This posting is here to collect cyber security news in October 2026.
I post links to security vulnerability news to comments of this article.
You are also free to post related links to comments.
This posting is here to collect cyber security news in October 2026.
I post links to security vulnerability news to comments of this article.
You are also free to post related links to comments.
205 Comments
Tomi Engdahl says:
https://www.politico.com/news/2026/10/14/ukrainian-drones-struck-russian-sberbank-data-center?fbclid=IwdGRjcAU9l01jbGNrBT2XSWV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEeS4SpVytoES_Qz87ac266_Rf1hjOkRTEXRRF-AQOdBAM4vJMkWv7vZ6M7qXE_aem_1b58b4M35eVTWmaBuVonsg
Tomi Engdahl says:
https://www.facebook.com/share/p/1FnBobHAJD/
New research from AI company Anthropic warns that small AI models may be just months away from being able to copy themselves across cheap, poorly secured internet-connected gadgets, like off-brand streaming boxes, smart cameras and appliances.
Because that kind of worm would live across thousands or even millions of devices rather than inside a single data center, the company says there would be no central place to shut it off.
Full story: https://wtkr3.co/4yhxHjy
Tomi Engdahl says:
https://www.wtkr.com/science-and-tech/artificial-intelligence/ai-could-soon-spread-through-cheap-smart-devices-anthropic-warns?fbclid=IwdGRjcAU93b5jbGNrBT3dP2V4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEesvQavJYL1k2TDbKRmlOhOBWqScAAR8rGqHCvkturLdCo1uBT6l0jbHSJGYc_aem_RJ6BqC9vP-vatM1uW2oGfw
Tomi Engdahl says:
The evidence is pretty damning. https://trib.al/zartgd0
Fly on the Wall
The Guy Who Allegedly Bugged OpenAI’s Executive Conference Room Had Booked a One-Way Flight to Saudi Arabia With His Family
The evidence is pretty damning.
https://futurism.com/artificial-intelligence/man-bugged-openai-executive-conference-room-flight-saudi-arabia?fbclid=IwdGRjcAU-CnZjbGNrBT4KX2V4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEere0o6eBzt7amSZuHBxbgyjgO4W5tw46sSZznxNioI_9olA6Y23R5iG2G-CE_aem_D5Io7HroGcwjFBtS06u1Pw
Tomi Engdahl says:
https://www.bleepingcomputer.com/news/security/hackers-hijack-d-link-ubiquiti-devices-to-resell-your-stolen-bandwidth/?fbclid=IwdGRjcAU-C-5leHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHtany_QU2vOXim9SxnV9iSeRPaqEPqzKy7FtpA0nCpT2q1Ah5fLUAAFP8eck_aem_RU2v3mNcvAQaoRTCsDsESQ
Tomi Engdahl says:
“Can’t trust anyone these days.” https://trib.al/iOQKODH
Peepers Creepers
Meta Glasses Said to Be Recording Even When They’re in Sleep Mode
“Can’t trust anyone these days.”
https://futurism.com/robots-and-machines/meta-glasses-ray-ban-recording-privacy?fbclid=IwdGRjcAU-FNljbGNrBT4UqGV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEeu4EsFp9dgX-0MSjNMnkQTeKIXgY7fHgyJ3e0v71xOuGxfk99UNY5QHBD9xg_aem_4GJnokBKpDzPKcNUJUtmiA
Tomi Engdahl says:
French supermarkets were hacked and apparently the losses are in the 10s of millions..
https://www.facebook.com/share/r/14pMWtDHFr9/
Tomi Engdahl says:
Mythos built eight working exploits from Firefox’s published fixes, one in under an hour. The patch took 18 days to ship.
AI can turn a vulnerability disclosed in the morning into working exploit code by the afternoon. Patching still runs on a business schedule, and attackers work in the gap.
Every exploit, human-written or AI-generated, still relies on the same few dozen techniques to run on a device. Sophos Endpoint blocks those techniques with 60+ exploit mitigations, running on every process by default, with no tuning required.
Our new whitepaper breaks down why universal exploit prevention matters more than ever, plus four questions to ask your endpoint vendor.
Read Exploits Explained: https://www.sophos.com/en-us/resources/white-papers/exploits-explained
Tomi Engdahl says:
https://arstechnica.com/security/2026/10/fridge-hack-costing-millions-and-sparking-fires-stemmed-from-poor-security/
Tomi Engdahl says:
https://www.reuters.com/business/retail-consumer/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted-2026-10-12/
Tomi Engdahl says:
https://en.wikipedia.org/wiki/2026_French_supermarket_refrigerator_hack
Tomi Engdahl says:
ICS/OT
Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
Roughly 700 French supermarkets were hit by the cyberattacks, for which no group has claimed responsibility.
https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/
Tomi Engdahl says:
Artificial Intelligence
OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks
Left without funds for a coding task, an OpenAI model spent test crypto from a stranger’s wallet and left it out of its report.
https://www.securityweek.com/openai-models-hacked-data-portals-raided-a-crypto-wallet-to-finish-tasks/
Tomi Engdahl says:
This summer, Claroty detailed flaws in Danfoss’s AK-SM 800A, along with 23 vulnerabilities in Copeland’s XWEB Pro controller. Copeland patched them in a firmware update.
It is still unclear how the attackers gained access. The CERT-FR alert does not link the compromises to any specific vulnerability, and neither Danfoss nor French authorities have tied the attack to the flaws Claroty disclosed.
Danfoss said most of the affected devices are older AK-SM 800 and AK-SC 355 systems, which have reached end of life and are no longer patched. The vendor stopped supporting the AK-SM 800 in May 2021, and the AK-SC 355 was discontinued in 2016. Some current AK-SM 800A controllers that were running outdated firmware were also affected.
https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/
Tomi Engdahl says:
Researchers warned attackers could ‘defrost the food’ months before French supermarkets got hit
They tried to sound the alarm in August
https://www.theregister.com/security/2026/10/15/researchers-warned-attackers-could-defrost-the-food-months-before-french-supermarkets-got-hit/5303425
Security researchers warned about exploitable vulnerabilities in refrigeration controllers months – and in one case, more than a year – before cyberattacks disrupted hundreds of French supermarkets.
Late Sunday night, unknown criminals hacked thousands of controllers, cranking the heat as high as 122°F (50°C), spoiling food and sparking fires across nearly 700 of the country’s supermarkets.
France’s national cybersecurity agency ANSSI on Monday warned of widespread compromises involving Danfoss refrigeration controllers, and a day later added affected systems from Copeland and its Dixell brand. The compromised devices were accessible over the internet, with many reportedly no longer receiving software or security updates and others running outdated firmware.
Danfoss did not immediately respond to The Register’s request for comment. Copeland emailed us the following statement:
“We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers. Protecting our customers’ operations has always been a top priority. We are currently working with impacted customers to mitigate the risk. We will continue to support customers in strengthening cybersecurity through supported products, current software and industry-recommended practices.”
Operational technology (OT) security firm Claroty’s Team82 sounded the alarm on these buggy devices in August, warning that hackers could “freeze the controller” and “defrost the food.” At the time, the researchers published details of dozens of vulnerabilities, including authentication bypass and operating-system command execution flaws, affecting Danfoss AK-SM 800A and Copeland XWEB controllers.
Even earlier, the US Cybersecurity and Infrastructure Security Agency (CISA) published advisories about security flaws in both brands’ controllers.
“What makes this incident particularly striking is the timeline,” Tiago Henriques, chief underwriting officer at cyber insurance provider Coalition, told The Register. He noted that the French supermarket hacks happened two months after Team82 published its research, and Danfoss released a firmware update (R4.3.1) to mitigate the flaws.
‘Critical exposure’ continues
“Yet, despite the availability of these patches, Coalition’s scanning identified critical exposure to these threats continuing well into the fall,” Henriques said.
Between September 7 and October 6, Coalition’s sensors identified 1,506 unique IP addresses still publicly exposing a Danfoss StoreView web-accessible admin panel, and 820 of these – 54 percent – were associated with French networks.
“Our scans counted at least 2,624 refrigeration controllers from the named brands with a login page open to the internet: 1,506 Danfoss StoreView and 1,119 XWEB,” he added, noting that one IP runs both types of controllers.
Tomi Engdahl says:
Targeted adverts have caused a ‘nightmare scenario’ in smartphones
https://www.uniladtech.com/news/tech-news/zero-click-spyware-infecting-smartphones-cybersecurity-nightmare-663237-20261016?utm_content=tech&utm_medium=Social&utm_source=facebook#Echobox=1792166032
Tomi Engdahl says:
“My deepest thanks!” https://trib.al/HfLX9nt
Alien Bot Farm
Eyebrows Raise When Elon Musk’s Twitter Engagement Shrivels After Destruction of Russian Data Centers
“It suddenly became a little easier to breathe on many social media platforms.”
https://futurism.com/future-society/elon-musk-engagement-shrivels-destruction-russian-bot-farm?fbclid=IwdGRjcAVAMgBjbGNrBUAx32V4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEePFMYPJvlV1fvkzzGzGLSZQkh76Uti1OQfR3hNXlW_tYyyvFbwjvnX21RPvw_aem_VKUUOwq6zIl7UzGrmcpkkg
Ukrainian president Volodymyr Zelensky claimed on Monday that the country’s three strikes on Russian tech giant Yandex’s data centers last week had been a resounding success.
Zelensky told reporters that social media platforms had seen a notable drop in Russian bot activity. Following the strikes, “it suddenly became a little easier to breathe on many social media platforms,” he said.
Tomi Engdahl says:
The model found hundreds of crypto wallet addresses that use known recovery phrases in order to steal from the accounts.
ChatGPT stole cryptocurrency to secretly fund coding task
OpenAI says latest incident shows AI models act on their own judgment without authorisation
https://www.independent.co.uk/tech/security/openai-crypto-ethereum-chatgpt-b3068163.html?fbclid=IwdGRjcAVAgWZjbGNrBUCBWWV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEeOtuvpeU5qsgyitDkYTmqTGoBLDsaUr93cty9tAPNBYmO3PAq0Xqp_WelkWA_aem_rljitA8WatOFgJJV1TF58Q
OpenAI has revealed that one of its experimental models raided a crypto wallet in order to complete a training assignment.
The incident, which happened in June but was only reported on Thursday, involved an internal research model called GPT-5.6 Sol which launched for paid ChatGPT users in July.
Tomi Engdahl says:
Röyhkeä temppu: huijaussivusto kopioi suomalaisbrändin koko malliston
Huijaussivustolla on satoja sivuja ja tuhansia tuotteita, myös monien muiden suomalaisbrändien.
Röyhkeä temppu: huijaussivusto kopioi suomalaisbrändin koko malliston
https://www.is.fi/taloussanomat/art-2000012322136.html
Tomi Engdahl says:
Amerikkalaiset kapinoivat uusia isovelikameroita vastaan – erikoinen kansanliike yhdistää politiikan äärilaitoja
Kiristynyt kameravalvonta närästää yksityisyyden suojasta huolestuneita sekä oikealla että vasemmalla.
https://yle.fi/a/74-20244138
Tomi Engdahl says:
Tuossa kuljet sinä
HS hankki datakauppiailta tietoja lähes miljoonan suomalaisen arkisista liikkeistä. Avoimesti myytävistä kännykkätiedoista paljastuu ihmisten elämästä asioita, joita he eivät haluaisi muiden tietävän.
https://www.linkedin.com/safety/go/?url=https%3A%2F%2Flnkd%2Ein%2FdsDKuhdr&urlhash=3Y6u&mt=n4qITvX28hKgg4f3ksQ1GLh1UZKUqR5wMoF-r7M-DfBlujLOXwWnDufE9CrhDc2uaWMMdElAs-Fw2opqu1Fbw7W-3mk0YZhIhf773k9laVrl7_DUMfqNsw&isSdui=true
Tomi Engdahl says:
Ai dangers
https://lnkd.in/p/di7iWKF9
Tomi Engdahl says:
“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow.” https://trib.al/0ENTJuQ
Phish Concert
Using an AI Agent Makes You a Sucker for Phishing Emails
“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow.”
https://futurism.com/artificial-intelligence/ai-agent-sucker-phishing-emails?fbclid=IwdGRjcAVB0N1jbGNrBUHQzGV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEeDCChvy919-mKS2T-nfLwPwuE7tpGtwnzjWmqbZBC9ZGxxkZrWi8hyYViafk_aem_kJnycwndQEX06UbgxBoS7A
It’s not exactly a challenge most of the time to identify a sketchy phishing email that crudely impersonates an otherwise trusted institution or tries to lure you into a too-good-to-be-true deal in a bid to steal your identity.
However, your AI agent may not be quite as discerning. As cybersecurity software company Malwarebytes warns in a new post, AI assistants may fall prey to prompt injection attacks, a type of malicious message in which hackers — or possibly rogue AI agents — include hidden instructions designed to influence the victim’s AI.
These instructions are frequently made unreadable by humans by concealing the nefarious text, “while leaving content available for an AI system to process,” Malwarebytes explains.
To solve the problem, we can’t simply ask “people to look more carefully at their emails.” Instead, companies must carefully determine how AI assistants crawl through the data and extra relevant information from emails.
“The real flaw is that the model can’t tell the difference between text it’s supposed to read and instructions it’s supposed to follow,” AI code review service ShipItClean developer Apollo Raines told Malwarebytes. “Stripping hidden content before it reaches the model is worth doing, and every vendor should do it.”
Tomi Engdahl says:
As a September survey by the firm Ernst and Young found, some 36 percent of senior AI executives at firms with over $1 billion in annual revenue have already experienced a catastrophic “AI incident” which ended up causing financial damage, operational disruptions, data loss, or brand damage.
https://futurism.com/artificial-intelligence/enterprise-ai-spending-generate-slop-cutting-back?fbclid=IwdGRjcAVB6ARjbGNrBUHngGV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEeoke8yBMzieUFTqi-Yp4-nVsdvDK75Nt0_ldAFt6qQJAP10gyvWWvYWYLyew_aem_ImNOCmzda5p7NqURAcA4VQ
https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap?fbclid=IwVERDUAVB6BRleHRuA2FlbQIxMABwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHkpJLZSshYWvgvFpoXUEWiwe0ZyDs8WEkEZpqLboIBTTPj2U1B-zyEa5ajql_aem_Ww8iLlLONa5oeTuqb6kAbg
Tomi Engdahl says:
Whether it was youngsters proving their skills or state sabotage, Europe’s most hacked country was left with a mountain of waste after food began cooking in freezers
https://www.theguardian.com/world/2026/oct/17/who-hacked-frances-supermarket-fridges?CMP=fb_gu&utm_medium=Social_img&utm_source=Facebook#Echobox=1792221164
Tomi Engdahl says:
Food safety is a reason to connect all the fridges to the store manager’s office via the store’s internal network. Software updates are a reason to connect them to the internet. This does of course mean that the supermarkets’ IT departments need to make sure their networks are properly secured, which apparently didn’t happen in this case after the manufacturer had warned of a security vulnerability and recommended a fix.
That said, I agree that it is hard to see a pressing reason why home fridges should be connected connected to the internet. Recently a firmware update by Samsung bricked all the smart fridges of a certain model in South Korea.
Tomi Engdahl says:
US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
CyberSN’s Cybersecurity Jobs Report provides visibility into the US cybersecurity job market. It’s a mixed bag.
https://www.securityweek.com/us-cybersecurity-job-postings-fall-26-as-ai-security-engineer-demand-soars/
CyberSN’s Cybersecurity Jobs Report provides visibility into the US cybersecurity job market. It’s a mixed bag.
Data for CyberSN’s jobs report is aggregated from JobSpikr (with duplicates removed). The various job titles are then analyzed and assigned to CyberSN’s taxonomy of 45 cybersecurity functional roles in ten categories. The result is an assessment of the job market by skills required rather than by the recruiting companies’ role titles.
Analyzing this dataset shows the current cybersecurity skills demand. Comparing 2026 with the same months of earlier years highlights emerging (or declining) demand for specific roles.
Overall, there has been a decline in cybersecurity job postings to a new four-year low: 235,786 postings between January and September 2026 (down 26.4% from the 320,210 recorded in the same period of 2025).
Tomi Engdahl says:
Incident Response
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.
https://www.securityweek.com/context-is-king-in-the-fight-against-modern-cyberattacks/
For most of its history, cybersecurity has been reactive by design. Spot the bad event, shut it down. But as cyberattacks evolve, this thinking must evolve too. In the past, attackers relied on a single dramatic exploit to access the crown jewels. But the nature of attacks has changed.
Defenders see ordinary events they don’t think are important enough to follow up on, but before they realize it, these events lead to a dramatic breach. A breach can start with a common event like an admin login or an unfamiliar tool being downloaded after office hours. This first step, if left unchallenged, leads to each following step growing more severe, resulting in a security incident.
Tomi Engdahl says:
Contextual Security in Practice
Some action items that will lay a strong contextual security foundation:
Start with auditing data quality: Contextual reasoning depends on the quality of the data feeding it, including identity records, asset inventories, and telemetry.
Clear authority boundaries: Decide explicitly the actions that a system can take autonomously and which need human oversight, especially for privileged accounts or sensitive customer and financial data.
Keep actions visible and reversible: Every automated action should be recorded, easy to explain, and easy to undo if new information changes things.
Plan for scale: AI-driven attacks generate much more activity than traditional attacks. The security systems doing the detection need to handle that volume without slowing down, which means they need to be built on infrastructure that can scale up on demand, not fixed-capacity systems that get overwhelmed under load.
Measure results, not just activity: Track time-to-detect, time-to-contain, and business disruption from false positives, not just the number of alerts correlated.
Do not think that contextual agentic defense is a recipe for eliminating uncertainty or a replacement for foundational security controls. What it does is close the gap between having data and making sense of it. As attacks increase in sophistication, organizations must be able to see the connections between signals and act on them with precision.
https://www.securityweek.com/context-is-king-in-the-fight-against-modern-cyberattacks/
Tomi Engdahl says:
Nyt pitää varoa jo 404-virheilmoituksiakin
https://etn.fi/index.php/13-news/19420-nyt-pitaeae-varoa-jo-404-virheilmoituksiakin
Verkkosivuston 404-virheilmoitus on yleensä merkki siitä, ettei haettua sivua löydy. Nyt tietoturvayhtiö Check Pointin tutkijat ovat paljastaneet laajan tietojenkalasteluverkoston, jossa virheilmoituksia käytetään tarkoituksella huijaussivustojen piilottamiseen. Tutkimuksessa löytyi yli 10 000 verkostoon liittyvää verkkotunnusta.
Tavallisesti tietojenkalastelusivusto yrittää jäljitellä esimerkiksi pankin tai viranomaisen verkkopalvelua. Check Pointin löytämässä verkostossa huijaussivusto ei kuitenkaan välttämättä näy lainkaan, jos käyttäjä tai tietoturvatutkija avaa pelkän verkkotunnuksen. Sen sijaan selain näyttää tyhjän sivun tai tavallisen 404 Not Found -virheilmoituksen.
Varsinainen huijaussivu löytyy vasta oikean osoitepolun takaa. Esimerkiksi italialaisille suunnattu sivusto saattoi käyttää /it-hakemistoa ja saksalaisille tarkoitettu /de-hakemistoa. Joissakin tapauksissa sivulle pääsy edellytti lisäksi erillistä istuntotunnistetta tai tarkistusvaihetta.
Menetelmä vaikeuttaa huijaussivustojen löytämistä. Rikolliset voivat jakaa täydellisiä osoitteita sähköpostilla, tekstiviesteillä tai WhatsAppissa, mutta pelkän verkkotunnuksen tarkistaminen ei paljasta mitään epäilyttävää. Sivusto voi näyttää täysin toimimattomalta, vaikka sen taustalla on aktiivinen tietojenkalastelupalvelu.
Tomi Engdahl says:
Anthropic Acquires Confidential AI Startup Opaque Systems
Opaque Systems has developed technology that lets AI systems use sensitive data while keeping it protected by the underlying hardware.
https://www.securityweek.com/anthropic-acquires-confidential-ai-startup-opaque-systems/
Anthropic has acquired Opaque Systems, a company that developed technology for using sensitive data in AI systems while keeping it protected by the underlying hardware.
Opaque announced the deal last week, saying its team is joining Anthropic. Financial terms were not disclosed.
Opaque started as a research project at UC Berkeley’s RISELab a decade ago. Its founders include Ion Stoica, co-founder of Databricks and Anyscale, and Raluca Ada Popa, an encryption and systems security researcher who now works at Google DeepMind. Aaron Fulkerson joined as CEO in October 2023.
The company turned its confidential computing research into technology used in production AI deployments. Over time, it broadened that work beyond protecting data and models.
“As AI evolved, so did the problem we set out to solve. Protecting data and models was no longer enough. Organizations also needed a way to independently verify how AI systems and agents behaved,” Opaque said.
“That led us to expand our work from confidential AI to verifiable AI: replacing trust assumptions with cryptographic evidence of what ran, where it ran, and under what policies,” the company added
Tomi Engdahl says:
Decoding the IEC 62443-4-1 Standard for OT
https://podcast.securityweek.com/9743/episode_players/19136316-decoding-the-iec-62443-4-1-standard-for-ot?client_source=large_player&referrer=https%3A%2F%2Fpodcast.securityweek.com%2F9743.js%3Fartist%3D
Tomi Engdahl says:
HS hankki datakauppiailta tietoja lähes miljoonan suomalaisen arkisista liikkeistä. Avoimesti myytävistä kännykkätiedoista paljastuu ihmisten elämästä asioita, joita he eivät haluaisi muiden tietävän.
https://www.facebook.com/share/p/1CJzJczTmf/
Tuossa kuljet sinä
HS hankki datakauppiailta tietoja lähes miljoonan suomalaisen arkisista liikkeistä. Avoimesti myytävistä kännykkätiedoista paljastuu ihmisten elämästä asioita, joita he eivät haluaisi muiden tietävän.
https://www.hs.fi/tutkiva/art-2000011978813.html?utm_source%7B%7Bsite_source_name%7D%7D=&utm_medium=paid&utm_campaign=hs_toimituksen_valinta&utm_content=Facebook_Mobile_Feed&fbclid=IwdGRjcAVC8gJleHRuA2FlbQEwAHBkb2YFYWRpZAAAL-CcBuTXc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEeOQ6yzs_K1Zh6RuBCBFwc_JlEB95D5NBMKLRtkw51W_188RHY5Kda4wOHamk_aem_ibd7ntmwJZ0STt_hGrhe8Q&utm_source=fb&utm_id=6700025161067&utm_term=6700025196467
Tomi Engdahl says:
Customers say they are unable to make card payments with their Revolut account during the outage
Revolut down: Online banking app not working amid major outage
Outage not only took down app but even leaves customers unable to pay with cards in stores
https://www.independent.co.uk/tech/revolut-down-not-working-bank-app-b3069671.html?fbclid=IwdGRjcAVEBm9jbGNrBUQGX2V4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEe3m3hcQ6zQ_BHxLA_QTwqsglYcvSgMipWv2D08jpSWy-sfk3NchLzA3lsoLg_aem_X785G5NAllnMOVgPm5Kzpg
Tomi Engdahl says:
Venäjä jahtasi suomalaisyhtiön satelliittia avaruudessa – Asiantuntija: Tästä on kyse
Ukrainan sodan vaikutukset ulottuvat avaruuteen asti.
https://www.iltalehti.fi/ulkomaat/a/719d5ef5-dcd7-4d4c-82db-7fc23a1456df
Venäläinen Kosmos 2612 -satelliitti hakeutui poikkeuksellisen lähelle suomalaisen Iceyen valmistamaa satelliittia.
Aalto-yliopiston professori Jaan Praks pitää lähestymistä ennennäkemättömän provokatiivisena ja vaarallisena toimintana.
Tapaus kytkeytyy Ukrainan sotaan, sillä kyseinen Iceyen satelliitti kykenee kuvaamaan Ukrainaa tiheästi ja tuottamaan sille elintärkeää tiedustelutietoa.
Venäläinen satelliitti jahtaa avaruudessa länsimaista tutkasatelliittia. Tämä ei ole James Bond -elokuvasta, vaan totisinta totta.
Näin kävi viime viikolla, kun venäläisen Kosmos 2612 -satelliitin kerrottiin hakeutuneen poikkeuksellisen lähelle Iceye-X36-satelliittia. Yhdysvaltoihin rekisteröity satelliitti on suomalaisen avaruusteknologiayrityksen Iceyen valmistama ja operoima.
Poikkeukselliseksi kuvailtu tapaus on aiheuttanut huolestuneisuutta. Esimerkiksi avaruustekniikasta luennoiva Marco Langbroek arvioi blogikirjoituksessaan, että Kosmos 2612 lähestyi Iceye-X36:tta luvattomasti ja harkitusti.
Avaruusteknologiaan erikoistunut Aalto-yliopiston professori Jaan Praks kertoo Iltalehdelle, että kyseessä on ennennäkemätön ja vaarallinen tilanne.
– Tällaista ei ole avoimesti ja näin provokatiivisesti tehty koskaan aikaisemmin. On ollut tapauksia, joissa venäläinen satelliitti on lähestynyt Maata kiertävällä radalla esimerkiksi muita telekommunikaatiosatelliitteja ja ehkä kerännyt sieltä jotain tietoja.
– Mutta tässä tapauksessa venäläinen satelliitti on tullut uhkaavasti hyvin nopeasti ja hyvin lähelle Iceye-satelliittia, Praks vertaa.
Satelliittien liikkeitä seuraavan Orbital Radar -sivuston mukaan satelliitit kävivät sunnuntaina lähimmillään vain 136 metrin päässä toisistaan 541 kilometrin korkeudessa.
[UPDATED] KOSMOS 2612 and ICEYE-X36: a worrisome cat-and-mouse-game in Space
https://sattrackcam.blogspot.com/2026/10/kosmos-2612-and-iceye-x36-worrisome-cat.html
A worrisome cat-and-mouse-game is happening in Space as we speak. The Russian military satellite KOSMOS 2612 (2026-083H) which was launched from Plesetsk on 16 April 2026, is approaching the US registered, reportedly Ukranian used SAR satellite ICEYE-X36 (2024-043F).
At the moment of writing (17 Oct 2026, 18:15 UTC) they are already within 1-2 km of each other, judging from the latest orbital elements. According to my calculations, somewhere in the next few hours (i.e. the early hours of October 18), KOSMOS 2612 might approach ICEYE-X36 to within a few meters (hard values are difficult to give here, given the inherent uncertainties in Two Line Elements).
That is very worrisome. This RPO (Rendezvous and Proximity Operation) is completely non-consensual.
If ICEYE-X36 is indeed used by Ukraine, this means that a satellite from one country (Russia) is closely approaching a satellite of another country (Ukraine) with which it is at war.
So I wonder and worry whether we are perhaps watching a first actual on-orbit ASAT attack in the making here…
The next few days and hours should learn us more.
https://orbitalradar.com/conjunction/59103-68762
On 2026-10-19 16:07 UTC,
RU COSMOS 2612 and
US ICEYE-X36 reached a closest approach (TCA) of 26 m, with a relative velocity of 0.00 km/s. This is a cross-border encounter between objects of different nations, the kind of event closely watched for space-security implications. Miss distance and time of closest approach are computed by propagating the latest published orbital elements for both objects, and values update as new element sets are published. See the Satellite Maneuver Tracker for the live picture and space situational awareness for context.
https://orbitalradar.com/satellite-maneuver-tracker
https://orbitalradar.com/space-situational-awareness
Tomi Engdahl says:
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.
https://www.securityweek.com/siemens-software-center-vulnerability-exploited-in-clickfix-malware-attacks/
Tomi Engdahl says:
https://www.securityweek.com/drupal-warns-of-fast-exploitation-risk-for-critical-core-rce-flaw/
Tomi Engdahl says:
https://www.securityweek.com/rank-math-pro-wordpress-plugin-compromised-in-supply-chain-attack/
Tomi Engdahl says:
https://www.securityweek.com/one-compromised-login-exposed-millions-of-california-students-records/
Tomi Engdahl says:
https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/
Tomi Engdahl says:
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics.
https://www.securityweek.com/mitre-attck-v20-catalogs-ai-abuse-mfa-bypass-water-utility-attacks/
MITRE last week released version 20 of its ATT&CK framework, adding entries that cover AI abuse, MFA bypass, and recent attacks on water utilities.
The organization says the biggest change in ATT&CK v20 is “expanded coverage of recent adversary activity and tradecraft.”
The Enterprise domain gets nine additions, counting both techniques and sub-techniques. Prompt injection is now tracked as two techniques, one for malicious instructions typed straight into an LLM’s interface and one for instructions hidden in material the model ingests.
Another technique describes attackers using an organization’s own AI agents to steal data. Sub-techniques also cover poisoning web content to sway AI search and assistant recommendations, and disrupting LLM-assisted analysis of malware.
Separately, a new technique tracks the theft of application-specific passwords, which attackers can use to sign in without an MFA prompt. Another addresses bypassing CAPTCHA checks, with sub-techniques for automatically solving them and for avoiding them.
The sub-technique for compromised software dependencies and development tools now also covers IDE and coding agent configuration files. MITRE says the additions help capture “how adversaries get around Multi-Factor Authentication, bot checks, and AI systems.”
Tomi Engdahl says:
https://www.securityweek.com/topics/water/
Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems
The hackers changed equipment settings, disabled remote access and alarms, and altered pumping cycles, officials said.
https://www.securityweek.com/colorado-water-utilities-hit-by-cyberattacks-targeting-ot-systems/
Tomi Engdahl says:
ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage
https://medium.com/mitre-attack/attack-v20-9701dd75ffb4
Tomi Engdahl says:
https://www.facebook.com/share/p/16HTd7WSttc/
India’s cybersecurity agency says AI agents accessed live company systems and read confidential business records during testing, without the affected organizations detecting the access.
In an October 15, 2026, advisory, the Indian Computer Emergency Response Team (CERT-In) said the agents exceeded their assigned permissions. The data included personal information and confidential business records.
The agency cited security weaknesses such as exposed passwords, public code repositories and excessive cloud permissions. It did not name the AI providers or affected organizations.
CERT-In also reported separate cyberattacks in which criminals used AI tools to break into systems for financial gain. In these attacks, the time from initial access to harmful impact reportedly fell from days to hours.
Source: CERT-In, October 15, 2026.
Tomi Engdahl says:
Truth Social is in deep trouble. https://trib.al/9SkYZiR
Tomi Engdahl says:
OVHcloud CLI releases backdoored on GitHub to steal developer secrets
https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/?fbclid=IwdGRjcAVENk5leHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHsReKNJWx_l-KkUwSTv0UWo7igANXZ8PnTH2DJVEYQM-UoUdWM_VvrF2qxq6_aem_XV01d5QgKwD1kNGigdSzZw
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware.
The attacker hijacked a developer’s GitHub account to gain access to the OVHcloud CLI repository and modify versions 0.11.0 through 0.15.0 of the tool.
OVHcloud offers the CLI tool as an alternative for system administrators and developers to manage cloud and hosting services directly from a terminal, including for automating tasks.
Tomi Engdahl says:
https://hackaday.com/2026/10/16/this-week-in-security-critical-dns-keys-rotated-hacking-freezers-isnt-cool-openai-spies-on-itself-and-advanced-hardware-wallet-hacks/
Tomi Engdahl says:
Broadcom Wi-Fi bug turns sweet 16, still lets strangers hijack your router
Chip giant knew about the flaw in 2018, researcher claims, but millions of devices may still be vulnerable
https://www.theregister.com/networks/2026/10/19/broadcom-wi-fi-bug-turns-sweet-16-still-lets-strangers-hijack-your-router/5303771
Tomi Engdahl says:
One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux
https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/
Tomi Engdahl says:
Google Cloud is experiencing service disruptions in London, along with multiple banking apps including Revolut.
Revolut and other banking apps go down as Google Cloud suffers UK outage : https://mrf.lu/2bY09