SECNEWS.co.uk https://validator.w3.org/feed/docs/rss2.html Apache OFBiz fixes 46 flaws, three allow pre-login code execution Follow-up: US agencies issue hardening advice after fridge attacks Deepfake CEO and fake UK lawyer gang charged over $129m fraud Barracuda email gateway flaws chain to pre-auth root, no login needed Storm-2603 hid in SharePoint memory, then left four backup tunnels Cloudflare revenue jumps 39% to $782.5m as Zero Trust demand grows OpenAI model hand-built network code to slip its sandbox OpenSSH rushes fix as long passwords bypass SSH logins on Alpine Bank phishing kit fakes its own takedown to fool UK defenders Trojanised ARTEX AI pentest image hands out root shells NATS outage cost UK economy £33m but was no cyber attack, says CMC DigiCert breach exposed customer passports via forgotten sign-up page CWPdoor: trojanised Control Web Panel server hides signed backdoor Google rules GhostMap Android crash-loop bug out of bounty scope Hackers dump 320,000 files from 39 Bristol schools on dark web ‘Key Eater’ operator signs in as MSP apps to raid 27 Azure tenants Poland’s CERT launches state-run bug bounty with 1m zloty pool Crédit Mutuel Arkéa confirms supplier-route heist of about $133m APT flaw lets on-path attackers swap Debian and Ubuntu packages China-aligned group hijacks Sogou keyboard DNS to plant backdoor Rapid7 revenue slips 2.5% as it bets on AI-run ‘Autonomous SOC’ mSecure breach: encrypted vaults reportedly stolen, rotate now OpenAI AI agents turn 2,308 kernel bugs into 948 Linux root exploits Critical Rails flaw lets crafted uploads write files on servers Poisoned cPGuard update hit 2,946 hosting servers: what to hunt for APT29 watering holes fake London hotel site to hit unpatched phones Zyxel GS1900 zero-day CVE-2026-107441 survived the June patch £2.4m fund cuts Cyber Essentials to as little as £80 for small firms Hiscox lifts premiums 9.5% and widens cyber resilience cover Meta paid $1.2m in Muse AI agent bounties, top award $300,000 Holcim confirms data theft after Emperador claims 360GB haul Follow-up: Binance post-mortem traces $6.3bn heist to fake interview 3AM ransomware hits UK school estate in suspected AI-assisted attack Red Hat ships fix for 9.8 Linux TCP flaw; Ubuntu LTS still waits Immunefi refunds bug report fees to 700+ hunters as AI floods triage Follow-up: fridge sabotage wave returns, NCSC warns UK firms CrowdStrike buys Fiddler AI and Dreadnode in reported $495m deal Microsoft paid $16,000 for Windows Get Help bugs but issued no CVEs WorkOS says AI attack framework breached its internal sales tool Node-RED CVSS 10 flaw exploited in attempts to plant Linux bots NCSC annual review: compliance alone won’t make UK firms resilient Check Point says revenue hit bottom as firewall refresh slump bites OpenAI quadruples bug bounty rewards, top payout now $172,000 London’s Trigger.dev says attacker stole customer secrets and API keys 400+ disguised AI apps and sites hid deepfake tools; Apple pulls 19 Name.com hijack sends 15 domains to wallet drainer: DNS lessons VOLTA infostealer asks Claude, Kimi and Gemini to rank its victims Lenovo ‘AES-256’ USB stick was a plain SD card; rivals got no warning Aon: only 13% of UK firms have quantified their cyber exposure Smart energy firms face CAF audits and 72-hour incident reports