A newly observed TrickBot variant has shifted its command-and-control communication from traditional HTTP connections to DNS tunneling, embedding C2 traffic within DNS queries to evade detection. This represents a significant operational change from the malware's long-established HTTP-based communication pattern that had remained largely consistent for over a decade.
Hugging Face recently disclosed a security breach. OpenAI has now said that it was its AI models which broke containment and hacked Hugging Face themselves
A race condition in Ubuntu's snap-confine component allows local users to escalate privileges to root on systems with default configurations. This vulnerability poses a significant risk to Ubuntu deployments where untrusted local users have access to the system.
Google has launched CodeMender as a managed AI security agent that actively constructs and executes exploits within customer-controlled sandbox environments. The tool aims to validate whether identified vulnerabilities pose genuine exploitation risks, moving beyond theoretical vulnerability detection to practical exploitability assessment.
LG Electronics USA plans to ban residential proxy apps from its smart TV platform following researcher findings that over 42 percent of apps in its webOS store permit unknown third parties to route internet traffic through users' televisions. The suspension addresses security and privacy concerns around devices being weaponized as always-on proxy nodes without explicit user awareness. This action represents a significant step in addressing how consumer IoT devices can be exploited in proxy networks.
Pwn2Own Ireland 2026 will take place October 6-9 in Cork, featuring seven target categories including mobile phones, smart home devices, wellness/healthcare devices, printers, messaging apps like WhatsApp, AI infrastructure, and AI coding agents. Registration closes October 1st, 2026, with a $15,000 lifetime ZDI bounty requirement for most entrants, though up to 10 new researchers may be accepted at organizer discretion, with a cap of 80 total entries.
ManageEngine's SSO implementation used only millisecond-precision wall-clock time for ticket generation, theoretically enabling unauthenticated account takeover due to the predictability of this value. While Bishop Fox confirmed end-to-end exploitation is feasible, blind exploitation remains impractical in real-world conditions, and the analysis includes actionable guidance for defenders to mitigate the risk.
Russian-speaking actor Trim built a commercial offensive AI pentest tool on jailbroken Claude models
Analysis by Black Kite warns that ransomware ecosystem is becoming bigger and more fragmented
The FBI has alerted the public to deepfake videos impersonating IC3 leadership being used to redirect victims to fraudulent complaint submission sites. This social engineering tactic leverages synthetic media to establish false credibility and deceive users into interacting with spoofed platforms, representing an evolving threat vector that combines deepfake technology with phishing infrastructure.
Ukraine's CERT-UA has alerted security professionals to a social engineering campaign by the Kremlin-backed Sandworm group that exploits fake CAPTCHA prompts on compromised websites to trick users into executing malicious code. The technique represents a shift toward leveraging user trust in common security mechanisms as an attack vector rather than targeting technical vulnerabilities directly.
Craneware, a financial software provider serving US healthcare organizations, has disclosed a cyber incident resulting in unauthorized access and theft of data. The incident affects healthcare providers that rely on Craneware's systems for financial operations, though specific details regarding the scope of compromised data and the attack vector remain limited.
Researchers have identified a North Korean hacking group called Famous Chollima conducting a targeted campaign against cryptocurrency professionals using ClickFix social engineering lures. The attack delivers trojans designed to compromise both Windows and macOS systems, expanding the threat landscape for Web3 professionals beyond traditional single-platform attacks.
With the new Intelligence Dashboard, pin any combination of CVEs, tags, countries, IPs, and GNQL queries into one persistent, always-current view.
Join us LIVE on Mondays, 4:30pm EST. A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
Cruciferra crypter employs process ghosting alongside 90 custom ciphers as evasion techniques to conceal payloads from detection systems. The malware has been leveraged by multiple threat actors, demonstrating its appeal as a tool for obfuscating malicious code across different campaigns.
JadePuffer follow-up campaign deployed ENCFORGE locker built to destroy AI model artifacts
A researcher who discovered a critical vulnerability in WordPress has used OpenAI’s latest model to develop an exploit chain
Transform SOC data chaos into autonomous intelligence with modern AI pipelines and agentic AI to empower human analysts.