US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
CyberSN’s Cybersecurity Jobs Report provides visibility into the US cybersecurity job market. It’s a mixed bag.
Security Feed
Cybersecurity news & advisories
500 articles 48 of 48 sources updated RSS ↗
Trending
Cross-source coverage · last 72 h
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
Bleeping Computer
Cyber Security News
Huntress
SecurityWeek
The Hacker News
+2
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise
The Hacker News
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
4h ago
Bleeping Computer
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
21h ago
Cyber Security News
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
17 Oct
The Hacker News
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
17 Oct
Huntress
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
16 Oct
Bleeping Computer
Microsoft: October Windows update may break Smart App Control
16 Oct
SecurityWeek
Microsoft Patches Two Dozen RCE Flaws in Office
16 Oct
Bleeping Computer
Microsoft: Windows Server 2022 reached end of mainstream support
15 Oct
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
Bleeping Computer
CCCS Alerts & Advisories
Cyber Security News
Palo Alto Unit 42
The Hacker News
+2
A campaign against government organizations and state-linked infrastructure used AI-assisted scripts to steal credentials, maintain access to Linux servers and seek sensitive data, according to new research. The attackers altered users’ shell startup files to intercept the sudo command, then copied entered passwords to a file while passing them to the real command. This let a user’s request appear to work normally as the password was stolen. Unit 42’s investigation says the activity also involved web shells, custom malware, mailbox searches and attempts to erase evidence. The operation shows…
Cyber Security News
Hackers Use AI-Generated Scripts to Hijack Linux Sudo Commands and Steal Passwords
16 Oct
Palo Alto Unit 42
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
15 Oct
The Hacker News
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
15 Oct
CCCS Alerts & Advisories
SUSE Linux security advisory (AV26-1053)
15 Oct
Bleeping Computer
Fake Arch Linux packages push malware with root privileges
15 Oct
Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI
Cyber Security News
Malwarebytes Labs
SecurityWeek
Volexity
+1
Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The update also addresses one critical, six high-severity, and three medium-severity vulnerabilities. Google announced the update on October 15, 2026. Google is rolling out Chrome versions 155.0.8059.84/.85 for Windows and Mac, and version 155.0.8059.84 for Linux over the coming days and weeks. Users should install the update when it becomes available and check Chrome’s About page to…
Cyber Security News
Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI
17 Oct
Volexity
Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
16 Oct
SecurityWeek
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
16 Oct
Malwarebytes Labs
Update Chrome: Google fixes 37 security flaws, including seven critical bugs
15 Oct
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Microsoft Security
The Hacker News
The Register Security
CVE-2026-108465 ↗
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
The Hacker News
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
17 Oct
The Hacker News
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
16 Oct
The Register Security
Networking problems after the October 2026 Windows update? NTLM might be to blame
16 Oct
Microsoft Security
CVE-2026-108465 Windows Update Delivery Optimization Elevation of Privilege Vulnerability
16 Oct
How Multi-Campus Universities can Build a more Connected Security Program
Bleeping Computer
Cisco Security Advisories
Rapid7 Blog
SecurityWeek
+1
Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape : universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make it harder to share intelligence and coordinate response. Second, the compliance burden: overlapping requirements across FERPA, GLBA, HIPAA, and CMMC make it difficult to establish what data was affected, which reporting obligations apply, and how quickly the institution needs to act. This final part is about what changes when a university…
Bleeping Computer
Employees using personal ChatGPT at work? Here's what IT admins need to do
16 Oct
Cisco Security Advisories
Cisco Meraki Security Hardening Release: October 2026
15 Oct
Rapid7 Blog
How Multi-Campus Universities can Build a more Connected Security Program
15 Oct
SecurityWeek
Context Is King in the Fight Against Modern Cyberattacks
15 Oct
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
CCCS Alerts & Advisories
Infosecurity Magazine
The Hacker News
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by
CCCS Alerts & Advisories
Google security advisory (AV26-1060)
16 Oct
The Hacker News
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
16 Oct
Infosecurity Magazine
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
16 Oct
CCCS Alerts & Advisories
Google security advisory (AV26-1045)
15 Oct
Drupal patches critical RCE flaws, warns exploits may emerge soon
Bleeping Computer
CCCS Alerts & Advisories
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
CCCS Alerts & Advisories
CISA Alerts & Advisories
SecurityWeek
CVE-2026-102764 ↗
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizations using older versions must upgrade first. Cyber threat actors are actively exploiting the vulnerability to gain initial access, then establishing persistence, escalating privileges, and moving laterally. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 16, 2026. CISA urges organizations with affected self-hosted…
CCCS Alerts & Advisories
AL26-025 - Critical vulnerability impacting BeyondTrust Remote Support – CVE-2026-102764
16 Oct
CISA Alerts & Advisories
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
16 Oct
SecurityWeek
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
16 Oct
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
CCCS Alerts & Advisories
SecurityWeek
The Hacker News
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could
Proofpoint lines up $6.3 billion deal for Varonis’ data security
CyberScoop
SecurityWeek
The Record
Cybersecurity giant Proofpoint says it will acquire Miami-based data visibility and security company Varonis in an all-cash transaction worth $6.3 billion.
Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers
Bleeping Computer
Cyber Security News
CVE-2026-110447 ↗
Hackers are exploiting a critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud, with users reporting web shells on compromised servers. Tracked as CVE-2026-110447, the vulnerability allows remote attackers to run operating system commands without logging in. It affects the richdocumentscode app before version 26.4.303 and carries a CVSS v4 score of 9.2. The GitHub Advisory Database entry states that attackers exploited the flaw during September and October 2026. An October 3 warning on the Nextcloud community forum reported that users had found web shells on their…
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
CCCS Alerts & Advisories
Dark Reading
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Bleeping Computer
The Hacker News
CVE-2026-103849 ↗
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
CISA Alerts & Advisories
The Hacker News
CVE-2025-61624 ↗
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a
Cybersecurity incident at BAE Systems disrupts US bankruptcy court system
CyberScoop
Infosecurity Magazine
A cybersecurity incident at BAE Systems has halted the production and delivery of bankruptcy notices for every federal bankruptcy court in the United States, disrupting a core administrative function of the judiciary with no announced date for restoration. The Bankruptcy Noticing Center, known as the BNC, produces and transmits notices in bankruptcy cases nationwide. BAE Systems, a defense contractor, operates the center’s systems and websites on behalf of the federal judiciary. In a statement published Thursday , the Administrative Office of the U.S. Courts said the incident affected BAE’s…
New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords
Bleeping Computer
Cyber Security News
A newly analyzed Android remote-access Trojan called YuanKong can watch and control a victim’s phone, capture passwords and payment PINs, and send stolen information to operators. Rather than relying on access to text messages or contact lists, it uses Android’s Accessibility features and screen controls to observe what people do inside apps, including banking and payment apps. Researchers warn that this approach can expose sensitive information even when the user is interacting with a genuine app. The malware is also built to stay active and give operators control from afar. Its capabilities…
Latest
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application…
OpenCode Security Breach Exposes Third-Party API Keys of its Console Users
OpenCode has disclosed a security breach affecting 1.4% of its Console users, warning that third-party API keys saved in affected workspaces may have been exposed. In an October 17 statement, the company linked the…
Claude AI Solves 25-Year NSA Cryptography Mystery in Just 30 Minutes
Anthropic says an internal Claude research model has traced the origins of five NSA-supplied elliptic curve seeds in under 30 minutes, answering a cryptography question that remained open for roughly 25 years. The…
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
This Might Be the Earliest Known Spear Murder In Earth’s History
Welcome back to the Abstract! Here are the studies this week that lived and died by the spear, drew unequal lots, paged Fox Mulder, and peered at an alien moon. First, scientists discover a mortal spear wound in a…
Encryption Is Getting Squeezed From All Sides
Canada’s planned surveillance law is the latest grim step in a series of threats to encryption that are spreading around the world.
Cybercrims go beyond stealing data to attack physical building systems
Late Sunday night, a still-unknown cybercriminal or group hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food, and sparking fires…
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package…
Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel
Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets.
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, giving them access through a trusted backup application. The incident shows how one leaked vendor…
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly…
Google Fixes 10 Chrome Vulnerabilities, Including Memory Corruption Flaw Found With Claude AI
Google released a Chrome Stable security update fixing 10 vulnerabilities across Windows, Mac, and Linux, including a high-severity DOM memory corruption flaw reported by Xinyang Ge of Anthropic with Claude AI. The…
Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers
Hackers are exploiting a critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud, with users reporting web shells on compromised servers. Tracked as CVE-2026-110447, the vulnerability allows remote…
OpenAI Confirms Its AI Model Hacked Government Website While Counting Hospital Beds
OpenAI has confirmed that an internal AI model hacked an unnamed government statistics website while trying to count hospital beds. The June 17, 2026 incident started as a data task during reinforcement-learning…
Federal agencies recommend cyber controls, independent testing for frontier AI systems
The federal government is advising AI companies to set more industry standards for securing agents in sandbox testing environments. In joint guidance from the Cybersecurity and Infrastructure Security Agency, the…
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
ConnectWise (SkyKick) vendor credentials are being abused to access Microsoft 365 tenants. Disable the apps now and check your logs here.
Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact
New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I…
OpenAI models hacked a crypto wallet and breached more websites
OpenAI said internal models hacked two more websites, bypassed company-imposed browsing restrictions, and used exposed credentials to draw cryptocurrency from a wallet it couldn’t otherwise access, in the latest…
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.
Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk
Campaigns that impersonate popular AI brands are on the rise, and they typically use ClickFix-like tactics to target unsuspecting enterprise employees.
Biomemory Launches DNA Shield, First Commercial Product Built on Its Molecular IT Platform
The launch follows the acquisition of catalog's assets and the appointment of Laurent Guengant as CEO earlier this year.
Enterprise AI Enters Risk Management Phase as Security Concerns Rise
Companies are increasingly discovering that the challenge with AI is no longer adoption, but execution.
AI Takes Control of Robotic Arm in 16 Minutes Flat
Most OT devices at utilities, factories, and elsewhere have been deployed for a decade or more, but operators need to get agile and deploy new cyber defenses.
Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP
Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google Chrome and…
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and…
Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing
Targeted ads installed Candiru spyware in zero-click attacks
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device.
Prolific Chinese espionage group exploits BeyondTrust zero-day
Suspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers have traced back to late August. Mandiant…
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup…
Behind the Blog: Doing Whatever
This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top stories of the week came together. This week, we discuss a new pod setup, video games, and Elon's spending habits. JASON…
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an…
Managing open-weight model risk in enterprise deployments
The growing AI landscape is giving enterprises more choice in how they build, customize, and deploy increasingly capable models. Open-weight models are an important part of that landscape. They give enterprises access…
Podcast: Cops Can Use AI to Pinpoint Your Home with Just One Photo
We start this week with Joseph’s article about Raven, previously known as Geospy. This is an AI tool that can geolocate photos, and now says it can pinpoint a specific house based just on one photo taken inside. After…
Networking problems after the October 2026 Windows update? NTLM might be to blame
The October 2026 Windows security update may break networking for some customers who are still clinging to long-deprecated NTLMv1 security. A seemingly minor change in the update could have major implications for…
Cybersecurity incident at BAE Systems disrupts US bankruptcy court system
A cybersecurity incident at BAE Systems has halted the production and delivery of bankruptcy notices for every federal bankruptcy court in the United States, disrupting a core administrative function of the judiciary…
Proofpoint lines up $6.3 billion deal for Varonis’ data security
Cybersecurity giant Proofpoint says it will acquire Miami-based data visibility and security company Varonis in an all-cash transaction worth $6.3 billion.
Hackers Use New ROMULUS ClickFix Platform to Deliver Malware and Evade Security Detection
Hackers are using a newly identified platform called ROMULUS to deliver malware through ClickFix traps, combining hidden PowerShell scripts, altered software installers, and encrypted archives. The platform supports…
Here’s What Telegram Giving Data to the U.S. Government Looks Like
This article was produced in collaboration with Court Watch , an independent outlet that unearths overlooked court records.
Eiliko robot companion exposes private chats and can be hijacked
The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says. According to The Verge…
In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit
Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow flaw under attack.
New YuanKong Android RAT Hijacks Phones to Steal Banking PINs and Passwords
A newly analyzed Android remote-access Trojan called YuanKong can watch and control a victim’s phone, capture passwords and payment PINs, and send stolen information to operators. Rather than relying on access to text…
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum test network…
37-Year-Old Kernel Flaw Exploited to Gain Root Access on OpenBSD — PoC Released
A proof-of-concept exploit that gains root access on OpenBSD by chaining two kernel flaws. The main bug dates back about 37 years to the original BSD source code. According to Security researchers at Calif, the flaw…
No articles found
Try adjusting your search, category, tags, source selection, or date range.