security
View full archive →Cybersecurity, defense, intelligence, and geopolitical threats.
FBI says open-source AI tool Artex automates cyberattacks in under 3 hours
The FBI warns that Artex, an open-source AI framework, lets attackers automate intrusion phases and reach privileged access in under three hours. Its spread through forks and commercial copies, plus documented use against critical sectors, shows AI-assisted attacks are becoming faster and more accessible.
Trezor Confirms Three CryptoBilis-Sold Safe 5 Wallets Contained Hidden Implants That Could Copy Recovery Phrases
Trezor confirmed three Safe 5 wallets from reseller CryptoBilis contained hidden implants capable of copying recovery phrases and transmitting them via mobile networks. The case shows supply-chain compromise can defeat cold-storage assumptions even when firmware and secure elements appear untouched. It matters because affected users may have had backups exposed before a firmware update, and the attacker or insertion point has not been identified.
FBI attributes $400M crypto theft to North Korean-linked deepfake video-call campaign
U.S. authorities attribute a $400 million cryptocurrency theft to North Korean-linked actors using deepfake video calls, stolen accounts and malware lures. The campaign exploits trust in video meetings and self-propagates through compromised communication platforms. It matters because it shows how identity impersonation can bypass technical defenses and directly endanger digital assets.
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Code Execution
PostgreSQL fixed 52 security flaws, including a 22-year-old type-confusion bug that can turn database object privileges into server code execution. The bug has no reported attacks, but administrators must patch servers and rebuild C-language extensions to fully close the path.
German parliament passes spy law giving agencies hacking, sabotage powers 308-190
German lawmakers approved a major intelligence reform granting the BND and BfV covert powers, including hacking foreign systems and disrupting supply chains. The law reflects Berlin’s move to treat cyber operations as state instruments while preserving postwar limits on force. It matters because it expands legal authority for offensive cyber action in a major European democracy.
SilentAir hijacks mobile network nodes in at least six countries to intercept calls and SMS
Enea documented SilentAir, a state-level actor hijacking mobile operator signaling nodes to intercept calls, SMS and subscriber data, mainly targeting Taiwan. The case matters because network-layer compromise can evade endpoint defenses and expose communications across multiple countries, including political figures.
OWASP GenAI Security Project says stopping AI agents requires revoking credentials and network access
OWASP GenAI Security Project says stopping AI agents requires tested controls that revoke credentials and network access, not just pausing the model. The guidance matters because agents can be embedded in workflows where queued jobs, sessions and tool access continue after a model is disabled.
Maersk says cyber incident hit LF Logistics legacy system after WhiteArmor claims 100GB theft
Maersk said a cyber incident was confined to a legacy system tied to LF Logistics, while WhiteArmor claimed to have stolen 100GB of data and demanded $5 million. The case fits a broader pattern of ransomware hitting ports and logistics firms as they digitize operations. Maersk said customer and partner systems were not affected, but the incident highlights the operational exposure of acquired systems.
Red Hat Quay Critical Flaw (CVE-2026-123710, CVSS 9.8) Lets Attackers Read and Overwrite All Private Container Images
Red Hat disclosed two critical Quay container registry flaws, CVE-2026-123710 and CVE-2026-110697, that let attackers read or overwrite private images and steal tenant robot tokens. The flaws expose private registries, CI/CD pipelines, and OpenShift environments to silent image poisoning and credential theft. Red Hat has issued patches and temporary mitigations, but its public vulnerability records still show inconsistencies.
Nightmare Eclipse Releases SignDrop Windows Exploit That Elevates Local Users to SYSTEM
Nightmare Eclipse released SignDrop, a public Windows privilege-escalation proof-of-concept that abuses CLFS and Windows Defender to obtain SYSTEM rights. Cyderes says it compiles and works, while finding no evidence of active exploitation. The release matters because it exposes a local escalation path in widely deployed Windows systems and makes exploitation easier for attackers with local access.
Microsoft rolls back network change after 365 outage disrupts Outlook, Exchange Online and Teams
Microsoft reported a widespread Microsoft 365 outage that disrupted Outlook, Exchange Online, Teams, SharePoint Online, Copilot and Defender XDR. Microsoft said a secure-connection process was overwhelmed and rolled back a recent network configuration change, while no cyberattack evidence was reported. The incident exposed how business email, collaboration and security workflows depend on the same cloud infrastructure.
U.S. prosecutors indict three Iranian-backed men in attempted RAF Fairford van plot
Federal prosecutors in New York indicted three Iranian-backed men for an alleged failed September van attack on RAF Fairford, saying a jailed Kataib Hezbollah commander directed the plot through coded messages. The case documents surveillance, fuel, accelerants and shrapnel procurement, plus a broader alleged campaign of nearly 20 attacks. It matters because it shows how Iran-aligned networks can task overseas associates against U.S. military infrastructure from prison and abroad.
US seizes $1.2 billion in crypto stolen from Binance, FBI says
The FBI says U.S. authorities seized more than $1.2 billion in cryptocurrency stolen from Binance, one of the largest recoveries tied to a $6.3 billion theft. The action combines blockchain tracing, exchange cooperation and court-ordered forfeiture, while U.S. officials attribute the theft to North Korea’s TraderTraitor group. It matters because it shows massive crypto thefts can be partially clawed back through state-led financial forensics and legal process.
US seizes $1.2 billion linked to Binance theft and disrupts North Korean FaceStealer tools
U.S. authorities seized or restrained $1.2 billion linked to the Binance theft and disrupted North Korean FaceStealer infrastructure. The action shows blockchain tracing and platform freezes can interrupt crypto laundering, while FaceStealer reveals a deceptive video-meeting malware risk.
Putin agrees to Europe’s seat in next Ukraine talks as Kyiv reports Starshield disruption across front
Putin reportedly agreed to include European representatives in the next U.S.-mediated Ukraine peace talks after trilateral negotiations in Abu Dhabi. Kyiv simultaneously reported significant Starshield restrictions across the front line, though no technical attribution was provided. The episode matters because battlefield communications and diplomatic alignment are both exposed.
Public SignDrop Exploit Claims SYSTEM Access Through Windows CLFS
A public exploit called SignDrop claims local privilege escalation to SYSTEM through Windows CLFS by redirecting creation of a companion.cnpf file. Independent testing found it works but unreliable and noticeable, while Microsoft has not confirmed a CVE or released a fix. It matters because CLFS is widely present in Windows and Defender, and the mitigation tradeoff affects enterprise patch and security decisions.
United Airlines to block AI agents from managing customer reservations and purchases
United Airlines will block third-party AI agents from managing reservations, ticketing and loyalty activity, citing credential exposure, privacy and regulatory risks. The move shows regulated businesses are treating AI assistants as access-control threats because they can hold passwords and act inside customer accounts. It affects travelers who use agents to book, change or redeem miles.
Finland detects strike on Russian warship in Gulf of Finland
Finland’s military reported detecting a strike on a Russian warship in the Gulf of Finland, with no public confirmation of cause or casualties. The incident occurred near a sensitive NATO-Russia maritime corridor already strained by drone spillover from Ukraine’s war. It matters because it shows a reported kinetic event appearing close to NATO territory, even as Helsinki said there was no immediate threat.
ConnectWise disables ScreenConnect extension after breaches at nearly 50 organizations
ConnectWise is investigating breaches at nearly 50 organizations tied to its ScreenConnect remote-support tool and the RMM+ extension. Huntress and Blackpoint Cyber data point to abuse of trusted admin APIs and possible session hijacking, with patching alone not enough to remove established access.
Researchers Track 186 Fake AI Domains Redirecting Users to Malware and Search Hijackers
Island researchers identified 186 AI-branded typosquatting domains that redirect users to fake verification pages, a signed but risky Microsoft Store app called Net Guard, and Chrome extensions that alter search settings. The campaign shows how AI brand confusion is being industrialized through parked domains, traffic distribution systems and signed software.