Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
44 stories match your filters.
A fake Claude Code 2.1.313 on Cursor's extension marketplace added an attacker SSH key, persistence and a reverse tunnel on up to 5,000 developer machines on Oct. 29. Update to 2.1.314 and check for the 'svc-telemetry' key.
CloudSEK says the Doorway botnet compromised 11,363 routers, cameras and servers in a month, mostly via blank or default passwords on MikroTik routers plus old RouterOS and Openfire bugs.
Huntress says attackers trick staff into enrolling PCs in attacker-run Hexnode and Rippling device-management tenants, then use them to install ScreenConnect as SYSTEM, and reinstall it when removed.
Kaspersky says an unknown group used NetamLoader, a near-fileless .NET loader that abuses a legitimate Patch My PC tool and hides in dllhost.exe, against a customized Windows 10 build used by governments in Asia.
Malicious code served through DebugBear's monitoring snippet hijacked logged-in Polymarket sessions on Oct. 29, selling positions and moving funds; estimates run from $2.19 to $2.71 million. Polymarket says users will be made whole.
NebuSec says answering a Telegram voice call could let an attacker run code on Android in versions 8.6.2 to 12.10.3. It's fixed in 12.10.4; Telegram disputes the risk and no CVE was assigned.
CrowdStrike says China-nexus Warp Panda used CVE-2026-41709, a VMware ESX insufficient-logging flaw, as a zero-day against US law firms. CISA added it to KEV with a Nov. 11 deadline.
Check Point's Yoba campaign pairs genuine signed OpenAI and Anthropic installers with a sideloaded DLL on fake GitHub AI-app pages, installing a hidden XMRig miner via a Telegram-seeded DGA.
Acronis TRU dissects Qilin's Rust encryptor, its password gate and the PowerShell routine that resets ESXi root passwords and encrypts every host, as the gang passes 900 claimed victims in 2026.
Fortinet patched critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator found by AI-assisted review, but won't publish CVEs until Nov. 10. Australia's ACSC says patch urgently.
ANY.RUN tracked the SkyW4lker kit across 173 domains: password-protected lures send Microsoft 365 users to the real device login page, where one typed code hands the attacker a token.
Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail.
Group-IB tracked seven Android trojan families behind fake bank 'protection plan' calls in India: nearly 18,000 phones infected and 7.6 million texts, including OTPs, intercepted.
Wiz says the Gheist campaign used stolen GitHub tokens to plant 13,500+ branches across 850+ accounts, each running a workflow that dumps repository secrets into Actions logs and deletes the run.
Sony Network Communications says an Oct. 19 intrusion exposed 2.59 million So-net and Docomo Hikari customer records, plus 54,401 email addresses with passwords. No card data was taken.
Cyberdione Labs' Tailworm report says flaws in Tailscale SSH's root-run forwarding let a permitted SSH user reach root-only sockets. Tailscale calls the issues serious and targets a patched client by Oct. 27.
GMO Internet says an attacker who breached Onamae.com Desktop Cloud used stolen logins to trade in customers' brokerage accounts and is now demanding money. GMO won't pay.
A cybersecurity incident forced UNM Health to divert ambulances from New Mexico's only Level 1 trauma center and cancel appointments at more than 30 clinics. The FBI is assisting.
CERT-UA warns attackers are hijacking Dahua cameras and recorders in Ukraine through Easy4IP P2P access, guessable serials, weak passwords and old auth-bypass bugs.
Arctic Wolf has seen more than 400 incidents where attackers mail-bomb a user, pose as IT on Microsoft Teams and get remote access via Quick Assist, a path to Black Basta, Cactus and Chaos ransomware.
DreamHost is forcing email, FTP and SFTP password resets in an ongoing incident and telling owners to remove unknown forwarding rules, but hasn't said what happened.
Sansec found a JavaScript loader in Magento CMS blocks on 953 stores since July 2025; the newest version fingerprints visitors so scanners see nothing, and PolyShell is the main way in.
Sansec says a Brazilian Magecart group planted a card skimmer in the Plausible analytics script every Convertr store loads, exposing checkouts at dozens of fashion brands Oct. 24 to 27.
Ransom-ISAC's analysis of leaked Silent Ransom Group files shows callback-phishing extortion of mostly US law firms via AnyDesk, with at least $43.95 million confirmed received.
Enclave's AuthMask bug let any Android app get work-account Microsoft Graph tokens from Authenticator by posing as Teams; Microsoft fixed it in 6.2606.4246 and says it wasn't exploited.