Cybersecurity

Orange unit inks cybersecurity pact with Mistral AI

Orange Cyberdefense struck a partnership with French player Mistral AI to develop services using a specialised version of its latest large language model, as European companies look to strengthen defences against automated digital threats.

Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis

A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device.

Fresh WordPress Vulnerability in Attackers’ Crosshairs

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving

The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.

Microsoft finally fixes VPN issues caused by September updates

Microsoft has resolved Always On VPN connection failures triggered after installing the September 2026 Windows 11 security updates.

Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison

Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets.

North Korean ‘elite’ hacking group steals $6.36bn from Binance

An engineer’s laptop was compromised, enabling hackers to withdraw $6.36bn from Binance wallets

Drupal warns of critical Commerce Core flaw exploited in attacks

Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.

Also: SecurityWeek

$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.

Max-Severity GitLab Vulnerability Exploited Against Alpine Linux

Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.

Also: BleepingComputer

UK Shelly reseller warns payment data stolen after malware found on website

Customer says they received fraudulent charges on their card hours before company notified them

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on…

Also: BleepingComputer

TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines

An integer overflow tracked as CVE-2026-111585 could be used to execute arbitrary code on the viewer’s system.

Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen

Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets.

Binance probes potential $5.8 billion crypto-theft hack

Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history.

Hugging Face malware campaign returns to hijack GPUs for crypto mining

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times.

Japan Airlines suffers third-party data breach exposing passenger info

Japan Airlines (JAL) has announced that a data breach at Amadeus's Passenger Service System exposed the data of about 92,000 customers.

Polymarket halts trading after crypto-draining script breach, $2.5M traced

Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a…

New Cisco firewall zero-day being actively exploited

A high-severity flaw in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) is under active exploitation to crash vulnerable devices.

Also: The Hacker News

Fake crypto app on Apple App Store linked to $23K wallet theft

A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets.

ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories

Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn't.

Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

Snoops 'likely still' have access to US government-affiliated network

When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.

Chrome extensions with 13.4 million installs caught hijacking searches

A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo.