Cyber Security News

XBOW says its security researchers earned a $250,000 reward from Google after building a full-chain Chrome exploit with AI agents. The team says the work took six days and about $40,000 in computing costs, using OpenAI’s publicly available GPT-5.6 Sol model. Google has fixed the flaws. XBOW disclosed the work on October 13, 2026. Its […]

The post Google Awarded a $250,000 Bounty for a Full-chain Chrome Exploit Found Using GPT-5.6 appeared first on Cyber Security News.

Microsoft has released fixes for a Windows SmartScreen vulnerability that allows an attacker with local access to gain higher privileges. Tracked as CVE-2026-85851, the flaw was disclosed on October 13, 2026, and carries a CVSS base score of 7.8. Microsoft rates it Important. The issue involves a use-after-free memory error and affects several Windows 11 […]

The post Windows SmartScreen Vulnerability Enables Privilege Escalation Attacks appeared first on Cyber Security News.

Two powerful iPhone exploit kits, Coruna and DarkSword, show how a visit to a malicious or compromised website can put an outdated device at risk. The kits can link several software flaws together to break out of the browser and reach deeper parts of iOS. Depending on the device’s software version and the kit used, […]

The post Coruna and DarkSword Exploit Kits Can Fully Compromise iPhones From a Single Web Visit appeared first on Cyber Security News.

Hackers used an employee’s stolen credentials to access some of Meta’s GitHub repositories, taking product source code and personal information linked to roughly 1,500 people. Most affected individuals are Meta employees in the United States, according to the company’s disclosure to SecurityWeek. Meta confirmed the breach on October 13, 2026, when it began notifying affected […]

The post Hackers Breach Meta GitHub Repositories, Steal Source Code and Data of 1,500 People appeared first on Cyber Security News.

A European bank was breached through a poorly secured, third-party gateway before an attacker tried to exploit its Windows Server Update Services (WSUS) infrastructure. The case shows how stolen login details and weak access controls can put a bank’s central software systems at risk without a complex attack chain. The bank’s security team uncovered unauthorized […]

The post Attackers Breach European Bank Through Third-Party Gateway and Target WSUS Server appeared first on Cyber Security News.

Gear of War: E-Day players faced login failures, sudden disconnects, and other online service problems after distributed denial-of-service attacks targeted the game’s online services. The official Gears Community account confirmed the cause on X, linking the disruption to DDoS activity and ending speculation about the source of the failures. The Gears Community reported attacks on […]

The post Gears of War: E-Day Hit by DDoS Attack, Causing Login Failures and Disconnects appeared first on Cyber Security News.

Google released a Chrome security update that addresses 37 vulnerabilities, including seven critical flaws that raise concerns about memory corruption and possible code execution. Published on October 13, 2026, the update covers Windows, Mac, and Linux, with fixes spanning graphics, PDF handling, media processing, networking, and other browser components. According to Google’s Stable Channel Update […]

The post Multiple Google Chrome Flaws Could Enable Memory Corruption and Code Execution Attacks appeared first on Cyber Security News.

Attackers chained three zero-day flaws in Ivanti Connect Secure VPN appliances to gain root-level access without logging in, then searched for credentials and sensitive Active Directory data. The activity, which began on October 3, 2026, targeted a fully patched appliance running version 22.8R2.4, showing that keeping a device current did not protect it from these […]

The post Ivanti Connect Secure 0-Days Exploited to Steal Active Directory Credentials appeared first on Cyber Security News.

Microsoft fixed three Windows BitLocker vulnerabilities CVE-2026-85920, CVE-2026-88070, and CVE-2026-83500 that could enable privilege escalation or bypass security protections in its October 2026 updates. BitLocker is a core Windows disk-encryption feature designed to protect data if a laptop, desktop, or storage drive is lost or stolen. It helps prevent someone from reading protected files by […]

The post Windows BitLocker Vulnerabilities Security Feature Bypass and Privilege Elevation Attacks appeared first on Cyber Security News.

IT administrators searching Google for PuTTY may see a convincing fake download result mixed with legitimate links. Researchers documented a campaign that uses a lookalike website to deliver a malicious Windows installer disguised as the popular SSH client. The installer opens a working PuTTY window as a decoy while secretly starting a separate malware chain […]

The post Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer appeared first on Cyber Security News.

A critical vulnerability in Ghostscript could allow attackers to use specially made PDF files to run code on vulnerable servers. The flaw, tracked as CVE-2026-39919, affects Ghostscript versions before 10.08.0 and has a CVSS severity score of 9.8 out of 10. Ghostscript is widely used to render PDFs, create document thumbnails, and convert PostScript files […]

The post Critical Ghostscript Flaw Lets Attackers Use Malicious PDFs to Execute Code appeared first on Cyber Security News.

SAP has released its October 2026 security updates, fixing critical code injection, access control, and cloud security flaws alongside a high-severity memory corruption issue. The October 13 release includes 16 new security notes, four GitHub security advisories and two updates to earlier notes. Four entries carry critical ratings, making this patch cycle important for teams […]

The post SAP Security Update Patches Critical Code Injection and Memory Corruption Vulnerabilities appeared first on Cyber Security News.

Kimsuky hackers have used a malicious résumé document to deploy Funhouse ransomware through a chain of scripts and remote access tools. The attack begins with a Hangul Word Processor document disguised as a job application, turning a routine work file into an entry point for malware that ultimately encrypts files. The campaign connects document-based deception […]

The post Kimsuky Hackers Use Malicious Resume Documents to Deploy Funhouse Ransomware appeared first on Cyber Security News.

A fake Web3 accelerator called Apex has been using malicious npm packages to target cryptocurrency start-ups and founders with what appeared to be free AI credits, coding tools, smart-contract audits, investment access, and invitations to in-person events. Behind the polished Web3 pitch, the operation delivered malware for macOS and Windows, exposed AI-agent data to attacker-run […]

The post Fake Web3 Accelerator Uses Malicious npm Packages to Target Crypto Founders appeared first on Cyber Security News.

Anthropic warns that small AI models may be months away from self-replicating across poorly secured smart TVs and other internet-connected devices. Its research suggests future AI worms could run on consumer hardware rather than depend on a data center, making them harder to shut down through a single central service. According to research published on October […]

The post Anthropic Warns AI Models Could Soon Self-Replicate on Smart TVs and IoT Devices Without a Data Center appeared first on Cyber Security News.

A security flaw in npm’s Trusted Publishing feature exposed more than 1,500 packages to possible takeover through reclaimed GitHub repository names. The affected packages accounted for more than 10 million total downloads and over one million downloads per month, creating a serious software supply-chain risk for developers, CI/CD systems, and organizations that rely on npm […]

The post npm Trusted Publishing Flaw With 10 Million Downloads Exposes 1,500+ Packages to Malicious Takeover appeared first on Cyber Security News.

Threat actors are exploiting two critical Citrix NetScaler zero-day vulnerabilities to deploy a modified Platypus remote access tool on exposed ADC and Gateway appliances. The activity shows how quickly attackers are moving from initial access to persistent control of edge devices that often sit between corporate networks and the public internet. The campaign targets CVE-2026-88771 […]

The post Hackers Exploit Citrix NetScaler 0-Days to Deploy Platypus Remote Access Tool appeared first on Cyber Security News.

Mobile security is two budgets wearing one name: testing finds the flaws before release, shielding hardens the binary against the hostile devices it ships to. When evaluating Mobile Application Security Testing (MAST) tools alongside commercial mobile application penetration testing, engineering teams quickly discover that inspecting source code covers only half the threat landscape. We scored […]

The post Top 10 Best Mobile Application Security Testing Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Federal buyers, the FDA, and the EU’s CRA era all want your software’s ingredients list and next year’s CVE will interrogate the SBOMs you generate today. Evaluating these platforms alongside the Top 10 Best Software Supply Chain Security Tools shows that simply creating a static inventory is insufficient; organizations must manage, correlate, and monitor those […]

The post Top 10 Best SBOM Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Supply-chain attackers stopped bothering with your code they poison the pipelines that build it. Modern build pipelines execute untrusted third-party code with elevated infrastructure privileges, making CI/CD pipeline security best practices the frontline of defense against software factory tampering. We scored ten options with native-first honesty: what your CI platform already includes resets every business […]

The post Top 10 Best CI/CD Pipeline Security Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.