Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer  - Anthropic's Claude Opus 5.5 appears to be changing how it writes, with new analysis showing fewer obvious AI writing patterns, shorter sentences, and simpler wording compared with Opus 5.

+3 from  bleepingcomputer

 CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks  - The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2.

+7 from  bleepingcomputer

 Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware  - Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign . The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment...

+1 from  thehackernews

 News alert: SCOUTz gives MSPs security evidence to help turn prospects into customers  - PHOENIX, Sept. 24, 2026, CyberNewswire — SCOUTz , a prospect intelligence platform built for managed service provider (MSP) security sales, is now available in open beta. The platform gives an MSP dated evidence about a prospect’s environment before the first meeting and keeps that evidence attached...

 FBI hack: ShinyHunters countdown ticks down, claims "we got what we wanted" in new post  - ShinyHunters insists the FBI hack is “NOT financially motivated” and “NOT a ransom,” as the hackers give the agency five days to comply with its demands.

 MacSync malware uses public iCloud calendars to deliver new payloads  - A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads.

+1 from  bleepingcomputer

 From Prototype to Conference: Winbush’s Journey in Motion Graphics

+8 from  dell

 "Entire systems could collapse:" OpenAI government breach is a stark warning for national security  - Experts warn that systems are “not ready” for AI attacks.

 Meta deceived Facebook users about privacy protections, jury finds  - This marks Meta’s second major loss to New Mexico this year.

 CISA Adds Two Known Exploited Vulnerabilities to Catalog

+1 from  cisa

 Kiteworks urges 6-hour server shutdown over potential zero-day attacks  - Secure file-sharing software company Kiteworks is urging customers worldwide to temporarily shut down their servers on Saturday for a six-hour window after receiving threat intelligence warning of a potentially imminent cyberattack.

+2 from  bleepingcomputer

 Trellix Advanced Research Center  - Read the Blog

 U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions  - A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims. One...

 RemControl Banking Trojan Gives Attackers Remote Control of Android Devices  - The newly-discovered trojan abuses the Android Accessibility Service to gain control over victim devices and collect sensitive banking credentials

+3 from  infosecurity-magazine

 Stable Channel Update for ChromeOS / ChromeOS Flex  - The Stable channel is being updated to OS version 16765.51.0 (Browser version 152.0.7977.132 ) for most ChromeOS devices.

 CISA Adds Two Known Exploited Vulnerabilities to Catalog

 Sovereign AI Is a Control Problem, not a Location Problem

 Hackers now exploit critical Roundcube flaw in code injection attacks  - A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.

+3 from  bleepingcomputer

 Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims  - Ransom notes by n0n ransomware claim to take double extortion to a new level of danger for victims

+3 from  infosecurity-magazine

 Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells  - Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in...

+3 from  thehackernews

 16,000 Supabase databases exposed as vibe-coded apps leak sensitive user data  - Over half of the databases showed indicators of personally identifiable information.

 Chrome Dev for Android Update  - Hi everyone! We've just released Chrome Dev 156 (156.0.8072.0) for Android. It's now available on Google Play .

+2 from  chromereleases.googleblog

 Attackers build “silent” cryptominer on victim’s machine and give themselves away

 UFO whistleblower says government has recovered craft and aliens may want our genes  - Wild hypotheses on the airwaves.

 Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild  - The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions...

+3 from  thehackernews

 CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026  - CrowdStrike has been named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026. We received the highest Strategy category score in the evaluation and maximum scores in both the Inno[…]

 Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions  - A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus's own software to gain root access, the highest level of control over an Android phone. OnePlus told him the...

+3 from  thehackernews

 Ukrainian ransomware developer jailed for nearly 13 years  - A court in Zurich has sentenced a Ukrainian man to 12 years and nine months in prison, and banned him from Switzerland for ten years, for developing ransomware that blackmailed companies around the world. Read more in my article on the Hot for Security blog.