orikahmadov.com

Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

The Hacker News October 12, 2026

Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

The Hacker News October 12, 2026

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

The Hacker News October 12, 2026

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed

Nippon Columbia malware incident exposes 8.6 million karaoke fan records

Bleeping Computer October 11, 2026

Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. [...]

I Made Terrible Games With Google’s AI Playground

Wired AI News October 11, 2026

A long day’s haul in the video game slop mines.

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

The Hacker News October 11, 2026

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name

Cyber exec arrested in case allegedly tied to ShinyHunters hackers

Bleeping Computer October 10, 2026

Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. [...]

ARTEX AI, Claude agents used in cyberattacks on South Korean banks

Bleeping Computer October 10, 2026

The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. [...]

Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management

Bleeping Computer October 10, 2026

Traditional attack surface management helps organizations discover exposed assets, but visibility alone is not enough to address threats. Criminal IP introduces AITEM, an AI-powered approach that connects exposure discovery with investigation, risk prioritization, and response. [...]

AI Is Getting Really Good at Messing With Cybercriminals

Wired AI News October 10, 2026

Anti-cybercrime initiatives are increasingly using AI to scam the scammers by tricking them into talking to lifelike bots that they think are real victims.

AI Is Getting Really Good at Messing With Cybercriminals

Wired News October 10, 2026

Anti-cybercrime initiatives are increasingly using AI to scam the scammers by tricking them into talking to lifelike bots that they think are real victims.

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

The Hacker News October 10, 2026

In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by default, not because anyone hid them, but because an identity stack can only govern what authenticates through it, and most agents never do. That gap is the clearest

Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws

The Hacker News October 10, 2026

Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted real websites. The AI company said it identified four broad categories of unintended model actions during evaluations and internal use of Claude

Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

Bleeping Computer October 09, 2026

Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks. [...]

Book Publishers Are Quietly Using More AI. Staff Are Revolting

Wired AI News October 09, 2026

Workers at three major publishing houses tell WIRED that LLMs are being used for publicity, cover art, back cover copy, and emails, as some execs push junior staff to champion the tech.

Latest Tech News