Every headline from 99 sources, newest first. Checks for new items every minute.
chore: remove staging-only R4 report leaked to main via PR #127 (#128) * chore: remove staging-only R4 report leaked to main via PR #127 Remove docs/audit/STAGING-0-R4-REMEDIATION-REPORT.md which was accidentally included in PR #127 (staging -> main merge). This file is staging-specific remediation documentation and…
ci(E16-S8): fail-closed secret scan gate; written rotation for the leaked secret scripts/secret-scan.py scans the working tree and the full history for Google OAuth/AIza keys, AWS key ids, GitHub/Slack tokens, PEM private keys, postgres URLs carrying a real password, sk-/sk-ant- keys and high-entropy strings in config…
Remove hard auto-fail on failureCondition breach; replace with 35-min attempt ceiling A candidate who is actively working an incident was being auto-failed and locked out the moment a scenario's failureCondition stayed true for its sustainedSeconds window (often just 60s) — testing reflexes against a clock rather than…
This newsletter is brought to you by Nebulock . You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed . You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here…
Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers. [...]
James Hopkin reports: The Sault’s police chief says it’s currently unclear how many anonymous tips received by Crime Stoppers locally were potentially exposed in a massive data breach. Both the Sault Ste. Marie Police Service and the Anishinabek Police Service have paused their relationship with the local Crime…
The Pentagon treats August freezer failures at US military bases as a suspected hack and is working with French investigators after a supermarket attack. The Pentagon is investigating freezer failures that spoiled food at US military bases in August as a suspected cyberattack, according to four officials who spoke to…
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. [...]
A company working on behalf of the Department of Homeland Security sought to cut off online access to information on more than 41,000 employees that hacktivists said they obtained from a database breached at DHS. A search tool for the database, named Icepick, went offline for a spell before coming online again…
Eric Weiss reports: The Florida Department of Education says a breach of its student financial aid website may have exposed personal information, including Social Security numbers, belonging to approximately 4.9 million people. The department said staff learned of unauthorized criminal access to the Florida Student…
Kalleigh Lane reports: If your school district used Frontline Central or School Health Management, your Social Security number, date of birth, or government ID could have been caught up in a cybersecurity incident. That risk applies to some adults and minors whose information was processed through those products.…
David DiMolfetta reports: Searchable records identifying more than 41,000 current and former Department of Homeland Security employees and contractors were published Wednesday, exposing contact information and details about sensitive assignments across the department, according to the organizations behind the release.…
A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. [...]
Suspected Chinese attackers chained PHP2Shell with a Linux kernel privilege-escalation exploit to root 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations, according to Dream researchers. The snoops began exploiting these servers on October 23, targeting organizations…
42 publicly listable cloud buckets containing 18 billion files, including exposed credentials, database dumps and backups. The Ransomnews research team counted 484,142 publicly listable cloud storage buckets in October 2026, holding 18.05 billion files. They built the count from the search engines that index open…
Ambulances were diverted, surgeries cancelled, and medical students sent home from classes after a ransomware group attacked the University of New Mexico's Health Sciences Center (HSC) this week. Read more in my article on the Fortra blog.
Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or drop into CI as a GitHub Action. Covers npm + Python + MCP agent configs. Free, MIT, no signup, no telemetry. Supply-chain attack scanner for the agent era. Triage in 30s with `npx…
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you. The post When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis appeared first on…
"No data was extracted,” a spokesperson for BAE Systems, a federal contractor, told Recorded Future News about its probe into a cyberattack against its systems for federal bankruptcy courts.
Belgium's finance and tax agency has pulled "several" digital services offline after a cyberattack on the organization. FOD Financiën confirmed the attack on Wednesday, saying that MyMinfin, the agency's main online tax portal, as well as other online services, are temporarily unavailable while they start the initial…
Microsoft has resolved a known issue that prevents non-admin users from connecting to devices via Remote Desktop when the "Administrator protection" security feature is enabled. [...]
AI systems rely on a complex web of hardware. Compromising any one component could let adversaries change model weights.
AI agents can control authenticated browsers, interact with corporate applications, and access sensitive data while appearing to act as legitimate employees. Keep Aware examines three ways agents operate inside browsers and why traditional security tools may struggle to distinguish their activity from human users.…
The social networking site is facing criticism for blocking access to the site, which identifies thousands of ICE agents and other employees working for Homeland Security.
The Federal Public Service Finance (FPS Finance), which oversees taxation and other financial administration, said Wednesday that it was investigating the extent of the attack and had temporarily suspended access to MyMinfin, the country's main online platform for managing tax and financial affairs.
BAE Systems says no data was extracted and no PII was breached in the incident that disrupted US bankruptcy court notices for weeks. The post BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts appeared first on SecurityWeek .
New ADEX research shows how AI is making familiar scams cheaper and harder to detect, while fraudsters prepare to target AI shopping assistants.
New York, New York, 29th October 2026, CyberNewswire
An unprecedented leak of Department of Homeland Security records has exposed details of more than 41,000 employees or contractors who work for the department and its constituent agencies. The records include email addresses, phone numbers, and office addresses, but also references to internal systems and sensitive…