Short answer: Hackers are actively exploiting two unpatched vulnerabilities in AhsayCBS backup management software to break into servers without any login credentials, install web shells, and run cryptocurrency miners with full SYSTEM privileges. The flaws are tracked as CVE-2026-105133 and CVE-2026-105134, in-the-wild attacks began on October 7, 2026, and at least five organizations have been…
In short: On October 8, 2026, the FBI and the U.S. Department of Justice seized seven internet domains used to run two hacking tools, MicroScan and FishHub, operated by a Beijing-based company called Integrity Technology Group and tied to the China-linked hacking collective Flax Typhoon. A day later, CISA added five exploited flaws to its…
On October 8, 2026, Anthropic launched the Anthropic Cyber Mission, a long-term security initiative that puts frontier AI models to work defending the systems the public relies on. The short version: Anthropic will give free AI-powered vulnerability scans to open-source projects through a service called OSS Scanner, and it is backing a Critical Infrastructure Defense…
Denmark is about to do something no other country has tried: give every citizen a legal right over their own face and voice, enforced through copyright law. On October 8, 2026, Culture Minister Zenia Stampe announced she would table a bill banning the digital copying and sharing of lifelike representations of a person, including their…
SonicWall has patched a maximum-severity security flaw in its SMA 1000 remote-access appliances that lets an attacker reach internal systems without a login. The vulnerability, tracked as CVE-2026-102255, carries a CVSS score of 10.0, the highest possible, and it is the third pre-authentication SSRF bug found in the same appliance interface this year. The two…
The short answer: PoeLLM is a new Linux malware campaign that has quietly taken over more than 3,400 internet-exposed AI servers since April 2026, turning them into cryptocurrency miners. Its most unusual trick is hiding its command-and-control server addresses inside a poem hosted on GitHub, so it can move its infrastructure without ever updating the…
Manus is back on its own and investors are betting big on it. The AI agent startup’s parent company, Butterfly Effect, said on Thursday it has completed a funding round of more than $500 million, the first since Meta was forced to unwind its $2 billion-plus acquisition of the company. Here is the short version:…
Apple has officially confirmed it will hold a product event on Tuesday, October 13, with a teaser titled “Welcome Home.” Marketing chief Greg Joswiak announced the date on October 8 via a short video post on X, which shows two people crocheting a retro Apple logo. The company is widely expected to launch an all-new…
The npm package tensorlake, the official TypeScript SDK for Tensorlake’s agentic AI platform, was compromised in early October 2026. Version 0.5.144 shipped with an obfuscated credential-stealing worm from the ChainDrop / Shai-Hulud family that runs automatically on install. It harvests npm and GitHub tokens, AWS credentials, Kubernetes and Vault secrets, SSH keys, .env files, crypto…
Google PageBreak is an internal AI security agent built by Google’s Product Security team that autonomously hunts vulnerabilities in Google’s own web applications. Since moving from pilot to a full project in January 2026, it has uncovered more than 500 cross-site scripting (XSS) vulnerabilities, and every finding is confirmed by executing a real exploit against…