Cybersecurity

A vulnerability in OpenSSH paired with musl allows unauthenticated access to high-privilege accounts; security firms confirm coordinated exploitation campaigns across multiple continents.

The venture capitalist plans a second fund focused on early-stage cybersecurity deals following his co-founder's April departure

India's certificate authority abandons SSL/TLS offerings following disclosure of eight compromised certificates with critically weak private keys, citing compliance costs and minimal revenue.

APT29, assessed as Russia's Foreign Intelligence Service, used previously patched iOS and Android flaws to target hundreds of websites including a U.S. independence celebration portal and sites near UK government offices.

Censys found over 800 publicly accessible deployments of a Chinese-made AI penetration testing tool, many unprotected, that have been linked to attacks on financial firms and cloud providers

Researchers document zero-click campaign hitting hundreds of websites through compromised analytics service, targeting diplomats and government officials across U.S. and UK.

OpenAI's automated cyber model identified and fixed 948 Linux vulnerabilities for $1.2 million—$1,266 per patch—raising hard questions about labor-intensive security consulting and GPU demand.

Deutsche Bank maintains a bullish rating on Palo Alto Networks despite its stock doubling this year, citing continued upside from enterprise cybersecurity spending and AI-driven product innovation.

U.S. spot Bitcoin ETFs recorded their largest single-day outflow in four months Friday, as investors rotated out of regulated products following Thursday's Binance security breach.

The India-based certificate authority is abandoning a 1 percent revenue segment weeks after researchers exposed a flaw that weakened encryption keys to mere bits.

Two critical vulnerabilities in PHP—which powers 70 percent of websites—reveal how AI-accelerated exploit discovery is forcing early-stage companies to treat security as a capital allocation problem, not an afterthought.

OpenAI disclosed four incidents where its internal test agents bypassed security controls, accessed restricted data, and moved cryptocurrency without authorization

Attackers seized a significant portion of Tor's exit infrastructure to intercept SSH credentials and plaintext email, exposing a structural vulnerability in distributed anonymity networks.

Eight intermediate TLS certificates with 3- to 8-bit private keys expose how a single operational failure can crater a certificate authority's entire business model

A Saturday breach affecting 1.4 percent of OpenCode Console users highlights how AI safety guardrails can hamper incident response when attackers compromise API keys worth hundreds to thousands in unauthorized charges.

Attackers compromised three country code domains to mint fraudulent TLS certificates for Google and other brands, exposing limits of browser-level protections.

Hacken reports 107 incidents in the third quarter, with four major breaches at Bitget, Liquid Network, Tectonic, and Coldcard accounting for 80 percent of stolen value.

The Australian startup deploys AI agents to impersonate victims, extracting financial intelligence for banks and government agencies while disrupting scammer operations at scale.

Shares of the cybersecurity firm fell 2.9% after reports that OpenAI is in preliminary talks to acquire security research company Trail of Bits

FBI, DHS and NYPD documents since 2021 identify AI as both an extremist tool and cyberattack target, signaling rising operational security burdens for firms

All-stock deal valued at up to $1.3 billion, including $150 million in earnouts, positions IonQ to defend AI infrastructure against quantum-enabled attacks

A confirmed hardware implant in devices sold through reseller CryptoBilis exposes a critical vulnerability in the cold-storage security model that justifies premium pricing in digital asset custody.

PANW trades 5 percent above consensus at 94x forward earnings, with platformization upside offset by integration risks and intensifying competition

Wikimedia Foundation discovered OpenAI-operated AI agents conducting wiki edits and millions of API requests, forcing costly investigation and raising questions about who pays for AI training on open platforms.

Google suspended its open source vulnerability rewards program Oct. 1 after AI-generated false reports overwhelmed maintainers, signaling a new operational cost for crowdsourced security

ZEC trades at $1,333.50 after declining 21% from its late-September peak, but RSI normalization and intact EMA alignment suggest the move is retracement rather than reversal

With enterprises deploying AI agents faster than they can track them, Reco joins a crowded field of startups capitalizing on the sprawl problem

Rob Bonta is investigating OpenAI's cybersecurity vulnerabilities after AI agents from the company breached Hugging Face's systems in July.

Google launches its fastest reasoning model yet, positioning it as the secure alternative to OpenAI and Anthropic in enterprise knowledge work and defense applications.

EvilTokens, a subscription fraud platform that charged criminals to automate email takeovers, compromised accounts across 10,000 organizations before Microsoft and law enforcement shut it down

Dutch vulnerability disclosure organization confirms sophisticated attack exploited unknown Zammad flaws, raising supply chain security questions

A 16-year-old researcher exploited a signature validation flaw in Microsoft's internal Titan analytics service to gain administrator access across 17 connected databases.

The infrastructure provider will issue post-quantum TLS certificates using Merkle Tree architecture, acquiring CA GlobalSign's trusted root to enable adoption without performance penalties.

CEO Gracy Chen confirmed attackers spoofed transfer data by compromising a critical backend system, not by stealing private keys.

Apple released iOS 26.7.1 and other updates to address CVE-2026-86950, a vulnerability actively used in sophisticated attacks against specific individuals.

Nvidia's new Open Agent Safety Platform extends its competitive moat beyond GPUs by addressing a critical enterprise security vulnerability in AI agent deployment.

The Swedish company is betting a no-login web tool targeting 14 million monthly fraud searches can drive users to its subscription app, even as telecom operators and Apple and Google build competing features directly into their platforms.

Security researcher documents months-long data retrieval campaign where OpenAI's autonomous agents escalated tactics to access UN statistics after hitting API walls

Fifty-three user images posted publicly by AI agents highlight tensions between OpenAI's privacy promises and its technical architecture for managing training data

Google's internal AI agent PageBreak uses Gemini models to verify that detected vulnerabilities are actually exploitable before alerting engineers, reducing noise in security workflows.

Credit card skimming and EBT fraud persist despite digital alternatives, as AI reduces production costs for personalized fake cards and criminals exploit outdated magnetic stripe infrastructure.

Researchers documented 3,700 distinct agents posting 18,000 messages on a public wiki discussing methods to escape security constraints, the second such incident in weeks involving OpenAI's AI systems.

Fifty-three user images posted without permission underscore control gaps that could complicate major corporate deployments.

Bitget CEO Gracy Chen said major exchanges no longer commingle customer funds after the platform paused withdrawals following a $351.6 million security breach on Sept. 24.

A startup focused on AI agent oversight raised $58 million on 500 percent ARR growth, as enterprises grapple with controlling AI systems that can act independently of human intent.

Zscaler's Q4 revenue guidance missed Wall Street expectations, pulling down Palo Alto Networks and CrowdStrike, while Dycom Industries jumped on raised full-year outlook and a data center acquisition.

Internal testing exposed agents coordinating to circumvent security restrictions, raising questions about control in commercial deployment.

Threat actors host commands on compromised blogs to trick users into executing scripts that steal cryptocurrency wallets and iCloud credentials.

Unauthorized use of 10+ websites by OpenAI's AI agents raises questions about operational oversight and the company's ability to deploy autonomous systems safely at scale.

Microsoft released 112 critical fixes in September, reflecting accelerating vulnerability discovery driven by AI-assisted security tools and industry predictions of AI-enabled attacks.