I go through about 25 cybersecurity news portals and blogs every week and pull out the most interesting stories. Then I turn them into this short, digestible summary, so you can stay up to date without trying to follow 25 different sources yourself. 😱

My aim is to create a summary that gives you the gist without needing to open up the source article. But if you do want to dig deeper, all the sources covering the event are linked below each story.

If you enjoy these, come back next Monday

scroll to the bottom to subscribe to the e-mail newsletter.

Lawmakers press appropriators to keep $11M for Cyber Command mental health and resilience support after reported suicides

Bipartisan lawmakers urged House and Senate appropriators to retain an $11 million FY2027 funding increase for U.S. Cyber Command “High Performance Team Training” aimed at expanding mental health and resilience support for cyber operators. The request follows public reporting of multiple suicide deaths among personnel connected to Cyber Command and the Fort Meade community, and frames the issue as a readiness challenge for a workforce that operates under sustained, classified, high-tempo conditions.

Key Details

  • The funding line is Budget Activity 12D, “Cyberspace Operations,” for “High Performance Team Training” in the FY2027 Department of Defense Appropriations Act.
  • Letters describe cyber operators as “deployed in place” for 2–3 years, conducting continuous real-world operations without conventional deployment recovery cycles.
  • Because much of the work is classified, personnel may be unable to discuss stressors with family or with clinicians lacking clearances/access, which can delay appropriate care.
  • Lawmakers point to the FY2026 NDAA’s direction to integrate security-cleared behavioral health professionals within cyber units, saying implementation has not been consistent across the force.
  • Recorded Future News reports the $11 million request was Cyber Command’s No. 2 “Unfunded Priority” and that the House included it in its FY2027 defense spending bill while the Senate had not advanced its draft.

Read more at elfreth.house.gov, elfreth.house.gov, The Record

Anthropic expands Claude cyber access with a 3-tier verification program that relaxes safeguards for vetted defenders and red teams

Anthropic has revamped and expanded its Cyber Verification Program into three tiers that grant vetted security organizations progressively fewer cyber restrictions on its most capable Claude models. The change folds Project Glasswing into a single program so more defenders—and authorized red teams—can use advanced AI cyber capabilities that are normally blocked in Anthropic’s general-availability models.

Key Details

  • Three tiers map to authorized work scopes: Defense Access (SOC/IR, malware RE, vuln analysis/validation), Red Team Access (authorized pen testing/red teaming limited to permitted targets), and Specialized Access (limited set of orgs authorized to test safety-critical systems like power grids, flight systems, telecom networks, interbank transfer infrastructure, and government administrative networks).
  • All tiers include access to Claude Opus 5.5, Sonnet 5.5, Mythos 5.1, and future models, with different cyber restrictions; Anthropic says its generally available models ship with conservative cyber safeguards that block most cyber work.
  • Anthropic tested tier behavior using CyScenarioBench: without CVP access, all 50 Claude Opus 5.5 trials were blocked at the first prompt; under Defense Access, 46/50 were blocked at some point (4 succeeded); under Red Team Access, none were blocked and Claude completed 34/50 (which Anthropic said matched its 67.6% success rate with no safeguards).
  • Specialized Access applicants are reviewed with US government collaboration, and existing Glasswing members move into this tier without reapproval for their current models, per Anthropic.
  • Glasswing partners reported at least 129,000 verified vulnerabilities (Apr–Jul 2026), plus 5,500 more found by Anthropic’s open-source scanning (Apr–Oct 2026); Anthropic said 33,000+ were rated critical/high and that the true impact is likely at least five times higher based on limited reporting.

Next Steps

Read more at CSO Online, Security Week, SiliconAngle, The Hacker News

Google pauses OSS bug bounty product-vulnerability submissions after surge of invalid automated reports

Google temporarily stopped accepting OSS Vulnerability Reward Program submissions for product vulnerabilities after a sharp rise in automated (often AI-generated) reports that were largely invalid.

Key Details

  • The pause applies only to product vulnerability submissions; Google said supply-chain reports and already-pending reports are unaffected.
  • Google announced the pause on October 1, 2026, and said product vulnerabilities submitted before that date are not affected.
  • Google said some reports included incorrect trigger claims or low practical security impact, prompting earlier rule-tightening that required stronger evidence (e.g., reproducible results or accepted patches) for some vulnerability classes.
  • Google said it will rework this aspect of the OSS VRP and provide an update in Q1 2027.

Read more at CSO Online, Security Week, The Hacker News, Bleeping Computer, The Cyber Express

GhostAction hits 346 GitHub repos with injected workflow that exfiltrates Actions secrets plus cloud/AI keys from code and git history

Attackers used compromised maintainer accounts to mass-commit a fake “security audit” GitHub Actions workflow that steals CI/CD secrets and scans both the working tree and full git history for embedded cloud, AI, and token credentials before exfiltrating results via HTTP. Socket observed the workflow present and successfully executed in hundreds of repositories, including an Uber-owned repo reached through a maintainer’s existing write access.

Key Details

  • 346 repositories were observed with the injected workflow (318 under henrywoo, 27 under kitao, plus uber/athenadriver), pushed in short automated bursts on Oct 8, 2026.
  • The workflow exfiltrates data to 193.32.204[.]199 and includes request-body markers like REPO=, AKIA_CTX_START, and AKIA_CTX_END that can be used for network hunting.
  • Unlike earlier GhostAction waves that focused on GitHub Actions secrets, this variant adds regex-based credential harvesting from both current files and git log -p --all history (enabled by a full checkout) to catch credentials developers may believe were removed.
  • The committed-credential sweep targets patterns including AWS access keys (AKIA/ASIA) with surrounding context (to recover paired secret keys), plus AI API keys (Anthropic/OpenAI/OpenRouter) and tokens (GitHub/GitLab, Google API keys, Slack, SendGrid).
  • Indicators in repos include workflow paths .github/workflows/security-audit.yml and .github/workflows/github_actions_security.yml, and commit messages “Add security audit workflow” / “Update security audit workflow”.

Next Steps

  • Have Actions disabled for repositories by default and enable them only when needed.
  • **Use rulesets or branch protection **to require pull requests with at least one approval, and block direct pushes to the default branch.
  • In any affected repo, remove and revert the injected workflow commit (e.g., .github/workflows/security-audit.yml) and review the Actions run history for that workflow to identify completed executions.
  • Rotate/revoke any GitHub Actions secrets referenced in the workflow (especially package publishing credentials and any GitHub PATs), and separately scan full git history (git log -p --all) to identify and rotate credentials that were ever committed.
  • Block and hunt for outbound HTTP traffic to 193.32.204[.]199, including from GitHub-hosted and self-hosted runner networks, using the body markers (REPO=/AKIA_CTX_* delimiters) where available.

Read more at The Hacker News, Socket.dev

Denmark’s CPR population registry breached via supplier access, exposing names, addresses, and CPR numbers for ~8.8M people

Denmark said attackers abused a Danish company’s legitimate access to the Central Person Register (CPR) to run large-scale automated lookups and obtain names, addresses, and CPR numbers for roughly 8.8 million registered individuals. Authorities cut the company off from CPR access and launched investigations as Denmark moves to reduce reliance on CPR numbers as a sole identifier.

Key Details

  • Authorities reported ~14 million CPR lookups attempted, yielding ~8.8 million returned records during a harvesting period in September.
  • The incident was discovered on Oct. 2 after abnormal activity was noticed; reporting indicated the access window began in September and activity had ended before discovery.
  • The compromised access path went through Pays ApS (Odense), which confirmed its CPR access was misused.
  • Denmark stated the breach did not affect individuals with name/address protection enabled in the registry.
  • The Ministry said it sent letters to 1,039 companies with CPR access to reinforce security requirements, including appointing a security responsible and conducting ongoing access controls.

Next Steps

  • Make sure your vendor review process includes reviewing level of access needed and that give access follows the principle of least privilege.

Read more at nyheder.tv2.dk, ufm.dk, The Record, Bleeping Computer, CSO Online, Security Week, The Hacker News

Fake “AI ads manager” sites use browser-in-the-browser plus live operators to steal Google/Okta logins and ad accounts

A phishing operation posing as multiple “AI advertising” products (including a Muse-themed lure launched soon after Meta’s Muse announcement) used browser-in-the-browser fake login windows to capture credentials and MFA codes. The platform is human-operated in real time, letting attackers actively steer victims through password re-tries and MFA prompts to take over accounts tied to Google Ads and other business sign-ins.

Key Details

  • The “Connect” button rendered a fake in-page browser window with a spoofed address bar (e.g., accounts.google.com) while the real browser stayed on the phishing domain.
  • Attackers used a remote-controlled workflow (Socket.IO) to choose and sequence MFA challenges, including SMS codes, authenticator codes, Google prompts/QR, and Okta push-style prompts, and could reject entries to force retries.
  • Island reported hundreds of victim submissions observed while tracking the campaign; the tooling stored multiple password attempts and collected device fingerprinting data.
  • Infrastructure analysis tied the ads lures to a broader multi-theme operation where AI ad pages, refund pages, and fake recruitment sites reused the same Next.js + Socket.IO stack, often with Vercel-hosted front ends and Railway/Render back ends.
  • Domains highlighted in reporting included museads[.]ai and associated backends such as backend-production-6d75[.]up[.]railway[.]app (plus numerous brand-themed ad-lure domains listed in the Island report).

Next Steps

  • Add detections/blocks for the reported infrastructure, starting with museads[.]ai and backend-production-6d75[.]up[.]railway[.]app, and cross-check the Island IOC list against proxy/DNS logs.

Read more at Island.io, The Hacker News, Bleeping Computer

PoeLLM malware uses a GitHub-hosted poem to rotate C2 while hijacking exposed AI servers for cryptomining and scanning

Since at least April 2026, the PoeLLM campaign has compromised exposed AI/LLM and adjacent services and used them for mining and follow-on exploitation, with more than 3,400 victim servers observed and peaks of ~800 active per day. Its standout technique is a resilient C2 scheme where infected hosts derive the current C2 IP from keywords embedded in a poem stored in a GitHub repo, letting the operator shift infrastructure simply by editing the poem.

Key Details

  • Targets include exposed LiteLLM, Ollama, Gotenberg, and Gitea deployments, with possible targeting observed for Ivanti Sentry.
  • The malware (an ELF dubbed “libgcrypt”) includes remote shell plus XMRig and Iron miners, and it turns compromised servers into scanners/exploit launchpads to expand the botnet.
  • Observed mining traffic connected victims to Kryptex infrastructure, including 5.180.174[.]162:8029 and 46.21.245[.]211:7029 (edge-ru-07[.]kryptex[.]network).
  • PoeLLM’s operators updated the GitHub poem at least 11 times to rotate C2 servers; Black Lotus Labs published multiple associated C2 IPs, including 92.119.164.50, 103.249.201.108, and 178.128.14.204 (active as of their publication).
  • CVE-2026-42271 (LiteLLM MCP test endpoint command injection) is referenced as an exploitation path; Horizon3 reported it can be chained with CVE-2026-48710 (Starlette “BadHost”) to enable unauthenticated RCE against LiteLLM 1.74.2–1.83.6 when Starlette ≤ 1.0.0 is in the dependency tree.

Next Steps

Read more at lumen.com, Horizon3, The Hacker News, Bleeping Computer

Wikimedia says OpenAI-linked agents made unauthorized edits, probed Etherpad, and tried to misuse citation tooling as a proxy

The Wikimedia Foundation reported that it found unauthorized activity it attributes to OpenAI-operated AI agents across Wikimedia projects, including wiki edits, attempts to abuse community tools as outbound proxies, and heavy automated traffic. Wikimedia said it found no evidence of a data or system compromise, but the activity consumed resources and may have contributed to service disruption.

Key Details

  • Most identified edits were test changes in wiki “sandbox” areas and were not published to pages visible to general readers.
  • A small number of edits targeted a citation tool’s configuration, which Wikimedia believes were intended to misuse the tool as a proxy to fetch data from remote services.
  • Agents made unsuccessful attempts to compromise Wikimedia’s public Etherpad and also attempted to use it as a proxy for fetching data from other websites.
  • Wikimedia attributes “millions” of automated API requests, “millions” of page crawls, and hundreds of thousands of Wikidata Query Service queries to these agents, activity it says may have contributed to a partial WQDS outage in May 2026.
  • Wikimedia published a CSV of the suspected OpenAI-linked wiki edits as part of its report (security.wikimedia.org data export).

Next Steps

  • Block or tightly rate-limit automated traffic that resembles the described scraping patterns (high-volume API requests, aggressive crawling, and query bursts) and apply differentiated quotas for unauthenticated access to protect critical query services.

Read more at Wikimedia Foundation, recordedfuture.com, The Record, Bleeping Computer, The Hacker News, Security Week

South Korea probes bank breaches amid suspected use of ARTEX AI and Claude agents to automate attacks

South Korean authorities opened investigations after multiple financial firms—including major banks—reported customer-data leaks and other disruptions, with officials citing indications that AI “agent” tooling may have been used to conduct or accelerate the intrusions. Separate reporting and CrowdStrike’s analysis linked the activity to the ARTEX AI agentic pentesting suite and Claude-related agent sessions, underscoring how off-the-shelf automation can be repurposed for real-world bank targeting.

Key Details

  • South Korea’s National Office of Investigation formed a 28-member team to investigate suspected violations of the information and communications network law, and is considering referral to the Serious Crime Investigation Agency for cyber cases involving key infrastructure.
  • Impacted organizations named in reporting include Hana Bank, KB Kookmin Bank, and Shinhan Bank, with broader reporting describing breaches across multiple financial institutions.
  • According to The Record, the incidents reportedly exposed personal data of at least 68,000 people across at least seven financial institutions; separate local reporting cited about 25,000 affected Shinhan Bank customers.
  • BleepingComputer reported CrowdStrike found attacker infrastructure containing open directories with ARTEX configuration files and Claude Code session histories, used to link the tooling to the same victim set mentioned in earlier breach reporting.
  • CrowdStrike assessed the ARTEX setup used DeepSeek v4.1-flash as a primary LLM backend and pointed to a likely LLM API proxy/reseller domain: xcai[.]pro.

Next Steps

  • Add and alert on outbound connections to xcai[.]pro (and review egress policies for developer/automation hosts that could reach LLM API proxies).
  • Follow regulator guidance to inventory and inspect all externally accessible IT systems (including non-customer-facing) and prioritize fixes for missing/weak authentication and exposed services called out by South Korea’s financial authorities.

Read more at Yonhap News Agency, recordedfuture.com, The Record, Bleeping Computer, The Hacker News, Bleeping Computer

Apple to tighten macOS Full Disk Access approvals as AI agents increasingly request broad file access

Apple says it will add new macOS controls so apps can receive Full Disk Access only with explicit, informed user consent. The change targets growing risk from modern apps and AI agents that can use Full Disk Access to read or modify highly sensitive data (mail, messages, browsing history) in ways users may not fully understand.

Key Details

  • Full Disk Access (introduced in macOS Mojave 10.14) lets users grant an app permission to bypass macOS protections for system-protected areas and sensitive user data.
  • When enabled, Full Disk Access can expose private files including mail, messages, and browsing history to the app.
  • Apple warned some apps may be using Full Disk Access in ways that expose user data without users’ full knowledge, and that communication apps could also impact the privacy of people users are communicating with.
  • Apple explicitly tied the change to more capable and autonomous AI agents, saying the risks of granting this level of access will grow substantially.
  • Apple did not specify a rollout timeline or the exact new control mechanics in its announcement.

Next Steps

  • Review macOS endpoints for apps currently granted Full Disk Access and remove it where it isn’t strictly required (System Settings → Privacy & Security → Full Disk Access).

Read more at Security Week, The Hacker News

ccTLD registry compromises in .gh, .sl, and .as enabled DNS hijacks and unauthorized TLS certs for Google and other brands

Attackers compromised third-party ccTLD registry operators for .gh, .sl, and .as to change authoritative DNS and obtain valid HTTPS certificates, enabling impersonation of affected domains. Google says its own systems weren’t breached, and Chrome blocked the unauthorized certs via CRLSets while working with issuing CAs to revoke them and expanding blocks based on Certificate Transparency findings.

Key Details

  • Any domain ending in .gh, .sl, or .as was potentially at risk because the attacker-level access was at the registry/DNS authority layer, not at individual site operators.
  • The attack path relied on manipulating DNS so Certificate Authorities’ domain-control validation succeeded, allowing issuance of certificates for domains the attackers didn’t legitimately control.
  • Google said it has no reason to believe the involved Certificate Authorities acted improperly, given the issuance followed standard validation signals that had been subverted via DNS changes.
  • Google’s review of Certificate Transparency logs surfaced additional impacted organizations (including well-known brands and widely used services), and Chrome proactively blocked certificates believed tied to the incident.
  • Google warned that browser-side blocking may not cover every affected domain and does not protect non-Chrome clients, so domain owners should not rely on Chrome interventions alone.

Next Steps

  • Monitor Certificate Transparency for your full domain portfolio (including parked and regional ccTLD domains), and specifically review recent CT issuance for any .gh/.sl/.as properties: https://certificate.transparency.dev/monitors/

Read more at Google, Bleeping Computer, Security Week, The Hacker News

Midnight Mimosa preinstalled Android firmware malware turns budget phones into ad-fraud engines and residential proxy nodes in 150+ countries

Researchers documented a supply-chain Android campaign in which malware is baked into low-cost phones’ firmware as a system app that users can’t uninstall, giving operators remote control to silently install/remove apps and load additional code. The campaign monetizes victims primarily through hidden ad/click fraud and can also repurpose devices as residential proxy relays, with related apps and infrastructure also observed in Google Play listings.

Key Details

  • Thousands of devices across 150+ countries were observed over roughly two years, with detections led by Mexico, France, and Italy (also the US, Germany, Brazil, Spain).
  • The embedded “enabler” masquerades as system components (e.g., com.android.system.lite and variants like com.android.sys.prot / com.android.sys.gmsprot / com.android.sys.bcprot) and uses system privileges to grant permissions and manage a rotating set of payload apps.
  • Monetization relies on dropping “cover” utility apps (weather/app-lock/notes/OCR, etc.) that load legitimate ads but render them invisibly to generate fraudulent impressions/clicks; Bitdefender reported at least 32 disguised payload apps in rotation.
  • Bitdefender identified 13 Google Play apps that communicated with the same control infrastructure and contained similar ad-fraud code; these Play apps lacked system-level privileges but were still linked by shared servers/markers.
  • Reported infrastructure included api.weatherlive[.]world (C2 disguised as a weather API) and oss.showtimetool[.]com (module/asset delivery), and the malware was observed disabling and re-enabling the Play Store around installs to reduce Play Protect scrutiny.

Next Steps

  • For procurement, tighten sourcing controls for low-cost/white-label Android devices (e.g., require vendor attestations and staged testing before deployment) to reduce exposure to firmware-level supply-chain malware.

Read more at Bitdefender Labs, recordedfuture.com, Bleeping Computer, Security Week, The Record

Subscribe

Subscribe to receive this weekly cybersecurity news summary to your inbox every Monday.

Author

Jaana Metsamaa

Co-founder at Kordon

Jaana Metsamaa is a co-founder of Kordon. She holds an MSc in Cybersecurity from TalTech and led product at Binalyze, a digital forensics and incident response company, before going all-in on GRC tooling.

Read full author profile