A new IANS report has found that despite the growth of the head of AI security role, accountability for AI governance in firms remains unsettled

OpenCode silently patched a critical RCE flaw, leaving vulnerable users unaware of the security risk, researchers at Pillar Security warned

Rapid adoption of agentic AI comes with potential business benefits. But if done incorrectly it also carries risks around AI activity management and security

Siemens identified the activity to be from the Romulus multi-platform ClickFix campaign, with Siemens Software Center users urged to apply an update

Known exploited vulnerabilities take a median time of 87 days to be patched, according to a new Moody’s report

The 2024 cyber incident affected the healthcare data of 62 million people, who launched a class action lawsuit against the business services firm

A breach affecting the OpenCode Console may lead to the exposure of API keys for Anthropic, OpenAI and Google Gemini users

Cloud Backup, SaaS Security, and Cloud Management services offline as IT service provider investigates possibility that unknown attackers have full access to client environments via stolen tokens

CyberSN observed a particularly big dip in cybersecurity leadership positions such as CISO and Cybersecurity Director in 2026 compared to 2025

New report warns that threats of violence against employees of organizations hit by ransomware are on the rise as attackers find new ways to guarantee payments

The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence

Several services of the US Bankruptcy Noticing Center are unavailable due to a cyber incident affecting defense contractor BAE Systems

France-based operators of Danfoss refrigeration controllers have sharply reduced their internet exposure after the October 11 cyber-attack

Symantec warned that Aoki can steal API keys and tokens from a number of popular AI coding assistants, including Claude and Gemini

CVE-2026-35029 and CVE-2026-59823 affect LiteLLM, which is commonly used by enterprises to connect their AI applications to providers like OpenAI and Anthropic

Microsoft and partners reveal a major Chinese-language phishing network centered around the Yam Store marketplace

The ICO has handed the Metropolitan Police a reprimand and enforcement notice after privacy failings linked to the Auror platform

Researchers at Forescout said the discovery shows how ClickFix is evolving from a delivery technique into full-blown cyber-criminal infrastructure

Dashlane data finds that passkey adoption is growing but not quickly enough

At least two French supermarkets using temperature regulation devices from Dixell Electronics also experienced food stock disruptions

Microsoft issued its largest ever round of security updates in the October Patch Tuesday

New Chainguard research reveals larger companies struggle to patch vulnerabilities due to business priorities and operational disruption

Several Europe-based retail firms have confirmed experiencing cyber incidents, while H&M said it is “investigating” such claims

Flashpoint research suggests that only 25% of security teams have actively deployed AI, with many concerned about AI Agents’ negative impact

The government is planning tweaks to legislation, new incident response and more to head of AI security threats

Socura report claims CISOs are calling in sick or taking holiday to miss Patch Tuesday

Leaked documents suggest a multi-pronged operation, with social engineering and more technical attackers working together to manipulate a single target

The CEO of Cooperative U confirmed a cyber-attack affected the food stock in several stores from October 11

The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHunters

ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May

Daiichi Kosho says a supply chain breach has exposed personal data on over eight million karaoke customers

Wikimedia says OpenAI agents performed unauthorized actions on its platforms, including edits to wikis

Comparitech observed 2627 claimed ransomware attacks in Q3, with critical sectors like finance, technology, education and healthcare experiencing significant increases

The UK, US and allies have issued an alert detailing malicious activity linked to China’s Integrity Technology Group

As AI adoption accelerates, ISACA is expanding its certification portfolio with a governance-focused credential designed to help professionals manage AI securely

Ten leading AI firms have committed to make data protection improvements following a call for evidence by the UK’s Information Commissioner's Office

Attackers compromised .gh, .sl and .as registries to obtain unauthorized HTTPS certificates

The ASOS hack comes from the compromise of agentic marketing platform Simon AI, said the attackers

Russia-aligned UAC-0099 has steadily upgraded its MATCHBOIL downloader since 2024

CrowdStrike revealed that a Chinese-speaking hacker deployed agentic pentesting tool ARTEX and Claude to help breach data from South Korean financial firms

A critical vulnerability affecting eight Atlassian products, including Jira and Confluence, is being exploited in the wild, said VulnCheck

Europol and US Government Accountability Office urge faster transition to post-quantum cryptography

The FBI and Secret Service are warning Fortigate admins that their systems are still being targeted

OTCC urged CISA to mandate baseline security requirements for federal operational technology

Barracuda finds phishing emails designed to manipulate both human users and AI assistants

A Group-IB researcher has found the Telegram account linked to the unauthorized ASOS customer notification previously engaged in gaming-item trading

A Yubico survey identified a significant gap between awareness and adoption of secure methods of authentication in enterprises

Ethical hackers have already found 32 zero days in various products at Pwn2Own Ireland

A breach of 8.8 million citizens on the Danish Central Register of Persons (CPR) occurred via third-party access

ClickFix sites stage a VBScript payload in the browser cache to bypass the Run dialog's length limit