November 10, 2026

What happened

One Zero Bank is seeking an Application Security Engineer in Israel for a hybrid role focused on building security into the software development lifecycle. [1]

The role includes security reviews and threat modeling across web and mobile applications, APIs, CI/CD pipelines, and the software supply chain, followed by helping developers fix identified vulnerabilities. [2]

The position also involves automating security controls and building internal tools, including AI-powered tools for code; the supplied text is truncated after this point. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Application Security Engineer ONE ZERO BANK | Israel | Hybrid – View job details As an Application Security Engineer, you will work with developers to build security into the software development lifecycle.

2. [2]

   You will use security reviews and threat modeling to find vulnerabilities in web and mobile apps, APIs, CI/CD pipelines, and the software supply chain, then help developers fix them.

3. [3]

   You will automate security controls and build internal tools, including AI-powered tools for code … More → The post Cybersecurity jobs available right now: November 10, 2026 appeared first on Help Net Security .

Read the original article →

What happened

Acronis TRU Cyber Pulse 2026 reports that cybercriminals are using AI agents to coordinate attacks, stolen credentials to access linked services, and tools that interfere with intrusion detection and system recovery. [1]

In an investigation called BOSSAI, researchers documented one operator connecting more than 10 AI models to tools for reconnaissance, scanning, and exploitation. [2]

The operator could assign tasks and monitor agent activity through WeChat and LINE. [3]

Known limitations

The supplied evidence does not substantiate the title’s claim about more than 575 malicious OpenClaw skills delivering malware to Windows and macOS. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybercriminals are using AI agents to coordinate attacks, stolen credentials to access linked services, and tools that interfere with intrusion detection and system recovery, according to Acronis TRU Cyber Pulse 2026.

2. [2]

   One operator coordinates activity across several countries In an investigation known as BOSSAI, researchers documented how one operator connected more than 10 AI models to tools for reconnaissance, scanning and exploitation.

3. [3]

   Through WeChat and LINE, the operator could assign tasks, monitor agent activity and … More → The post Over 575 malicious OpenClaw skills delivered malware to Windows and macOS appeared first on Help Net Security .

Read the original article →

What happened

Abnormal AI’s 2026 State of Behavioral Security Report identified AI agents as the leading planned investment area for behavioral monitoring. [1]

In the survey, 43% of respondents said their organizations would invest most in AI agents over the next two years; API integrations were the next most common choice, at less than one-third of that share. [2]

Why it matters

Security professionals were divided over how well their organizations could establish and maintain baselines for normal AI-agent behavior. [3]

Known limitations

The supplied evidence does not provide the full breakdown of respondents’ confidence in maintaining normal-behavior baselines. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   AI agents topped the list of planned investments in behavioral monitoring in Abnormal AI’s 2026 State of Behavioral Security Report.

2. [2]

   Asked where their organizations would invest most over the next two years, 43% of respondents chose AI agents, more than three times the share who chose API integrations, the next most common answer.

3. [3]

   Security professionals were divided on how well their organizations could establish and maintain baselines for normal AI agent behavior.

4. [4]

   Nearly half said … More → The post Security teams want to spot unusual AI agent behavior while they’re still defining normal appeared first on Help Net Security .

Read the original article →

What happened

Iris Plaza, Iris Ohyama’s online-shopping subsidiary, confirmed unauthorized access involving an external cloud service; data stored there may have been viewed or obtained by unauthorized parties. [1] [2] [3] [4] [5]

The affected cloud service held approximately 7.7 million records: about 5.8 million current or former member records and 1.9 million non-member records. The figure represents stored records, not confirmed stolen data. [5] [6] [7]

Potentially exposed information includes names, addresses, phone numbers, email addresses, gender, dates of birth and passwords; some fields, including passwords, were encrypted, and affected items vary by registration status. [8] [9] [10] [11] [12]

Credit-card information was not stored in the affected cloud service and, according to the company, was not exposed; the company also reported no identified compromise of its stores on other external marketplaces. [12] [13]

After discovering a suspicious file on October 28, 2026, Iris Plaza shut down its online-shopping platform and related systems, investigated, blocked the unauthorized access route, suspended affected systems and engaged external experts. [2] [14] [15]

Why it matters

As of November 5, the company had received no reports of fraudulent use or financial losses linked to the incident, but warned that exposed information could support phishing emails, SMS messages, calls, fake websites or social-media accounts. [16] [17] [18] [19]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Japanese household goods manufacturer Iris Ohyama has disclosed that attackers may have accessed personal information belonging to approximately 7.7 million people through an external cloud service used by its online shopping subsidiary, Iris Plaza.

2. [2]

   The company immediately shut down its online shopping platform and related systems, launched an investigation and confirmed unauthorized access by a third party.

3. [3]

   In its official incident notice , the company confirmed that information stored in the external cloud environment may have been accessed or obtained by unauthorized parties.

4. [4]

   “Subsequent investigations have confirmed the possibility that data stored on an external cloud service may have been leaked.

5. [5]

   The total amount of personal information stored was approximately 7.7 million records, and at this time, we have confirmed the possibility that this data may have been viewed or obtained.

6. [6]

   “ The 7.7 million figure refers to records stored in the affected cloud service, not confirmed stolen data.

7. [7]

   Potentially affected individuals include 5.8 million current and former members and 1.9 million non-members.

8. [8]

   Exposed information may include names, addresses, phone numbers, email addresses, gender, dates of birth and passwords, some of which are encrypted.

9. [9]

   “The following personal information may have been leaked at this time: classification Target items Number of people Member data (including information on members who have withdrawn) Name, address, phone number, email address, gender, password * , date of birth, etc.

10. [10]

    Approximately 5.8 million people Non-member data (including information on individuals who have purchased products without registering as a member or who have participated in campaigns) Name, address, phone number, email address Approximately 1.9 million people Not all of the above information about our customers has been leaked.

11. [11]

    The items affected vary depending on your registration status.” continues the notice.

12. [12]

    “Some items, including passwords, are encrypted.” There is one important distinction: credit card information wasn’t stored in the affected cloud service and, according to the company, wasn’t exposed.

13. [13]

    Iris Plaza also says it hasn’t identified unauthorized access or data leaks involving its stores on other external e-commerce marketplaces.

14. [14]

    Iris Plaza discovered a suspicious file in an external cloud service on October 28, 2026.

15. [15]

    It also blocked the unauthorized access route, suspended the affected systems and brought in external experts to support the investigation.

16. [16]

    As of November 5, it had received no reports of fraudulent use of the information or financial losses linked to the incident.

17. [17]

    Iris Plaza has also warned customers about possible follow-up scams.

18. [18]

    Attackers could use the exposed personal information to create convincing phishing emails, SMS messages or phone calls, impersonating the company or other organizations.

19. [19]

    Fake websites and social media accounts could also appear, attempting to collect login credentials, payment details or other personal information.

Read the original article →

What happened

CISA added four security flaws affecting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. [1]

The listed vulnerabilities include CVE-2026-123218, which has a CVSS score of 9.8 and is described as an incorrect authorization vulnerability. [2]

Why it matters

The source identifies active exploitation as the basis for adding these vulnerabilities to CISA’s KEV catalog. [1]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

2. [2]

   The vulnerabilities are listed below - CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability

Read the original article →

What happened

N-able said it took N-central Hosted Environments offline after the public disclosure of more than 30 vulnerabilities collectively tracked as Able2Shell. [1]

N-able urged customers running on-premises N-central servers to shut them down until further notice. [1]

Known limitations

The supplied evidence does not provide the vulnerabilities’ identifiers, affected versions, exploit prerequisites, or remediation status. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell.

2. [2]

   "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the

Read the original article →

What happened

Google released updates addressing nine security vulnerabilities, including CVE-2026-125350, which was described as a high-severity use-after-free bug in Chrome’s XML component and was actively exploited in the wild. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild.

2. [2]

   The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component.

Read the original article →

What happened

The French government said an IRGC cyber unit carried out an October cyberattack on refrigeration controllers at about 700 French retail sites. [1]

The attackers broke into the controllers on October 11 and changed their defrost settings to high temperatures. [2]

Why it matters

The altered defrost settings caused food losses and, in at least 15 cases, fires. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.

2. [2]

   The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures.

3. [3]

   That caused food losses and, in at least 15 cases, fires.

Read the original article →

What happened

ESET reported discovering a modular Turla toolset, dubbed “Turla’s Cereal,” in November 2025; it chains legitimate functions across Microsoft Exchange, Windows, and .NET assemblies. [1] [2]

The toolset was found on a compromised Exchange server used by Kazakhstan’s government, where it could receive commands, execute in memory, gather organizational intelligence, and collect certain emails. [3] [4]

A version found at a Romanian government agency was configured to target emails sent to or received by the European Union and NATO. [5]

Why it matters

The compromised Exchange server was co-opted to act as command-and-control infrastructure, rather than the toolset relying on external command-and-control infrastructure. [2] [6]

ESET reported that the toolset lacks several common malware-identification features, including implants, beaconing to command-and-control infrastructure, and built-in command lists. [7]

Most executables run in memory using temporary storage, while commands written to permanent memory are delivered through encrypted payloads. [8]

The CerealNeuron backdoor passively listens for incoming web requests on paths resembling ordinary Exchange traffic and does not beacon to its operator. [9] [10]

Known limitations

The supplied article does not provide remediation guidance, indicators of compromise, or details on how broadly the toolset was deployed beyond the reported government cases. [3] [5] [7]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The toolset was first discovered in November 2025 by cybersecurity firm ESET, which named it “Turla’s Cereal” as a play on its highly modular, interconnected and “serialized” design.

2. [2]

   It chains and exploits different legitimate functions across Microsoft Exchange, Windows, and .NET assemblies, which Microsoft has described as “the fundamental units of deployment, version control, reuse, activation scoping, and security permissions for .NET-based applications.” “One of the most interesting aspects of this toolset is what we did not find: external command and control infrastructure,” ESET researcher Matías Porolli wrote in the report , released Tuesday.

3. [3]

   Porolli said the toolset was found on a compromised Exchange server used by the government of Kazakhstan on Nov.

4. [4]

   28, 2025, where it could receive commands, execute in memory, gather intel on the organization and collect certain email messages.

5. [5]

   Another version found inside a Romanian government agency a month later was configured to target emails sent to or received by the Western powers — the European Union and the North Atlantic Treaty Organization — adversarial with Russia.

6. [6]

   “Instead — adding insult to injury — the victim’s compromised Exchange server is co-opted to act as the C&C infrastructure.” Illustration of Turla’s Cereal compromise of Microsoft Exchange servers using a modular, stealthy toolset.

7. [7]

   According to ESET, the toolset lacks many features used to identify malware, such as implants, beaconing back to command-and-control infrastructure or built-in command lists.

8. [8]

   Most executables are performed in-memory using temporary storage to avoid leaving evidence, while commands written to permanent memory are delivered via encrypted payloads.

9. [9]

   One component, dubbed CerealNeuron, operates as the main backdoor but does not beacon back to its operator the way many pieces of malware do.

10. [10]

    Instead, it runs on the compromised server and “passively listens for incoming web requests on paths that look like ordinary Exchange traffic.” The result is an attack that leaves no domain, IP address, hosting provider or timing patterns for defenders to find and block.

Read the original article →

What happened

ESET researchers found and named the malware Cereal after Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania. [1] [2]

The toolset was used to copy selected email directly from the mail flow. [1]

Why it matters

Cereal does not require an attacker-owned server; operators send commands to the victim’s internet-facing Exchange server while disguising the traffic as ordinary Outlook Web Access, Autodiscover, and ActiveSync requests. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Russia-aligned group Turla planted a modular .NET toolset on Microsoft Exchange servers at two government organizations, one in Kazakhstan and one in Romania, and used it to copy selected email straight out of the mail flow.

2. [2]

   ESET researchers found the malware and named it Cereal.

3. [3]

   The toolset doesn’t need an attacker-owned server.

4. [4]

   Operators send commands to the victim’s internet-facing Exchange server, dressed up as ordinary Outlook Web Access, Autodiscover, and ActiveSync traffic.

Read the original article →

What happened

Starting with Windows 11 version 26H2, Windows settings backup will be enabled by default on eligible devices. [1]

The feature launched in August 2025 as Windows Backup for Organizations, was renamed, and now includes management of roaming settings in the same policy tools. [2]

The backup covers supported Windows settings and the list of installed Microsoft Store apps. [3]

When restore is available, users can select a backup profile to recover their settings and supported data; the supplied text is truncated before giving further restore details. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Starting with Windows 11, version 26H2, Windows settings backup will switch on by default on eligible devices.

2. [2]

   The company renamed the feature, which launched in August 2025 as Windows Backup for Organizations, and moved the management of roaming settings into the same policy tools.

3. [3]

   What gets saved The feature backs up supported Windows settings and the list of installed Microsoft Store apps.

4. [4]

   When restore is available, users can select a backup profile to recover their … More → The post Windows settings backup is on by default starting with Windows 11 26H2 appeared first on Help Net Security .

Read the original article →

What happened

Apple said an iMessage flaw could allow a remote attacker to join a group chat and receive its messages, and stated that it released updates to fix the flaw. [1]

The updates also address a separate iMessage flaw that could allow someone added to a group to access messages sent before joining. [2]

Known limitations

The supplied text is truncated while describing other updates released for certain Apple devices, so their applicability and details are unavailable. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it.

2. [2]

   The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined.

3. [3]

   As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple

Read the original article →

What happened

The article reports evidence that spyware attacks are becoming less selective, affecting everyday people rather than only traditionally high-value targets. [1] [2]

iVerify reported Apple Threat Notification cases involving a city bus driver’s children, a stay-at-home mother, and a limousine driver; these people reportedly lacked public profiles, sensitive jobs, or obvious connections to espionage targets. [3] [4] [5] [6]

Rocky Cole said most iVerify detections involved criminal groups stealing credentials and cryptocurrency rather than state-sponsored actors; the report attributed three in four detections that year to such criminal adversaries. [9] [11] [12]

The report said iVerify saw no DarkSword- or Coruna-infected devices among users who received Apple threat notifications, suggesting Apple’s notifications might focus too heavily on nation-state threats and known commercial mercenary spyware. [13]

iVerify reported a 2026 rate of 1.07 spyware infections per 1,000 iOS consumer scans, described as relatively steady. [14]

Why it matters

iVerify said that, in enterprises, employees at risk may resemble ordinary workers more than executives, because mass attacks can target credentials without prioritizing seniority. [7] [8] [9] [10]

Known limitations

The source presents the notification gap as a suggestion about Apple’s focus, not as a definitive finding that Apple fails to detect all DarkSword or Coruna infections. [13]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   There’s mounting evidence of spyware attacks growing more indiscriminate, leading to more everyday citizens being hit as opposed to traditionally “high-value” targets.

2. [2]

   The AdFection spyware attacks , which could infect anyone visiting a website that had advertising on it, represented the most recent revelation.

3. [3]

   And iVerify published a report Tuesday analyzing customer infections and threat notifications from Apple that contributes to the trend.

4. [4]

   “Some Apple Threat Notification cases iVerify saw this year don’t fit that pattern.” “In Ottawa, Apple Threat Notifications reached the children of a city bus driver and a stay-at-home mom,” it continued.

5. [5]

   “In Australia, one went to a limousine driver.

6. [6]

   None of them had a public profile, a sensitive job or an obvious connection to anyone worth spying on.

7. [7]

   These cases matter because they show the threat reaching people who had no reason to expect it.

8. [8]

   For an enterprise, the employees most likely to be hit look much more like the limousine driver than like the CEO.” Part of that is that when spyware attacks are less targeted, they might be more likely to hit those who aren’t as diligently focused on routine cyber hygiene, as opposed to CEOs who are probably regularly upgrading their defenses, iVerify told CyberScoop.

9. [9]

   “The vast majority of our detections were mass attacks by criminal groups looking to do purely criminal things,” Cole said.

10. [10]

    “For the purposes of stealing credentials and selling them on the black market, an executive credential is not necessarily more valuable than a system administrator or even an average employee.” iVerify’s report looked at other trends as well.

11. [11]

    Rocky Cole, co-founder of the company, said the change reflects a shift in who’s using spyware.

12. [12]

    “Three in four of this year’s detections were criminal adversaries stealing credentials and cryptocurrency, not state-sponsored actors,” the report said.

13. [13]

    Among the findings: iVerify didn’t see any devices that were infected by the DarkSword or Coruna iOS exploit kits where users received Apple threat notifications, suggesting that the tech giant might be overly focused on nation-state threats and well-known commercial mercenary spyware like NSO Group’s Pegasus.

14. [14]

    The rate of spyware infections held relatively steady in 2026, at 1.07 infections per 1,000 iOS consumer scans.

Read the original article →

What happened

Anthropic released Claude Fable 5.2 and Claude Mythos 5.2, which share an underlying model; Fable has stricter safeguards for cybersecurity and biology tasks. [1] [2]

Fable’s safety classifiers block high-risk cybersecurity requests, including penetration testing and exploit generation, and block most biology research tasks. [3]

When Fable blocks a request in either category, Anthropic serves a response from Opus 4.8 for cybersecurity or Opus 5 for biology. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Anthropic released Claude Fable 5.2 and Claude Mythos 5.2.

2. [2]

   The two versions share an underlying model, with stricter safeguards for cybersecurity and biology tasks in the broadly available Fable.

3. [3]

   Fable blocks fewer requests Fable’s safety classifiers block high-risk cybersecurity tasks such as penetration testing and exploit generation, as well as most biology research tasks.

4. [4]

   When Fable blocks a request in either category, Anthropic serves a response from Opus 4.8 for cybersecurity or Opus 5 for … More → The post Claude Mythos 5.2 arrives with stronger bug hunting and less sandbox-breaking behavior appeared first on Help Net Security .

Read the original article →

What happened

A newly disclosed OpenSSH and musl flaw, dubbed “sshole,” can allow attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication by submitting an oversized password. [1]

The described oversized password is longer than 256 bytes. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   It’s a bad one , and it’s been in the code for a decade: A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

2. [2]

   “Oversized” means longer than 256 bytes.

Read the original article →

What happened

A GitHub-published iOS sandbox escape reportedly lets an app read other apps’ files on iPhones running iOS 26 and iOS 27. [1]

Apple’s updates for iOS 26 and iOS 27, released the previous day, did not list a fix for the issue. [3]

The research was conducted by a researcher using the name forcequit in collaboration with 0xjohnny. [4]

Why it matters

Binance warned that malicious apps could expose seed phrases, private keys, and login credentials through the issue. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27.

2. [2]

   That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today.

3. [3]

   Apple's updates for iOS 26 and 27, released yesterday, do not list a fix.

4. [4]

   A researcher who goes by forcequit, in collaboration with 0xjohnny,

Read the original article →

What happened

Vanderbilt University reported an active cybersecurity incident affecting university devices, systems, and cloud-based services; access to most systems remained restricted while classes proceeded as scheduled. [1] [2] [3]

Vanderbilt initially instructed students and staff to shut down university devices and disconnect from campus Wi-Fi, and warned them to watch for unexpected prompts, altered files or permissions, unfamiliar applications, and unsolicited authentication requests. [4] [5]

Campus computers reportedly played an audio threat attributed to ransomware group BYOD, with the message claiming that Vanderbilt had been compromised and directing recipients to contact the group. [6] [7] [8] [9]

Why it matters

The disruption included an unavailable Athletics ticketing system that prevented students from claiming tickets for Vanderbilt’s football game against Alabama. [10]

BYOD claimed responsibility and alleged extensive data theft, including student and employee records and more than one million Social Security numbers; Vanderbilt had not confirmed the extent of access or the alleged theft. [11] [12] [13]

Known limitations

Vanderbilt said its Information Technology team was working with government agencies and other partners to manage the incident, while access to most university systems remained restricted. [3] [14] [15]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Classes at Vanderbilt University are proceeding as scheduled today, although access to most university systems remains restricted following a cyberattack claimed by ransomware group BYOD.

2. [2]

   Vanderbilt announced on Monday morning that it was dealing with "an active cybersecurity incident," and that the fallout may affect university devices, systems, and cloud-based services.

3. [3]

   Make the right choice or rot with the wrong one." By Monday evening, Vanderbilt had restored access to campus Wi-Fi, but warned that access to most systems remains restricted.

4. [4]

   The Nashville-based university initially told students and staff to shut down university devices and disconnect from campus Wi-Fi.

5. [5]

   It warned them to watch for unexpected prompts, altered files or permissions, unfamiliar applications, and unsolicited authentication requests.

6. [6]

   Campus computers reportedly began playing an audio threat attributed to BYOD.

7. [7]

   Student newspaper The Vanderbilt Hustler cited posts on campus social network Fizz showing the message.

8. [8]

   "You have been compromised by BYOD," the recording said.

9. [9]

   "We suggest you reach out to us as soon as possible.

10. [10]

    Vanderbilt's Athletics department said that its ticketing system was unavailable, and that students were unable to claim tickets for the college's football game against Alabama on Saturday.

11. [11]

    BYOD claimed responsibility for the attack on Vanderbilt on Monday, along with extensive data theft.

12. [12]

    "If you could not tell already, your databases are locked [and] we have your entire estate and research data," it said via its leak site.

13. [13]

    "Over 1 million SSNs, full names, email addresses, phone numbers, student and employee records, full takeover of your DC, whatever was on your network, we possess." Vanderbilt has not confirmed BYOD's claims about the extent of its access or the data allegedly stolen.

14. [14]

    "We know this has disrupted important work and caused frustration across the university," it said.

15. [15]

    "Vanderbilt Information Technology is working with government agencies and other partners to manage this situation." Students were told to attend classes as scheduled on Tuesday and contact instructors about flexibility on coursework deadlines.

Read the original article →

What happened

CISA updated its online incident-reporting form so analysts can better identify when attacks against different organizations may belong to the same campaign. [1]

The revised questionnaire asks more specific questions and removes duplicate questions. [2]

The form asks whether an incident involved malware, attempts to trick people, hacking techniques, or an insider threat. [3]

The form also uses terminology from MITRE ATT&CK, a catalog of attacker techniques. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity and Infrastructure Security Agency (CISA) has updated its online incident reporting form to help analysts spot when attacks on different organizations may be part of the same campaign.

2. [2]

   The revised questionnaire asks more specific questions and removes duplicate ones.

3. [3]

   The form asks whether an incident involved malware, attempts to trick people, hacking techniques, or an insider threat.

4. [4]

   It also uses terms from MITRE ATT&CK, a catalog of attacker techniques.

Read the original article →

What happened

Dreeze announced general availability of its Application Revival platform for Amazon Web Services and said it raised $33 million in seed funding. [1]

The platform is described as recovering complete cloud applications by restoring data, infrastructure, and dependencies in the required order. [2]

Norwest and Bessemer Venture Partners led the funding round, with participation from Claltech. [4]

Why it matters

The source states that a successful backup may still leave a business offline, because cloud application recovery involves more than backup data alone. [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Dreeze emerged from stealth with $33 million in seed funding and announced the general availability of its Application Revival platform for Amazon Web Services (AWS).

2. [2]

   The platform helps enterprises recover complete cloud applications by restoring data, infrastructure, and dependencies in the order they need to come back online.

3. [3]

   A successful backup can still leave a business offline.

4. [4]

   Norwest and Bessemer Venture Partners led the round, with participation from Claltech.

Read the original article →

What happened

Fireworks AI disclosed an October cyberattack and broader customer-data exposure involving billing records, datasets, and some incomplete model weights. [1]

A third-party cloud provider hosting Fireworks’ research-and-development machines was compromised on October 23; attackers used that access the next day to reach development systems and run an unauthorized workload. [2] [3]

Why it matters

Affected resource metadata included identifiers, display names, descriptions, and creation times; billing data included billing and shipping addresses, invoice and payment histories, account balances, and credit usage. [4]

Payment card numbers were not stored and were therefore unaffected, while certain customers had a subset of incomplete model weights and datasets accessed. [5]

Fireworks suspects financially motivated criminals associated with LLMJacking, described as selling unauthorized access to AI models through illicit gateways. [6]

Known limitations

Fireworks co-founder and CEO Lin Qiao said attackers did not appear to be seeking model weights and that most downloads were partial and stopped. [5] [7]

The supplied evidence truncates a Notion notification and does not establish which chats or workspace data were ultimately exposed. [8] [9]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Fireworks AI has disclosed another cyberattack in October and a wider customer data exposure involving billing records, datasets, and incomplete model weights.

2. [2]

   The company, which lets customers train and run AI models, said a third-party cloud provider hosting its research and development machines was compromised on October 23.

3. [3]

   Attackers used that access the following day to reach Fireworks development systems and run an unauthorized workload.

4. [4]

   Fireworks grouped the affected data into three categories: Resource metadata: Resource identifiers, display names, descriptions, creation times, and more Billing information: Billing and shipping addresses, invoice and payment histories, account balances, and credit usages.

5. [5]

   Payment card numbers are not saved and therefore unaffected Model weights and datasets: For certain customers, a subset of incomplete model weights and datasets were accessed, Fireworks said Lin Qiao, Fireworks co-founder and CEO, said the apparent motive was not stealing model weights in response to concerns raised by Cantina Security CEO Hari Mulackal.

6. [6]

   Fireworks suspects links to financially motivated criminals involved in LLMJacking – selling unauthorized access to AI models through illicit gateways.

7. [7]

   "From what we see attackers are not after weights," said Qiao.

8. [8]

   "Most downloads were partial and stopped." Render founder and CEO Anurag Goel shared a notification from Notion warning that some chats with its AI assistant may have been exposed through the Fireworks incident.

9. [9]

   "Following an investigation by the Notion security team, we have determined that your workspace, Render, was among the

Read the original article →

What happened

President Donald Trump nominated Palantir security chief Michael LoSapio to lead CISA, the US civilian cyber defense agency. [1]

LoSapio has served as Palantir’s CISO since September 2024 and previously led its infrastructure and network security team. [2]

Why it matters

If confirmed, LoSapio would move from securing Palantir’s systems to leading CISA, which protects federal civilian networks and works with critical-infrastructure operators including power, water, and telecommunications providers. [3] [4]

CISA has reportedly lost more than 1,000 staff—about one-third of its workforce—since Trump returned to the White House; around 250 recruits were still awaiting security clearance in September. [5] [6]

CISA’s recent strategy prioritizes infrastructure whose failure would cause the most damage, raising questions about what receives less attention while staffing is reduced. [7] [8]

Palantir’s government work, including with immigration authorities, has drawn criticism from civil-liberties groups and Democratic lawmakers over surveillance and sensitive personal information. [9] [10]

Known limitations

It is unclear whether LoSapio would leave Palantir or what would happen to his financial interests in the company if confirmed. [11]

The nomination arrived late in the congressional calendar; if the Senate does not confirm LoSapio before Congress ends, Trump would have to nominate him again for consideration by the incoming Democratic-controlled Senate. [12] [13]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   President Donald Trump has nominated Palantir security chief Michael LoSapio to lead CISA, putting an executive from the controversial government supplier in line to run America's civilian cyber defense agency.

2. [2]

   LoSapio has served as Palantir's CISO since September 2024, having previously led the company's infrastructure and network security team.

3. [3]

   If confirmed, LoSapio would move from securing Palantir's systems to leading the federal government's main civilian cyber defense agency.

4. [4]

   CISA protects federal civilian networks and works with critical infrastructure operators, including power, water, and telecommunications providers.

5. [5]

   CISA has shed more than 1,000 staff, roughly a third of its workforce, since Trump returned to the White House, according to reports.

6. [6]

   It's now trying to plug the gaps, although acting director Nick Andersen said in September that around 250 would-be recruits were still waiting for security clearance before they could get to work.

7. [7]

   With fewer people to go around, CISA is also rethinking where to spend its time.

8. [8]

   A strategy published last month emphasizes infrastructure whose failure would do the most damage, raising questions about what gets less attention as the agency operates with fewer staff.

9. [9]

   Palantir, co-founded by billionaire Peter Thiel, has become a major supplier of technology to US government agencies, including the Department of Homeland Security and Immigration and Customs Enforcement (ICE).

10. [10]

    Its work with immigration authorities has attracted criticism from civil liberties groups and Democratic lawmakers concerned about surveillance and the handling of sensitive personal information.

11. [11]

    It's unclear whether LoSapio plans to leave Palantir or what would happen to any financial interests he holds in the company if confirmed.

12. [12]

    The nomination arrives late in the congressional calendar.

13. [13]

    If the Senate does not confirm LoSapio before the current Congress ends, Trump would have to nominate him again for consideration by the incoming Democratic-controlled Senate.

Read the original article →

What happened

Firefox’s latest fingerprinting protections reduce the browser and device details extractable by tracking scripts, making more Firefox users appear alike and strengthening privacy during browsing. [1] [2]

Browser fingerprinting combines details such as available fonts, screen dimensions, and graphics hardware to identify users across websites without cookies. [3] [4] [5]

Mozilla evaluated simulated measurements from Fingerprint Pro, Signifyd, and Akamai using data from nearly 25 million Firefox users, with additional safeguards including OHTTP routing and deletion of individual telemetry records. [6] [7] [8] [9] [10]

The evaluated protections, including the most recent shipment in Firefox 145, reduced unique fingerprints and increased the sizes of groups sharing a fingerprint. [11]

Why it matters

Firefox limits some screen-resolution information, coarsens reported processor counts, and improves consistency for image rendering, Web Audio, and mathematical operations on Android to reduce distinguishing details. [12] [13] [14] [15]

Known limitations

Mozilla states that the protections do not make fingerprinting impossible because trackers can adapt; randomization benefits were outside the reported measurements and are harder to quantify. [16] [17]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Firefox is strengthening protection against trackers that recognize you across websites, even when they don’t use cookies.

2. [2]

   The latest fingerprinting protections shipped in Firefox reduce the extractable distinguishing details, making more Firefox users look alike to tracking scripts and strengthening individuals’ privacy in everyday browsing.

3. [3]

   These protections build on our research into browser and device fingerprinting, a technique that combines details about your browser and device to identify you across websites.

4. [4]

   Cookie-less Tracking Browser fingerprinting combines details about your browser and device, such as available fonts, screen dimensions, and graphics hardware, to build a uniquely recognizable profile.

5. [5]

   Each piece may seem ordinary, but together, they can enable trackers to single you out across websites, even without storing a cookie.

6. [6]

   To evaluate these techniques, we simulated the browser measurements collected by fingerprinting scripts from Fingerprint Pro, Signifyd, and Akamai and examined how their combinations distinguish users.

7. [7]

   The study used measurements collected from nearly 25 million Firefox users, with additional privacy safeguards beyond Mozilla’s existing data collection policies .

8. [8]

   Those safeguards included OHTTP , which routed encrypted requests through a relay.

9. [9]

   The relay sees the user’s IP address but not the request contents, while Mozilla receives the contents without the user’s IP address.

10. [10]

    We also tightly limited data access and retention: individual telemetry records were deleted several months ago and only aggregate results were retained and published for open science.

11. [11]

    In our evaluation, these protections (the most recent of which shipped in Firefox 145 ) substantially degraded the precision of fingerprinting in Firefox both by reducing the number of users with unique fingerprints and increasing the size of the groups of users that share a fingerprint.

12. [12]

    For example, Firefox limits the information exposed through screen resolution APIs to hide the size and position of the system taskbar or dock, preventing that desktop layout detail from contributing to a fingerprint.

13. [13]

    As another example, it can report processor counts as either 4 or 8 instead of exposing the exact count, which can make a browser more distinctive.

14. [14]

    The research also enabled us to identify why certain measurements differed between users.

15. [15]

    Addressing these differences produced more consistent outputs for image rendering , Web Audio , and mathematical operations on Android , reducing the distinguishing details available to fingerprinters.

16. [16]

    Firefox also uses randomization to make other fingerprinting signals less useful to trackers, though the benefits of these techniques are harder to quantify and fall outside the measurements reported here.

17. [17]

    These do not make fingerprinting impossible as trackers can surely adapt.

Read the original article →