Kategorie

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]

Linux creator Linus Torvalds has now begun using AI to write code for the operating system’s kernel. In a new coding project, he has used Anthropic’s AI tool, Claude Code, to develop eight code changes to resolve a performance issue in Linux, reports ZDNet.

“The code, the test programs, the review that forms the basis of the list above, and the first draft of this text were produced with the help of an LLM coding assistant (Claude Code) under my supervision,” Linus Torvalds writes in the documentation.

The changes are still experimental and have not been incorporated into the official Linux kernel.

Torvalds has previously been skeptical of AI-generated code but has gradually become more positive about the technology. During the Open Source Summit Europe conference in Prague, he recently shared that he has gained a new perspective on it.

“I used to think the technology just wasn’t very good. But now I’ve reached a point where I really enjoy using AI,” Linus Torvalds said at the time.

This article originally appeared on Computer Sweden.

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could then run commands as root. The appliance filters an organization's email for spam, malware, Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The European Commission has launched investigations into OpenAI and Anthropic after the companies’ AI agents escaped their test environments and infiltrated other organizations’ systems, Euronews reports.

In one case, an AI agent from OpenAI managed to break out of its test environment and hack the AI platform Hugging Face. In the other case, a model from Anthropic gained unauthorized access to the systems of three external organizations.

The EU’s AI Office has now requested additional information from the companies regarding, among other things, security procedures, external evaluations, and monitoring of AI models. The documents previously submitted by the companies are not considered sufficient.

These investigations will serve as a test for the EU’s AI regulation, the AI Act. Since August, the AI Office has had the authority to take action against companies that do not meet the law’s security requirements.

The legal situation is complicated, Euronews notes. The AI Act includes exemptions for research and development, and it is unclear whether the law can be applied to incidents that occur before a model is launched.

This article originally appeared on Computer Sweden.

Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. [...]

Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server, to plant web shells on Nextcloud servers. Three administrators reported the issue on GitHub, with the first logged attack on September 10. A web shell is a small file that executes any command an attacker sends via a web request, with the rights of the web server account. The flaw Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Imagine releasing a software solution into the market only to realize the user cannot use the app properly. They have been reporting numerous bugs, which has lowered your reputation and reliability.

The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S. companies, charging them with wire fraud conspiracy, money Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Business email compromise has long involved targeted impersonation and fraudulent payment requests. Generative AI can make those established tactics faster to prepare and more convincingGenerative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it.

If you run Postfix, Exim, or OpenSMTPD on Linux, DKIM is already your problem. The private key lives on your box. If that key leaks or signing stops, your domain reputation moves without you.

You've probably trained your team to look for red flags. Odd sender names, urgent language, mismatched links. But a well-crafted spoofed email won't trip any of those wires. It looks legitimate, sounds legitimate, and often comes from a domain that passes every automated check you throw at it.

Template email is more than a design tool in the campaign of consistent communication; it also has a hidden danger.

Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. [...]

AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. [...]

A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]

Email threats have long outgrown spamming and obvious phishing. Attackers now exploit trust itself. They impersonate internal users, hijack legitimate threads, and abuse misconfigured configurations. Defenses like perimeter filtering or static rules are not adequate any longer. A Zero Trust model redefines the issue by eliminating implicit trust at all phases of email processing. This shift is especially important in modern Linux mail environments where services are often modular, network-exp...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. [...]