So far in 2025, at least 44 U.S. states reported cyber incidents affecting state and local government systems. With advancements in artificial intelligence (AI), North Korea has deployed undercover information technology (IT) workers to infiltrate U.S. companies by gaining remote jobs, in part, using AI as a force multiplier. Courts was reportedly breached, at least in part, by Russia-affiliated hackers. Iranian-affiliated cyberattacks spiked 133 percent in May and June of this year, compared to March and April, amid U.S. and Israeli airstrikes.
The breakdown comes from Bobby Gould of the Zero Day Initiative (ZDI), whose team reported the flaw to Oracle. The site’s domain, including its mirror sites, was shut down at about 4 a.m. It received a demand for about $50 million (about ¥8 billion) on October 21 from people it believes carried out the attack. The service hosts Windows desktops used for FX trading, and a broker has linked unauthorized trades on some of its customers’ accounts to logins leaked from the service. „Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” Binance said in an update. Researchers at Hudson Rock downloaded the malicious file on October 29 from the address Polymarket’s site used to load the DebugBear script.
For example, PRC-backed cyber actors maintained access for months within the networks of a public power utility in Littleton, Massachusetts, highlighting the persistent and sophisticated nature of these operations. The private sector owns or operates most of our nation’s critical infrastructure, and 70 percent of attacks involved this infrastructure in 2024. These intrusions appear intended to establish persistent access and pre-position capabilities that could be leveraged to disrupt services in the event of a geopolitical crisis.
- Railway said the incident is likely part of a series of attacks designed to target platform companies with the ultimate goal of compromising artificial intelligence (AI) inference providers.
- „The operators exploited edge and remote-access systems at scale, including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways,” SOCRadar said .
- Environment variables refer to user-defined key-value pairs that are used to store sensitive data like API keys, database credentials, or feature flags.
- The impact, it said, is limited to a „subset of users,” although it did not disclose an exact number.
- The case, filed in 2021, was filed in the aftermath of revelations that Cambridge Analytica, a British political consulting firm, obtained data belonging to millions of Facebook users without their consent to build psychographic profiles.
The ‘Vulnpocalypse’ is coming for the internet’s aging code, says Wiz’s CTO
The OpenCode command-line and desktop apps keep provider keys added on the machine in a SQLite database th… A CIF identifier is the customer information file number, the bank’s internal ID for each customer. „Our team responded straight away and worked through the night to contain it – we closed the access route, signed out every account and replaced the keys and credentials that could have been affected.” As a result of the incident, threat actors are believed to have accessed its … The poisoned version incorporated code to harvest credentials and keys, and run arbitrary code from a remote server every hour, turning it into a remote acce… They are configured at the operating system or container environment level instead of hard-coding the values directly into a program’s source code.
IBM Guardium® Data Protection
US sanctions Russians and North Koreans for alleged roles in fraudulent IT worker operations. Maximum-severity GitLab flaw is under active exploitation. An AI-powered command-and-control framework emerges in the wild. An abandoned Mac app leaves security risks behind.
cyber- Business English
PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Linux Kernel TCP Flaw https://beginnersmind.info/short-course-on-what-you-need-to-know/ With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
The replaced script came from DebugBear, whose real user monitoring (RUM) tool measures how fast web pages load for real visitors. The code had replaced a page-speed script that the site loaded from an outside company. They talked each user into opening Quick Assist, a remote-help http://lacasitaroja.info/page/3/ tool built into Windows, and rea… They relied on social engineering and on AD CS that had been set up insecurely, and Microsoft did not tie the activity to any known group. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company data being copied to an external server. Outside of nation-state actors, decentralized cybercriminal groups, such as Scattered Spider, continue to launch ransomware and data extortion campaigns against major global companies.
Treasury sanctions North Korean IT worker operations. Russian disinformation targets U.S. elections. Ibnyahya discusses how evolving architecture has continued to build on earlier work utilizing multiple waveform technologies, greater interoperability, and incorporating more satellite payloads.
These widespread threats underscore the need for enhanced interagency coordination throughout the government. Senate Democrats must reopen the government so we can chart a better path forward for our nation’s collective cyber resilience.” “As the shutdown continues and a gap remains in our cyber information sharing authorities, a decrease in the visibility of cyber threats across public and private sectors could create blind spots in our networks. “Amid a heightened threat landscape, we must take a whole-of-society approach to countering escalating cyber threats from adversaries like the Chinese Communist Party, Iran, Russia, North Korea, and others,” Chairman Garbarino said upon releasing the snapshot. He discusses how TAC is bridging the skills gap through hands-on training, simulated industrial environments, and partnerships that connect emerging technologies with national security needs. Our guest is Yonald Chery, CTO from Technology Advancement Center (TAC), discussing securing operational technology in our critical infrastructure.
In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
Central to the operation is an „Autonomous Red Team Kill Chain Framework” referred to as Phantom. „On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of the LiteLLM Agent Platform, an open source tool we use for orchestrating agents,” LiteLLM’s Oliver Jensen and Mateo Wang said . LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve owners’ recovery phrases or wallet private keys. „They ranged from workspaces used largely by hand by skilled operators to AI-agent platforms that automated the entire workflow, including command and control.” The first of the three attacks has been found to abuse CyberStrikeAI , another open-source penetra… In its analysis , ZDI said it reported three distinct vulnerabilities across two PeopleSoft components, and that it is working with Oracle to assign a separate CVE to each.
A Ukrainian national gets prison time for ransomware operations. The Federal Election Commission takes systems offline. A suspected coordinated supply chain attack targets public GitHub repositories.
- DebugBear’s DNS records were compromised through its domain registrar, the company said on X.
- „This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools,” Chainalysis said Friday.
- The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice.
- „These environments held reconnaissance and attack tools, scripts, target lists, results, logs, and command histories,” security researchers Bakuei Matsukawa and Joseph C Chen said.
- The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said this week.
Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed „anomalous activity” related to systems that store customer environment variables. Social media giant Meta was ordered to pay 25 billion in penalties by a New Mexico court on Wednesday as part of a data privacy lawsuit that sprang from the company’s Cambridge Analytica data scandal , which came to light in 2018. The cybercriminal actor was first seen in the wild on October 22, 2025.