The article warns that the greatest danger from AI is not sentient machines, but humans intentionally using autonomous AI weapons to target cultures, countries, political adversaries, and civilian infrastructure. It calls for urgent international rules to define acceptable boundaries and deter authoritarian governments from scaling these capabilities against protected targets. #AutonomousAIWeapons #HelpNetSecurity
A forum actor using the name RedStone is claiming to sell a full database tied to the FĂ©dĂ©ration Française de SpĂ©lĂ©ologie, allegedly exposing 93,493 member records with emails, phone numbers, IBANs, and other personal and financial data. The post also claims server RCE, 28 database compromises, source code theft, and defacement…
A forum actor known as Individual is claiming a full breach of Nigeriaâs Federal Capital Territory Internal Revenue Service, advertising 87 tables, about 5 million records, 7 GB of data, and 121,000 users. The alleged dataset reportedly includes taxpayer and identity information such as emails, hashed passwords, OAuth tokens, tax profiles,…
A forum actor known as Quantique claims to have scraped data from ColisPort APIs, releasing a dataset that allegedly contains 19,741 records. The unverified claim includes shipment and customer details such as emails, addresses, phone numbers, tracking numbers, billing data, and other sensitive logistics information. #ColisPort #Quantique #France…
A new WordPress Core CSRF chain dubbed Click2Shell can let an attacker force-install a theme and achieve pre-authenticated remote code execution when a logged-in administrator visits a crafted link. WordPress fixed the issue in version 7.1.1, and researchers have already published full technical details and a proof-of-concept exploit. #Click2Shell #WordPress #pwn.ai #PaulosYibelo
CISA is warning that attackers are actively exploiting three Linux kernel vulnerabilities, including CVE-2025-39964, which has existed for 14 years and is rated critical. Federal agencies must patch and perform forensic triage immediately, while Red Hat and researchers have confirmed public or known exploits for CVE-2025-39682 and CVE-2026-53266. #CVE-2025-39964 #CVE-2026-53266 #CVE-2025-39682 #LinuxKernel #CISA
BigCommerce notified merchants that attackers compromised credentials for the third-party Ribon and Ribon 1.5 applications and used them to inject malicious scripts into a small number of storefronts. Master of Malt said shopper data including names, email addresses, phone numbers, and shipping addresses was exposed, while BigCommerce said its own platform and payment data were not breached. #BigCommerce #Ribon #MasterofMalt #Fastr #BeAPartOf
Google was fined âŹ403 million by Irelandâs Data Protection Commission for GDPR breaches involving the handling of location data in Web & App Activity, Location History, and Location Accuracy between May 2018 and February 2020. The DPC said Google failed to ensure lawful, fair, and transparent processing, and ordered the company…
North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices in over 100 countries and stolen funds or credentials from more than 7,000 cryptocurrency wallets, causing at least $10.71 million in losses. The operation targets developers and crypto professionals through fake job offers, delivering malware and…
A fake LastPass Authenticator installer on GitHub delivered a signed Windows kernel driver that disabled security tools before a password stealer harvested credentials, wallet files, and session data. Researchers said the campaign used DLL side-loading, BYOVD tactics, and impersonation pages for many brands, while LastPass confirmed its own systems were not…
Metallco in Brazil reported a ransomware incident attributed to the play threat actor. The attack impacted organizations in #brazil
There were 3 defacement incidents targeting Colombia, Brazil, and Turkey, carried out by the attackers TeaM_CC and azraelzer0d4y. TeaM_CC was involved in 2 incidents, while azraelzer0d4y was involved in 1 incident. #Colombia #Brazil #Turkey…
Nightspire ransomware allegedly encrypted and stole Victimâs (360 Consulenza S.r.l., IT) private documents, projects, and software source codes as part of its coercion attempt. The attack is reported to have impacted IT#Italy
Microsoft has fixed a known issue in the September 2026 security updates that caused copy-and-paste, autofill, and formula dragging to fail silently in Excel for multiple versions, including Excel Online. Affected users must install the updated Office builds, while some Office 2016 and Office LTSC 2019 scenarios with conditional formatting may still need the Paste Special workaround. #Microsoft #Excel #KB5002914 #Office2016 #OfficeLTSC2019 #OfficeLTSC2021 #OfficeLTSC2024
Irelandâs Data Protection Commission fined Google âŹ403 million for GDPR violations tied to the processing and retention of usersâ location data. The case focused on Googleâs Web & App Activity, Location History, and Location Accuracy features, with the DPC ordering compliance improvements within six months. #Google #GDPR #DataProtectionCommission