Threat Wire

Today30

1. REG16:45

   Smartphone shipments plummet as memory crisis pumps up prices

   AI's appetite for components hammers budget handsets, with analysts seeing little relief before 2028

2. REG16:15

   Workday wants a slice of customers' labour budget that its AI agents could replace

   CEO eyes usage-based billing as automation pushes HR software vendor beyond traditional IT spending

3. THN16:01

   Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

   Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background. The Citizen

4. THN16:00

   Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

   The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives

5. REG15:45

   TinyLittleOffice, where the link is the document

   For those times when a full-fat editor is overkill

6. REG15:13

   KDE hits 30, decides it's time to move out of the X11 era

   Wayland-only Plasma 6.8 heads for Kubuntu 'Tenacious T-Rex' early next year

7. REG15:00

   When faster supercomputers aren’t enough

   PARTNER CONTENT: A million reasons why advanced computing matters for genomics

8. REG14:31

   Spyware vendors found a way to make targeted ads even worse

   Israeli adtech outfit allegedly helped spyware vendors infect phones while enjoying Google's seal of approval

9. THN14:11

   Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams

   A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting

10. BLEEP14:01

    Is AI pentesting as good as a human pentester?

    AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing. [...]

11. REG13:45

    Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified

    CEO said the workers were hired in Q2 and are still helping today

12. BLEEP13:18

    Microsoft: Windows Server 2022 reached end of mainstream support

    Microsoft announced that Windows Server 2022 has reached the end of mainstream support and will remain in extended support until October 2031. [...]

13. REG13:15

    TSMC sends scouts to check whether America's datacenters can deliver

    Silicon giant budgets up to $64B for expansion while keeping an eye on construction progress and power supplies

14. THN12:58

    NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

    NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit. A fourth lets an attacker forge a TLS session that could

15. REG12:45

    X purges 13,000 accounts linked to suspected meddling ahead of US midterms

    Platform points to Iran, Russia, and China but provides no public evidence for attribution

16. THN12:28

    Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

    Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images. The fixes are in

17. REG12:15

    Rocket Lab pushes back first Neutron launch to 2027

    Carbon composite woes cause another delay for Peter Beck's Hungry Hippo

18. BLEEP11:55

    Police arrests 95 suspects in international CSAM crackdown action

    Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. [...]

19. THN11:46

    Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early

    Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026. The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets. Similar attacks

20. REG11:46

    OpenAI claims 100-plus secret files followed ex-employee back to Apple

    ChatGPT maker turns tables in Apple's trade secrets lawsuit, claiming confidential hardware plans made their way back to Cupertino

21. REG11:23

    Legal Aid Agency hackers made off with records dating back to 1978

    Nearly 50 years of data caught up in breach, with probation service records also among the haul

22. THN10:42

    India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1

    The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls. To that end, the Department of Telecommunications has issued a circular urging service

23. REG10:30

    US Air Force pilots used malware-laden USB drives to plan Afghanistan missions

    The term military intelligence seems like an oxymoron in this case

24. REG10:00

    Japanese consortium bets on building bobbing bit barns

    Four firms believe server farms on barges in ports will help solve the problem of finding suitable sites

25. REG09:15

    UK keeps AI safeguards in the maybe pile for Cyber Security BIll

    Officials say amendments remain under consideration despite minister's pledge to act

26. BLEEP09:10

    Microsoft fixes bug causing Windows black screens, Explorer crashes

    Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. [...]

27. THN08:45

    GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

    The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan

28. REG08:30

    Royal Navy goes fishing for suppliers to build its Type 93 robot submarine

    Preliminary notice seeks XLUUV builders, payload makers and AI developers, with Excalibur and Herne the obvious candidates

29. BLEEP08:06

    UK Legal Aid Agency: Hackers stole records dating back to 1978

    The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. [...]

30. REG07:30

    Metropolitan Police's unchecked use of shoplifting platform lands force in trouble with data watchdog

    Officers unlawfully uploaded 179 people's details to Auror without required privacy checks or corporate approval