Oasis Security disclosed a weakness in NVIDIA NemoClaw that could let an attacker-controlled webpage take over a locally hosted Ollama instance and poison a model’s chat template with hidden instructions. NVIDIA fixed the issue for macOS and Linux in NemoClaw v0.0.35, but the Windows and WSL path remains unpatched and is…
Category: Cyber Security News
The U.S. Treasury has imposed new sanctions on Iranian cyber actors and related networks under Operation Economic Outcast, targeting entities tied to the IRGC and MOIS. The action follows allegations of compromises against U.S. critical infrastructure, cryptocurrency theft, and broader Iran-linked cyber activity against U.S. and allied targets. #OperationEconomicOutcast #IRGC #MOIS…
Operation Jackal IV led to 58 arrests and 263 identified suspects in a coordinated crackdown on West African organized crime networks involved in money laundering, scams, and asset concealment. Authorities also uncovered related schemes in Romania, South Africa, Argentina, and Italy, while warning of a growing sextortion trend targeting teenagers. #OperationJackalIV #BlackAxe #TheCom
CISA’s red-team tests found that a government organization was compromised and failed to respond effectively, while a water-sector organization detected the intrusion and quickly quarantined affected systems. Both organizations still had security gaps, including cloud-risk underestimation, missing Conditional Access for workload identities, and weak token revocation processes. #CISA #OrganizationA #OrganizationB
Threat actors are opportunistically exploiting two patched MiniOrange SAML 2.0 Single Sign-On vulnerabilities, CVE-2026-61979 and CVE-2026-15981, to bypass authentication on WordPress sites. The silent patching approach and inconsistent versioning for paid editions make it difficult for site owners to know whether they are protected. #CVE-2026-61979 #CVE-2026-15981 #MiniOrange…
Alice raised $140 million to strengthen AI systems against emerging vulnerabilities, bringing its total funding to $280 million. The company uses stress-testing, continuous red-teaming, and its Rabbit Hole dataset to help developers defend against prompt injection, jailbreak attempts, and other adversarial attacks. #Alice #RabbitHole #ActiveFence…
The Linux Foundation has assumed governance of TRACE, an open specification that produces verifiable evidence of how AI agents and confidential workloads run across different environments. Developed with OPAQUE, AMD, Intel, Microsoft, and TII, TRACE combines existing standards to create portable, hardware-backed proof for compliance, security, and AI runtime transparency. #LinuxFoundation…
WhatsApp is rolling out new account security features, including support for multiple passkeys across devices and stronger two-step verification with full alphanumeric passwords. It is also adding more context on call screens for unknown callers to help users spot scam attempts before answering. #WhatsApp #Passkeys
Microsoft has updated PowerToys with Window Hopper, a new utility that lets users switch between windows of the currently focused app using a configurable Alt + backtick shortcut. The release also adds compact mode for Command Palette, linked brightness controls for multiple displays, Shortcut Guide Windows-key activation, DemoMirror, and a new Mouse Highlighter ripple mode. #PowerToys #WindowHopper #CommandPalette #DemoMirror #ZoomIt
Security teams have strengthened logins with MFA and conditional access, but attackers are increasingly targeting onboarding and account recovery instead of the authentication flow itself. The article highlights how groups like Scattered Spider and North Korean IT workers exploit weak identity verification at the service desk, and how Specops Verified ID adds document validation and biometric liveness detection to help stop impersonation. #ScatteredSpider #NorthKoreanITWorkers #SpecopsVerifiedID #M&S
Nutex Health is investigating a data breach after an unauthorized third party allegedly exfiltrated information from its servers, including data that may be private or confidential. The company has activated its incident response process, notified law enforcement, and says it has not yet determined whether patients, employees, or business partners were affected. #NutexHealth #NUTX
A large DDoS attack has disrupted Norway’s shared government digital infrastructure, affecting services run by the Norwegian Digitalization Agency (Digdir) and its provider Vivicta. Digdir says there is no sign of a security breach or personal data compromise, but some services like ID-porten and eSignering remain partially unavailable. #Digdir #Vivicta #ID-porten #eSignering #Altinn #Skatteetaten
Kaspersky researchers found what may be the first malware built specifically for car head units, delivered through a compromised update channel on DoFun Android infotainment systems. The campaign appears linked to the BadBox botnet and the MoYu Group, suggesting an expansion of BadBox beyond TV boxes and into vehicle systems. #DoFun…
SecurityWeek and MTSI will host the Cyber Attack Methods course at the 25th Anniversary ICS Cybersecurity Conference in Nashville from October 6–8, giving participants hands-on experience in how attackers compromise cyber-physical systems. The training is designed for engineers, developers, testers, and security professionals to better understand attack paths, reduce risk, and…
WhatsApp has introduced new security features for passkeys, two-step verification, and caller context to help users better protect their accounts and identify suspicious calls. More than 1 billion people now use passkeys on WhatsApp, and Android users will soon see additional details about unknown callers before answering. #WhatsApp #Meta…