October 2026

Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands 2026-10-21 at 16:15 By Google on Tuesday said it’s rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social engineering technique in which bad actors trick users into copying […]

China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors 2026-10-21 at 15:05 By Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. “The most distinctive technical marker for Bronze Sandcastle is its consistent use of […]

PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't 2026-10-21 at 13:36 By You cannot fully block the two critical PHP flaws called PHP2Shell before today’s fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it […]

The Harness Is the Hard Part of Agentic Pentesting 2026-10-21 at 13:32 By An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run against production and worth acting on […]

Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections 2026-10-21 at 13:30 By Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where […]

Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks 2026-10-21 at 13:00 By Priti More, Susmit Yenkar Offensive agent is using unprotected AI models to scan the web, exploit frameworks, steal credentials and mine cryptocurrency for up to 100,000 steps without human input. The model’s owner pays for every step. This article is […]

In HyperArmor, Three Pillars Uphold A Layered Defense 2026-10-21 at 13:00 By Tim Smith It’s time to secure your hypervisor against AI-accelerated attacks This article is an excerpt from SECURITY.COM View Original Source

U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases 2026-10-21 at 12:49 By U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services “developed using DeepSeek implementations,” under a Department of Homeland Security order. They may also no longer buy information technology products […]