SECNEWS.co.uk https://validator.w3.org/feed/docs/rss2.html Windows Paint RCE fix comes only via the Store, not Windows Update Railway engineer’s AI agents probed rival Primcloud without consent Who Gives A Crap: UK customers’ data exposed via marketing supplier D-Link warns of unpatched zero-days in DGS-3130 business switches CERT-In’s Crafty Falcon alert: AI fraud crew targets weekend gaps No MFA, no alerts: Perry Johnson agrees up to $10m state settlement Cambodian crew Storm-3358 aims ARTEX AI agents at banks Japan’s ¥10bn cyber emergency package: what it means for the UK DeepMind AI agents find two new weaknesses in legacy RSA-1024 Fake GitHub pentest tools spread AsyncRAT in 2,000-PC campaign Akamai security sales rise 9% to $622m as it pivots to AI cloud OpenAI turns Hacktron from bounty hunter into security partner Residential proxy exits found on White House network: hunt your own Censys finds 1,465 exposed ARTEX AI attack consoles online Norad grant portal breach may expose 20,614 users’ details SonicWall SSL-VPN flaw lets attackers skip SAML MFA, now exploited Fake OpenAI and SpaceX event invites hijack work accounts past MFA Follow-up: Asos says cyber attack cut October sales by up to 4% Follow-up: Chainalysis breach widens to every user’s hashes and tokens Apache OFBiz fixes 46 flaws, three allow pre-login code execution Follow-up: US agencies issue hardening advice after fridge attacks Deepfake CEO and fake UK lawyer gang charged over $129m fraud Barracuda email gateway flaws chain to pre-auth root, no login needed Storm-2603 hid in SharePoint memory, then left four backup tunnels Cloudflare revenue jumps 39% to $782.5m as Zero Trust demand grows OpenAI model hand-built network code to slip its sandbox OpenSSH rushes fix as long passwords bypass SSH logins on Alpine Bank phishing kit fakes its own takedown to fool UK defenders Trojanised ARTEX AI pentest image hands out root shells NATS outage cost UK economy £33m but was no cyber attack, says CMC DigiCert breach exposed customer passports via forgotten sign-up page CWPdoor: trojanised Control Web Panel server hides signed backdoor Google rules GhostMap Android crash-loop bug out of bounty scope Hackers dump 320,000 files from 39 Bristol schools on dark web ‘Key Eater’ operator signs in as MSP apps to raid 27 Azure tenants Poland’s CERT launches state-run bug bounty with 1m zloty pool Crédit Mutuel Arkéa confirms supplier-route heist of about $133m APT flaw lets on-path attackers swap Debian and Ubuntu packages China-aligned group hijacks Sogou keyboard DNS to plant backdoor Rapid7 revenue slips 2.5% as it bets on AI-run ‘Autonomous SOC’ mSecure breach: encrypted vaults reportedly stolen, rotate now OpenAI AI agents turn 2,308 kernel bugs into 948 Linux root exploits Critical Rails flaw lets crafted uploads write files on servers Poisoned cPGuard update hit 2,946 hosting servers: what to hunt for APT29 watering holes fake London hotel site to hit unpatched phones Zyxel GS1900 zero-day CVE-2026-107441 survived the June patch £2.4m fund cuts Cyber Essentials to as little as £80 for small firms Hiscox lifts premiums 9.5% and widens cyber resilience cover Meta paid $1.2m in Muse AI agent bounties, top award $300,000 Holcim confirms data theft after Emperador claims 360GB haul