SECNEWS.co.uk https://validator.w3.org/feed/docs/rss2.html Critical Rails flaw lets crafted uploads write files on servers Poisoned cPGuard update hit 2,946 hosting servers: what to hunt for APT29 watering holes fake London hotel site to hit unpatched phones Zyxel GS1900 zero-day CVE-2026-107441 survived the June patch £2.4m fund cuts Cyber Essentials to as little as £80 for small firms Hiscox lifts premiums 9.5% and widens cyber resilience cover Meta paid $1.2m in Muse AI agent bounties, top award $300,000 Holcim confirms data theft after Emperador claims 360GB haul Follow-up: Binance post-mortem traces $6.3bn heist to fake interview 3AM ransomware hits UK school estate in suspected AI-assisted attack Red Hat ships fix for 9.8 Linux TCP flaw; Ubuntu LTS still waits Immunefi refunds bug report fees to 700+ hunters as AI floods triage Follow-up: fridge sabotage wave returns, NCSC warns UK firms CrowdStrike buys Fiddler AI and Dreadnode in reported $495m deal Microsoft paid $16,000 for Windows Get Help bugs but issued no CVEs WorkOS says AI attack framework breached its internal sales tool Node-RED CVSS 10 flaw exploited in attempts to plant Linux bots NCSC annual review: compliance alone won’t make UK firms resilient Check Point says revenue hit bottom as firewall refresh slump bites OpenAI quadruples bug bounty rewards, top payout now $172,000 London’s Trigger.dev says attacker stole customer secrets and API keys 400+ disguised AI apps and sites hid deepfake tools; Apple pulls 19 Name.com hijack sends 15 domains to wallet drainer: DNS lessons VOLTA infostealer asks Claude, Kimi and Gemini to rank its victims Lenovo ‘AES-256’ USB stick was a plain SD card; rivals got no warning Aon: only 13% of UK firms have quantified their cyber exposure Smart energy firms face CAF audits and 72-hour incident reports UK researcher had no way to report Applebee’s customer data flaw NHS England tells GPs to weigh ICO reports after supplier collapse Cyera in talks at $20bn valuation as data security market heats up AO3 silent three days on as possible user data theft keeps site down OpenAI pays $5,000 for ChatGPT share-link account takeover Northflank breach joins Wiz’s ‘Black October’ AI key theft wave TeamViewer flaw could let a rogue host run code on helpdesk PCs Cloudflare: 18.2m DDoS attacks in Q3, most over before SOCs can react Shelly Store UK warns card data may have been stolen via web malware AI deepfake investment scams cost UK victims £24.3m this year: police Apple sends new spyware threat alerts to users in 99 countries Hijacked UK DebugBear script drains up to $2.7m from Polymarket Microsoft: fake help desk calls led to AD CS abuse and DCSync Follow-up: n0n’s exposed server reveals AI-built extortion kit Ofcom names four age checks for UK under-16 social media ban Norton owner Gen raises FY27 outlook as Q2 revenue rises 12% Chainalysis says ‘agentic’ attacker exposed customer details Orange Cyberdefense signs up as Mistral’s first European MSSP partner ICO reprimands Staffordshire Police for revealing victim’s address Researcher finds 26,400 live cloud and AI keys exposed on Gitee Tenable raises 2026 outlook after Q3 beat and $800m note sale IPCO: GCHQ still cannot account for thousands of storage devices Talos IR: help desk vishers and EDR killers push ransomware to 27%