Cybersecurity News and Updates

Abdulrahman Alfozan, 35, a Saudi national working as an engineer for OpenAI, was charged Tuesday with secretly bugging an executive conference room at one of the company’s buildings in San Francisco.

A flaw in Linux’s vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host’s memory and hijack the program that runs the virtual machine.

The bug is tracked as CVE-2026-74580 and named Vghost. Tencent Zhuque Lab, which found the

The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part.

TL;DR

During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer’s production website, on its own.
One login request let the user choose where the one-time passcode went.
The attack was the easy part. Proving it

Anthropic’s latest study combined IoT and network tests to explore AI self-replication, which researchers said would be “challenging” to shut down.

The Democratic People’s Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks.

The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs.

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to “act immediately.” A fix for the third is still pending, according to Volexity.

Volexity, which reported the flaws to Ivanti,

A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it.

The flaw was in the feature that converts a personal account into an organization, Docker said in a security advisory on October 12.

Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens and off-brand Android TV boxes, according to a warning from Anthropic.

The frontier AI lab said small AI models could form autonomous, self-propagating worm botnets that are “challenging to shut down,” since “there’s no centralized point to shut off.”

More than two dozen people were arrested by police in Ghana and Nigeria as part of a U.K.-hosted operation that also included tech companies.