PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.
Cyber Risks 894
Reporting on cyber threats: ransomware, phishing, breaches, malware and the actors behind them, curated from security news, research and vendor blogs.
CISA Kicks Off Critical Infrastructure Security and Resilience Month 2026
When confusion reigns, trusted vendors must guide their SMB customers
SMBs need guided onboarding and supervised protection to optimize their investments
Cyber Strike AI in the wild: the use of AI in real-world attacks on organizations
We analyze a series of attacks on educational institutions that were fully automated during the post-exploitation phase using the CyberStrikeAI penetration testing framework.
ZDI-26-848: Microsoft Qlib Static Data Loader Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI...
ZDI-26-849: Microsoft Qlib Restricted Unpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI...
ZDI-26-850: Microsoft Qlib MLflow Recorder Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI...
FBI confirms North Korea behind Binance hack
The FBI links the Binance hack to North Korea, game developers are being extorted with game-cloning threats, the Belarusian CyberPartisans hack Russia’s statistics service and Apple sends new mercenary spyware notifications. Show notes Risky Bulletin: Game...
Proofpoint CEO Sumit Dhawan Speaks to $6.3 Billion Varonis Systems Acquisition
Sponsored: Sublime Security on the rise of ISC calendar phishing
In this Risky Business News sponsor interview, Catalin Cimpanu talks with Luke Wescott, Threat Detection Engineer at Sublime Security. Luke talks through the rise of calendar-based phishing campaigns over the past year and the reasons behind it. Show notes...
Weekly Update 528: Reading AI-generated Code & the Economics of Solar
By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO.
Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer
The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.
Investors Dish on New Startups & What They'd Back Next
The cybersecurity market is difficult to predict, but a glimpse into the annual DataTribe Challenge shows what's trending and what's not.
4 real? Tracking exploitation and patching of eMudhra’s weak keys
Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates. Here’s how we quickly patched Cloudflare, what evidence we can see of attempted exploitation, and how much of the rest of the...
This month in security with Tony Anscombe – October 2026 edition
The PHP2Shell disclosure and other major cybersecurity news this month brought into relief the need for well-thought-out cyber-readiness plans
Building Cybersecurity Careers through Certification and Continuous Learning
Explore how Fortinet training and certification help people enter cybersecurity, build practical skills, and advance throughout their careers.
What AI Cybercrime Exercises Reveal About Collective Defense
Fortinet's Derek Manky shares lessons from three CLTC tabletop exercises on AI-enabled cybercrime and what they reveal about decision-making in collective defense and previews the next step in the collaboration.
Cloudflare services for private origins is now generally available
Public traffic to private origins, with WAF, bot management, caching, and Workers, is now available to every customer with Cloudflare One connectivity.
ARTEX and Friends: Enter Agentic Offensive Frameworks
Written by: Aurora Blum, David Mainor, Rohit Nambiar, Omar ElAhdan, Matthew McWhirt, Will Silverstone, Bhavesh Dhake, Chris Busse Introduction Recent intrusions in which threat actors have been observed weaponizing agentic frameworks to execute...
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-118527 Ivanti...
Hackers leak personnel data of 41,000+ Homeland Security staff, including ICE and border agents
The US Department of Homeland Security has had the details of more than 41,000 staff, including ICE and CBP agents, published online. Not ideal for an organisation with "Security" in its name. Read more in my article on the Hot for Security blog.
Filter generation in practice: from algorithms to LLMs
We automate filter generation for security alerts using an algorithm, a large language model, and a group of LLM agents.
Billions stolen in Binance hack
Billions stolen from Binance in a crypto hack, Last week’s PHP2Shell bugs are being exploited to hack Palo Alto Networks firewalls, The Brotli bugs also get a run, Belarusian state hackers carry out a wiper attack, and a hacker leaks the data of 41,000 DHS...
Malicious Claude Code extension distributed through Cursor marketplace
Categories: Threat Research Tags: advisory, Cursor
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems. The post Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)...
A quiet week in infosec <.<
In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node.js has joined in, but underneath it all, there are still good people doing good work.
BYOD cyberattack diverts ambulances and cancels classes at University of New Mexico health center
Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico's Health Sciences Center (HSC) this week. Read more in my article on the Fortra blog.
Cohere’s Qwen Story: Looks More Like Model Jaggedness
Key findings On October 26, Cohere reported a puzzling incident involving Qwen3.8-Flash-Next, an open-weight model from Alibaba. The task was straightforward: write a detection rule for suspicious curl downloads followed by bash execution. Instead, the...
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted industries.
Cloudflare DDoS Threat Report 2026 Q3: More swarms, fewer giants
Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. Explore the latest threat data, including the collapse of CLDAP vectors and the impact of recent botnet takedowns.