Code Defender

Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.

The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.

The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.

In a report published earlier

Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian.

Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM.

The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.

The spike, according to GitGuardian, was observed on October 8 and 9, 2026.

“This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories’ CI,” security researchers Gaetan

The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers’ registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls.

To that end, the Department of Telecommunications has issued a circular urging service

The Ukrainian military can again use SpaceX’s Starshield satellite service on the move, a Defense Ministry source told Recorded Future News on Thursday, days after sudden restrictions disrupted drone missions along the front line.

The AI-enabled operation used spoofed emails, fake government documents, and the creation of a local organization to target schools in Peru and Ecuador, among other efforts.

A bug in Claude Code Desktop’s preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens.

A sprawling cybercrime marketplace supplied cloud infrastructure and phishing kits that helped fuel more than 1 billion phishing messages worldwide.

CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.