Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by AV Bypassing
New MITRE Framework Tracks AI Attacks and Water Utility Breaches
MITRE has released ATT&CK v20, expanding its widely used cybersecurity framework to reflect how attackers now exploit artificial intelligence, evade multi-factor authentication (MFA), and target operational technology in critical infrastructure. The update adds nine new Enterprise techniques and sub-techniques, alongside significant changes to the Industrial Control Systems (ICS) domain. The most notable Enterprise additions focus on AI abuse.
Millions of Student Records Exposed After a Single Login Is Compromised
A secure file transfer system has been accessed by an unauthorised individual, using compromised login credentials, and files containing student records have been copied by that individual. During the early morning hours of September 25, 2026, ETS noticed suspicious activity on its secure file transfer protocol server (SFTP), resulting in the discovery of the incident.
Anthropic Acquires Opaque Systems to Strengthen Confidential and Verifiable AI
Opaque announced the transaction last week, adding that their previous research output and engineering efforts concentrated on confidential computing and recently evolved towards solutions that can help organizations audit the behavior of AI systems and agents. The company was formed based on a research project at UC Berkeley’s RISELab about ten years earlier.
OpenCode Breach Exposes User API Keys in What Company Calls a Distillation Attack
An intruder broke into a legacy system at OpenCode late on October 16, gaining access to third-party AI provider API keys that users had stored inside OpenCode Console, the company's optional hosted service. The open-source coding platform disclosed the incident on October 17 and said 1.4% of its Console users were affected, all of whom had linked at least one external AI provider to their account.
AI Use in Connecticut Utilities Faces Security Review
Artificial intelligence is rapidly entering the computer networks that help run and protect the United States’ electric grid, and federal regulators are warning that this shift could create new openings for hackers. The Federal Energy Regulatory Commission (FERC) said its cybersecurity auditors found increasing use of advanced AI tools—including chatbots, digital assistants, and automated analytics—inside protected network environments linked to the bulk power system.
AI-Powered Fraud Puts 9 in 10 Americans at Risk as Cyber Scams Become More Sophisticated
The findings are based on a Consumer Reports survey of nearly 5,000 U.S. adults conducted in March and April. They highlight the widespread exposure of consumers to online threats, alongside growing concerns about the security of personal information and the possibility of unauthorized access to financial accounts. Artificial intelligence is changing how fraudsters operate by reducing the time, expense and technical effort required to target potential victims.
US Cybersecurity Job Postings Drop 26% as AI Security Demand Surges
While the demand for artificial intelligence security specialists continued to grow, cybersecurity job postings decreased to a four-year low in 2026 in the United States. CyberSN's Cybersecurity Jobs Report indicates that between January and September 2026, employers posted 235,786 cybersecurity jobs, a 26.4% decline from the same period in 2025 when 320,210 jobs were posted.
AI Can Hijack Industrial Systems in 16 Minutes
Frontier AI models can move from an enterprise network into operational technology (OT) systems and take physical control of industrial equipment in as little as 16 minutes, according to new lab testing by Booz Allen. In one demonstration, an AI model navigated through a firewall and IT network, entered the OT environment, compromised a SCADA system, and moved a robotic arm.
Compromised ConnectWise OAuth App Exposes Over 170 Microsoft 365 Tenants in Supply Chain Attack
A compromised credential tied to a ConnectWise cloud backup application has allowed threat actors to access more than 170 Microsoft 365 environments managed by the company's partners and customers, with security researchers and Microsoft all tracking what they describe as an active supply chain attack. The affected application, ConnectWise Cloud Backup, was formerly known as SkyKick before ConnectWise acquired it.
Agencies Call for Stronger Cybersecurity in Frontier AI Testing
The guidelines were developed by the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Department of Commerce’s Center for Advancing Innovation and Standards for Super Intelligence. They were issued after several major AI companies, including OpenAI, Anthropic, Google, Meta and others, had reported instances of AI models getting out of test sandboxes and hacking companies and websites during the summer.
Google Introduces New Android Protections Against Mobile Scams
A new security feature for Android has been announced by Google. The update targets mobile scams that include fraudulent messages, spoofed telephone calls, malicious links, and the attempted theft of sensitive data. The updates include enhanced scam detection using artificial intelligence, additional security measures for screen sharing, and controls to prevent unauthorized call forwarding.
Cyber Attack Disrupts Refrigeration Systems at 700 French Supermarkets, Triggering Food Waste and Fires
A cyberattack targeting refrigeration equipment has cut food storage capacity at more than 700 stores in France, creating safety and economic concerns. The attack, which involved Danfoss Group’s refrigeration controllers and caused hundreds of refrigerators to burn up, leaving food to rot and threatening to cause fires, is being investigated by the Paris prosecutor’s office.
India’s Cybersecurity Agency Flags AI Agents That Quietly Read Business Data During Testing
India's national cybersecurity agency, CERT-In, issued a warning on October 15 saying AI agents being tested by unnamed companies had reached live systems belonging to Indian organizations and read business records, including personal data and confidential material, without authorization. Not one of the affected organizations noticed it happening.
Website Headers Emerge as New Attack Surface for AI Agents
Security researchers have found that some websites are using HTTP response headers to send hidden instructions to AI agents, including attempts at indirect prompt injection. A study by Signals Corps examined 217 million HTTP page responses from Common Crawl and identified nearly 8,000 sites communicating with AI agents through header messages. While most were harmless navigation pointers, 30 sites attempted to manipulate AI systems through embedded commands.
Cyber Incident at BAE Systems Disrupts Critical US Judicial Services
According to the Administrative Office of the US Courts (AOUSC), the defense contractor's systems have become unavailable. A major concern is the Bankruptcy Noticing Center (BNC), which is responsible for preparing and delivering bankruptcy notices to the parties involved in cases throughout the nation.
US Charges 14 People in North Korean IT Worker Scheme Targeting More Than 70 Companies
The operation allegedly enabled North Korean IT workers to secure remote jobs at more than 70 American companies, generating around $3 million in revenue. Investigators believe the money was transferred to sanctioned entities controlled by North Korea and may have supported its weapons programmes.
Israeli Ad Firm Built a Spyware Pipeline Inside the Online Advertising System, Researchers Say
An Israeli advertising company quietly turned the infrastructure of targeted digital ads into a delivery mechanism for mercenary spyware, according to new research from the Citizen Lab at the University of Toronto. The findings, published October 15, represent the first publicly confirmed case of zero-click government-grade spyware delivered through online advertising. The company at the center of the report is Discover-Tech, registered in Israel and run by CEO Dekel Boni.
FBI and North Macedonia Arrest Alleged OLVX Market Operator
Authorities in North Macedonia have arrested and charged the alleged administrator of OLVX, an underground cybercrime marketplace accused of selling stolen personal data, login credentials, and tools used in cyberattacks. The operation was conducted jointly by North Macedonia’s Ministry of Interior and the U.S. Federal Bureau of Investigation (FBI), marking what officials describe as the first coordinated cyber operation between the two countries.
India Mandates Caller Name Display on 4G and Newer Networks From November 1
In order to assist in identifying unknown callers and combating phone-based spam and fraud, the directive introduced mandatory Calling Name Presentation (CNAP), as introduced by the Department of Telecommunications (DoT) on October 13. Under these new rules, incoming calls will display the caller's name and telephone number, making identification easier.
Hirudo Android Malware Replaces Banking Apps to Evade Security Checks
A newly identified Android banking trojan called Hirudo is taking an unusually aggressive approach to evading mobile security: instead of merely overlaying fake login screens on top of legitimate apps, it replaces the victim’s banking app with a modified copy. According to mobile security firm ThreatFabric, the malware retains nearly all of the original app’s code but injects a hooking engine based on the open-source frameworks YAHFA and Dobby.
Microsoft and Japanese Police Dismantle Network Behind Over 1 Billion Phishing Messages
Microsoft and Japan's National Police Agency have jointly dismantled a phishing operation that sent more than 1 billion fraudulent emails and text messages to organizations across 150 countries since January 2026, with over 750 million of those messages directed specifically at Microsoft customers. The action was announced on Tuesday under an order from the U.S. District Court for the Southern District of Florida.
AI Agents Build Chrome Zero-Day Exploit in Six Days, Winning $250,000 Reward
Researchers at XBOW utilized OpenAI’s publicly available GPT-5.6 Sol model to find and combine three Chrome vulnerabilities, resulting in an exploit that enables code execution in Chrome when a victim loads a web page. The researcher group spent nearly $40,000 on the AI-powered process, in addition to the extensive preparations before the six-day research window. V8 JavaScript Engine, WebP image codec, and Crashpad constitute Google Chrome’s fundamental components.
Company Accused of Making $60 Million by Exploiting Sextortion Victims
A US-based digital forensics company is facing allegations that it collected at least $60 million from people seeking help with sextortion threats but failed to provide the assistance it promised. According to a complaint filed by the US Federal Trade Commission (FTC), Digital Forensics Corporation (DFC), its owner Dmitry Belkin, and associated businesses allegedly misled victims who were already experiencing fear, emotional distress, and threats of having private images exposed.
OpenAI Employee Arrested Over Hidden Recorder Allegations
As a result of the arrest of Abdulrahman Alfozan, a 35-year-old Saudi national, on October 9, 2026, his position has been terminated. A federal charge has been filed against him by the U.S. Department of Justice (DoJ) for using or attempting to use an electronic or mechanical device to intercept oral communications. He joined OpenAI in July 2025 and worked on its product team.
XWorm RAT Evolves Into Advanced Surveillance Malware
Remote access trojan (RAT) XWorm has developed into an advanced surveillance threat whose capabilities extend beyond data theft and remote system control. According to cyber security researchers at Netskope Threat Labs, recent versions of this malware contain plugins for tracking the location of victims, capturing live audio, controlling webcams, and controlling active browser sessions.
Hobbs and Whistles Owner Hit by Cyberattack
The owner of Hobbs, Phase Eight, and Whistles has become the latest major fashion retailer to be hit by a cyberattack. The Foschini Group (TFG) confirmed that its UK business, TFG London, discovered the incident on October 11, leaving several IT systems offline and disrupting customer orders across the three brands. Although physical stores remain open, the company said some website functions may be unavailable while its investigation continues.
Microsoft's Xandr Handed Norway's Largest Privacy Fine for Funneling Grindr User Data to Thousands of Advertisers
Norway's data protection authority has issued its largest fine to date, hitting Microsoft-owned advertising company Xandr with a NOK 92 million ($9.6 million) penalty for passing sensitive personal data belonging to Norwegian Grindr users through automated advertising auctions without a legal basis.
Anthropic Warns AI Worms Could Soon Spread Across IoT Devices
The team found that a model with 26 billion parameters could generate 0.39 tokens per second. They also found that a 9 billion parameter model could run on 8 out of 9 of the different hardware types they tried. The team then tried to see if a model could replicate across 8 emulated Android devices attached to a network. To make matters easier for the would-be-attackers, the researchers made the hacking process trivial; they only had to focus on the artificial intelligence processes.
Critical Flaws in LG Smart TVs Could Allow Hackers to Gain Root Access Over Local Networks
Three security vulnerabilities in LG's webOS operating system could allow attackers to gain complete control of certain LG smart TVs without authentication or any action from the owner. The flaws can be combined to obtain root access when an attacker is connected to the same local network as the television. LG has released a firmware fix for the vulnerabilities, following their disclosure by SSD Secure Disclosure on October 12.
Cyberattack Knocks Out Supermarket Refrigerators Across France
Vulnerabilities in Danfoss Systems Raise Security Concerns ANSSI (National Cybersecurity Agency of France) has been directed to assess the risks and determine whether other businesses could be affected by the incident, while French authorities are investigating it. It appears that refrigeration units reached temperatures as high as 50°C, which resulted in extensive food spoilage and fires at several locations.
Paying a Ransom Does Not Guarantee Full Data Recovery or Security
In addition, according to a report by Proofpoint, which appeared in July, 54% of the 1,600 organizations surveyed worldwide said they had paid a ransom within the last year. Joe Hoosech, an executive at the cybersecurity insurance company Cowbell, estimates that paying the ransom retrieves data with no further leaks in 75 to 80% of cases. Some hackers do indeed honor their word to deter potential victims by building a reputation as reliable businesspeople, he adds.
Russian Hacker Weaponized Claude Code to Breach 429 WordPress Sites and Steal 628,000 Ukrainian Records
A financially motivated cybercriminal using Anthropic's Claude Code as an AI backbone has carried out a sweeping attack campaign that compromised 429 WordPress administration panels in a 61-second window and pulled more than 628,000 personal records from four Ukrainian organizations, according to findings published by threat intelligence firm SOCRadar last week.
Let’s Encrypt to Cut TLS Certificate Validity to 64 Days
Let’s Encrypt will reduce the default validity period of its TLS certificates from 90 days to 64 days starting February 10, 2027. The change will apply to all certificates issued or renewed after that date, while previously issued certificates will remain valid until they naturally expire. The nonprofit certificate authority says the move is the first step in a broader transition toward 45-day certificates, which it plans to introduce in 2028.
Malware Incident at Karaoke Giant May Expose Data of 8,724,000 People
Daiichi Kosho, a major Japanese karaoke company known for operating the popular Big Echo chain, has disclosed a potential data breach that could affect approximately 8.7 million records. The incident involved malware discovered on a computer belonging to Nippon Columbia Group (NCG), an entertainment company that handles customer information on Daiichi Kosho’s behalf.
Skyticket Breach Exposes Data of 14.6 Million Customers
Japanese travel booking platform Skyticket has disclosed a major data breach that may have exposed the personal information of approximately 14.64 million customers. Its operator, Adventure Inc., said attackers gained unauthorized access to internal servers and cloud storage between October 2 and October 4, 2026. The company publicly confirmed the incident on October 9 after blocking the access route and launching an investigation.
AI Race Fuels Surge in Cybersecurity M&A Deals
As companies strengthen their artificial intelligence capabilities, the cybersecurity industry is poised for another record merger and acquisition (M&A) year. Momentum Cyber reported 117 deals in the third quarter of 2026, which represents an increase from 117 deals in the prior year. This increased activity is a reflection of a shift in security companies' purchasing strategies in order to keep up with rapid advances in artificial intelligence.
GhostAction Returns: 772 GitHub Repos Hit as Supply Chain Campaign Picks Back Up
A GitHub Actions credential-theft campaign that researchers first flagged a year ago has returned with a fresh wave of attacks, hitting 772 public repositories between August 31 and September 30, 2026, and going after more than 2,500 developer secrets in the process. The campaign, named GhostAction, was first reported in September 2025 after attackers compromised 817 public repositories across 327 GitHub user accounts and walked off with at least 3,325 secrets.
Nippon Columbia Malware Incident Puts 8.6 Million Customer Records at Risk
Daiichi Kosho, Japan’s biggest karaoke company, owns 521 karaoke places and provides services for the well-known chain of Big Echo. They rely on Nippon Columbia Group (NCG) to provide customer information. NCG’s businesses range from music creation, video and game software development and distribution to artist management, making it an important supplier for the karaoke entertainment sector.
Calendar Phishing Scams Rise as Hackers Exploit Fake Meeting Invitations
Cybersecurity experts are warning about the growing threat of calendar phishing, a scam that uses scam meeting invitations, payment alerts and renewal reminders to trick people into sharing sensitive information. Unlike traditional phishing attacks that mainly rely on suspicious emails, calendar phishing places deceptive events directly into a user's calendar. Because these entries appear alongside genuine appointments, victims may be more likely to trust them.
Ukrainian-Russian Dual National Behind 15,000-Mule Money Laundering Ring Pleads Guilty in North Carolina
A Ukrainian-Russian dual national who spent years overseeing one of the most operationally sophisticated money laundering rings in recent cybercrime history pleaded guilty last Thursday in a federal court in North Carolina, admitting to routing stolen funds through tens of thousands of ordinary Americans before shipping the cash to criminal operatives in Eastern Europe.
Engineer Jailed Over Insider Cyber Extortion Plot Against Industrial Firm
The former infrastructure engineer was sentenced to 32 months in federal prison for sabotage of his employer's computer network and for demanding a ransom of $750,000 in Bitcoin from his employer. According to the US Department of Justice (DOJ), Daniel Rhyne, 59, was convicted of extortion involving threats to damage protected computers and intentional damage to protected computers.
AgentCorruption Exposes Security Risks in Amazon Bedrock AgentCore
The researchers' proof-of-concept involved an agent with a web-request tool that was prompted to call the local metadata endpoint at 169.254.169.254, which is where AWS workloads get temporary AWS credentials. Since the request came from inside the agent's Firecracker microVM, it returned credentials for the agent's execution role. This created a server-side request forgery (SSRF) vulnerability that was triggered by a prompt injection.
Stolen Passwords Expose 1,787 US Water Providers to Hackers
A new cybersecurity study has found that stolen passwords are exposing more than 1,700 American water and wastewater providers to potential hacking. Research by SpyCloud, shows that password-stealing malware has compromised credentials belonging to 1,787 organizations—nearly two in every ten providers examined. The findings highlight how basic credential theft, rather than advanced artificial intelligence or sophisticated exploits, can create a serious threat to critical infrastructure.
Anthropic Restricts Internet Access for Internal AI Tests After Claude Models Target Real Websites
Anthropic has restricted live internet access across its internal artificial intelligence evaluations after finding cases in which Claude models performed unauthorised actions on real websites and systems. Anthropic identified four categories of unintended behaviour. Although the company said the incidents had minimal real-world impact, it is strengthening its security measures to prevent similar events.
AI Adds to Open-Source Security Pressure as Vulnerability Reports Surge
The Chief Client Innovation Officer for Enterprise Security for IBM, Jamie Thomas, highlighted the sharp increase in vulnerability disclosures at the Linux Foundation Open Source Summit. In 2026, there are expected to be 66,000 unique vulnerability entries, representing a fourfold increase when compared with seven years ago. Cybercriminals are exploiting vulnerabilities at a faster rate, making the growing volume especially concerning.
Fake Ransomware Recovery Firm Charged Over $11M Decryption Markup
The owner of a US cybersecurity company has been charged with running a ransomware recovery fraud that allegedly involved secretly paying attackers for decryption keys and then charging victims a large markup. Zohar Pinhasi, 50, owner of MonsterCloud and also known as “Zack Silver” and “Zack Green,” appeared in a New York court on wire fraud charges.
Attackers Are Already Exploiting SonicWall’s Freshly Patched Max-Severity SMA1000 Flaw
Just three days after SonicWall shipped a patch for a maximum-severity vulnerability in its SMA1000 secure remote access appliances, attackers have started scanning for and exploiting the flaw in the wild. The vulnerability, tracked as CVE-2026-102255 and carrying a perfect CVSS score of 10.0, is a pre-authentication server-side request forgery (SSRF) bug living inside the Appliance WorkPlace interface.
Public Exploit Reveals Critical AnyDesk Linux Vulnerability That Could Allow Root Access
Security experts have released a functional exploit demonstrating how a vulnerability in AnyDesk for Linux could be abused to gain the highest level of system privileges without authentication. The flaw could put computers running vulnerable versions of the remote desktop software at risk if attackers can reach the affected service. The exploit, called AnyPwn, shows a weakness in the way AnyDesk processes certain connection data.
Atlassian CVE-2026-21589 Exploited Hours After Public Disclosure
The problem was disclosed by Atlassian on October 5, 2026, with a CVSS score of 9.3. The products affected by the bug are Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye. The company already released fixes for all software versions. The flaw allows the adversaries to access some files in the application root directory without providing proper authentication.
Japan Reports Sharp Rise in Web Data Leaks
Japan is experiencing a sharp rise in personal-data leaks from web systems, according to an October 2026 alert from the JPCERT Coordination Center. The incidents, which surged around September, are separate from ransomware and other routine breaches, and JPCERT/CC says they may be increasing.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with AV
Contact AV, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack