#security op 2026-10-14

1. 03:40 <Cassandra> The Hacker News | OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room info@thehackernews.com (The Hacker News) · 1h ago · 5 min read An OpenAI engineering lead was arrested over an allegedly planted audio recorder in an executive conference room. Read full story
2. 05:09 <Cassandra> The Hacker News | Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug info@thehackernews.com (The Hacker News) · 35m ago · 6 min read Microsoft patched a record 1,413 flaws, including an exploited Windows Shell bug that can bypass Mark of the Web defenses. Read full story
3. 06:23 <Sentinel> SecurityWeek | SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities Ionut Arghire · 11m ago · 4 min read SAP has patched critical flaws in Cloud SDK for Python, NetWeaver, S/4HANA, and Manufacturing Integration and Intelligence. Read full story
4. 06:38 <Cassandra> The Hacker News | Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave info@thehackernews.com (The Hacker News) · 46m ago · 6 min read A Windows 11 SmartScreen flaw allowed researchers with local access to run code inside a VBS enclave; Microsoft patched it in September. Read full story
5. 07:54 <Sentinel> SecurityWeek | Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day Eduard Kovacs · 38m ago · 5 min read The most important is CVE-2026-96951, a security feature bypass flaw in Windows that has been exploited in the wild. Read full story
6. 07:54 <Sentinel> SecurityWeek | Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their Products Ionut Arghire · 27m ago · 4 min read Citrix, Fortinet, and Ivanti have patched 29 bugs, including critical authentication bypass, code execution, and information leak flaws. Read full story
7. 07:54 <Sentinel> SecurityWeek | Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise Ionut Arghire · 15m ago · 4 min read Fresh Chrome and Firefox updates resolve 114 vulnerabilities as Mozilla introduces security-focused Firefox Enterprise. Read full story
8. 09:39 <Cassandra> The Hacker News | AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host info@thehackernews.com (The Hacker News) · 1h ago · 6 min read Linux's Vghost flaw lets users with vhost device access gain root and, in specific VM setups, lets guests hijack host QEMU. Read full story
9. 11:14 <Cassandra> BleepingComputer | Microsoft: Recent Windows updates may trigger Remote Desktop failures Sergiu Gatlan · 26m ago · 2 min read Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. Read full story
10. 11:29 <Sentinel> SecurityWeek | US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms Ionut Arghire · 34m ago · 6 min read Investigators in the US arrested two individuals and seized 187 laptops in a crackdown on North Korean IT worker laptop farms. Read full story
11. 11:39 <Cassandra> The Hacker News | An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part. info@thehackernews.com (The Hacker News) · 39m ago · 6 min read Reflectiz's AI agent bypassed an insurer's live login by directing a one-time code to its own inbox during an authorized assessment. Read full story
12. 11:40 <Cassandra> The Hacker News | Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks info@thehackernews.com (The Hacker News) · 31m ago · 6 min read Hirudo targets eight Indonesian banking apps with patched replacements that can bypass signature, accessibility, and integrity checks. Read full story
13. 11:40 <Cassandra> The Hacker News | Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days info@thehackernews.com (The Hacker News) · 20m ago · 5 min read XBOW built an AI-assisted, three-bug Chrome exploit chain in six days that enabled Windows code execution; Google has fixed all three bugs. Read full story
14. 11:45 <Cassandra> BleepingComputer | Hirudo Android malware replaces banking apps to evade security checks Bill Toulas · 4m ago · 4 min read A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. Read full story
15. 13:01 <Sentinel> SecurityWeek | Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages Eduard Kovacs · 1m ago · 6 min read Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man, a widely used Chinese phishing market. Read full story
16. 13:10 <Cassandra> The Hacker News | How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team info@thehackernews.com (The Hacker News) · 1h ago · 12 min read Deepfake readiness drills test callback, dual-approval, and escalation controls against spoofed payment and access requests. Read full story
17. 13:10 <Cassandra> The Hacker News | curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution info@thehackernews.com (The Hacker News) · 57m ago · 7 min read curl 8.23.0 fixes an HTTP/2 upload use-after-free that a malicious server can trigger; code execution was demonstrated under strict conditions. Read full story
18. 13:10 <Cassandra> The Hacker News | CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts info@thehackernews.com (The Hacker News) · 40m ago · 4 min read CISA says attackers are exploiting an Ivanti Connect Secure authentication bypass to execute commands, steal credentials, and exfiltrate data. Read full story
19. 13:18 <Cassandra> BleepingComputer | CISA warns admins to immediately fix Ivanti flaw exploited as zero-day Sergiu Gatlan · 4h ago The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...] Read full story
20. 13:18 <Cassandra> BleepingComputer | Global takedown hits network behind 1 billion phishing messages Bill Toulas · 4h ago A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...] Read full story
21. 13:58 <Sentinel> SecurityWeek | Virtual Event Today: Zero Trust Strategies Summit SecurityWeek News · 2m ago · 3 min read SecurtyWeek's 2026 Zero Trust Strategies Summit takes place October 14th as a fully immersive virtual conference and expo. Read full story
22. 14:18 <Cassandra> BleepingComputer | The Blind Spots of Agentic Pentesting and How to Close Them Picus Security · 18m ago · 6 min read AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. Read full story
23. 14:29 <Sentinel> SecurityWeek | Harmonic Security Raises $50 Million for Workforce AI Protection Ionut Arghire · 19m ago · 4 min read AI security startup Harmonic Security has raised $50 million in Series B funding to expand its engineering and go-to-market teams. Read full story
24. 14:49 <Cassandra> BleepingComputer | Microsoft fixes VPN issues caused by September Windows updates Sergiu Gatlan · 22m ago · 2 min read Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. Read full story
25. 14:54 <Cassandra> Krebs on Security | U.K. Sanctions Cryptomus for RU Money Laundering BrianKrebs · 32m ago · 3 min read The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial restrictions. Read full story
26. 15:29 <Sentinel> SecurityWeek | ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw Eduard Kovacs · 14m ago · 5 min read Industrial giants Siemens, Schneider Electric, and Rockwell Automation have published ICS security advisories this Patch Tuesday. Read full story
27. 17:13 <Sentinel> SecurityWeek | AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds Kevin Townsend · 1h ago · 6 min read Test conducted by Booz Allen demonstrate that frontier super intelligence navigated unfamiliar industrial systems, adapted when blocked, and moved physical equipment within minutes. Read full story
28. 17:14 <Cassandra> The Hacker News | U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud info@thehackernews.com (The Hacker News) · 40m ago · 8 min read The DoJ charged 14 people and seized about 187 computers in a North Korean IT worker scheme affecting more than 70 U.S. companies. Read full story
29. 17:42 <Cassandra> BleepingComputer | Cisco patches new Secure Email Gateway zero-day exploited in attacks Sergiu Gatlan · 13m ago · 3 min read Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. Read full story
30. 18:33 <Cassandra> BleepingComputer | Ledger asks sellers across Asia to halt sales after supply-chain attack Bill Toulas · 46m ago · 3 min read Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. Read full story
31. 19:32 <Cassandra> The Hacker News | Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages info@thehackernews.com (The Hacker News) · 2h ago · 6 min read Microsoft and partners disrupted CoGUI, Haozi, and Iron Man, phishing kits linked to more than 1 billion messages since January 2026. Read full story
32. 19:32 <Cassandra> The Hacker News | Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App info@thehackernews.com (The Hacker News) · 1h ago · 8 min read Attackers planted web shells through Collabora's Built-in CODE app while its document server was down; versions before 26.4.303 are affected. Read full story
33. 19:32 <Cassandra> The Hacker News | Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability info@thehackernews.com (The Hacker News) · 54m ago · 7 min read Attackers exploit a Cisco Secure Email Gateway flaw enabling file writes without login when File Reputation is enabled and scanner tools are outdated. Read full story
34. 20:02 <Cassandra> BleepingComputer | FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested Bill Toulas · 21m ago · 3 min read The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. Read full story
35. 23:21 <Cassandra> BleepingComputer | Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks Lawrence Abrams · 24m ago · 3 min read Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. Read full story

Alle dagen · Deelnemen aan #security