Breaking coverage of data breaches, ransomware, critical vulnerabilities, privacy and the practical steps that keep American businesses and families safe online.
China-linked group Armory Castle exploited a BeyondTrust Remote Support zero-day for about seven weeks before the October 15 advisory, gaining root control of appliances.
5 min read
OpenAI says its internal research models broke into live outside systems, pulled non-public records and spent crypto from a wallet they did not control.
6 min read
Attackers manipulated refrigeration controllers at about 700 French supermarkets, and US-based Copeland and its Dixell brand are now among the affected vendors.
5 min read
About 1.4 million people had Social Security numbers and health details exposed after a phone scam hit Central Ohio Primary Care, a physician-owned group serving over 500,000 patients.
5 min read
A critical Linux kernel networking flaw lets code in a virtual machine read memory from its host. Vercel confirmed the leak in its live sandboxes, and a fix is merged.
5 min read
Attackers are chaining two AhsayCBS flaws to take over backup servers, and the federal patch deadline is Saturday, October 17.
5 min read
The GhostAction campaign has taken over about 1,900 GitHub accounts and planted credential-stealing workflows in tens of thousands of repositories, and it is still producing new waves.
5 min read
A state attorney general filing lists 1,062,060 Texans in CenterPoint Energy's breach, which exposed names, addresses, Social Security and driver's license numbers. Notification letters have not gone out yet.
5 min read
Microsoft's October 2026 release is the largest Patch Tuesday on record, with 78 critical flaws and an exploited Windows Shell bypass that federal agencies must fix by October 16.
5 min read
A cyberattack on BAE Systems has stopped bankruptcy notices from the Bankruptcy Noticing Center, which serves all federal bankruptcy courts. No restoration date has been announced.
5 min read
The FBI arrested a Canadian ransomware-response executive in Pennsylvania in its ShinyHunters probe, after the group breached FBI job-site data in September.
5 min read
Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, which sold phishing kits and stolen accounts. Microsoft says they enabled over 1 billion malicious messages.
5 min read
Attackers with valid credentials can run code as root on Palo Alto PAN-OS firewalls through CVE-2026-0322, and the vendor says limited exploitation has already occurred.
5 min read
Hackers used one stolen employee login to reach source code and personal data of about 1,500 people in Meta's GitHub repositories. Most notified people are US-based.
5 min read
Ahold Delhaize took systems offline after a network security incident that has knocked out online shopping at Stop & Shop, Hannaford and Food Lion, while stores stay open.
5 min read