Automated feed
Threat Wire
Aggregated every six hours from CISA KEV, NIST NVD, CISA advisories and trade reporting, then deduplicated and stored. Free to read, and it will stay that way, because these are links to other people's public work. What a membership adds is the analyst layer on top of them.
What “Exploited” means
Yesterday
- BLEEP
Global takedown hits network behind 1 billion phishing messages
A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]
- ARS
Anthropic warns small AI models could self-replicate through IoT devices
"Small weight-based replicators" could usher in a new generation of computer worms.
- REG
US tech giants warn Europe that ditching US tech giants could cost €115B
Amazon, Google, Meta among members of lobby group funding dire warnings over cloud sovereignty plans
- THN
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash
- REG
Python 3.15 goes global with UTF-8 support
Decades of cross-platform character corruption finally comes to an end for Windows coders
- THN
How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team
Cloned voices and synthetic video calls now show up in payment fraud, help desk resets, and access requests. A structured drill shows security teams exactly where verification breaks down, while nothing is at stake. The call comes in at 4:40 on a Friday. It's the CFO, or it sounds exactly like her, asking the controller to push a supplier payment out before the weekend because a deal closes
- BLEEP
Hirudo Android malware replaces banking apps to evade security checks
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]
- THN
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $
- ARS
The Internet’s undersea backbone is slipping into the danger zone
Elisabeth Braw’s book Undersea War on rising risks for undersea infrastructure.
- REG
Welcome to the lovely landlocked land of Luxembork, where the fares are free, and the terminals are techno
Tick, tick, tick, tick, ticket, ticket, tick tick
- THN
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
- ARS
OpenAI, Google pushing new AI models easily tricked into making nudes, researchers say
Attack method exposes flaws in OpenAI, Google safeguards against AI nudes.
- THN
An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
The bug was simple: the login let you choose where your sign-in code went. Proving it on a live website was the hard part. TL;DR During an authorized assessment, an AI pentesting agent found a critical authentication bypass on a major insurer's production website, on its own. One login request let the user choose where the one-time passcode went. The attack was the easy part. Proving it
- BLEEP
Microsoft: Recent Windows updates may trigger Remote Desktop failures
Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. [...]
- REG
KPMG tech and data boss tells staff facing the boot he's getting promoted
Paul Henninger shares news of his move up via email as around 200 colleagues prepare for redundancy
- REG
OpenAI engineer charged after boardroom bug found wrapped in toilet paper
FBI alleges covert recorder was plugged into a TV, with a second device later discovered in the employee's bag
- REG
The AI math isn't mathing as infrastructure spending forecast to outstrip expected revenue
Analyst predicts 80% of neoclouds will disappear as standalone businesses by 2030
- REG
UK government chases AI while aging IT leaves it exposed, PAC chair warns
Whitehall's digital staffing falls short of its own target as ministers leave the skills gap unresolved
- REG
It won't kill you, or humanity, to get off the AI upgrade treadmill
New models arrive so fast, we already have more new tech than it's possible to understand in a career
- THN
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of
- REG
Ransomware gets personal: 'We-know-where-you-are kind of stuff'
37% of ransomware attacks involve psychological or physical threats, global survey found
- THN
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug
Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities, including one that it said has come under active exploitation. These include 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server, and 22 in SQL Server. Of these, more than 670 relate to privilege escalation, followed by over 300 remote code
- THN
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room
A Saudi national and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to covertly record sensitive conversations. Abdulrahman Alfozan, 35, has been charged with using or endeavoring to use an electronic, mechanical, or other device to intercept oral communications. He was arrested by
Tuesday 13 October
- ARS
Martin Shkreli livestreamed himself violating lifetime pharma ban, FTC says
"I can always find a couple of biotech stocks to smoke," Shkreli said in a livestream.
- REG
Anthropic reinvents source control as Claude floods the world with code
When continuous integration gits you down, there's always an AI-tuned monorepo
- BLEEP
OpenAI engineer arrested for allegedly planting spy device in office
A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. [...]
- ARS
ESA targets Anbernic emulation handhelds as "superfake" piracy enablers
But third-party sellers, not Anbernic, are the ones routinely selling ROM-filled SD cards.
- ARS
Topgolf saved over $11.3 million after leaving VMware
Topgolf and VMware "ran deep" before the migration.
- BLEEP
Anthropic warns self-replicating AI could spread to your smart devices
Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. [...]
- REG
CISA director touts private partnerships after agency killed many
Nick Andersen wants to work with private industry on security, but the Trump admin has taken an axe to such efforts.