-
Security researchers earned $1,262,000 at Pwn2Own Ireland 2026 after demonstrating 98 zero-day vulnerabilities over three days. The competition tested smartphones, AI products and other connected technologies through controlled hacking attempts. Ikotas Labs finished first with 42.5 Master of Pwn points and $361,000 in rewards. Its successful demonstrations included the Samsung Galaxy S26, OpenAI Codex, Oracle…
-
The FBI has seized seven domains supporting hacking tools allegedly used by Chinese state-sponsored attackers to compromise organizations worldwide. The Flax Typhoon disruption targeted infrastructure behind MicroScan and FishHub, two platforms linked to vulnerability scanning, network intrusions and data theft. U.S. authorities attribute the platforms to China-based Integrity Technology Group, which they say holds Chinese…
-
An IDCF Cloud ransomware attack has disrupted services used by 495 companies and local governments in Japan. Operator IDC Frontier shut down affected infrastructure after detecting the incident in its East Japan Region 1 environment. The company says the attack began at 3:40 a.m. local time on October 7. Investigators are still determining how the…
-
Some low-cost Android smartphones have reached customers with Midnight Mimosa malware embedded in their firmware. The malicious software can silently install applications, generate fraudulent advertising activity and turn infected phones into residential proxies. Bitdefender researchers identified thousands of affected devices across more than 150 countries over roughly two years. Mexico, France, Italy, the United States,…
-
The FakeGit malware campaign has resumed operations, using 17,610 malicious GitHub repositories to distribute SmartLoader. The latest wave uses the loader to deliver StealC, malware designed to steal information. Researchers at software supply-chain security firm Apiiro traced the renewed activity to October 4. Although the operation relies mainly on disposable accounts, they also identified at…
-
Five critical Cisco Nexus flaws could let attackers execute code with root privileges on affected data center switches. Cisco has released security updates to address the vulnerabilities in its NX-OS operating system. Attackers could also crash processes and trigger device reloads, disrupting network services even when attempts to execute code fail. However, exposure depends on…
-
Three more Samsung Galaxy S26 hacks featured on the second day of Pwn2Own Ireland 2026. Across the day’s competition, researchers earned $232,500 after exploiting 45 unique zero-day vulnerabilities in multiple products. The successful phone demonstrations came from KAIST Hacking Lab’s Kyeongmin Kim, PetoWorks, and a team comprising Dimitrios Valsamaras, Ken Gannon and CENSUS Labs’ Tenia…
-
The FBI has warned that FortiBleed attacks continue to target internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways. In some incidents, attackers take control of administrator accounts and prevent legitimate users from managing their devices. The campaign relies on stolen or compromised credentials to gain access. Meanwhile, the FBI says the attack chain has provided…
-
Attackers hijacked several Google domains and obtained unauthorized HTTPS certificates after compromising third-party domain operators. The Google domain hijacking incidents affected country-code domains for Ghana, Sierra Leone and American Samoa. Other organizations also suffered domain hijacks within the .GH, .SL and .AS namespaces. However, Google said the attacks did not compromise its own systems. The…
-
Microsoft will begin blocking Outlook MSIX attachments by default in November 2026, introducing new restrictions for Windows installation packages. The change affects Outlook on the web and the new Outlook for Windows for Exchange Online users. The rollout should begin in early November and reach general availability by the middle of the month. Microsoft expects…