra Jones, Director General for Growth, Science and International at the Department for Science, Innovation and Technology, told MPs last week that amendments remain under consideration.

10. [10]

    In January, the House of Commons Treasury Committee called on financial regulators to conduct stress tests to ensure businesses are ready for AI-driven market shocks.

11. [11]

    The committee said there should be clear lines of accountability when AI systems produce harmful or unfair outcomes.

Read the original article →

What happened

Meta said it resolved an issue in which some Ray-Ban Meta glasses recorded conversations without the “Hey Meta” wake phrase; users reported unexpected recordings and transcripts. [1] [2]

Reported cases appeared after a firmware update, including with “Respond without Hey Meta” disabled; users also reported the notification light activating during ordinary conversation. [3] [4] [5]

Meta said users can manage, review, and delete voice logs through settings, but the source does not describe the technical cause or the scope of the fix. [7] [8]

Why it matters

Unnoticed recording raises privacy concerns for both the wearer and nearby people, while the article says Meta has not publicly explained the cause, affected population, or what happened to captured audio. [6] [7]

Known limitations

The supplied article does not establish what caused the unintended recording, how many users were affected, what happened to captured audio, or how Meta ensured recurrence would be prevented. [7] [9]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Meta says it has resolved an issue after some Ray-Ban Meta owners reported that their glasses recorded conversations without the “Hey Meta” wake phrase.

2. [2]

   Users reported finding recordings and transcripts of conversations they did not knowingly save.

3. [3]

   The complaints surfaced on Reddit , where one owner described unexpected recordings occurring with three pairs of glasses.

4. [4]

   The owner said the behavior started after a firmware update and occurred even with Respond without Hey Meta disabled.

5. [5]

   They also reported that the glasses’ internal notification light sometimes activated during normal conversation.

6. [6]

   Recording without anyone realizing raises privacy concerns for both the wearer and the people around them.

7. [7]

   People can manage, review and delete voice logs of their interactions with Meta AI via settings at any time.” What’s missing is a public explanation of what caused it, how many people were affected, and what happened to the audio captured.

8. [8]

   As Android Authority reports , Meta says the problem has been fixed: “This issue has been resolved.

9. [9]

   Meta still owes users an explanation of what went wrong and what it has done to ensure it won’t happen again.

Read the original article →

What happened

Although ministers scrapped the proposed national digital ID scheme, officials said work continues on GOV.UK One Login, digital wallets and other digital credentials. [1] [2]

More than 80 document types are earmarked for the government’s digital wallet, including benefits evidence, driving-test certificates and DBS certificates. [3]

Officials said a testing environment is open for private-sector providers to integrate with the government’s digital wallet; proposed uses include digital driving licences for age checks, parcel collection and online identity verification. [4] [5] [6]

Further testing was planned for December, with national rollout of digital driving licences targeted for 2027. [7]

Why it matters

Officials distinguished the canceled national scheme from existing or continuing services, saying the government had scrapped plans for a new identity product while One Login, the government wallet and the trust framework predated that scheme. [8] [9]

At the hearing, officials said consent is the model for digital ID used in digital services, while the article reports that departments can already share data without permission and that the strategy was not yet fully finished. [10] [11] [12] [13]

Known limitations

Officials maintained that people would retain alternatives to digital identification, while an MP warned Britain could receive digital ID indirectly rather than through the canceled national scheme. [14]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Despite the government scrapping its controversial plans, officials told MPs on Monday that work continues on GOV.UK One Login, digital wallets, and a growing collection of digital credentials designed to help people prove who they are.

2. [2]

   Susannah Storey, DCMS permanent secretary, was keen to draw a line between the national scheme ministers had scrapped and the digital identity projects Whitehall had no intention of abandoning.

3. [3]

   Officials told MPs this week that more than 80 types of documents are earmarked for the government's digital wallet, including proof of benefits, driving test certificates, and Disclosure and Barring Service (DBS) certificates.

4. [4]

   Whitehall isn't wasting time putting that technology to use, with officials confirming that testing is already underway to enable digital credentials to work with private businesses.

5. [5]

   Natalie Jones, the senior responsible owner for GOV.UK One Login, revealed that the government had opened a testing environment for private sector providers to integrate with its digital wallet technology.

6. [6]

   This would let people use digital driving licenses to prove their age in pubs, collect parcels, or verify their identity online.

7. [7]

   A digital driving license is only useful if there are people ready and shops and businesses ready to receive it,” Jones said, noting that further testing is planned for December, with a national rollout of digital driving licenses targeted for 2027.

8. [8]

   One Login already allows people to prove who they are online, she said, but "that is not the same as a national digital identity strategy." Rod Latham, DCMS director for cybersecurity and digital identity, had a convenient explanation for why so much of digital ID was still standing: the government had only scrapped plans for a new identity product.

9. [9]

   "We already had One Login and the Gov Wallet," he told MPs, adding that work on the digital identity trust framework was also underway before the national scheme was announced.

10. [10]

    MPs also pressed officials on privacy, particularly whether citizens would have to consent before their information was shared between government departments.

11. [11]

    "In the confines of digital ID used in digital services, then consent is the model," said Christine Bellamy, interim director general for digital products at the Government Digital Service.

12. [12]

    Government departments can already share data without asking permission, and officials couldn't quite explain how that squares with their promises about consent.

13. [13]

    "The strategy needs to be fully finished," Bellamy admitted, which might not be the reassurance MPs were hoping for.

14. [14]

    Rupert Lowe MP remained unconvinced, warning that Britain could end up getting digital ID "by the back door rather than the front door." Officials maintained that the canceled national scheme was fundamentally different from the services still being developed, and that people would retain alternatives to digital identification.

Read the original article →

What happened

AfD confirmed that its hosting provider was hacked in September and that mailboxes were copied; the party said only parts of a few mostly unused mailboxes were accessed, not current leadership accounts. [1] [2]

An anonymous site, hexane.cc, claims to index 421,179 AfD emails but publishes AI-generated summaries rather than the original messages. [3] [4] [5] [6]

Bild reported that a small sample of directly reviewed files appeared to contain genuine party records, including identity documents, financial records, membership applications and regional member lists. [13] [14]

Why it matters

The summaries include allegations involving Nazi symbols, greetings and discussions of forcibly removing a photographer; if authenticated, some material could matter in proceedings concerning whether the AfD should be banned. [7] [8] [9]

Some reviewed files reportedly contained membership applications and lists with full names and home addresses, despite the site’s claim that it minimized personal data. [17] [18]

Known limitations

No summary has been linked to a verifiable original email, the operators have not identified the AI software, and the site displays that source text is not published. [10] [11] [12]

The reported entry route—an unpatched party website followed by access to mail servers—has not been independently verified, although the hosting-provider compromise was confirmed by the AfD. [15] [16]

The archive’s About, Method and Support pages were returning server errors on October 19, limiting access to its explanations of how the archive was created and managed. [19]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied.

2. [2]

   The party said the attackers copied parts of a few mailboxes, most of which had not been used for years, and did not access the leadership’s current accounts.

3. [3]

   By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails.

4. [4]

   In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical .

5. [5]

   The website hexane.cc does not publish the emails themselves.

6. [6]

   Instead, it provides AI-generated summaries grouped into categories such as racism and antisemitism, with severity ratings from Low to Critical.

7. [7]

   “A district board member sent a Christmas card with a swastika and the words “Heil Hitler”.

8. [8]

   Staff at the party’s Berlin headquarters discussed luring a photographer to an event and throwing him out by force, in a thread signed off “hail and victory”.

9. [9]

   The summaries describe swastikas, Nazi greetings, Christmas cards bearing Heil Hitler, and a thread at the federal party headquarters signed off with “hail and victory.” If authenticated, some of this material would matter significantly in ongoing court proceedings about whether the party can be banned.

10. [10]

    The site operators have not identified the AI software used to create them.

11. [11]

    When users try to open a record, the site displays the message “source text not published for this record.” So far, none of the summaries has been linked to an original email that can be verified.

12. [12]

    So far, none of the summaries has been linked to an original email.

13. [13]

    Bild is the only German news outlet confirmed to have examined files from the archive directly, although it reviewed only a very small sample.

14. [14]

    The files appeared to be genuine party records, including identity documents, invoices, bank statements, membership applications, and regional member lists.

15. [15]

    The hacker reportedly told the International Cyber Digest account on X that they gained access through “a single unpatched party website” and then reached the mail servers.

16. [16]

    The AfD has confirmed that its hosting provider was targeted, but the reported entry method has not been independently verified.

17. [17]

    The website describes itself as an independent archive published in the public interest and claims to have minimized personal data.

18. [18]

    However, Bild found that the files it reviewed included membership applications and member lists containing full names and home addresses of people whose only apparent connection to the story was their party membership.

19. [19]

    By the afternoon of October 19, the site’s About, Method, and Support pages were returning server errors, leaving visitors unable to access its own explanations of how the archive was created and managed.

Read the original article →

What happened

ConnectWise said it took remediation measures after unauthorized access to application identities associated with Cloud Backup, including strengthening administrative-access protections, resetting accounts, and replacing application credentials. [1]

ConnectWise said it was continuing to respond to the security incident, while Cloud Backup remained offline. [1]

Known limitations

The supplied evidence does not specify the incident timeline, affected customers, scope of access, or when Cloud Backup would return online. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup.

2. [2]

   The company said it has completed the following actions since it began

Read the original article →

What happened

Justin.sh reports on a leaked confidential Cellebrite document describing Advanced Unlocks (AU), a distinct product from Cellebrite’s previously marketed advanced unlocking services. [1]

A press release cited by the report confirms that Advanced Unlocks is a new Cellebrite product planned for 2026. [2]

According to Cellebrite, AU is a next-generation after-first-unlock (AFU) vector intended to be more resilient to Apple operating-system changes. [3] [4]

According to Cellebrite, AU works with Stolen Device Protection enabled, which tightens USB restrictions. [3]

The report states that AU is enabled by a dedicated appliance with a stated range of approximately 8 meters. [3]

Known limitations

The supplied evidence does not establish the specific radio technology, a demonstrated zero-day exploit, affected device models or operating-system versions, or independent validation of AU’s capabilities. [1] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years.

2. [2]

   A press release from earlier this year confirms AU is a new product for 2026.

3. [3]

   […] According to Cellebrite, AU: is a “next-generation AFU vector that is more resilient to Apple’s OS changes” works with Stolen Device Protection enabled, which tightens USB restrictions is enabled by a dedicated appliance with a stated range (!) of about 8 meters.

4. [4]

   AFU = after first unlock.

Read the original article →

What happened

Go 1.27.3 and Go 1.26.10 reject certificate chains passing through any of eight intermediate certificate-authority keys. [1]

Programs built with the new releases will refuse connections to sites and services whose certificates were issued under those keys. [2]

Known limitations

The supplied text says the Go team attributed the keys to one certificate authority, but the statement is truncated before identifying it or explaining the security concerns. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys.

2. [2]

   Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys.

3. [3]

   The Go team says the keys belong to one certificate authority it has not

Read the original article →

What happened

WhatsApp help pages contained hidden instructions for its support chatbot not to recommend a data protection authority or regulator to users unable to delete their accounts. [1]

The instructions were embedded in page code and were not displayed on screen; the text had been removed by October 18. [2]

Why it matters

The instruction conflicted with WhatsApp’s European privacy policy, which tells users they can complain to a regulator. [1]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one.

2. [2]

   The text sat in the pages' code, never shown on screen, until it was removed by October 18.

Read the original article →

What happened

CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. [1]

The additions include four Plex Media Server vulnerabilities, one SiteGuard Server Edition OS command-injection vulnerability, and one Siemens Software Center uncontrolled-search-path-element vulnerability. [2]

BOD 26-04 requires FCEB agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation, while deferring lower-risk vulnerabilities. [3] [4]

BOD 26-04 also establishes expectations for checking whether threat actors compromised systems before patches were applied. [5]

Why it matters

CISA states that these vulnerability types are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.

2. [2]

   CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

3. [3]

   Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.

4. [4]

   BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities.

5. [5]

   BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

Read the original article →

What happened

Bullhorn temporarily disabled access to its recruitment platform to contain a detected cyber incident and investigate it with help from CrowdStrike. [1] [2]

Bullhorn serves more than 10,000 customers worldwide; services returned in the UK, US, and Australia, but some users still had SSO and password-reset problems and several products had degraded performance. [3] [4]

Why it matters

The outage disrupted access to candidate records, job applications, placements, and, in some cases, systems used to pay people at recruitment agencies. [5]

Bullhorn had not determined whether attackers exfiltrated customer data because its forensic investigation was ongoing. [6] [7]

Known limitations

The cause of the intrusion, the attackers’ identity, and whether ransomware was involved remained unconfirmed. [8]

Bullhorn said it would contact affected customers if the investigation found their information had been compromised. [9]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   "We have detected a cyber incident on the Bullhorn Platform.

2. [2]

   We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said, noting that it had roped in cybersecurity specialists from CrowdStrike to help investigate the attack and restore its services.

3. [3]

   The US-based company, which serves more than 10,000 customers worldwide, says its systems are now back online in the UK, US, and Australia.

4. [4]

   In its latest status update, published on Tuesday, Bullhorn confirmed that some users were still struggling with single sign-on (SSO), password resets, and customizations, while several products continued to report degraded performance.

5. [5]

   For recruitment agencies using Bullhorn, the outage meant losing access to candidate records, job applications, placements and, in some cases, the systems used to get people paid.

6. [6]

   While Bullhorn is making progress getting customers back into their accounts, it has yet to answer arguably the bigger question: whether the attackers stole anything.

7. [7]

   In its customer FAQ, it said a forensic investigation is ongoing, and has not yet determined whether attackers exfiltrated customer data.

8. [8]

   The cause of the intrusion remains unknown, and Bullhorn has not publicly identified the attackers or confirmed whether ransomware was involved.

9. [9]

   Bullhorn says it will contact affected customers if the investigation finds their information was compromised, and it also warned people to watch out for opportunistic crooks looking to exploit the chaos.

Read the original article →

What happened

Check Point and Sublime Security warned of a sharp escalation in attacks using malicious calendar invites to reach targets. [1]

Sublime Security recorded a 1,216% month-over-month increase in these attacks in August 2026; the first half of September exceeded the whole of August by 1,426%. [2]

Check Point reported growth from a few thousand such emails per month in April to more than 118,000 in the later period described by the truncated source. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned.

2. [2]

   Sublime recorded a 1,216% month-over-month increase in August 2026, and the first half of September alone surpassed the whole of August by 1,426%.

3. [3]

   Check Point’s numbers tell a similar story: the volume of these emails grew from a few thousand a month in April to more than 118,000 in … More → The post Quarantined, but still on your calendar: The explosion of invite-based attacks appeared first on Help Net Security .

Read the original article →

What happened

Researchers reported that Meta’s Muse AI agent could expose sensitive information when users shared conversations through web links. [1]

Muse allowed users to share searches, conversations, images, and similar content through links that other people could use to load the content. [2] [3]

Researchers from Claroc said they enumerated 6,800 Muse links created to share conversations. [4]

Why it matters

The article attributes the discoverability of shared links to a central URL-design decision, despite the usual use of hard-to-guess URL text to limit unintended access. [5] [6]

After opening a few hundred enumerated links, the researchers reported finding information that was clearly not intended to be publicly available. [4] [7]

Known limitations

The supplied evidence does not specify what information was found in the opened conversations or describe a permanent fix. [7]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Muse, the new general-purpose AI agent from Meta, can expose sensitive information when users share conversations through web links, researchers reported Monday.

2. [2]

   Like many online services, Muse has allowed users to share searches, conversations, images, and similar content with other people.

3. [3]

   Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content.

4. [4]

   As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others.

5. [5]

   To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.

6. [6]

   But a central design decision for constructing URLs has made the links easy to discover.

7. [7]

   After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available, including: Read full article Comments

Read the original article →

What happened

Google’s documentation says phone-number verification is enabled by default on Android and adds the device’s number to all Google accounts signed in there, including existing accounts and accounts added later. [1] [2] [3]

Google says phone-number verification supports sign-in, account recovery, RCS messaging, and finding or securing a lost device. [7]

Why it matters

The association can connect a phone number intended for a primary account with a secondary account; the number does not automatically become public, but Google gains another way to connect the accounts. [4] [5] [6]

Known limitations

Android Central reports that some users say automatic verification turns itself back on after being disabled, but the article says this is not confirmed for every phone; concerned users are advised to check the setting again later. [8] [9] [10]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   But if you’re using an Android phone, those accounts may have something in common that you didn’t intend or even know about: your phone number.

2. [2]

   Google’s own documentation confirms that phone number verification is on by default and adds your number to all Google accounts signed in on the device.

3. [3]

   This applies to both existing accounts and any you add later.

4. [4]

   But it also means that a number you intended to use with your main account can become associated with a secondary account simply because both are signed in on the same Android device.

5. [5]

   If you deliberately left your phone number off a secondary account, this links it to your real identity without you knowingly making that connection.

6. [6]

   Your number doesn’t automatically become public, but Google gains another way to connect accounts you wanted to keep separate.

7. [7]

   Google says phone number verification helps support features such as signing in, account recovery, Rich Communications Services (RCS) messaging, and finding or securing a lost device.

8. [8]

   Android Central reports that some users say automatic verification switches itself back on after they disable it.

9. [9]

   Those are user reports, not confirmation that this happens on every phone.

10. [10]

    But if you’re concerned, check the setting again later.

Read the original article →

What happened

Mozilla reported that private keys associated with eight eMudhra intermediate certificates had been compromised, potentially enabling fraudulent HTTPS certificates for websites attackers did not control. [1] [2]

Mozilla blocked the affected certificates in Firefox through OneCRL, and said the updated distribution reached all Firefox users with standard configurations in less than three hours. [4] [5]

OneCRL protection does not require users to update or restart Firefox. [6]

Mozilla released Firefox 158.0.1, Firefox ESR 115.43.1, and Firefox ESR 153.5.1 to provide protection for a minority of users whose custom settings may have blocked the OneCRL update. [7] [8]

Mozilla also updated NSS to remove the root certificate that signed the affected intermediates, extending protection to other applications using Mozilla’s trust store or derived versions that do not receive OneCRL updates. [9] [10]

Why it matters

An attacker able to intercept a user’s connection could use the fraudulent certificates to impersonate websites and potentially read or modify traffic. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   On Saturday, October 17, at 20:06 UTC, Mozilla received a report that private keys associated with eight eMudhra intermediate certificates had been compromised.

2. [2]

   These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.

3. [3]

   An attacker who could intercept a user’s connection could use those certificates to impersonate websites and potentially read or modify traffic.

4. [4]

   Mozilla engineers responded immediately, blocking the affected certificates in Firefox using OneCRL , Mozilla’s centralized list of revoked certificates.

5. [5]

   By 22:59 UTC that same day, in less than 3 hours after we received the report, the updated OneCRL distribution was complete for all Firefox users with standard configurations.

6. [6]

   OneCRL delivers this protection without requiring users to update or restart Firefox.

7. [7]

   Today, we are also releasing Firefox 158.0.1 for Desktop and Android, along with Firefox ESR 115.43.1 and Firefox ESR 153.5.1 .

8. [8]

   These releases will distribute this protection for a minority of users whose custom settings may have prevented them from receiving the OneCRL update.

9. [9]

   We are also updating the trusted certificate list in NSS ( NSS 3.131.1 ) to remove the root certificate that signed the affected intermediates.

10. [10]

    Firefox is already protected through OneCRL, but this additional update helps protect other applications that use Mozilla’s trust store or versions derived from it and do not receive OneCRL updates.

Read the original article →

What happened

AppGate expanded its zero trust offering for operational technology with Session Governance capabilities intended to reduce third-party access risk, simplify compliance audits, and protect operational uptime. [1]

The expansion builds on AppGate ZTNA for OT, introduced in March 2026, which initially controlled who could access critical systems. [2] [3]

The new release governs activity during each session and gives supervisors live monitoring and session-termination controls. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   AppGate has expanded its zero trust offering for operational technology (OT) with Session Governance capabilities that help critical infrastructure operators reduce third-party access risk, simplify compliance audits and protect operational uptime.

2. [2]

   The expansion builds on the ZTNA for OT offering AppGate introduced in March 2026.

3. [3]

   The initial release of AppGate ZTNA for OT controlled who could access critical systems.

4. [4]

   This release governs what happens during each session and gives supervisors the final say when activity … More → The post AppGate gives OT supervisors live monitoring and session termination controls appeared first on Help Net Security .

Read the original article →

What happened

Citizen Lab said on October 19 that an iPhone belonging to Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026. [1]

The finding was reported six days before Serbia’s October 25 snap parliamentary election. [2]

Why it matters

The infection used a zero-click exploit, meaning the device owner did not have to tap a link; the supplied sentence is truncated before stating the complete condition or mechanism. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19.

2. [2]

   The finding came six days before Serbia's October 25 snap parliamentary election.

3. [3]

   The infection used a zero-click exploit, meaning Đokić did not have to tap a link or

Read the original article →

What happened

IDENTOS announced that PolicyArc is generally available. [1]

PolicyArc provides security, platform, and compliance teams with one place to define, enforce, and audit access policy across applications. [2]

IDENTOS says PolicyArc is intended to extend access to AI agents acting on behalf of people and services. [3]

The source describes PolicyArc as providing AI agents with task-specific, time-limited access. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   IDENTOS has announced that PolicyArc is now generally available.

2. [2]

   The new solution gives security, platform, and compliance teams a single place to define, enforce, and audit access policy across their applications.

3. [3]

   PolicyArc is built to solve how to safely extend access not just to people and services but to the AI agents now acting on their behalf.

4. [4]

   PolicyArc builds on more than 12 years of IDENTOS identity and access work across Canadian government and healthcare … More → The post IDENTOS PolicyArc gives AI agents task-specific, time-limited access appeared first on Help Net Security .

Read the original article →

What happened

ThreatModeler announced NexusAI, an AI-powered threat-modeling partner within the ThreatModeler Nexus platform. [1]

NexusAI is described as automating more of the work involved in creating, analyzing, and maintaining threat models. [2]

The source describes NexusAI as tracking architectural changes and proposing security updates, but the supplied text does not provide further details about how those capabilities operate. [4]

Why it matters

The source says security teams face pressure to assess more applications, respond to architectural changes, and manage risk without slowing innovation as application development accelerates. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   ThreatModeler has announced the launch of NexusAI, its new AI-powered threat modeling partner within the ThreatModeler Nexus platform.

2. [2]

   NexusAI helps enterprises automate more of the work involved in creating, analyzing, and maintaining threat models, enabling security teams to scale their impact without scaling manual effort.

3. [3]

   As AI accelerates application development, security teams face growing pressure to assess more applications, respond to architectural changes, and manage risk without slowing innovation.

4. [4]

   NexusAI addresses this challenge by taking … More → The post ThreatModeler NexusAI tracks architectural changes and proposes security updates appeared first on Help Net Security .

Read the original article →

What happened

Abstract announced AI SOC capabilities in its agentic SIEM for investigation, threat hunting, and triage, using its own trained and tuned models together with frontier foundation models. [1]

The platform also provides SOAR response capabilities with actions assigned directly to detection rules. [1]

These capabilities are built into a platform that already collects, routes, and detects on security data in stream. [2]

Why it matters

The article frames the capabilities against security teams facing agentic attacks that move at machine speed while their tooling becomes more distributed. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Abstract has announced new AI SOC capabilities in its agentic SIEM: investigation, hunt, and triage powered by a combination of Abstract’s own trained and tuned models and frontier foundation models, and SOAR response capabilities with actions assigned directly to detection rules.

2. [2]

   The capabilities are built into the platform that already collects, routes, and detects on security data in stream.

3. [3]

   Security teams are facing agentic attacks that move at machine speed while their own tooling spreads … More → The post Abstract links automated response actions directly to SIEM detection rules appeared first on Help Net Security .

Read the original article →

What happened

On November 1, 2024, a ransomware actor exploited Data Cymru’s unused Test2 account, encrypted 182.7 GB of data, and exfiltrated 42 GB from a domain controller, file server, and SQL server. [1] [2]

The Test2 account was created for access testing in 2012 and retained the very weak password Password1, which a cited strength tool estimated could be cracked in under a second. [3] [4] [5]

The local administrator accounts on the three impacted systems shared one password, allowing collected account hashes from one breached system to authenticate access to others on the network. [7] [8]

ONL did not review local administrator accounts after deployment; they remained active with their original default passwords for more than 12.5 years. [9] [10]

Why it matters

The compromised account enabled theft of personal data relating to 3,300 people, mostly children, and the attack affected systems holding substantial organizational data. [1] [2] [6]

The ICO found ONL lacked Active Directory procedures for auditing user accounts and reprimanded both ONL and Data Cymru over security failures. [11] [12] [13]

The ICO said responsibility was shared: ONL created the test account, while Data Cymru retained overall network control and could instruct ONL to create or remove accounts. [14] [15]

Known limitations

The source reports that neither organization had sufficiently clear and effective measures to routinely identify and remove old accounts. [16]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   On November 1, 2024, Data Cymru suffered a ransomware attack after a miscreant exploited a test account called Test2 to infiltrate its network and encrypt 182.7 GB of data housed in a file server and an internal database server.

2. [2]

   "Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL [PDF].

3. [3]

   ONL told the ICO it created the test account on January 13, 2012, during its initial project for Data Cymru.

4. [4]

   "ONL confirmed that the creation of the 'Test2' account was likely intended to test user account access before migrating 'real' users to its services," the ICO said.

5. [5]

   "When it was created, the 'Test2' account was given the password of 'Password1'." The ICO cited Bitwarden's password strength tool, which rated "Password1" as "very weak" and estimated a cracking time of less than a second.

6. [6]

   A test account protected by "Password1" helped an intruder steal personal data relating to 3,300 people, mostly children, in a ransomware attack that has drawn regulatory rebukes for two Welsh organizations.

7. [7]

   "The local administrator accounts on the three impacted systems all had the same password.

8. [8]

   This meant that once one system had been breached, the local account hashes could be collected and used by the threat actor to authenticate access to other systems on the Data Cymru network," the regulator added.

9. [9]

   "ONL confirmed that it did not carry out any reviews of local administrator accounts following their initial deployment.

10. [10]

    This meant these accounts remained active, regardless of whether they were used, and continued to use the same default passwords set at the time of their creation in January 2012, as part of ONL's initial project with Data Cymru, for more than 12.5 years." The data watchdog reprimanded ONL under Article 32 of the UK GDPR because it failed to put in place "appropriate technical and organisational measures" to ensure processing systems and services were safe, and it didn't regularly assess or evaluate those measures.

11. [11]

    The Information Commission's Office (ICO) issued reprimands rather than fines to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, also known as Data Cymru.

12. [12]

    It found ONL had no auditing procedures to review user accounts within Data Cymru's Active Directory.

13. [13]

    The ICO's separate reprimand of Data Cymru [PDF] also detailed failures in its security arrangements.

14. [14]

    "The responsibility for these failures did not sit with one organisation alone.

15. [15]

    ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts.

16. [16]

    Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed." ®

Read the original article →

What happened

Security researchers reported that an unknown number of AOMEI Backupper users were infected with a backdoor through a supply-chain attack. [1]

Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s servers for five to ten minutes before restoring the originals. [2]

Why it matters

The altered files supported Backupper’s update and promotional pop-up mechanism, which periodically fetches instructions from AOMEI’s servers. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered.

2. [2]

   Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minutes at a time, then restored the originals.

3. [3]

   The tampered files belong to the software’s update and promotional pop-up mechanism, which periodically fetches instructions from AOMEI’s servers.

Read the original article →

What happened

The Department of Justice announced 28 California arrests under “Operation Protect the Vote,” charging foreign nationals and permanent green-card holders with allegedly fraudulent voter registration and false statements in naturalization applications. [1] [2]

DOJ said the defendants appeared on a list of more than 20,000 California registrants it provided to state officials as allegedly ineligible to vote; DHS separately said its internal list contained more than 190,000 potential noncitizen registrants. [3] [4] [5] [6] [7]

DHS said its list was compiled from state voter-registration data, federal databases, and commercial third-party data cross-referenced with known aliens in government systems. [5]

Why it matters

The article reports that the arrests and official comments signal federal willingness to investigate, arrest, or prosecute people identified by the administration as potential noncitizen voters, amid disputes over federal authority versus states’ control of elections. [8] [9] [10] [11]

The source states that follow-up investigations in nearly every comparable instance reduced initial claims of hundreds of thousands of potential noncitizens to a tiny fraction of confirmed cases, with most discrepancies attributed to mistakes and no evidence of a larger plot. [12] [13]

Source-supported guidance

Acting Deputy Attorney General Trent McCotter said California must verify the citizenship of the more than 20,000 listed registrants before mail-in ballots are counted. [4] [10] [14] [15]

Known limitations

The article states there is no credible evidence of widespread voter fraud in U.S. elections, among either legal voters or noncitizens, and describes the administration’s fraud claims as historically overinflated. [16] [17] [18] [19]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The Department of Justice announced Monday it made 28 arrests across California, part of what it was calling “Operation Protect the Vote.” All those arrested were foreign nationals and permanent green card holders, charged with fraudulently registering to vote in U.S.

2. [2]

   elections and making false statements in a naturalization application.

3. [3]

   13 it provided a “list” of 20,000 registered California voters to California Secretary of State Shirley Weber, claiming they were ineligible to vote based on federal records.

4. [4]

   “Each of the 28 defendants charged today appears on the list of more than 20,000 likely noncitizen registrants we provided to California election officials last week,” said Acting Deputy Attorney General Trent McCotter in a statement.

5. [5]

   A DHS spokesperson told CyberScoop that its internal list contains more than 190,000 registered California voters alleged to be “potential noncitizens.” The spokesperson said the list was culled from publicly available state voter registration data, federal databases and “commercial third-party data,” that cross-referenced them “with known aliens in our systems.” “Our message to aliens who vote in American elections is clear: we will find you, arrest you, and you will face the consequences — including criminal charges and deportation,” the spokesperson said.

6. [6]

   “190,000 remains the number of potential noncitizens registered to vote in California that DHS asked Secretary Weber to review,” the spokesperson continued.

7. [7]

   “The 20,000 referenced by DOJ is a subset of registrants that have gone through the manual verification process so far.” Last week three Democratic senators, including Alex Padilla, D-Calif., wrote to Attorney General Todd Blanche pressing him to commit that the Department of Justice, FBI or other federal law enforcement agencies will not seize live ballots or voting machines during the upcoming midterm elections.

8. [8]

   A series of federal raids and arrests of voters in California has escalated the Trump administration’s ongoing efforts to take administrative control of U.S.

9. [9]

   The arrests, paired with comments from top officials at the departments of Justice and Homeland Security, also make it clear that the federal government is willing to act on its past threats to investigate, arrest, or prosecute more than 190,000 California voters who the administration claims are “potential” noncitizens.

10. [10]

    California must verify the citizenship of those more than 20,000 registrants before mail-in ballots are counted.” A DHS spokesperson said Immigration and Customs Enforcement (ICE) and Homeland Security Investigations are “actively rooting out and investigating” alleged voter fraud while claiming the Trump administration has “repeatedly” proven that noncitizens vote in elections.

11. [11]

    In these cases, the administration argues the federal government’s authority to investigate and prosecute voter fraud outweighs states’ authority to run elections.

12. [12]

    In the past two years, the Department of Justice and Republican secretaries of state have regularly announced findings of hundreds of thousands of “potential noncitizens” registered to vote.

13. [13]

    In nearly every single instance , follow-up investigations confirm the number of confirmed noncitizens registered was a tiny fraction of the original claims, with the vast majority being simple mistakes with no evidence of a larger plot.

14. [14]

    “California refused to look at that list.

15. [15]

    Today’s charges show exactly what that refusal puts at risk.

16. [16]

    “ONLY Americans should elect American leaders.” There is no credible evidence of widespread voter fraud in U.S.

17. [17]

    elections, either among legal voters or noncitizens.

18. [18]

    The Trump administration’s record, in public statements as well as lawsuits and other court actions, reflects a history of wildly overinflated claims of actual fraud, while casting routine or isolated errors in voter registration as evidence of larger election malfeasance.

19. [19]

    Over the course of Trump’s first term, his subsequent time as a private citizen, and his current second term, he has had many chances to provide evidence of widespread voter fraud or noncitizen voting in court, and he has lost each time.

Read the original article →

What happened

Palo Alto Networks reports continued exploitation by ransomware actors of CVE-2026-0257, an authentication-bypass flaw affecting PAN-OS and Prisma Access. [1] [2]

The flaw has a CVSS score of 7.8 and could allow attackers to establish unauthorized VPN connections. [2]

Palo Alto Networks patched the flaw in May 2026; the supplied evidence ends mid-sentence and does not establish further patch or exploitation-status details. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.

2. [2]

   The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections.

3. [3]

   It was patched by Palo Alto Networks in May 2026 and was

Read the original article →

What happened

Researchers released a proof-of-concept exploit for a recently patched critical Fortinet FortiSIEM vulnerability that could enable arbitrary code execution. [1]

The flaw is identified as CVE-2026-106173, has a CVSS score of 9.4, and is described as a critical path-traversal vulnerability. [2]

The reported impact includes unauthorized code or command execution by an unauthenticated attacker; the supplied text truncates before stating the full exploitation conditions. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution.

2. [2]

   The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially

Read the original article →

What happened

A Google Cloud outage in London disrupted Revolut services, including card payments and ATM withdrawals; Revolut’s status page showed most services unavailable or partially unavailable. [1] [2] [3]

Google identified multiple service disruptions in its London region, including the europe-west2 data center, while its engineering team investigated the problem. [4] [5] [6]

A person familiar with the matter told Reuters that Revolut’s outage was related to the Google Cloud disruption; the source does not establish a confirmed technical cause. [5] [7] [8]

Revolut said customers’ money and data were safe and that it had been working to fix the disruption since it was identified, but it did not name a cause. [8] [9] [10] [11]

ING Germany separately reported customer problems logging into online banking and its mobile app; Reuters did not link those problems to the Google Cloud outage, and ING did not explain the cause. [12] [13] [14]

Why it matters

The article says Google Cloud’s London region supports many UK and European fintech services, and that outages at a major data center can prevent customers from paying or accessing banking services before the cause is understood. [15] [16]

Interpretation: The simultaneous incidents raise questions about European banks’ dependence on a small number of cloud providers, although the article says the timing could be coincidental. [17] [18]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Google Cloud’s London outage disrupted Revolut payments and ATM withdrawals, while ING Germany reported online banking issues.

2. [2]

   Multiple Google Cloud services went offline in the London region this morning, according to Google’s status page, and the disruption didn’t stay contained to infrastructure dashboards.

3. [3]

   Revolut’s own status page showed most services as unavailable or partially unavailable, including card payments and ATM withdrawals.

4. [4]

   Google Cloud's London region is affected by network failures.

5. [5]

   “Multiple Google Cloud services ​experienced disruptions in the company’s London ‌region on Tuesday, according to its service status page, while British digital bank ​Revolut also reported a service outage.” Reuters states , “A ​person familiar with the matter told ⁠Reuters that Revolut’s service outage ​was related to the Google Cloud service ​disruption.” The outage affected Google’s europe-west2 data center, its main facility in London.

6. [6]

   Google’s engineering team said they were investigating the problem.

7. [7]

   pic.twitter.com/kyxOMlVaak — International Cyber Digest (@IntCyberDigest) October 20, 2026 British digital bank Revolut reported a widespread service outage at roughly the same time, and a person familiar with the matter told Reuters the two events were directly connected.

8. [8]

   Revolut says money and data are safe but has not named a cause.

9. [9]

   “We are currently experiencing a service disruption affecting multiple services.

10. [10]

    We can confirm that all our customers’ money and data are safe.

11. [11]

    We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience.” the financial company wrote on X.

12. [12]

    ING Germany also reported problems on Tuesday.

13. [13]

    Customers had trouble logging into online banking and the mobile app because of a technical issue.

14. [14]

    Reuters did not link these problems to the Google Cloud outage, and ING has not explained the cause.

15. [15]

    Google Cloud’s europe-west2 region in London supports many UK and European fintech services.

16. [16]

    When a major data center goes down, the impact can quickly reach customers, preventing them from paying or accessing banking services before the cause is fully understood.

17. [17]

    Two major financial services companies experiencing problems on the same morning could be a coincidence.

18. [18]

    However, it also raises questions about how much European banks depend on a small number of cloud providers.

Read the original article →

What happened

ConnectWise Cloud Backup customers’ Microsoft 365 applications were compromised after an unidentified threat actor obtained an API secret used to connect the vendor application with Microsoft 365 environments. [1] [2]

The affected Microsoft 365 services included Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, Microsoft Graph and Partner Center. [2]

Huntress observed malicious-infrastructure sign-ins across almost 1,000 Entra tenants, with more than 300 appearing successful; ConnectWise confirmed unauthorized sign-ins in 162 tenants and said further compromises were likely beyond its telemetry. [8] [9]

ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management about two days after researchers observed the initial unauthorized sign-ins. [10]

Why it matters

The credential could request access tokens in any tenant where the multi-tenant application was installed, without customer action, and granted technical ability to read and write mail and files. [3] [4]

The credential’s highly privileged access could bypass multi-factor authentication; in observed post-compromise activity, the application elevated privileges and added credentials that could preserve access after the original application was disabled. [5] [6] [7]

Known limitations

ConnectWise said restoration efforts remained underway without a confirmed timeline for customers to regain access, and the root cause of how the credential was obtained remained under investigation. [11] [12] [13]

ConnectWise reported no successful threat activity in environments it monitored since mitigations began, but said this did not establish whether individual partner or customer Microsoft 365 tenants were affected; each potentially affected tenant still required review. [14] [15]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The company temporarily shut down multiple services Saturday after a threat actor gained access to a highly sensitive credential that allowed its customers to connect the vendor’s application with Microsoft 365 environments.

2. [2]

   The threat actor, which hasn’t been identified, used the application programming interface (API) secret to compromise a series of ConnectWise Cloud Backup customers’ Microsoft 365 applications, including Exchange Online, Microsoft Teams, SharePoint Online, Cloud Backup, MS Graph and Partner Center, according to Huntress.

3. [3]

   “Because it’s a multi-tenant application, anyone holding that credential can request access tokens in any tenant where the application is installed, without any action by the customer,” Semon said.

4. [4]

   Sign-ins, which were performed by an automated tool, also gave the attacker the technical ability to read and write mail and files across various Microsoft 365 applications, Todyl wrote in a blog post .

5. [5]

   Highly privileged access granted by the credential for ConnectWise Cloud Backup allowed attackers to bypass security controls, including multi-factor authentication, and establish additional access.

6. [6]

   “In the tenants where we saw post-compromise activity, the account associated with the application elevated its own privileges and added new credentials to other applications in the tenant.

7. [7]

   That would let someone keep access even after the original application was disabled,” Semon said.

8. [8]

   Researchers observed an initial wave of attacks Friday, and by late Saturday Huntress “had seen sign-in activity from the malicious infrastructure across almost 1,000 Entra tenants, with more than 300 of those sign-ins appearing to succeed,” Jonathan Semon, principal security operations analyst at Huntress, told CyberScoop.

9. [9]

   The cybersecurity company, which primarily supports small- to mid-sized businesses, confirmed unauthorized sign-ins in 162 tenants and said additional compromises beyond its telemetry are likely.

10. [10]

    ConnectWise suspended its Cloud Backup, SaaS Security and Cloud Management services about two days after researchers observed an initial wave of unauthorized sign-ins.

11. [11]

    A portion of ConnectWise’s customers have been adrift for days, and hundreds are compromised, as the company’s efforts to restore its Cloud Backup service remain underway with no confirmed timeline for when customers can regain access.

12. [12]

    The root cause of the breach and ensuing fallout remains under investigation, and the company declined to answer questions about how attackers obtained the credential for ConnectWise Cloud Backup.

13. [13]

    The company said restoration efforts remain underway, but it hasn’t provided a timeline for when customers can regain access.

14. [14]

    “Since mitigations began on October 17 at 05:00 UTC, we have not observed successful threat activity in the environments we monitor.

15. [15]

    This does not establish whether individual partner or customer Microsoft 365 tenants were affected; each potentially affected tenant still requires review.” Microsoft Threat Intelligence said it observed broad successful sign-ins from a malicious IP address on Oct.

Read the original article →

What happened

curl will move low- and medium-severity vulnerability reports to its public GitHub repository from October 26, while reserving private handling for high- and critical-severity flaws. [1] [2]

Researchers uncertain about severity can still submit reports through HackerOne for curl maintainers to assess. [3]

Why it matters

The policy change follows a sustained reporting surge: more than 90 percent of submissions in recent years were quickly assessed as below high severity, and AI-generated submissions had already contributed to workload pressure. [4] [5] [6] [7]

Public handling may let more people assess reports, develop fixes, write advisories, and check for related problems before releases, while making lessons and documentation easier to find; it is not expected to reduce work per report. [8] [9] [10]

The maintainer said AI-assisted researchers are generating unusual option combinations unlikely in real applications and treating minor discrepancies as vulnerabilities. [13]

Known limitations

Public disclosure gives attackers more time to exploit flaws before fixes arrive; the maintainer describes this as unfortunate but unavoidable and limits the practice to issues below high severity. [11] [12] [13]

The project described the change as part of a survival strategy amid strained and overloaded maintainers, and said it might not be the last response to the reporting volume. [14] [15] [16] [17]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An "avalanche of vulnerability reports" is forcing curl to move lower-severity cases into public view, reserving private handling for high and critical flaws.

2. [2]

   From October 26, low and medium-severity reports should be filed in the open source data transfer tool's public GitHub repository, maintainer Daniel Stenberg said.

3. [3]

   "Security researchers in doubt can still submit the issue on HackerOne and we can tell them what severity we deem it to be.

4. [4]

   Over the last few years, over 90 percent of all submissions could quickly be assessed to be less than HIGH." Stenberg already shuttered curl's bug bounty scheme this year as AI-generated submissions piled work onto its security team.

5. [5]

   Stenberg has previously acknowledged that not all AI-assisted reports are bad, but the workload now demands another response.

6. [6]

   "This policy change is entirely triggered by the current avalanche of vulnerability reports that keep pouring in.

7. [7]

   We see no end to them and we do not anticipate this flood to decrease within the next several months.

8. [8]

   We aim to not drown." Public handling would let more people assess reports, develop fixes, write advisories, and check for related problems before releases ship, Stenberg said.

9. [9]

   Handling vulnerability reports publicly won't reduce the work per report, he admits, though it could spread the load and make the resulting lessons and documentation easier to find.

10. [10]

    At least that's the theory.

11. [11]

    Public disclosure also gives attackers more time to exploit flaws before fixes arrive.

12. [12]

    The maintainer agrees this is unfortunate yet unavoidable.

13. [13]

    "We limit this practice to less than HIGH for this reason: at least these problems are not terrible." Stenberg said researchers using AI are generating unusual option combinations unlikely to occur in real applications, then treating minor discrepancies as vulnerabilities.

14. [14]

    "We are struggling as a project as all key maintainers feel strained, overloaded and brought to the brink of what we can muster.

15. [15]

    We must act to survive.

16. [16]

    This is our next step in a survival strategy.

17. [17]

    It might not be our last.

Read the original article →

What happened

Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. [1]

Google introduced Enhanced Protection for Chrome’s Safe Browsing feature in 2020 to address online scams and social engineering. [2]

Why it matters

Google says users of Enhanced Protection have been ten times safer from phishing, social engineering, notification abuse, and other scams than users of Standard Protection. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command.

2. [2]

   The company introduced Enhanced Protection for Chrome’s Safe Browsing feature in 2020 to address online scams and social engineering.

3. [3]

   Google says further updates have made its users ten times safer from phishing, social engineering, notification abuse, and other scams compared with those using Standard Protection.

Read the original article →

What happened

The private keys of eight eMudhra intermediate certificate authority certificates were compromised, according to confirmation from Mozilla and Google’s Chrome Root Program on October 20. [1]

Why it matters

Because an intermediate CA signs certificates presented by websites, possession of one of the compromised keys could allow issuance of a certificate for any website that a browser would accept. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20.

2. [2]

   An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept.

Read the original article →

What happened

Symantec researchers said Russian government-connected hackers compromised two NATO-country defense firms and a law enforcement agency in an espionage campaign. [1]

Symantec identified the group as Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, and linked it to Russia’s GRU. [2]

Targets reportedly included a naval shipbuilder, a military-aircraft-engine manufacturer and a law enforcement agency. [3]

The hackers used the Hookedge backdoor, previously observed by Recorded Future against defense and diplomatic targets in Romania, Spain and Turkey. [8] [9]

Symantec also observed an undocumented loader, ld.exe, which decrypts its payload in memory and requires a runtime command-line key; researchers did not recover the payload and do not know its function. [10] [11] [12] [13] [14]

Why it matters

At the shipbuilder, Symantec observed human-directed activity in which operators repeatedly returned to a compromised host over a week to steal credentialed material. [4] [5]

Symantec’s analyst said the activity indicated the organization was a deliberate target and that exploitation beyond the initial infection was at least attempted; the campaign’s motive remained uncertain. [6] [7]

Known limitations

The analyst said the attackers moved sensitive follow-up activity to a dedicated server rather than continuing to hop between free services, contrary to Recorded Future’s expectation. [15]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Russian government-connected hackers compromised two defense firms and a law enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign, Symantec researchers said in a blog post Tuesday.

2. [2]

   The infamous group behind hacks of the Democratic National Committee during the 2016 election cycle was behind the attacks that Symantec identified in recent months: Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, notorious for its links to the Russian military agency GRU.

3. [3]

   The hackers apparently chose the targets of their attacks carefully, including a naval shipbuilder, a manufacturer of military aircraft engines and the law enforcement agency.

4. [4]

   In the attack on the shipbuilder, Symantec saw “hands-on-keyboard” activity as the hackers repeatedly returned to a compromised host over the course of a week to steal credentialed material.

5. [5]

   “Hands-on-keyboard activity means a human operator is choosing what to do next, rather than malware running a fixed routine,” Dick O’Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told CyberScoop.

6. [6]

   “It’s essentially confirmation that the organization is a genuine target for the operators, not an accidental infection.

7. [7]

   It also confirms that further exploitation beyond the initial infection was at least attempted.” O’Brien said the campaign reflected broader intelligence collection aimed at European government and defense targets, but its motive wasn’t certain.

8. [8]

   The hackers made use of the Hookedge backdoor first identified in August by Recorded Future’s Insikt Group.

9. [9]

   That firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey.

10. [10]

    Symantec also observed the hackers deploying a previously undocumented loader.

11. [11]

    “The loader, ld.exe, hadn’t been publicly documented.

12. [12]

    It decrypts its payload in memory, and it needs a key supplied only at runtime on the command line.

13. [13]

    Without both the encrypted file and the key, the payload can’t be recovered.

14. [14]

    We didn’t recover it, so we don’t know its function.” This spring, researchers and U.S.

15. [15]

    “What surprised us was that the attackers then moved their most sensitive follow-up activity onto a dedicated server, when Recorded Future had expected them to keep hopping between free services,” O’Brien said.

Read the original article →

What happened

Nikkei disclosed a breach affecting approximately 1.83 million items of personal information after attackers used previously stolen credentials to access a cloud service used for system development on October 7. [1] [2] [3]

About 150,000 items contained at least one identifying detail such as a name, email address, postal address, phone number, or date of birth; approximately 120,000 included an email address. [4] [5]

Approximately 1.68 million items contained only information that could not identify an individual, and no credit-card information was included. [6] [7]

Nikkei blocked the stolen credentials; as of October 16, it had found no signs of further damage, including misuse of the leaked data, system outages, or changes to its data. [10] [11]

Why it matters

Nikkei reported the breach to Japan’s Personal Information Protection Commission on October 11 and said it was still investigating the scope and what personal information was stolen. [8] [9]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Nikkei disclosed a data breach affecting over 1.8 million records after hackers used stolen credentials to access a cloud service for system development.

2. [2]

   On the morning of October 7, the hackers used previously stolen credentials to gain access.

3. [3]

   for system development was accessed without authorization, and as of October 16, approximately 1.83 million items of personal information had been leaked.” reads the data breach notice published by the company.

4. [4]

   “About 150,000 items contained one or more of the following: name, email address, postal address, phone number or date of birth.

5. [5]

   Of these, about 120,000 included an email address.

6. [6]

   About 1.68 million items contained only information that cannot identify an individual.

7. [7]

   No credit card information is included in any of the leaked information.” The security breach did not compromise financial information.

8. [8]

   The company reported the breach to Japan’s Personal Information Protection Commission on October 11.

9. [9]

   The company is still investigating the scope of the security breach and what personal information was stolen.

10. [10]

    Nikkei has since blocked the stolen credentials.

11. [11]

    As of October 16, the company had found no signs of further damage, such as misuse of the leaked data, system outages, or changes to its data.

Read the original article →

What happened

Xerj Console API has an authentication-bypass vulnerability, CVE-2026-97406, that can bypass passkey-backed requirements during token issuance. [1] [2] [3]

An attacker with an existing valid Xerj API token can invoke the token-creation endpoint and mint independent successor credentials with the original token’s access levels. [4] [5] [6] [7]

The vendor could not be reached, and no official patch was available when the advisory was written. [14]

Why it matters

Successor tokens persist after the compromised parent token is revoked because Xerj lacks hierarchical revocation logic, allowing continued access and potential privilege escalation. [8] [9]

If the compromised token belongs to an account owner, the successor token retains full administrative authority; the attacker can create an invitation and enroll an attacker-controlled passkey. [10] [11] [12]

The advisory states that this path can give an attacker persistent control over the Xerj instance and its sensitive data indices, making revocation of the initial token ineffective. [13]

Source-supported guidance

Users are advised to monitor the project’s GitHub repository for updates and install the latest library version once a fix is released. [15]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance.

2. [2]

   The vulnerability, CVE-2026-97406 , stems from a flaw in how session states are authenticated and handled within the Xerj system architecture.

3. [3]

   According to the documented security contract, the issuance of new API tokens must be strictly authorized by a passkey-backed session.

4. [4]

   By exploiting this flaw, an attacker with an existing valid token can create independent, persistent successor credentials directly through the console API.

5. [5]

   However, the Xerj implementation converts both standard browser sessions and API bearer tokens into the same generic AuthSession object.

6. [6]

   The token creation handler then accepts this generalized principal without verifying whether the session was authenticated via a passkey.

7. [7]

   Because of this architectural oversight, an attacker who obtains or intercepts a valid Xerj API token can directly invoke the token creation endpoint, allowing them to create independent successor credentials with the same access levels of the original token.

8. [8]

   This allows the attacker to maintain access and potentially escalate privileges within the Xerj ecosystem, even if the initial token is revoked.

9. [9]

   Furthermore, the Xerj platform lacks hierarchical revocation logic; consequently, revoking a compromised parent token has no effect on any descendant tokens spawned from it.

10. [10]

    The security risk escalates significantly if the compromised token belongs to a Xerj account owner.

11. [11]

    In this scenario, the newly created successor token retains full administrative authority.

12. [12]

    An attacker can use this persistent access to issue a new account invitation, redeem it in their own browser, and successfully enroll an entirely independent, attacker-controlled passkey.

13. [13]

    This grants the attacker permanent control over the Xerj instance and its sensitive data indices, rendering the revocation of the initial token completely ineffective.

14. [14]

    Solution The vendor could not be reached to coordinate this vulnerability and an official patch has not been made available at the time of this writing.

15. [15]

    Users are advised to monitor the project's GitHub repository for updates and install the latest version of this library once a fix has been released.

Read the original article →

What happened

A Nigerian national was sentenced to eight years in prison after pleading guilty to conspiracy to commit computer intrusions and wire fraud in a scheme that ran from 2019 to 2023. [1] [2] [3]

The scheme involved hacking U.S.-based tax-preparation businesses, using stolen identities to file false federal and state tax returns, and soliciting money for nonexistent investments. [2]

In a May 2021 attack, conspirators sent a spearphishing email to an employee of a New York tax-preparation business, infecting the firm’s computer systems with malware. [5]

The defendant was arrested in France in July 2023 and extradited to the United States in August 2025; the investigation involved the FBI, the Justice Department’s Office of International Affairs and the U.S. Marshals Service. [8] [9] [10]

Why it matters

Court records say the conspirators stole tax and personal data from at least 800 business customers of tax businesses in New York, Texas and elsewhere. [4]

Prosecutors attributed more than $7 million to fraudulent investment schemes, about $2.5 million to fraudulent tax returns, and $819,000 to fraudulent Small Business Administration disaster-loan payouts. [6]

The court ordered nearly $3.65 million in restitution and almost $10.85 million in forfeiture. [7]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A 40-year-old Nigerian national was sentenced to eight years in prison for running a years-long hacking, tax fraud and investment scheme, the Justice Department said Monday.

2. [2]

   Chukwuemeka Victor Amachukwu enriched himself from 2019 to 2023 by hacking into U.S.-based tax preparation businesses, filing false tax returns with federal and state authorities using identities stolen from victim organizations and enticing victims to send him money for investments that did not exist, according to court records.

3. [3]

   Amachukwu pleaded guilty to conspiracy to commit computer intrusions and wire fraud in April.

4. [4]

   Amachukwu, his alleged co-conspirator Kingsley Uchelue Utulu and other alleged Nigeria-based co-conspirators also stole the tax and personal data of at least 800 business customers after hacking into tax businesses based in New York, Texas and elsewhere, according to court records.

5. [5]

   In one of those attacks, in May 2021, members of the conspiracy sent a spearfishing email to an employee of a New York-based tax preparation business, which infected the firm’s computer systems with malware.

6. [6]

   Prosecutors said Amachukwu and his alleged co-conspirators obtained more than $7 million in fraudulent investment schemes, about $2.5 million in fraudulent tax returns and $819,000 in fraudulent payouts from the Small Business Administration’s Economic Injury Disaster Loan program.

7. [7]

   A federal judge ordered him to pay nearly $3.65 million in restitution to his many victims and forfeit almost $10.85 million.

8. [8]

   He was arrested in France in July 2023 and extradited to the United States in August 2025.

9. [9]

   The FBI, Justice Department’s Office of International Affairs and the U.S.

10. [10]

    Marshals Service assisted the investigation, which led to Amachukwu’s arrest and extradition from France.

Read the original article →

What happened

Eight eMudhra Limited intermediate TLS certificates had weak private keys that could allow unauthorized parties to mint trusted credentials for any internet site. [1] [2]

The reporting party demonstrated control of one private key by digitally signing an advisory with it, indicating that the key could be used to sign unauthorized certificates trusted by millions of servers. [3] [4]

By late Tuesday morning, browser makers and some major applications and programming languages had blocked all eight intermediate certificates. [5]

Why it matters

Updating other internet components, including Linux distributions and embedded or IoT devices, was expected to be difficult and time-consuming, leaving the threat unresolved across parts of the ecosystem. [6]

Known limitations

The source reported no certificate-transparency evidence that the compromised keys had been used maliciously at the time described. [7]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet.

2. [2]

   One word: bonkers The eight intermediate certificates belong to India-based certificate authority eMudhra Limited.

3. [3]

   An informal advisory published to emudhra.we-have-a-problem.com over on Tuesday posted the message “We have a problem here - Wayne.” The words were digitally signed using the private key of one of the eMudhra certificates.

4. [4]

   With proof that the reporting party had control of the key, defenders scrambled because the same key could be used to sign unauthorized certificates that would be trusted by millions of servers worldwide.

5. [5]

   As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates.

6. [6]

   The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

7. [7]

   There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously.

Read the original article →

What happened

Oracle’s October 2026 Critical Patch Update addresses 1,209 unique CVEs through 1,295 security updates across 33 Oracle product families. [1] [2]

The update includes 112 critical patches covering 95 CVEs; critical patches represent 8.6% of all published security updates. [3] [4]

Oracle Fusion Middleware received the most patches, with 206 updates, followed by Oracle E-Business Suite with 194. [5]

Why it matters

The product-family breakdown identifies vulnerabilities exploitable over a network without authentication, including 134 Fusion Middleware patches, 66 Siebel CRM patches, and 49 Java SE patches. [6] [7]

Known limitations

Tenable states that plugins for identifying these vulnerabilities will appear as coverage is released and directs readers to its matching-plugin search filter. [8] [9]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Key Takeaways The October 2026 Critical Patch Update (CPU) contains fixes for 1209 unique CVEs in 1295 security updates 112 issues (8.6% of all patches) were assigned a critical severity rating Oracle Fusion Middleware received the highest number of patches at 206, accounting for 15.9% of all patches Background On October 20, Oracle released its Critical Patch Update (CPU) for October 2026 , the final quarterly update of the year.

2. [2]

   This CPU contains fixes for 1209 unique CVEs in 1295 security updates across 33 Oracle product families.

3. [3]

   Out of the 1295 security updates published this quarter, 8.6% of patches were assigned a critical severity.

4. [4]

   This quarter's update includes 112 critical patches across 95 CVEs.

5. [5]

   Severity Issues Patched CVEs Critical 112 95 High 475 439 Medium 613 582 Low 95 93 Total 1295 1209 Analysis This quarter, the Oracle Fusion Middleware product family contained the highest number of patches at 206, accounting for 15.9% of the total patches, followed by Oracle E-Business Suite at 194 patches, which accounted for 15% of the total patches.

6. [6]

   A full breakdown of the patches for this CPU can be seen in the following table, which also includes a count of vulnerabilities that can be exploited over a network without authentication.

7. [7]

   Oracle Product Family Number of Patches Remote Exploit without Auth Oracle Fusion Middleware 206 134 Oracle E-Business Suite 194 31 Oracle Siebel CRM 122 66 Oracle Communications 110 77 Oracle PeopleSoft 109 41 Oracle JD Edwards 102 44 Oracle MySQL 98 29 Oracle Java SE 55 49 Oracle Supply Chain 50 19 Oracle Essbase 38 14 Oracle REST Data Services 35 11 Oracle Analytics 33 14 Oracle Systems 28 9 Oracle Database Server 14 4 Oracle Construction and Engineering 13 7 Oracle Enterprise Manager 12 2 Oracle GoldenGate 11 3 Oracle Trusted Answer Search 8 1 Oracle Utilities Applications 8 7 Oracle Secure Backup 6 3 Oracle Virtualization 6 0 Oracle Autonomous Health Framework 5 1 Oracle Financial Services Applications 5 5 Oracle Retail Applications 5 5 Oracle TimesTen In-Memory Database 4 0 Oracle HealthCare Applications 4 4 Oracle Hospitality Applications 4 4 Oracle Commerce 3 2 Oracle APEX 2 2 Oracle Application Testing Suite 2 0 Oracle Global Lifecycle Management 1 0 Oracle NoSQL Database 1 1 Oracle SQL Developer 1 1 Solution Customers are advised to apply all relevant patches in this CPU.

8. [8]

   Identifying affected systems A list of Tenable plugins to identify these vulnerabilities will appear here as they're released.

9. [9]

   This link uses a search filter to ensure that all matching plugin coverage will appear as it is released.

Read the original article →

What happened

IQ.Lvbs alleged that attackers repeatedly attempted from October 7 to 14 to steal its NovaSpark driving model, access users’ devices and private driving files, and exploit its sign-in system. [1] [2]

IQ.Lvbs said the first requests came from an IP address assigned to Comma.ai Inc.; its published logs also associated the username haraschax with Comma.ai IP addresses, and the article notes that Schäfer uses that username on GitHub. [3] [4] [5]

The article reports that IQ.Lvbs’s team was banned from the Comma.ai Discord channel on October 8, while private beta testers were also reportedly banned from the IQ.Pilot Discord channel. [3] [6]

IQ.Lvbs attributed the alleged incident to potential competitive pressure, while a company representative said NovaSpark was ahead of Comma’s latest models; the article presents this as the representative’s speculation. [9] [10]

A Discord message attributed to Comma.ai CTO Harald Schäfer implied that NovaSpark was distilled from Comma.ai’s Rebellious Hope model; IQ.Lvbs disputed that claim and said it developed NovaSpark independently. [11] [12] [13] [14]

IQ.Lvbs said it was reviewing legal options and considering involving authorities over the alleged hack. [17] [18]

Why it matters

IQ.Lvbs introduced NovaSpark in a private beta through the Comma.ai Discord channel because the model requires Comma.ai camera hardware built for self-driving vehicles. [7] [8]

Known limitations

Comma.ai, Schäfer and the Discord user identified as Torq_boi did not respond to requests for comment, so the article does not provide their response to the alleged attacks or model-origin dispute. [15] [16]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The tech startup, IQ.Lvbs, described the alleged security incident in a recent blog post.

2. [2]

   "From October 7 to 14, we faced repeated attempts to steal NovaSpark, access users’ devices and private driving files, and exploit our sign-in system," the IQ.Lvbs blog post claims.

3. [3]

   "The first requests came from an IP assigned to Comma.ai Inc." In addition, on October 8 – shortly after the alleged attacks began – somebody banned IQ.Lvbs' team from the Comma.ai Discord channel.

4. [4]

   In the log data IQ.Lvbs published to support its claims, the company flags the username haraschax as one of those associated with Comma.ai IP addresses.

5. [5]

   Schäfer uses that username on GitHub.

6. [6]

   Posts on the IQ.Pilot Discord channel indicate that individuals doing private beta testing for IQ.Lvbs have also been banned from that channel.

7. [7]

   On October 3, IQ.Lvbs introduced the private beta of NovaSpark, the first model for the company's IQ.Pilot app, in the Comma.ai Discord channel.

8. [8]

   They put it in that channel because the model requires the use of Comma.ai's camera hardware, which is built for self-driving vehicles.

9. [9]

   One of the three people involved in IQ.Lvbs, a UI/UX designer who asked to be identified only as "Cat," speculated to The Register about the reasons for the alleged hack and Discord ban.

10. [10]

    "Our model, NovaSpark, is a good deal ahead of Comma's latest small and large models, which directly threatens their core business of making AI models good enough to sell their hardware," he said.

11. [11]

    "Comma for the most part has been stagnant in their models' improvement and that was a main driver for us making NovaSpark." An October 7, 2026 Discord message from user Torq_boi, said to be Harald Schäfer, Comma.ai’s CTO, implies NovaSpark was distilled from Comma.ai's Rebellious Hope model.

12. [12]

    “I’m glad people are training models and experimenting with this stuff," the post starts.

13. [13]

    "But don’t lie to people about what you’re doing, and saying it’s not a finetune of existing comma models when it is.

14. [14]

    That’s not cool.” IQ.Lvbs disputes that assertion and says it did the work on its own.

15. [15]

    Comma.ai and Schäfer did not respond to requests for comment sent to several different addresses.

16. [16]

    The Discord user Torq_boi in the Comma.ai channel did not respond to a DM seeking comment.

17. [17]

    IQ.Lvbs says it's considering legal action over the alleged hack.

18. [18]

    "We are currently reviewing our legal options and looking into involving the authorities," said Cat.

Read the original article →

What happened

Eight eMudhra intermediate-certificate private keys were reported compromised, enabling attackers to issue fraudulent HTTPS certificates for domains they do not control. [1] [2]

eMudhra had issued more than 60 million digital certificates, and certificates signed with the compromised keys remained in use by some services. [3] [4]

Mozilla, Chrome, and Apple remediated the issue so their browsers would not rely on the affected certificates after users installed updates; eMudhra was also reported to have revoked the certificates. [2] [5]

Scott Helme reported recovering eMudhra private keys from public certificates, including keys represented by the numbers 4, 56, and 115, in less than a second; other researchers found additional similarly small values. [6] [7] [8] [9]

Why it matters

Cloudflare characterized the certificate-forgery capability as allowing an attacker to impersonate servers and intercept or modify traffic. [2]

The article characterized the keys as inadequate because they were easy to guess, making certificates issued by eMudhra susceptible to brute-force attacks. [10]

Known limitations

At publication time, eMudhra had not responded to the publication’s inquiries about the incident or its security practices, and the story was still developing. [11] [12]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   “On Saturday, October 17, at 20:06 UTC, Mozilla received a report from a community member that private keys associated with eight eMudhra intermediate certificates had been compromised,” he wrote.

2. [2]

   “These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.” Or as Cloudflare put it, “an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic.” Jackson has since elaborated on the incident and the response, which has thankfully seen Mozilla, Chrome, and Apple remediate the issue so their browsers won’t rely on the certificates – at least after users install an update.

3. [3]

   The CA of concern in this case is called eMudhra, which boasts of having issued over 60 million digital certificates to help usher in a world of digital trust.

4. [4]

   That’s welcome, but sadly certs signed with these private keys are still out there and many services rely on them.

5. [5]

   He also reports that eMudhra has revoked the certs, and lists many FOSS projects that have issued updates that mean they won’t recognize certs from eMudhra.

6. [6]

   The latter question is of great interest because security researcher Scott Helme analyzed eMudhra’s certs and found one the private keys it used “is the number 4.” “Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4...

7. [7]

   Another one is 56, and another is 115.

8. [8]

   I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second,” Helme wrote.

9. [9]

   Other researchers have found private keys including the numbers 66, 155, 156, 230 and 237.

10. [10]

    Those are vastly inadequate keys, because they’re easy to guess, making all certs issued by eMudhra susceptible to brute force attacks.

11. [11]

    At the time of writing, eMudhra has not responded to The Register’s inquiries about the incident and its security practices.

12. [12]

    As Helme put it: “A P-384 private key should be a random 384-bit number, which gives you 2³⁸⁴ possibilities (or roughly 10¹¹⁵), so nobody is ever going to search that.” This is a developing story and The Register will update it as more information becomes available.

Read the original article →

What happened

A 45-year-old U.S. citizen pleaded guilty to running an identity-theft and fraud scheme that defrauded thousands of U.S. servicemembers and veterans while he lived in the Philippines. [1] [2] [3]

According to court records, the scheme used stolen personally identifiable information to compromise victims’ bank accounts and steal money and veterans’ benefits over five years ending in July 2019. [4]

Prosecutors describe Boling as the principal orchestrator; he received personal information on thousands of military-affiliated individuals from a former U.S. Army contractor medical-records administrator in South Korea. [5] [6]

Boling pleaded guilty to conspiracy to commit wire fraud and money laundering and faces up to 40 years in prison upon sentencing. [8]

He was arrested in Los Angeles in May after the Philippines deported him to the United States to face charges; two co-conspirators previously pleaded guilty, while two others remain at large. [9] [10] [11] [12]

Why it matters

The operation allegedly used dozens of U.S. money mules to receive stolen funds through bank accounts and transfer part of the proceeds to the Philippines. [7]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A 45-year-old U.S.

2. [2]

   citizen pleaded guilty to running a widespread identity theft and fraud scheme that defrauded thousands of U.S.

3. [3]

   servicemembers and veterans while living in the Philippines, the Justice Department said Tuesday.

4. [4]

   exploited stolen personally identifiable information (PII) to compromise victims’ bank accounts and steal their money and veterans’ benefits during a five-year period ending in July 2019, according to court records.

5. [5]

   Prosecutors describe Boling as the “principal orchestrator of the scheme.” He received PII of thousands of military-affiliated individuals from Brown, who worked as a contractor medical records administrator for the U.S.

6. [6]

   Army in South Korea from 2010 to 2015, officials said.

7. [7]

   Officials said the crew also worked with dozens of money mules in the United States who provided bank accounts to deposit stolen funds into and sent a portion of the funds to the Philippines.

8. [8]

   He pleaded guilty to conspiracy to commit wire fraud and money laundering and faces up to 40 years in prison upon sentencing.

9. [9]

   “This defendant betrayed our country by exploiting personal information belonging to thousands of military-affiliated individuals, including elderly and disabled veterans, in a calculated scheme to steal from those who have given so much.” Boling was arrested in May in Los Angeles after he was deported by the Philippines to the United States to face charges related to the scheme, officials said.

10. [10]

    He was originally indicted in July 2019 along with four co-conspirators, and a warrant issued for his arrest in October 2022.

11. [11]

    Two of Bolling’s co-conspirators — Frederick Brown and Trorice Crawford — previously pleaded guilty and were sentenced to 151 months and 46 months in prison in 2021 and 2020, respectively.

12. [12]

    Other alleged co-conspirators Jongmin Seok and Allan Albert Kerr remain at large.

Read the original article →

What happened

PHP maintainers planned to release patches for two vulnerabilities, each rated 9.2 out of 10 in severity. [1] [2]

The planned patches concern PHP, a programming language used to power websites and web applications. [1]

PHP maintainers reserved the right to release the patches earlier if vulnerability details became public or active exploitation appeared in the wild. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Fixes for what are believed to be uncommonly severe vulnerabilities are scheduled to drop in a little more than 12 hours for PHP, a programming language that powers websites and Web applications everywhere.

2. [2]

   PHP maintainers said Monday that they planned to release patches for two vulnerabilities, both with severity ratings of 9.2 out of a possible 10.

3. [3]

   “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” Read full article Comments

Read the original article →

What happened

PHP announced an upcoming security release for two critical vulnerabilities, each rated CVSS v4.0 9.2, scheduled for October 21, 2026 at 14:00 UTC. [1] [2]

Public reports have associated CVE-2026-109618 and CVE-2026-109619 with the release, but PHP has not confirmed the identifiers or disclosed technical details, affected versions, or fixed versions. [3] [4] [5]

Qualys customers can use QID 45110 to identify systems running PHP and assess inventory before the release; the check does not confirm vulnerability. [9] [10]

Why it matters

PHP may release the updates earlier if vulnerability details become public or evidence of active exploitation emerges. [6]

Qualys recommends using CSAM to inventory PHP installations, identify end-of-life software, and prioritize internet-facing systems for review and remediation once affected versions are confirmed. [11]

Source-supported guidance

The source recommends preparing for expedited patching, monitoring PHP’s official security announcements, and applying updates promptly once available. [7]

Organizations should review affected versions after PHP publishes its advisory and prioritize updates accordingly. [8]

Known limitations

PHP 8.1 and earlier are unsupported upstream and are identified as a priority for upgrade planning, while affected versions, remediation guidance, and dedicated detection QIDs remain pending. [12] [13]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2.

2. [2]

   The release is scheduled for October 21, 2026, at 14:00 UTC .

3. [3]

   Public reports have linked CVE-2026-109618 and CVE-2026-109619 to the upcoming PHP security release.

4. [4]

   However, PHP has not yet confirmed these identifiers or disclosed technical details about the vulnerabilities.

5. [5]

   What to Expect PHP has not yet disclosed technical details, affected versions, or fixed versions.

6. [6]

   PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges.

7. [7]

   Organizations should prepare for expedited patching and monitor PHP’s official security announcements to apply updates promptly once available.

8. [8]

   Customers should review the affected versions once PHP publishes the advisory and prioritize updates accordingly.

9. [9]

   What Qualys Customers Can Do Qualys customers can use QID 45110 – PHP Server Detected , an Information Gathered (IG) QID, to identify systems running PHP and assess their inventory ahead of the security release.

10. [10]

    QID 45110 is a discovery check and does not confirm vulnerability to these issues.

11. [11]

    Customers can also leverage Qualys CyberSecurity Asset Management ( CSAM ) to inventory PHP installations and identify end-of-life software, and prioritize internet-facing systems for review and remediation once affected versions are confirmed.

12. [12]

    PHP 8.1 and earlier are no longer supported by the upstream PHP project, making these systems a priority for upgrade planning.

13. [13]

    Note : We will update this blog as additional information becomes available, including affected versions, remediation guidance, and dedicated QIDs for detecting these vulnerabilities once the security updates are released and detection coverage is available.

Read the original article →

What happened

Google released TorchTPU as open source to provide PyTorch developers with a native way to run models on its Tensor Processing Units. [1]

Google announced TPU support in vLLM, SGLang, TorchTitan, Ray, and Hugging Face libraries. [2]

Google says PyTorch workloads can move to its custom TPUs with minimal … More → [4]

Why it matters

Teams that write models in PyTorch and run them on GPUs by default are identified as having the most to gain. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units.

2. [2]

   Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan training framework, Ray, and Hugging Face’s libraries.

3. [3]

   Teams that write their models in PyTorch and run them on GPUs by default have the most to gain.

4. [4]

   Google says those workloads now move to TPUs, its custom AI chips, with minimal … More → The post Google open-sourced TorchTPU, so PyTorch on TPUs just got a lot easier appeared first on Help Net Security .

Read the original article →