October 27, 2026

What happened

OpenAI released GPT-6.1 Terra, a model that operates desktop software, to Plus, Pro, Enterprise, and Edu users in ChatGPT Work and Codex, and to developers through its API as gpt-6.1-terra. [1]

OpenAI says GPT-6.1 Terra meets its Critical cyber threshold. [2]

Why it matters

The API prices are stated to be 50% below those of GPT-5.6 Terra and GPT-6.1 Sol: $1 per million input tokens, $0.05 per million cached input tokens, and $5 per million output tokens. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   OpenAI released GPT-6.1 Terra, a model that operates desktop software, to all Plus, Pro, Enterprise, and Edu users in ChatGPT Work and Codex, and to developers through its API as gpt-6.1-terra.

2. [2]

   OpenAI says Terra … More → The post GPT-6.1 Terra meets OpenAI’s Critical cyber threshold, and it’s cheaper than GPT-5.6 Terra appeared first on Help Net Security .

3. [3]

   API prices are 50 percent below those of GPT-5.6 Terra and GPT-6.1 Sol: $1 per million input tokens, $0.05 per million cached input tokens, and $5 per million output tokens.

Read the original article →

What happened

CISA confirmed active exploitation of the recently patched PHP2Shell flaws and added them to its Known Exploited Vulnerabilities catalog. [1]

The two PHP vulnerabilities are each rated 9.2 on the CVSS scoring system and facilitate unauthenticated remote code execution on affected deployments. [2]

Known limitations

The supplied excerpt truncates the vulnerability details after identifying CVE-2026-109618, so affected versions and remediation details are unavailable. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog.

2. [2]

   The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory

Read the original article →

What happened

Barrion advertised an on-site Cybersecurity Expert / Penetration Tester role in Sweden, but applications were no longer being accepted. [1]

The role involved testing web applications and APIs for authentication, authorization, and business-logic vulnerabilities. [1]

Responsibilities included identifying complex attack paths, validating findings, and evaluating AI-driven security testing for false positives and missed vulnerabilities. [2]

The role also involved developing scenarios intended to improve automated vulnerability discovery. [2]

The article also listed a Cloud Network Solution Architect position at TAL in Australia as an on-site role. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity Expert / Penetration Tester Barrion | Sweden | On-site – No longer accepting applications As a Cybersecurity Expert / Penetration Tester, you will test web applications and APIs for authentication, authorisation, and business logic vulnerabilities.

2. [2]

   You’ll identify complex attack paths and validate findings.You’ll evaluate AI-driven security testing, investigate false positives and missed vulnerabilities, and develop scenarios that improve automated discovery.

3. [3]

   Cloud Network Solution Architect TAL | Australia | On-site – View job details As … More → The post Cybersecurity jobs available right now: October 27, 2026 appeared first on Help Net Security .

Read the original article →

What happened

Rapid7’s Q3 2026 Quarterly Threat Landscape Report says the average interval between public disclosure and exploitation of high-severity vulnerabilities was three days. [1] [2]

Rapid7 reported that 71% of tracked exploitation occurred within the first week after disclosure. [2]

Researchers tracked 43 newly exploited high- and critical-severity vulnerabilities during the quarter. [3]

Why it matters

The report characterizes exploitation timing as putting pressure on fixed patching schedules. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape Report.

2. [2]

   The company reported an average of three days between public disclosure and exploitation of high-severity vulnerabilities, with 71% of tracked exploitation occurring within the first week.

3. [3]

   Cumulative exploitation rate (Source: Rapid7) Exploitation puts pressure on fixed patching schedules Researchers tracked 43 newly exploited high- and critical-severity vulnerabilities during the quarter.

Read the original article →

What happened

Amutable opened signups for a private preview of Amutable Foundations, a Linux system in which each machine sends a signed report of its software and configuration, using local hardware to make the report easier to verify. [1]

The company says its engineers write and maintain code in the kernel, systemd, and image-building tools. [2]

Why it matters

The article says Linux fleet operators should change what they check when evaluating this system. [3]

Known limitations

The supplied excerpt does not provide enough detail to establish how the system operates without SSH or a package manager. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Amutable opened signups for the private preview of Amutable Foundations, a Linux system in which each machine sends a signed report of the software and configuration it runs, drawing on local hardware to make the report easier to verify.

2. [2]

   The company says its engineers write and maintain code in the kernel, in systemd and in image-building tools.

3. [3]

   If you run a Linux fleet, this changes what you check.

4. [4]

   Say a machine can’t show it matches … More → The post Amutable Foundations is a Linux system with no SSH and no package manager appeared first on Help Net Security .

Read the original article →

What happened

Madhu Shashanka, identified as Chief Scientist at Concentric AI, explains that securing LLM tools and agents depends more on the data they can access than on the model itself. [1]

The article covers prompt injection, data leakage through connectors, overprivileged agents, and shadow AI as LLM-agent security concerns. [2]

Why it matters

Controls on model behavior, including guardrails and injection detection, reduce bad outcomes but do not eliminate them. [3]

Controls over agent inputs and access differ because organizations own the documents, systems, and credentials available to an agent. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Madhu Shashanka, Chief Scientist at Concentric AI, explains why securing LLM tools and agents depends more on your data than on the model.

2. [2]

   He covers prompt injection, data leakage through connectors, overprivileged agents, and shadow AI.

3. [3]

   Controls on model behavior, such as guardrails and injection detection, lower the rate of bad outcomes but never reach zero.

4. [4]

   Controls on what goes in are different, because you own the documents, systems, and credentials an agent can reach.

Read the original article →

What happened

Researchers at Enclave found a flaw in Microsoft Authenticator on Android that allegedly let any app on the phone take over a work account without requiring permissions or user interaction. [1] [2] [3]

The article describes Authenticator as an Android authentication “broker” used when Teams, Outlook, or another Microsoft app requests sign-in. [4] [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   If you use Microsoft Authenticator on Android, update it.

2. [2]

   Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account.

3. [3]

   The app didn’t need permissions, and you didn’t need to tap anything.

4. [4]

   Here’s what happened Authenticator does more than show six-digit codes.

5. [5]

   On Android it also acts as a “broker.” When Teams, Outlook or another Microsoft app needs to sign you in, it asks Authenticator, and Authenticator … More → The post Microsoft Authenticator vulnerability let rogue Android apps steal work account access appeared first on Help Net Security .

Read the original article →

What happened

CERT-UA warned of unauthorized remote access to Dahua-manufactured video surveillance systems in Ukraine. [1]

Recorded compromises affected IP cameras and DVRs, enabling access to video streams, device-configuration changes, and creation of third-party accounts, according to SSSСIP. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua.

2. [2]

   "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP)

Read the original article →

What happened

The Australian Signals Directorate says a criminal using Amadey malware can no longer access or steal data from 180,000 infected computers worldwide, including some in Australia. [1]

ASD operators gained access to the criminal operation’s backend and disconnected its controller from the infected computers. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says.

2. [2]

   The agency's operators gained access to the criminal's operation's backend and cut it off from those computers.

3. [3]

   "The next steps that we took were to disconnect that Amadey controller from all those

Read the original article →

What happened

Generative AI is making fake login pages easier to build and more convincing. [1]

Attackers can recreate familiar login screens, impersonate trusted brands, and tailor phishing attempts to specific employees or organizations. [2]

Why it matters

Some fake login pages can capture MFA codes or hijack authenticated sessions, not merely steal passwords. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Fake login pages are nothing new, but generative AI is making them easier to build and more convincing.

2. [2]

   Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations.

3. [3]

   Some fake login pages go beyond stealing passwords.

4. [4]

   They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain

Read the original article →

What happened

The University of Copenhagen ruled out a second cyberattack and said activity prompting the shutdown of several administrative systems was tied to a previously disclosed breach that exposed personal data belonging to about 525,000 people. [1]

The university took Workzone, Nimbus and other administrative systems offline in what it described as a preventive and controlled shutdown. [2]

Why it matters

The incident involved exposure of personal data belonging to approximately 525,000 people and disruption of several administrative systems. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal data belonging to some 525,000 people.

2. [2]

   On Monday, the university took Workzone, Nimbus and other administrative systems offline in what it called “a preventive and controlled shutdown of the administrative systems in question,” warning that users might have … More → The post Cyberattack on University of Copenhagen exposes data of 525,000 people appeared first on Help Net Security .

Read the original article →

What happened

Keystone said an attacker who accessed its website obtained the key used by its hardware wallets to prove they are genuine. [1]

Someone possessing the key could build counterfeit Keystone devices that pass owners’ online verification check. [2]

Why it matters

A buyer who trusted a counterfeit device could have their cryptocurrency stolen; the supplied account is truncated before stating what the incident did not involve. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.

2. [2]

   Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone.

3. [3]

   A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve

Read the original article →

What happened

ThreatAware announced Dimension, a governed workspace for organisations to build, run and manage customised security applications. [1]

Dimension is described as giving security teams flexibility to develop tailored applications while providing organisations with oversight of how those applications access data and interact with live systems. [2]

Examples of possible applications include a shadow AI detector, MFA dashboard and compliance tracker. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   ThreatAware has announced the launch of Dimension, its governed workspace that provides organisations with a foundation for building, running and managing their own customised security applications.

2. [2]

   Dimension gives security teams the flexibility to develop applications tailored to their needs, while providing organisations with greater oversight of how those applications access data and interact with live systems.

3. [3]

   A shadow AI detector, an MFA dashboard, a compliance tracker, or whatever the organisation needs.

Read the original article →

What happened

CISA released “CISA 2030: Defend, Harden, Prevail,” a strategy focused on strengthening national security and critical-infrastructure resilience against intersecting cyber, physical, and geopolitical threats. [1] [2]

The strategy addresses threats that can disrupt essential services. [2]

With public- and private-sector partners, CISA plans to strengthen operational-technology security, advance software security, support secure adoption of new technologies, and improve continuity of National Security and Emergency Preparedness communications. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The Cybersecurity and Infrastructure Security Agency (CISA) has released CISA 2030: Defend, Harden, Prevail, a strategy to strengthen national security and the resilience of critical infrastructure.

2. [2]

   It addresses intersecting cyber, physical, and geopolitical threats that can disrupt essential services.

3. [3]

   Working with public- and private-sector partners, the agency will strengthen operational technology security, advance software security, support the secure adoption of new technologies, and improve the continuity of National Security and Emergency Preparedness communications.

Read the original article →

What happened

The University of New Mexico Health Sciences Center reportedly suffered a cyberattack that temporarily disrupted hospital operations and may have caused a substantial data breach. [1]

The disruption reportedly led hospitals to divert ambulances and cancel appointments. [2]

Why it matters

The Health Sciences Center includes the university’s clinical, research and education initiatives, so the reported incident affected an organization spanning those functions. [3]

Known limitations

The evidence describes the potential data breach as uncertain and attributes the attack claim to an extortion group; it does not establish the breach’s scope or confirm the group’s responsibility. [1] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a substantial data breach.

2. [2]

   Hospitals diverted ambulances and canceled appointments The University of New Mexico, located in Albuquerque, New Mexico, is a public research university.

3. [3]

   Its Health Sciences Center encompasses its clinical, research and education initiatives.

4. [4]

   The clinical … More → The post Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack appeared first on Help Net Security .

Read the original article →

What happened

Exeon Analytics introduced Exeon.AgentGuard, an AI security solution intended to provide visibility into approved and shadow AI use, autonomous-agent activity, and data flows through connected tools and external services. [1]

Exeon says the solution builds on its AI-driven behavioral analytics and threat-detection capabilities to address risks associated with growing adoption of agentic AI. [2]

Why it matters

The announcement identifies data leakage and rogue AI-agent behavior as areas addressed by the expanded threat-detection offering. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Exeon Analytics has introduced Exeon.AgentGuard, a new AI security solution designed to give organizations visibility into approved and shadow AI use, autonomous agent activity and the data flows created through connected tools and external services.

2. [2]

   Building on its expertise in AI-driven behavioral analytics and threat detection, Exeon expands its cybersecurity capabilities to address emerging risks associated with the rapid adoption of agentic AI.

3. [3]

   Bringing visibility, addressing data leakage and rogue AI agent behavior As enterprises … More → The post Exeon expands threat detection to shadow AI and autonomous agents appeared first on Help Net Security .

Read the original article →

What happened

FireMon announced FireMon Agentic AI for investigating network access, making policy decisions, and preparing security changes. [1]

The capabilities are built into FireMon’s network security management solutions and use policy data, context, and tools trusted by practitioners for complex, multi-step tasks. [2]

Customers can use FireMon-supplied agents, create their own agents, or connect external agentic workflows through the FireMon MCP Server. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   FireMon has announced FireMon Agentic AI, changing how enterprises investigate network access, make policy decisions, and prepare security changes.

2. [2]

   Built into FireMon’s network security management solutions, the new agentic AI capabilities makes agents first-class citizens alongside practitioners, putting them to work on complex, multi-step tasks using the policy data, context, and tools practitioners already trust.

3. [3]

   Customers can use FireMon’s supplied agents, create their own, or connect external agentic workflows through the FireMon MCP Server.

Read the original article →

What happened

DNSFilter launched LUMINATE, a security platform intended to provide five security solutions through one agent, one console, and one policy. [1]

Why it matters

The article characterizes shadow AI as a rapidly growing business risk and says employees are adopting AI tools and agents faster than security teams can approve them. [2] [3]

The article reports that existing security technology often lacks visibility into employees’ AI-tool adoption and that nearly a third of employees using generative AI at work do so without employer permission. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   DNSFilter has launched LUMINATE by DNSFilter, a security platform that allows organizations to deliver five security solutions from one agent, one console and one policy.

2. [2]

   Shadow AI is now one of the fastest-growing risks in business.

3. [3]

   Employees are adopting AI tools and agents faster than security teams can approve them, often without any visibility from existing security technology.

4. [4]

   Nearly a third of employees using generative AI at work are doing so without their employer’s permission, … More → The post DNSFilter LUMINATE unifies DNS security, AI controls and remote work protection appeared first on Help Net Security .

Read the original article →

What happened

Sekoia introduced Sekoia Self-Hosted, a deployment model that brings its SOC platform into a customer’s own infrastructure. [1]

The model is designed for large organizations, including government, defense, critical-infrastructure and highly regulated organizations. [2]

Why it matters

Sekoia Self-Hosted targets organizations whose sovereignty, connectivity or data-control requirements make standard public-cloud deployment unsuitable. [3]

The deployment model gives customers control over where security operations are run, although the supplied excerpt truncates the fuller description. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Sekoia has introduced Sekoia Self-Hosted, a deployment model that brings the Sekoia SOC platform into the customer’s own infrastructure.

2. [2]

   Designed for large organizations, including government agencies, defense organizations, critical infrastructure operators and highly regulated enterprises, Sekoia Self-Hosted enables security teams to run modern, intelligence-driven security operations within their chosen environment.

3. [3]

   The deployment model is designed for organizations whose sovereignty, connectivity or data-control requirements make standard public-cloud deployment unsuitable.

4. [4]

   It gives customers control over where security … More → The post Sekoia introduces self-hosted deployment for organizations with strict data controls appeared first on Help Net Security .

Read the original article →

What happened

Socure launched Agent Intelligence, a suite that detects AI agents, scores whether they should be trusted, and links each agent to the verified person or business that authorized it. [1]

The suite includes Agent Detection, Agent TrustScore, and Agent Credential, positioned as extending beyond simple Know Your Agent solutions. [2]

Agent Detection is generally available within Socure’s existing Digital Intelligence offering, while Agent TrustScore is open to beta customers. [2]

Agent Credential is stated to reach general availability in Q1 2027. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Socure has launched Agent Intelligence, a suite that detects AI agents, scores whether they should be trusted, and ties each agent to the verified person or business that authorized it.

2. [2]

   Agent Intelligence includes three layers in one platform designed to go beyond simple Know Your Agent (KYA) solutions: Agent Detection, generally available today inside Socure’s existing Digital Intelligence offering, Agent TrustScore, open for beta customers now, and Agent Credential, reaching general availability in Q1 2027.

Read the original article →

What happened

Arctic Wolf found threat actors flooding employees’ inboxes with spam, then contacting them on Microsoft Teams while posing as IT support and offering to fix the problem. [1]

The security company documented more than 400 incidents involving abuse of Teams’ external chat feature. [2]

Why it matters

In many cases, the fraudulent help-desk message arrived minutes after the victim’s inbox had received hundreds of newsletter and subscription confirmations. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found.

2. [2]

   The security company documented more than 400 incidents in which the external chat feature in Teams was abused.

3. [3]

   In many of these cases, the fake help desk message arrived minutes after the victim’s inbox had been filled with hundreds of newsletter and subscription confirmations.

Read the original article →