Financial technology company Abrigo has restored its Sageworks risk management application, except for borrower-facing capabilities, following an outage triggered by "irregular activity" in its environment. On October 30, the company began emergency maintenance and took the Sageworks application offline to investigate suspicious activity detected earlier that day, with the outage continuing through the weekend. READ MORE...
Frontline Education is notifying over 1.3 million people that their personal information was compromised in a data breach. The incident occurred on August 14 and involved the exploitation of a vulnerability in a third-party software product to gain unauthorized access to Frontline's environment. Frontline, which provides administration software purpose-built for K-12 school districts, addressed the security defect and reinforced security. READ MORE...
Last week's $6.3 billion breach at Binance underscores why effective security often depends not just on what an organization's controls are designed to block, but also on what they are configured to allow. Details from Binance's disclosures thus far show that a threat actor, whom the FBI has identified as North Korea's TraderTraitor group, compromised a developer's laptop to access an internal service container with the permissions to initiate withdrawal requests. READ MORE...
Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. Harvard is a private Ivy League research university with over 20,000 faculty and staff, over 24,500 undergraduate and graduate students, and more than 400,000 alumni worldwide. READ MORE...
If you're a customer of cloud-hosted AI workflow platform Trigger.dev, take heed, because your environment variables may have been exposed in a security incident disclosed on Sunday. Trigger offered little explanation in its Sunday security incident report, noting that its investigation had identified "exposure across a subset of organizations" and that an attacker had gained unauthorized access to environment variables belonging to those organizations. READ MORE...
Google on Monday announced new security updates for Android that resolve more than 200 vulnerabilities, including two dozen critical-severity issues. The first part of the patches arrives on devices as the 2026-11-01 security patch level and resolves 119 security defects across Android runtime, Framework, and System. Framework received fixes for the largest number of flaws, namely 65, followed by System with 53. Google resolved one high-severity information disclosure bug in Android runtime. READ MORE...
Unknown criminals are exploiting a maximum-severity vulnerability in Node-RED, a flow-based programming tool that is widely used in critical infrastructure, to deploy a flow that downloads and runs a Linux bot. Node-RED is commonly used for workflow automation in industrial control systems (ICS) and operational technology (OT) environments. It's built on top of Node.js and is used in commercial products including Siemens SIMATIC IoT2050. READ MORE...
A 3AM ransomware attack targeting a UK school estate may provide an early look at how cybercriminals could use AI as a force multiplier rather than a replacement for human operators. Bitdefender today published research concerning a "hybrid AI ransomware attack" observed in the wild, attributing certain actions taken to human or agentic elements. On the surface, the attack is fairly straightforward. As a blog post explained, a 3AM ransomware affiliate attacked a school in the UK. READ MORE...
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user's Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet's access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products. READ MORE...
Three dozen business groups, including organizations representing critical infrastructure sectors, are pressing Congress to renew a major cybersecurity information sharing law before its expiration next month. The 2015 Cybersecurity Information Sharing Act "has become a foundational component of the nation's cybersecurity," the groups wrote on Sunday to the chairs and ranking members of the congressional armed-services committees. READ MORE...
When a developer tells an AI coding agent to "set up a GitHub MCP," the agent has to pick a package. New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again. Reviewing real AI coding session transcripts, Glow Labs found deprecated MCP servers landing on developer machines, a pattern it calls MCPhantom. In 98% of those sessions, the agent appears to have filled in the name from the model's training data. READ MORE...