US Government Email Systems Open to Abuse Thanks to Typos
Erroneous or outdated DNS records can give attackers surprising powers over organizations' email systems.
Latest
Phishing
Fake OpenAI, SpaceX events used to steal Microsoft, Google accounts
Hackers are using fake OpenAI, SpaceX, and Anthropic event invitations to lure employees into phishing attacks, using two different phishing-as-a-service platforms to steal Microsoft and Google account credentials and…
Phishing
What We Missed: Knicks Phishing Test Goes Out of Bounds
In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from an ill-conceived phishing simulation to a hacktivist attack on a US government agency.
The White House is apparently a popular residential proxy exit spot
How it got there is another matter entirely
Social media giants sue California to overturn law shielding kids 15 and under from compulsive use
Google, Meta and TikTok each filed suit in federal court against an incoming California law that blocks platforms from deploying features considered “psychologically exploitative.”
Data Breaches
Nearly 1.5 million exposed secrets targeted in new revocation program
Truffle Security has launched the Secrets Revocation Program, a free initiative that helps API key issuers revoke 1.4 million publicly exposed secrets that remain valid. [...]
US issues more sanctions against Prince Group scam center affiliates
The sanctions target four people and 41 companies linked to the Prince Group — a Cambodian company accused of running a billion-dollar scam operation.
APT & Nation-state
APT29's Watering Holes Target Thousands of Mobile Users
After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones.
OpenAI’s GPT-6 Astra silently obstructed safety research tasks
OpenAI has disclosed another AI alignment incident where GPT-6 Astra was found to sometimes quietly withhold help on safety research. [...]
Air Force cyber official: need to invest in digital forensics
Wanda Jones-Heath said it’s key to keeping pace with incidents and threats, speaking at a Datadog event Thursday.
Harden cooling systems now, feds warn critical infrastructure operators amid attacks
The U.S. government on Thursday called on critical infrastructure operators to safeguard their cooling systems following hacks that have caused chaos in European supermarkets in recent weeks.
Vulnerabilities
OpenBSD security advisory (AV26-1130)
Serial number: AV26-1130Date: November 5, 2026 As of November 5, 2026, OpenBSD is affected by a vulnerability in the following product: OpenSSH Prior to 10.6p2 The Cyber Centre encourages users and administrators to…
Bring a tent, I've got the coffee: Lessons from it-sa
Thorsten may have had to camp out in Nuremberg to attend it-sa, but the real story is the initiative to add a formal IT Security apprenticeship program in Germany for the thousands of young hackers ready to join our…
US government warns of ‘ongoing cyber threat’ amid mass hacks of industrial retail and military freezers
A joint U.S. government statement says the hacks are affecting the food, transportation, and healthcare industries after reports of global mass hacks.
Vulnerabilities
Get root on a musl Linux system by slamming it with an overly long password
Decade-old vulnerability in OpenSSH is now fixed, so get a-patchin'
October crypto-tracker hack: Access cracked, law enforcement tokens packed
Agentic 'on-path attack' went after Chainalysis's tools, which are routinely called upon to assist police investigations
Vulnerabilities
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an…
Vulnerabilities
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.
New investments to reduce on-premises security risk
We’re announcing a new on-premises security initiative, bringing together guidance, migration, and product investments.
APT & Nation-state
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign
Russian state-linked hackers targeted users in Ukraine, the United States and Europe in a campaign to steal sensitive information from iPhone and Android devices, researchers found.
What’s new in Microsoft Security: November 2026
Microsoft Security’s November 2026 updates strengthen AI agent security, least privilege, threat protection, and exposure management.
OpenAI releases GPT-6 Cyber, and promises this one stays within 'rules of engagement'
The latest bug hunting model 'avoided exploiting out-of-scope services over 99 percent of the time', claims House of Altman
OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrails
After a summer of sandbox escaping hacks, OpenAI said their new model was trained to be more cautious around user intent and less sensitive to “reward hacking” behaviors.
SecurityDataPipeline.com Launches as a New Educational Resource for the AI Era
The ungated resource explains how security data pipelines reduce SIEM ingestion costs, preserve detection coverage, and prepare the data layer for AI-driven security operations.
Vulnerabilities
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name…
Vulnerabilities
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT. Lockdown Mode was introduced by the artificial intelligence…
Malware
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]
Data Breaches
DigiCert data breach exposes customer information, identity documents
DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. [...]
Tobacco company got smoked by leaving secret recipes on a file share
They denied the data was real...then removed it
