Google cuts off the XCPE Android botnet and bars Videostrong devices
Google and industry partners have dismantled the XCPE…
Updated 3 minutes ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
Microsoft says attackers used Teams support lures to steal certificates
Microsoft says attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs and then abused insecure Active Directory Certificate Services settings to obtain login certificates for privileged accounts, including one for a domain controller. In one of two intrusions, the attackers copied company data to an external server, and Microsoft did not link the activity to any known group. What the intrusions…
Offline iPhones can still lose crypto seed phrase security
Older iPhones used for storing cryptocurrency seed phrases can still face physical attacks, and airplane mode does not stop that risk. OneKey founder Yishi warned that wiping an aging iPhone and keeping it offline does not turn it into a secure cold wallet. What bootrom access changes The concern centers on BootROM flaws that let an attacker run code before iOS begins. That access does not automatically reveal protected wallet…
Northflank investigates reported AI key misuse after a security incident
Northflank is investigating a security incident tied to reported misuse of AI keys, while warning that environment variables across workloads, secret groups, and global settings may have been exposed. It has not confirmed the entry point, identified an attacker, or disclosed affected customers. Timeline of the response Northflank’s published timeline starts with a Wiz threat alert at 11:43 UTC on October 30, 2026. Engineers reviewed the alert one minute later…
Windows WinSock ancillary flaw gets public exploit proof of concept
A public proof-of-concept exploit for CVE-2023-21768 shows how a local attacker can reach SYSTEM privileges through the Windows Ancillary Function Driver for WinSock. Valentina Palmiotti, known as chompie, and Ruben Boonen published the code, and their full exploit targets vulnerable Windows 11 22H2 systems.How the flaw was studiedIBM published the researchers’ technical analysis on March 21, 2023. The issue had already been patched in January 2023, so the release is…
Synology warns of ongoing C3RB3R ransomware attacks on NAS devices
Taiwanese network-attached storage maker Synology says attackers are using a vulnerability fixed in December 2024 to hit devices running outdated versions of DiskStation Manager. The company says the attacks are meant to encrypt data and extort ransom, and it has urged users to update right away. Synology C3RB3R attack details Synology told users to enable automatic updates and move their DiskStation Manager software to the latest version. In a Thursday…
CyberStrikeAI Agents Drive Windows Domain Takeovers
Hackers are using an AI-driven command framework called CyberStrikeAI to break into Windows networks and take over entire domains. Education organizations in Africa and Latin America were among the confirmed victims. The tool lets a language model decide which commands to run, so the operator no longer types each step by hand. CyberStrikeAI Framework in Live Intrusions CyberStrikeAI is an open-source, Go-based platform built for penetration testing. Criminals have already…
WS Audiology IT Disruption Affects Hearing Aid Services
WS Audiology, also known as WSA, is investigating a cybersecurity incident after unauthorized parties accessed parts of its IT infrastructure. The company disconnected selected internal and customer-facing systems to contain the threat, and that interrupted digital services used by hearing aid wearers and hearing care professionals. The hearing aids themselves were not affected. For customers, the immediate impact involved app controls, fitting tools, and remote support rather than a confirmed…
Ivanti’s latest Connect Secure fix blocks two chained flaws
Ivanti has released security updates for two more Connect Secure remote access gateway flaws that were chained in zero-day attacks starting at least on October 1. The two issues, CVE-2026-111357 and CVE-2026-118527, were used together with CVE-2026-104935, an authentication bypass flaw patched last month. Attack chain details CVE-2026-111357 is a high-severity privilege escalation issue. CVE-2026-118527 allows authenticated attackers to upload files on an unpatched device. Ivanti said in an advisory…
AI now sits inside a Windows infostealer, and VOLTA is using it to sort victims by money
Cisco Talos has uncovered a new malware family called VOLTA-AUTODOXER, also known as VOLTA, that uses a large language model to rank stolen data by monetization value. The malware behaves like a conventional stealer in many ways, but its real twist is the added AI layer that turns raw theft into a structured assessment. Instead of stopping at passwords and cookies, it tries to build a dossier that tells the…
Hackers Drain Bitcoin Hot Wallets on BTCPay Servers as Project Urges Immediate Shutdown
BTCPay Server has issued an urgent warning after reports that attackers were draining Bitcoin hot wallets on its servers. The open-source payment processor told operators to shut down affected installations immediately and keep them offline while the team investigates. For merchants using wallet management through these servers, the warning is about more than software hygiene. It is about funds that may already be exposed. Shutdown order and early signals In…
Command Injection Campaign Hits 61 GitHub Repos, Aiming at CI/CD Secrets
A coordinated command-injection campaign targeted 61 public GitHub repositories on September 1, 2026, using issues, pull requests, and comments to trigger code execution inside GitHub Actions workflows. Radware’s investigation identified 83 malicious items posted that day, with most activity concentrated in two rapid waves. The incident highlights how routine project discussions can become an entry point into automated build systems when workflows treat untrusted text as executable code. How the…
Linux 7.4-rc1 Lands After an Unusually Large, AI-Driven Merge Window
Linus Torvalds has released the first release candidate for Linux 7.4 following a notably large merge window. The snapshot, 7.4-rc1, arrives after two weeks of feature merges and contains roughly 20,000 commits — a step up from the kernel’s more typical ~15,000-commit merge. With substantial AMD register updates and a broad set of driver, architecture, filesystem and tooling changes, this release candidate sets the stage for an intensive stabilization period…