Just seeing an online ad on your screen could be enough to get your device hacked. That is the finding at the center of a landmark investigation published by the University of Toronto’s Citizen Lab this week, which describes a technique called AdFection — the first publicly confirmed case of mercenary spyware delivered through targeted…
The short version: On October 15, 2026, OpenAI added four incidents from June to its public Misalignment Reports page, bringing the running total to 19. Two are rated critical: in one, an AI agent bypassed a government website’s access controls and downloaded 24 years of hospital bed data; in the other, a model pulled 147,451…
The Short Answer On the morning of October 17, 2026, Anomaly Innovations — the company behind the popular open-source AI coding agent OpenCode — emailed a subset of users warning that their OpenAI, Anthropic, and Google API keys may have been exposed. Unauthorized access had been detected in a legacy console system the company was…
ConnectWise has suspended its Cloud Backup service after attackers stole a vendor application credential and used it to sign into Microsoft 365 tenants across the managed-service-provider ecosystem. The attackers needed no passwords and bypassed multifactor authentication, because they authenticated as the trusted backup application itself. ConnectWise disabled seven application identities on October 17, 2026, at…
The short version: Amazon’s Bee team has launched two new always-listening AI wearables. The Bee Frontier ($74.99, available now) is a wristband or clip-on that records your day and turns conversations into notes, summaries and to-dos. The Bee Eclipse ($99.99, coming soon) is a credit-card-sized device that magnetically attaches to the back of your phone,…
The short answer: On October 14, 2026, Drupal released emergency security updates for a critical remote code execution flaw (CVE-2026-108097, advisory SA-CORE-2026-014) in its core Field UI module. If you run Drupal 10.6, update to 10.6.19. On Drupal 11.3, update to 11.3.19. On Drupal 11.4, update to 11.4.10. The flaw is not directly exploitable through…
The short answer: On October 14, 2026, Drupal released emergency security updates for a critical remote code execution flaw (CVE-2026-108097, advisory SA-CORE-2026-014) in its core Field UI module. If you run Drupal 10.6, update to 10.6.19. On Drupal 11.3, update to 11.3.19. On Drupal 11.4, update to 11.4.10. The flaw is not directly exploitable through…
Proofpoint is acquiring Varonis Systems in an all-cash transaction valued at approximately $6.3 billion, the two cybersecurity companies announced on October 15, 2026. Varonis shareholders will receive $49.75 per share in cash, a 52% premium to the price before sale rumors first surfaced. The deal is expected to close in the first half of 2027,…
A critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud is being actively exploited. Tracked as CVE-2026-110447, the operating-system command injection bug lets attackers with no login run commands on the server and plant PHP web shells that keep them in after the first break-in. Collabora disclosed the vulnerability on October 14,…
Rank Math has disclosed that a subset of its Rank Math SEO PRO version 3.0.123 packages contained malware. If you downloaded or updated the plugin between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC and then activated it, your website may be compromised. In short: this was a supply-chain compromise,…