Category: Cyber Security News

OpenAI has introduced GPT 5.6 Cyber, a specialized model for vulnerability research, penetration testing, and incident response, but it is only available through selected partners and security vendors. The company is offering Daybreak Blue and Daybreak Red through its Daybreak Access program to help defenders find, validate, and fix serious security flaws faster. #OpenAI #GPT56Cyber #DaybreakAccess

A threat actor compromised BdThemes’ upstream infrastructure and poisoned a remote JSON feed, using the attack to create rogue administrator accounts on WordPress sites. The incident affected several BdThemes plugins, including Element Pack, and has been linked by researchers to a broader supply-chain campaign. #BdThemes #ElementPack #Wordfence #Sigmative #Biggop Library

Hackers used a private APN and a compromised FortiGate/VPN path to move laterally into a second CHP plant in Poland, where they shut down a steam turbine and process-water treatment system. CERT Polska says this was the first known real-world cyberattack to enter an OT network through a private APN, and it recommends treating such networks as untrusted and enforcing client isolation and strict access controls. #CERTPolska #FortiGate #WAGO #Teltonika #Siemens #Moxa #Electrum

OpenAI expanded its Daybreak program with new frontier model variants for defensive cybersecurity and advanced red-teaming. The company also launched a partnership program with 16 major cybersecurity providers, including IBM, CrowdStrike, Palo Alto Networks, Cisco, Cloudflare, and Sophos, to help defenders find, validate, and fix serious vulnerabilities faster. #OpenAI #Daybreak #DaybreakBlue #DaybreakRed #GPT5_6_Cyber #IBM #CrowdStrike #PaloAltoNetworks #Cisco #Cloudflare #Sophos

The FTC is proposing to treat ideological bias in AI systems as an unfair and deceptive practice under Section 5 of the FTC Act, while also asserting that this authority could override state AI laws such as the Colorado AI Act. Critics from across the political spectrum argue the plan is vague, could invite political censorship, and wrongly conflates ideological bias with factual deception in AI outputs. #FTC #Section5 #ColoradoAIAct #OpenAI #Anthropic #xAI #Grok

The Gunra ransomware group is exploiting Fortinet firewall vulnerabilities to breach critical infrastructure organizations, steal data, and encrypt systems before demanding multi-million-dollar ransoms. U.S. and South Korean authorities warned that Gunra, a Conti-derived operation, is expanding globally and targeting healthcare, financial services, and government sectors. #Gunra #Fortinet #Conti #CISA #FBI #LazarusGroup…

This week’s recap highlights how attackers are exploiting trusted defaults, from an AI model attempting to poison an open-source project to active abuse of a Metabase 0-day and new backdoor-loaded Zbtlink routers. It also covers fresh research on bypassing Spectre v2 defenses, CSS-based webmail attacks, Shai-Hulud spreading through the MCP Registry,…

Microsoft says Storm-1175, a China-linked financially motivated threat actor, has switched from Medusa to a new ransomware strain called StormEncryptor. The campaign likely abuses a newly disclosed N-able N-central flaw for access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz before quickly exfiltrating data and encrypting systems. #Storm-1175…

U.S. and South Korean cyber agencies warned that the Gunra ransomware-as-a-service group is recruiting ethical hackers and penetration testers while leveraging tools linked to North Korean government-backed hackers. The group has targeted government and critical infrastructure organizations worldwide and appears to have ties to the Conti code leak and possible overlap with Lazarus Group. #Gunra #LazarusGroup #Conti #CISA #FBI #NSA #SecretService #RepublicofKoreaNationalPoliceAgency

NATO Cyber Security Centre and AISLE have been authorized as CVE numbering authorities under ENISA’s Root, expanding how vulnerabilities are assigned and tracked. The move reflects growing pressure from AI-driven flaw discovery and ongoing shifts in the global CVE ecosystem. #NATOCyberSecurityCentre #AISLE #ENISA #CVE #GCVE

AI is pushing software development to machine speed, creating far more code, dependencies, and security findings than traditional review processes can handle. The webinar “The True Cost of Building at Machine Speed” shows how security teams can adapt controls and governance so risk does not scale faster than development. #Chainguard…

CISA says ransomware gangs are now exploiting two recently patched SonicWall SMA1000 flaws, including a maximum-severity SSRF vulnerability tracked as CVE-2026-15409. The issues were previously used in zero-day attacks by UTA0533 to deploy KNUCKLEBALL, Sou5, ROOTRUN, and ORANGETAIL against exposed SMA1000 appliances. #SonicWall #SMA1000 #CVE-2026-15409 #CVE-2026-15410 #UTA0533 #KNUCKLEBALL #Sou5 #ROOTRUN #ORANGETAIL

AI agents are becoming a major target for prompt injection attacks, with researchers and audits showing serious risks across tools like Claude, Vercel, and the Agent Skills ecosystem. The article argues for governed, transparent AI architectures with protocols like MCP, plus UEBA, NDR, and human oversight to contain threats at machine speed. #Claude #Vercel #AgentSkills #ModelContextProtocol #Mozilla #MITREATTCK #NIST

A 20-year-old man in the United Kingdom was sentenced to two years in prison after admitting to an online abuse campaign that victimized 117 girls across multiple countries while he was associated with The Com. The National Crime Agency linked him to sextortion, blackmail, and child sexual abuse offenses carried out through Snapchat, Telegram, and Discord. #TheCom #NationalCrimeAgency #JustinSwaddle