Cyber Security News

Microsoft warns organizations to treat AI agents as potential insider risks not because they are automatically malicious, but because they can access company data, apps, and tools and act on that access at high speed. The warning, published on October 19, 2026, comes as businesses use agents to handle tasks such as writing code, reviewing […]

The post Microsoft Says AI Agents Cannot Be Trusted and Could Become Insider Security Threats appeared first on Cyber Security News.

San Rafael, United States, October 19th, 2026, CyberNewswire Built on an evolutionary engine first released in 2018, STAR Fuzzer by Bright Security finds crashes, memory exhaustion and memory-safety bugs in security-critical code without a running application. In its first open source research run, it found High or Critical issues in 45% of the projects tested, […]

The post Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding appeared first on Cyber Security News.

NSA, CISA, and NIST have released joint security guidelines to help organizations detect, contain, and shut down AI agents that act beyond their approved tasks. Published October 16, 2026, the voluntary guidance sets out ten practices for managing incidents during superintelligence training and evaluation, with a focus on maintaining human oversight. The NIST announcement groups […]

The post NSA, CISA and NIST Release New Security Guidelines to Detect and Shut Down Rogue AI Agents appeared first on Cyber Security News.

Hackers are exploiting a command injection flaw in SiteGuard Server Edition, a web application firewall installed directly on protected servers. Tracked as CVE-2026-106931, the vulnerability could let attackers run operating system commands with root or SYSTEM privileges, potentially giving them full control of an affected server. The flaw affects the product’s statistics function, which is […]

The post Hackers Exploit SiteGuard WAF Vulnerability That Could Give Them Full Control of Servers appeared first on Cyber Security News.

A newly registered domain copies Microsoft Teams’ login page and interface, raising concerns about a phishing attempt targeting workplace users. Security researcher Steven Lim reported that teams-cloud[.]live was just five days old when he flagged it on October 18, 2026. He urged organizations to block the address before employees encounter the fake site. The alert […]

The post Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins appeared first on Cyber Security News.

A 16-year-old flaw in Broadcom’s Wi-Fi software can let attackers within wireless range take control of affected routers without knowing the network password. Security researcher Quentin Kaiser disclosed the issue at Hexacon in Paris on October 16, 2026, warning that old code remains in widely deployed devices. According to Kaiser’s research, the flaw has existed […]

The post 16-Year-Old Broadcom Wi-Fi Flaw Lets Attackers Hack Routers Without Knowing Passwords appeared first on Cyber Security News.

Google has announced a new set of Android security protections designed to stop mobile scams across calls, text messages, chat apps, web links, and account verification codes. The update comes as criminals increasingly use spoofed phone numbers, fake bank alerts, phishing pages, remote screen sharing, and AI-generated voices to trick users into giving up money […]

The post Google Unveils New Android AI Protections to Block Scam Calls, Phishing Links and OTP Theft appeared first on Cyber Security News.

Hackers are exploiting flaws in Plex Media Server to install cryptocurrency mining malware, with a researcher recording successful attacks against a honeypot on October 17, 2026. The activity follows the release of Plex2Shell, a public exploit that chains four vulnerabilities to run code without logging in. Later observations also revealed proxy software running alongside the […]

The post Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware appeared first on Cyber Security News.

Microsoft has confirmed that Windows Server security updates released on October 13, 2026, can disrupt Exchange Server email services, blocking webmail access and leaving messages undelivered. The issue affects some on-premises systems running Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. Microsoft has published a workaround and advises administrators not to uninstall […]

The post Microsoft Confirms October Windows Updates Can Break Exchange Server Email Services appeared first on Cyber Security News.

OpenCode has disclosed a security breach affecting 1.4% of its Console users, warning that third-party API keys saved in affected workspaces may have been exposed. In an October 17 statement, the company linked the incident to a large-scale distillation attack and said it was working with Anthropic, OpenAI, and Google to address it. The affected […]

The post OpenCode Security Breach Exposes Third-Party API Keys of its Console Users appeared first on Cyber Security News.

Anthropic says an internal Claude research model has traced the origins of five NSA-supplied elliptic curve seeds in under 30 minutes, answering a cryptography question that remained open for roughly 25 years. The finding explains how important public security parameters were chosen, rather than exposing secret keys or breaking encryption. In a report published October […]

The post Claude AI Solves 25-Year NSA Cryptography Mystery in Just 30 Minutes appeared first on Cyber Security News.

Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application. The incident shows how one leaked vendor secret can create risk across many organizations when a multitenant app already has wide permissions. The affected product is ConnectWise Cloud […]

The post Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts appeared first on Cyber Security News.

Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026. Google is rolling out […]

The post Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI appeared first on Cyber Security News.

Hackers are exploiting a critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud, with users reporting web shells on compromised servers. Tracked as CVE-2026-110447, the vulnerability allows remote attackers to run operating system commands without logging in. It affects the richdocumentscode app before version 26.4.303 and carries a CVSS v4 score of […]

The post Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers appeared first on Cyber Security News.

OpenAI has confirmed that an internal AI model hacked an unnamed government statistics website while trying to count hospital beds. The June 17, 2026 incident started as a data task during reinforcement-learning training, but turned into unauthorized access involving server files, exposed credentials, fake login tokens, and 24 years of downloaded statistics. OpenAI found the […]

The post OpenAI Confirms Its AI Model Hacked Government Website While Counting Hospital Beds appeared first on Cyber Security News.

Hackers are using a newly identified platform called ROMULUS to deliver malware through ClickFix traps, combining hidden PowerShell scripts, altered software installers, and encrypted archives. The platform supports separate infection paths, including one that installs LegionLoader and another that abuses a legitimate Stardock program to load malicious code. The findings show how a single delivery […]

The post Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection appeared first on Cyber Security News.

A newly analyzed Android remote-access Trojan called YuanKong can watch and control a victim’s phone, capture passwords and payment PINs, and send stolen information to operators. Rather than relying on access to text messages or contact lists, it uses Android’s Accessibility features and screen controls to observe what people do inside apps, including banking and […]

The post New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords appeared first on Cyber Security News.

A proof-of-concept exploit that gains root access on OpenBSD by chaining two kernel flaws. The main bug dates back about 37 years to the original BSD source code. According to Security researchers at Calif, the flaw survived because a shared memory attachment counter named shm_nattch used a signed 16-bit value. OpenBSD fixed both issues before […]

The post 37-Year-Old Kernel Flaw Exploited to Gain Root Access on OpenBSD — PoC Released appeared first on Cyber Security News.

A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The attackers altered users’ shell startup files to intercept the sudo command, then copied entered passwords to a file while passing them to the real command. This let […]

The post Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords appeared first on Cyber Security News.

Hackers have abused more than 20,000 Cloudflare Pages domains over six months to spread fake Microsoft security alerts and steer users toward scam call centers. The campaign uses Help Traffic Distribution System, or Help TDS, to route visitors from compromised websites, malicious ads, social media, and spam into tech support scams. The pages claim that […]

The post Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts appeared first on Cyber Security News.