AX·NEWS
Sign in

Cybersecurity

Cybersecurity news — Thursday 29 October 2026

50 stories from 9 sources, every one in English. Each links to its publisher.

Open in the live feedRSS feedOn a TV

  1. OpenAI doubles ChatGPT Pro usage limits after backlash over planned 50% cut
    USBleepingComputer

    OpenAI says it won't reduce usage limits for the $100, $200, and $500 ChatGPT Pro plans, as well as Business Premium, and it also promised to keep Dots usage independent. [...]

  2. Binance probes potential $5.8 billion crypto-theft hack
    USBleepingComputer

    Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history. [...]

  3. Hugging Face malware campaign returns to hijack GPUs for crypto mining
    USBleepingComputer

    A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is positioned to…

  4. Japan Airlines suffers third-party data breach exposing passenger info
    USBleepingComputer

    Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers. [...]

  5. Polymarket halts trading after crypto-draining script breach, $2.5M traced
    USBleepingComputer

    Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a…

  6. Leaked DHS employee archive, Icepick, faces challenges to stay online
    USCyberScoop

    A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS. A search tool for the…

  7. Fake crypto app on Apple App Store linked to $23K wallet theft
    USBleepingComputer

    A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. [...]

  8. ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
    INThe Hacker News

    Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't. There's a strange mix of clever tricks…

  9. Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
    USBleepingComputer

    A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called…

  10. Your headphones have hidden LE Audio features you’ll want to know about
    USZDNet Security

    Your JBL, Sony, or Bose Bluetooth headphones got a top-to-bottom wireless makeover — not just Auracast.

  11. Firefox and Chrome patch 200+ security flaws combined – update both ASAP
    USZDNet Security

    The latest version of Firefox fixes 167 security vulnerabilities, most of which are of high severity, while the newest version of Chrome patches 52 flaws, four of which are critical.

  12. When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
    USSecurityWeek

    Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you. The post When Risk Becomes Personal…

  13. Chrome extensions with 13.4 million installs caught hijacking searches
    USBleepingComputer

    A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. [...]

  14. Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
    INThe Hacker News

    A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October…

  15. Stop sharing your passwords with AI agents, Bank of America warns customers
    USZDNet Security

    The bank’s message follows a trend among financial institutions that are restricting third-party AI agent access.

  16. Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
    INThe Hacker News

    Threat actors are delivering malicious loaders and cryptocurrency miners under the guise of artificial intelligence (AI) desktop applications for Anthropic Claude and OpenAI ChatGPT as part of a campaign dubbed Yoba. The activity involves…

  17. Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
    USSecurityWeek

    Google’s new frontier model scored 88.2% on SEC-bench Pro and is rolling out first to vetted cyber defenders via its Fairwind Program. The post Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model appeared first on…

  18. How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI
    USSecurityWeek

    Unpatched voting machines, unverifiable QR-coded ballots, and AI-driven influence campaigns leave US elections short of secure. The post How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI appeared first on…

  19. Microsoft fixes Remote Desktop failures caused by recent Windows updates
    USBleepingComputer

    Microsoft has resolved a known issue that prevents non-admin users from connecting to devices via Remote Desktop when the "Administrator protection" security feature is enabled. [...]

  20. Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps
    USSecurityWeek

    Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions. The post Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps appeared first on…

  21. Malicious Firefox extensions impersonate popular crypto wallets
    USMalwarebytes Labs

    Socket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets. Once installed, the malicious extensions stole recovery phrases and private keys, which would provide…

  22. 3 Ways AI Agents Already Operate in Your Browser
    USBleepingComputer

    AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional…

  23. CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
    USBleepingComputer

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. [...]

  24. Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
    USSecurityWeek

    The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation. The post Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek .

  25. Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities
    INThe Hacker News

    Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key…

  26. BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts
    USSecurityWeek

    BAE Systems says no data was extracted and no PII was breached in the incident that disrupted US bankruptcy court notices for weeks. The post BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts appeared first on SecurityWeek .

  27. Over 41,000 DHS Employee Records Leaked Online
    USSecurityWeek

    The personal and work information was allegedly stolen from an Okta single sign-on system earlier this year. The post Over 41,000 DHS Employee Records Leaked Online appeared first on SecurityWeek .

  28. Windows 11 KB5127936 update released with 41 changes and fixes
    USBleepingComputer

    Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements. [...]

  29. Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
    INThe Hacker News

    A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary…

  30. The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers
    INThe Hacker News

    AI is beginning to take over much of the work that has traditionally defined the security analyst's job. Investigating alerts, collecting evidence, correlating activity across tools, and executing response actions are becoming tasks that…

  31. 26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
    INThe Hacker News

    26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann…

  32. New Cisco firewall zero-day exploited to crash SSL VPN devices
    USBleepingComputer

    Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. [...]

  33. Have an older iPhone or iPad? Apple has a security update for you
    USMalwarebytes Labs

    Apple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads. Apple released security updates on October 26. Apple first fixed the flaw…

  34. Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net
    USSecurityWeek

    The data of So-net and Plala customers in Japan was exposed, along with 54,401 email account passwords and 16 bank account records. The post Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net appeared first on SecurityWeek .

  35. Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls
    INThe Hacker News

    Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild. The…

  36. Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
    USSecurityWeek

    Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed. The post Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network appeared…

  37. GitHub Launches npm Firewall to Block Malicious Packages Before Installation
    INThe Hacker News

    GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of…

  38. Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
    USSecurityWeek

    An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload. The post Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August appeared first on SecurityWeek…

  39. Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
    INThe Hacker News

    An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an…

  40. HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
    USSecurityWeek

    Hackers stole personal information and iRhythm account and device data from third-party-hosted business applications. The post HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million appeared first on SecurityWeek .

  41. Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
    INThe Hacker News

    Hackers exploited a critical Cisco Catalyst SD-WAN flaw, fixed in February, to plant custom malware inside the systems that control an organization's SD-WAN network. The malware, called KeyDrift, is designed to copy the keys that encrypt…

  42. Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
    USSecurityWeek

    CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged. The post Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day appeared first on SecurityWeek .

  43. China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
    INThe Hacker News

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Broadcom VMware ESX to its Known Exploited Vulnerabilities (KEV) catalog, after CrowdStrike revealed that it had been weaponized…

  44. Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)
    USSANS ISC

    Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it's convenient to play with snapshots in your lab. Start a new investigation from a clean snapshot and take some more when you…

  45. Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
    INThe Hacker News

    Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto…

  46. New Prompt Injection Techniques Cover Agent-Planning Attacks
    USCrowdstrike Blog
  47. VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
    USCrowdstrike Blog
  48. ISC Stormcast For Thursday, October 29th, 2026 https://isc.sans.edu/podcastdetail/10156, (Thu, Oct 29th)
    USSANS ISC
  49. Officials seize domain of top bulletproof hosting provider Virtualine
    USCyberScoop

    Authorities seized the domain of Virtualine , a bulletproof hosting provider that cybercriminals used to commit a large-scale sextortion scheme, ransomware, data theft, malware hosting and money laundering, the Justice Department said…

  50. Prediction Markets Emerge as a New Vertical for Traffer Teams
    USRecorded Future

    Executive Summary Since the spring of 2026, Insikt Group has observed multiple Russian-language traffer teams that have quickly adapted affiliate-fraud models to capitalize on growing public interest in prediction markets such as…