Cyber Security News

Apache Tomcat has fixed eight security flaws that could let attackers bypass password checks, expose data between users, and disrupt connections under specific conditions. Apache disclosed the vulnerabilities on October 20, 2026, after releasing fixes in Tomcat 11.0.27, 10.1.61, and 9.0.123. The eight issues span different release branches, so not every flaw affects every version. […]

The post Apache Tomcat Fixes 8 Security Flaws That Could Let Hackers Bypass Authentication appeared first on Cyber Security News.

Every breach eventually touches a file a dropped binary, an edited config, a replaced DLL and file integrity monitoring is the control that notices. The 2026 challenge isn’t detection, it’s signal: PCI DSS 4.x demands FIM, but a tool that pages on every patch Tuesday trains the SOC to ignore the one change that matters. […]

The post Top 10 Best File Integrity Monitoring (FIM) Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

The fastest way to leak production data is to copy it somewhere less defended and most organizations do exactly that every sprint, cloning customer records into test, analytics, and now AI-training environments with a fraction of production’s controls. Data masking closes that gap by making the copies worthless to steal while keeping them useful to […]

The post Top 10 Best Data Masking Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Privacy stopped being a policy problem and became a data-engineering problem: you cannot fulfill a deletion request against data you cannot find, and in 2026 more US states, deeper AI-governance rules, and shrinking DSAR deadlines punish teams still running privacy on spreadsheets. We scored ten platforms across discovery depth, DSAR automation, consent orchestration, and mid-market […]

The post Top 10 Best Data Privacy Management Software in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Databases hold what attackers came for, and service accounts hold the widest keys database security decides whether either gets noticed.We scored ten options from enterprise DAM anchors to warehouse-era access layers. Imperva takes 1 for watching-plus-stopping; IBM Guardium and Satori complete the podium. Key Takeaways • 1 overall: Imperva the DAM anchor that blocks policy […]

The post Top 10 Best Database Security & Activity Monitoring Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

SafePay ransomware has affected at least 600 separate victims across multiple critical infrastructure sectors, according to a joint government advisory released on October 20, 2026. Active since August 2024, the group has targeted businesses and essential services across North America, South America, Europe, and Australia, becoming one of the most active ransomware threats in 2026. […]

The post SafePay Ransomware Has Affected 600+ Organizations by Exploiting VPNs and Backup Servers appeared first on Cyber Security News.

State Bank of India (SBI) has disclosed a data loss incident after a preliminary review identified 3,897 customer records containing personal information on the dark web. The bank reported the findings in an October 21, 2026, stock exchange filing, while saying investigators still needed to establish the data’s authenticity, completeness, and source. The disclosure confirms […]

The post SBI Confirms Data Breach – 3000+ Customer Records Exposed on Dark Web appeared first on Cyber Security News.

Meta has paused Muse AI’s conversation sharing feature after a privacy flaw exposed confidential business records and personal details through discoverable chat links. The problem affected pages users chose to share, not every private Muse conversation. Anyone who found an affected link could open its contents without signing in. The exposure came from how Muse […]

The post Meta Muse AI Privacy Flaw Exposes Confidential Business Data Through Shared Chat Links appeared first on Cyber Security News.

OpenAI has expanded its ChatGPT Chrome extension so the assistant can read information across open tabs and carry out browser tasks. The update moves ChatGPT beyond answering questions about a single page, adding tools for comparing content, filling forms, sending messages, and organizing tabs. The announcement appeared on October 16 in India. OpenAI says the […]

The post Now ChatGPT Chrome Extension Can See and Analyze the Content in Open Tabs appeared first on Cyber Security News.

TeamUpdraft, the developer behind the UpdraftPlus WordPress backup plugin, has disclosed a website breach that exposed remote management keys. Attackers used those keys to install malicious plugins on connected WordPress sites, turning a trusted management feature into a route for running harmful code. The company identified unauthorized access to teamupdraft.com during October 17–18, 2026. Attackers […]

The post WordPress Backup Plugin Developer Hacked to Inject Malicious Code on Installed Sites appeared first on Cyber Security News.

Federal investigators suspect an executive at a United States consulting firm helped ShinyHunters operate a website used to pressure hacked companies into paying ransom demands. The allegation raises questions about whether trusted ransomware advisers crossed from helping victims into supporting the criminals demanding payment for stolen data. The suspected website operator has not been publicly […]

The post FBI Suspects Cybersecurity Executive Helped ShinyHunters Run Extortion Website appeared first on Cyber Security News.

Criminals have found a way to use open banking as a low-cost checking service for stolen bank and card details. In a campaign described by Group-IB, fraudsters abused a spend-management platform’s account-linking process to check whether credentials worked and whether linked accounts held funds. The platform did not lose money through stolen funds, but it […]

The post Hackers Exploit Open Banking Services to Test Stolen Credentials Without Paying a Cent appeared first on Cyber Security News.

WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an administrator account and install a plugin-based web shell. Seqrite’s October 16 analysis lists affected releases, but does not establish widespread live exploitation. The report says the flaws were disclosed in July 2026. […]

The post WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login appeared first on Cyber Security News.

Hackers are using generative AI to build custom malware, rewrite harmful scripts, and make phishing messages harder to spot. The shift puts pressure on security tools that mainly depend on known file signatures, while helping ransomware operators move faster from their first foothold to data theft and encryption. The danger is not that every AI-generated […]

The post Hackers Use Generative AI to Build Custom Malware and Bypass Traditional Security Detection appeared first on Cyber Security News.

Thousands of Android phones across more than 150 countries have been found running malware planted in their firmware before purchase. The campaign, called Midnight Mimosa, targets low-cost devices and gives attackers system access without requiring owners to download a harmful app or click a suspicious link. The malware can secretly install and remove apps, load […]

The post Thousands of Android Phones Ship With Hidden Malware That Disables Google Play Protections appeared first on Cyber Security News.

A campaign called GhostAction has placed malicious GitHub Actions workflows in 790 repositories, putting cloud credentials, software-publishing tokens, and AI service keys at risk. The total is OpenSourceMalware’s count of publicly recoverable, validated repositories through October 9, 2026; it is not a claim that every repository leaked credentials or suffered confirmed misuse. The campaign abuses […]

The post Hackers Hijack 790 GitHub Repositories to Steal Cloud Credentials and AI API Keys appeared first on Cyber Security News.

Revolut suffered a major service outage on Tuesday, October 20, 2026, disrupting payments, cash withdrawals, and access to its banking app. The digital bank said customer money and data remained safe while engineers worked to restore affected services. The disruption came as Google Cloud reported problems in its London region. Reuters reported that a person […]

The post Revolut Outage Disrupts Payments and Banking Services as Google Cloud Reports London Issues appeared first on Cyber Security News.

Hackers linked to AI-assisted attacks on South Korean banks left parts of their own infrastructure open, giving researchers a view of their tools and preparations. The exposed files showed a wider operation involving cryptocurrency theft tools, Linux attacks, and mobile security testing beyond the banking campaign. Public reporting cited in the investigation said the breaches […]

The post Hackers Target South Korean Banks With AI, Then Accidentally Expose Their Own Attack Tools appeared first on Cyber Security News.

ThreatBook has launched RedAgents, a cloud platform that brings several AI-powered penetration-testing agents together to assess an organization’s systems. Announced on October 16, 2026, the service is designed to help security teams find weaknesses in their own networks by running multiple automated tests within a defined, authorized scope. ThreatBook says the agents can work in […]

The post ThreatBook Launches RedAgents AI Platform That Uses Multiple Hacking Agents to Find Security Flaws appeared first on Cyber Security News.

The U.S. Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and remove related technology from their IT systems. The action covers products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliates, and third-party products and services developed using DeepSeek implementations. The notice was filed for public inspection on October […]

The post U.S. Government Bans DeepSeek AI and Orders Federal Agencies to Remove All Related Tools appeared first on Cyber Security News.