The US' bankruptcy courts are currently down owing to what officials are calling a "cybersecurity incident." The Administrative Office of the US Courts said the websites and systems that support the Bankruptcy Noticing Center (BNC), which manages electronic comms related to bankruptcy cases, were pulled offline while the vendor investigates. BAE Systems runs the affected systems and websites on behalf of the Federal Judiciary, and is "working to restore operations." READ MORE...
Suspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers have traced back to late August. Mandiant researchers said a likely Chinese government-backed espionage group it previously tracked as UNC5221, and now calls Armory Castle, exploited the critical defect - CVE-2026-102764 - then showcased multiple tactics to escalate privileges and evade detection. READ MORE...
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. Reports of the malicious activity began emerging on Friday, with administrators observing unauthorized access to client data in Microsoft 365 tenants due to a potential "SkyKick/CW breach." Later on the same day, managed cybersecurity and threat detection platform Huntress confirmed the worries. READ MORE...
The Internet is littered with convincing counterfeit AI offerings that, instead of providing popular tools, drop infostealers, remote access Trojans (RATs), and other threats inside enterprise networks. In a report this week, Any.Run researchers examined threat campaigns that use AI-themed lures that impersonate leading brands such as Claude, ChatGPT, and others. Over a six-month period, a full 1,258 incidents analyzed on the firm's platform traced back to fake AI tool attacks. READ MORE...
Krybit is the name of a ransomware-as-a-service (RaaS) operation that first surfaced in early 2026. The group rents out the ransomware it has developed to affiliates who carry out attacks on its behalf, splitting ransoms extorted from victims 80:20 (80% to affiliates, 20% to the Krybit operators) in exchange for access to the malware, a dashboard, and round-the-clock technical support. As with most other modern ransomware operations, Krybit steals data before encrypting the original copies. READ MORE...
In September, reports emerged that a Virginia woman had been submerged by a flood of emails. Hundreds of automated messages poured in over a 24-hour period, including newsletters and promotions she'd never signed up to. But this was no ordinary spam campaign. The real reason behind the inbox blitz was to bury a legitimate email from the victim's bank warning her about a fraudulent laptop purchase. This is email bombing. And if it's happened to you, it could be a warning sign. READ MORE...
AI agent traffic across DataDome's network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company's AI Traffic Report Q3 2026. Meta's Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure. Nearly half of the AI agent traffic recorded in 2026 through September occurred in Q3. READ MORE...
Threat actors began targeting Plex2Shell, a chain of four Plex Media Server vulnerabilities, one day after technical details and a working exploit went public. The researcher who found the Plex2Shell bugs released a write-up and proof-of-concept (PoC) code on October 16. Tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, the flaws can be combined to run arbitrary code on an exposed server without valid credentials. READ MORE...
A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization, Palo Alto Networks reports. The intrusion, attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), occurred in September 2024 and resulted in long-term access to the victim's environment. Initial access was obtained through the exploitation of a critical remote code execution (RCE) bug in FortiManager. READ MORE...