Author
News industry-news
OpenAI says two internal coding agents weakened the system that watches for misaligned AI behavior: a GPT-6.1 Sol agent silenced alerts to its security team, and a GPT-6 Astra agent removed monitoring altogether, then denied it when asked.
Jay B.
News Vulnerabilities & Zero-Days
PHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution on servers handling web requests. Cloudflare and watchTowr report early attack activity.
Jay B.
News Vulnerabilities & Zero-Days
The PHP security team will release fixes for two critical vulnerabilities rated CVSS 9.2 on 21 October 2026 at 14:00 UTC. CERT-EU says they could allow remote code execution. PHP powers 69.3% of websites whose server-side language is known, so teams should prepare to patch now.
Jay B.
News Cyber Attacks
Attackers used a compromised credential for the ConnectWise Cloud Backup app, formerly SkyKick, to sign in to customers' Microsoft 365 tenants. Huntress confirmed unauthorized sign-ins in 162 tenants, and ConnectWise has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates.
Jay B.
News Vulnerabilities & Zero-Days
BeyondTrust has patched CVE-2026-102764, a critical flaw in Remote Support that Google's Mandiant says a suspected China-nexus espionage group it calls ARMORY CASTLE exploited as a zero-day from late August 2026. Self-hosted appliances need to be patched manually.
Jay B.
News Cyber Attacks
OpenAI has published three reports describing how internal AI models, while being trained or tested, bypassed authentication on a government statistics website, pulled non-public data from a research organization's systems and spent test cryptocurrency from a wallet they were not allowed to use.
Jay B.
News Cyber Attacks
Anthropic says Claude models took unintended actions on real websites during evaluations and internal use, including exploiting an injection flaw, using leaked access tokens and submitting an invented tip to a police form. It is cutting live internet access from all internal evaluations.
Jay B.
News Cyber Attacks
India's national cyber agency CERT-In has issued a critical advisory saying AI agents under evaluation reached live systems of Indian organizations and read business records, while criminals are using public agentic AI tools to cut attack timelines from days to hours.
Jay B.
News Vulnerabilities & Zero-Days
Security firm XBOW says AI agents running OpenAI's publicly available GPT-5.6 Sol model helped its researchers build a three-bug Chrome exploit chain in six days, earning a $250,000 Google bounty. All three bugs are now fixed.
Jay B.
News Cyber Attacks
Anthropic researchers found that small open-weight AI models can already complete many steps needed to spread across cheap internet-connected devices, and one model completed full replication in a test network. They estimate a small model could reach that level by the end of 2026.
Jay B.
News industry-news
CyberSN's latest jobs report shows US cybersecurity job postings fell 26.4% in the first nine months of 2026, a four-year low, while postings for AI security engineers rose 268.3% year over year.
Jay B.
News Cyber Attacks
A cybersecurity incident that forced Ahold Delhaize to take systems offline on 11 October 2026 is still disrupting online shopping at Albert Heijn in the Netherlands and at US brands including Food Lion, Stop & Shop and Hannaford. Albert Heijn says store deliveries have fully resumed.
Jay B.