Anthropic has released Claude Haiku 5.5, its newest small AI model. The company says it is the cheapest, fastest, and most capable small model it has ever built, and the lower cost is the biggest change for teams that run AI at scale. Anthropic launched Haiku 5.5 on October 7, 2026 (). On average, it […]
The post Claude Haiku 5.5 – Cheapest Model with Enhanced Coding and Computer Use appeared first on Cyber Security News.
The U.S. Department of State is offering up to $10 million for information on Zhang Yu, a Chinese national accused of helping hackers target American COVID-19 research. The Rewards for Justice notice seeks details about Zhang, his associates, and their malicious cyber activities, with possible rewards and relocation for eligible sources. U.S. authorities allege Zhang […]
The post U.S. Offers $10 Million Reward for Chinese Hacker Who Tried to Steal COVID-19 Research appeared first on Cyber Security News.
Double Counter, a Discord security bot, has disclosed a breach that exposed user data after an attacker broke into its cloud systems on October 4, 2026. Attackers copied about 12 GB of database records, and the stolen bot token was used to post unwanted invitations across roughly 50 large Discord servers. According to Double Counter’s […]
The post Discord Users’ Data Exposed in Security Bot Double Counter Security Breach appeared first on Cyber Security News.
US security operations centers are not short on security products. They are short on time, people and context. Current industry research suggests the biggest obstacles to fast detection and containment are operational: too many alerts, too much manual triage, investigations split across disconnected tools, and phishing campaigns built to slip past standard checks. A new […]
The post Alert Overload, Tool Sprawl and Evasive Phishing: The 5 Bottlenecks Slowing Down US SOCs appeared first on Cyber Security News.
Hackers compromised the .gh, .sl and .as country-code domain registries and used their access to obtain unauthorized HTTPS certificates for Google and other organizations. Chrome blocked the identified certificates automatically, while Google worked with certificate authorities to revoke those covering its properties. In its October 6 disclosure, Google said it learned of the attacks the […]
The post Hackers Hijack .gh, .sl and .as Registry to Obtain Unauthorized HTTPS Certificates appeared first on Cyber Security News.
CrowdStrike announced its fourth annual Cybersecurity Startup Accelerator on October 6, 2026, expanding its collaboration with Amazon Web Services and NVIDIA. The global initiative will help early-stage companies develop agentic cybersecurity products through technical mentorship, business development, and broader access to enterprise security ecosystems. Applications are open worldwide until November 2, 2026. The eight-week program […]
The post CrowdStrike, AWS, and NVIDIA Expand Global Cybersecurity Startup Accelerator appeared first on Cyber Security News.
CyberXero has emerged as an initial access broker that combines familiar hacking tools with artificial intelligence to run large-scale intrusions. The Russian-speaking operator targeted WordPress and e-commerce sites worldwide while separately probing Ukrainian energy and utility organizations. The campaign came to light after an open directory exposed more than 90,000 files, including scripts, AI session […]
The post CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks appeared first on Cyber Security News.
SonicWall has patched four vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances, including a critical server-side request forgery (SSRF) flaw with a maximum CVSS score of 10.0. The bug could let a remote attacker without valid credentials make the appliance send requests on their behalf, reach internal functions, and perform unauthorized operations. The […]
The post SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10 appeared first on Cyber Security News.
Hackers breached two major South Korean churches, exposing more than one million congregant records and extensive financial and administrative data. The investigation reveals how web shells, leaked credentials, and weak access controls opened routes into connected systems. In one case, attackers entered through a web shell planted in an enterprise resource planning, or ERP, system. […]
The post Hackers Breach Two Major South Korean Churches, Exposing Data of Over 1 Million People appeared first on Cyber Security News.
Hackers are impersonating ChatGPT, Claude and Gemini with fake advertising products that steal passwords and multifactor authentication codes. Instead of delivering a conventional malware download, the campaign uses convincing websites and live human operators to guide victims through fraudulent sign-in screens. Invitation emails lead advertisers to pages promising campaign planning, spending audits and account connections. […]
The post Hackers Use Fake ChatGPT, Claude and Gemini Ads to Steal Passwords and MFA Codes appeared first on Cyber Security News.
WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses. The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported. The release documentation lists seven security issues, although its introductory sentence describes “one […]
The post Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks appeared first on Cyber Security News.
OpenSSH 10.6, released on October 6, 2026, fixes security flaws that could expose secrets, write files outside intended folders, or enable shell injection under specific conditions. The update covers both client and server tools, making it relevant to administrators and users who rely on SSH for remote access and file transfers. The official release notes […]
The post Multiple OpenSSH Vulnerabilities Could Enable Plaintext Recovery, File Write and Injection Attacks appeared first on Cyber Security News.
Security researchers reportedly exploited 32 unique zero-day vulnerabilities and earned $388,500 on the opening day of Pwn2Own Ireland 2026. Samsung Galaxy S26, OpenAI Codex, smart home devices and AI services fell to working exploits, but the Google Pixel 10 attempt failed within the contest time limit. The October 6 results show how security gaps span […]
The post 32 Unique 0-Days Exploited in Samsung S26, Pixel 10, OpenAI Codex and Other Devices in Pwn2Own 2026 appeared first on Cyber Security News.
Google released a major Chrome security update on October 6, 2026, fixing 247 vulnerabilities, including four critical memory-safety flaws, across Windows, Mac, and Linux. The patched versions are 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 for Linux. Although the critical bugs raise concerns about possible code execution, Google’s announcement identifies them as use-after-free vulnerabilities. It […]
The post Google Chrome Update Fixes Massive 247 Vulnerabilities, Including 4 Code Execution Flaws appeared first on Cyber Security News.
IAST’s core idea watch the running app from inside and confirm which findings are real won so thoroughly that platforms absorbed it, and the standalone market shrank. Integrating Interactive Application Security Testing (IAST) runtime monitoring has transformed how security teams validate exploitable code paths during execution, ensuring that securing modern enterprise applications through DevSecOps relies […]
The post Top 10 Best IAST Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.
Veeam has released Veeam Backup & Replication 12.3.2 P4, build 12.3.2.4934, to address four security vulnerabilities, including a flaw that lets attackers execute malicious scripts in an authenticated user’s browser. Released on October 6, 2026, the update also fixes a critical remote code execution vulnerability affecting the backup server. The vulnerabilities carry CVSS 4.0 scores […]
The post Veeam Backup and Replication Vulnerability Allow Attackers to Execute Malicious Script appeared first on Cyber Security News.
A scanner that can’t authenticate, crawl a SPA, or read an API schema is testing your login page and calling it coverage. We scored ten DAST options with modern-stack capability as the qualifying bar. Evaluating the market alongside the Top 10 Best Dynamic Application Security Testing (DAST) Platforms makes it clear that black-box security testing […]
The post Top 10 Best DAST Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.
Hackers concealed the Vasilek backdoor inside an existing VMware Tools installation during a prolonged intrusion at a medical organization. The attackers maintained access for approximately two years, exposing sensitive medical information while leaving systems operational rather than launching a destructive attack. The earliest evidence dates to early 2024. Investigators found signs of remote command execution, […]
The post Hackers Hide Vasilek Backdoor Inside VMware Tools to Target Medical Organizations appeared first on Cyber Security News.
Ernst & Young (EY) has warned that a cyber breach exposed personal and financial information belonging to individuals linked to Goldman Sachs and Man Group. The incident affected a platform used to support EY’s tax services, rather than the financial firms’ own systems. As the Financial Times first reported, the latest disclosures widen the known impact […]
The post EY Data Breach Exposes Goldman Sachs and Man Group Clients’ Data appeared first on Cyber Security News.
A malicious HEIC image can become a route to remote code execution on a WordPress server. Researchers have demonstrated an attack chain that turns a normal Media Library upload into code execution in the PHP-FPM process that runs the site. The risk comes from libheif, a widely used component that reads HEIC, HEIF and AVIF […]
The post Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers appeared first on Cyber Security News.
