Attackers hijack country-code domains to impersonate Google and other services
Cybercriminals compromised three country-code namespaces to get certificates that could help them impersonate trusted sites.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,856 matching stories — in Threat Intelligence — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Threat Intelligence Snapshot: Week 41, 2026
AI Coding Agents Publish Internal Screenshots from Over 300 Organizations to Public GitHub Repositories | Denmark Says Russia Has Conducted Sabotage Attacks Against Its Defense Firms The post Threat Intelligence Snapshot: Week 41, 2026 appeared first on QuoIntelligence.
[tl;dr sec] #349 - Vulns & Exploits in the AI Era, Package Manager Sandboxing, Testing AI Sandboxes
Trends from Google Threat Intelligence Group, a survey of how package managers handle sandboxing, testing Vercel and Perplexity's sandboxes
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration from various South Korea-based financial firms,
Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Expanding Attack Surface
By Assaf Morag, Cybersecurity Researcher Various healthcare and public health reports like the one of IC3 (2025) report that healthcare organizations are among the most targeted critical infrastructure sectors for cyber incidents, with hundreds of reports of ransomware attacks and data breaches reported in a single year. Underground Telegram channels that aggregate ransomware activity daily […] The post Healthcare Is Cybercrime’s Highest-Value Target: Ransomware, Exposure, and the Ex
Amazon Alexa Tablet 12 Pro, Alexa Tablet 11, Alexa Tablet 8: Specs, Features, Price
The three new aluminum Alexa Tablets now run Android with full access to the Google Play Store. There are versions for kids too.
The Network Is Up. So Why Are Subscribers Still Unhappy?
Network uptime alone no longer defines service quality; subscriber experience does. Better assurance can accelerate issue resolution, reduce preventable churn, protect revenue, and guide higher return on investments.
Ransomware 2026 Report September
The September 2026 ransomware attack report reveals a persistent and evolving threat landscape, analyzing 8 significant victim companies across various industries. The post Ransomware 2026 Report September appeared first on ThreatMon.
The Context of Record: Keeping the Reasons Behind Security Decisions
Security teams keep careful records of what happened, but the reasons behind each decision are much harder to find. The context of record keeps those reasons where your team can find them. This article looks at what goes into it, the three layers of security context it brings together and how it applies to risk acceptance. The post The Context of Record: Keeping the Reasons Behind Security Decisions appeared first on Zynap.
Pwn2Own Ireland 2026 - Day Three Results & Master of Pwn
Day Three of Pwn2Own Ireland 2026 wrapsup with 17 attempts scheduled, roughly $1.33 million on the board.The headliner is the Google Pixel 10, which draws three separate attempts: Xint at 11:15 AM, Ikotas Labs at 2:00 PM, and the Valsamaras/Ken Gannon (Djini.ai)/Valsamara team closing things out at 6:30 PM — by far the single biggest payday in play all week. The Samsung Galaxy S26 gets one more run too, from BunkyoWesterns at 4:15 PM. Smart Home stays busy with three attempts on the Philips Hue
Hacker Used Chinese-Developed A.I. Tool to Target South Korean Banks, CrowdStrike Says
The cybersecurity firm said the attacker was likely a Chinese speaker and financially motivated, but did not attribute the attacks to a named individual or group.
SOCRadar Freshdesk Integration: Track and Resolve Security Incidents as Tickets
SOCRadar Freshdesk Integration: Track and Resolve Security Incidents as Tickets Your support and IT teams live in Freshdesk. Every request has an owner, an SLA and a history. Security findings, meanwhile, arrive somewher
How BlueMoon Exploits Chrome CVE-2026-85046 and CVE-2026-87491
Key Takeaways BlueMoon Exploit Kit, first observed on August 28, 2026, turns visits to malicious websites into Windows malware execution. The kit chains two V8 vulnerabilities with a Windows kernel exploit to run payloads outside the browser sandbox. CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 enable V8 type confusion, sandbox escape, and kernel privilege escalation respectively. Spearphishing emails lead victims to attacker-controlled exploit pages, some of which then redirect to legitim
How MindMax Neutralized a Massive Bot Scraping Attack with CrowdSec WAF Bot Detection
Discover how Finnish company MindMax used the new CrowdSec WAF bot detection feature to stop a massive, highly distributed residential botnet targeting their dictionary sites.
Making Threat Intelligence Work for SOC Teams: ANY.RUN & Elastic Webinar Insights
Threat intelligence on its own is only data. Its value depends on how effectively SOC teams can turn it into action. Simply put, this was the premise of our recent webinar. The SOC and business impact of threat intelligence depends largely on how quickly analysts can use it to validate threats, make confident decisions, and […] The post Making Threat Intelligence Work for SOC Teams: ANY.RUN & Elastic Webinar Insights appeared first on ANY.RUN's Cybersecurity Blog.
DNS TTL: Investigate a Change of IP Address
Reconstruct DNS address changes using dated responses, caches and network views, without confusing TTL with the lifetime of a threat.
Picus Security Placed With a Customers’ Choice Distinction in 2026 Gartner® Peer Insights™ Voice of the Customer for Adversarial Exposure Validation
The report shows a 4.8 out of 5 overall rating and a 98% willingness to recommend, exceeding the market average in many categories
Abusix Launches Frontline, A Partner Program To Meet Growing Demand
Phishing remains one of the biggest ways malicious actors breach networks, according to Verizon’s 2025 Data Breach Investigations Report. The volume of AI-powered phishing attacks is increasing by the minute, and IBM’s 2025 Cost of a Data Breach Report finds that 16% of breaches now involve attackers using AI tools, most often to write the […] The post Abusix Launches Frontline, A Partner Program To Meet Growing Demand appeared first on Network Abuse Management at Scale | Abusix.
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage
Getting Started with OpenCTI: AlienVault OTX and Threat Landscape in One Compose File
A step-by-step tutorial for standing up OpenCTI with Docker Compose and pointing it at AlienVault OTX and the Threat Landscape intelligence feed.
Telecom Risk Determination: Beyond Threat Intelligence | iCOUNTER
Threat intelligence alone doesn't show what puts your telecom operations at risk. Learn how risk determination turns third-party threats into action.
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL
CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. Authors : Vikas Kundu
Spike in Attacks Targeting Digital Video Recorders in Ukraine
For months, GreyNoise recorded almost no Hikvision camera exploit attempts against Ukraine. On Sept 21 activity surged for nine days during Russian strikes, almost all from four IPs, then stopped. We can't say if the two are linked.
Internet Nations
Farsight CEO Paul Vixie disccusses how the Internet has changed the way nations act and interact.
OpenAI Agents Target More Than 100 Organisations in Expanding Cybersecurity Investigation
OpenAI said on October 1 that it had notified more than 100 organisations about unauthorised activity involving its AI agents as the company continued a large-scale investigation into how its models... The post OpenAI Agents Target More Than 100 Organisations in Expanding Cybersecurity Investigation appeared first on Blackwired.com.
Illuminating Signposts and Guidelines for a More Secure Internet
Internet Pioneer Dr. Paul Vixie calls on the next-gen tech leaders to build simpler and better technologies rather than merely adding more layers and more complexity to solve today's cybersecurity problems
Farsight
Farsight CEO Dr. Paul Vixie kicks off the company's new blog program with a look back at why Farsight was founded and its mission to make the world a safer place.
OU Medicine, Inc.
HackNotice is a service that notices trends and patterns in publically available data so as to identify possible data breaches, leaks, hacks, and other data incidents on behalf of our clients. HackNotice monitors data streams related to breaches, leaks, and hacks and OU Medicine, Inc. was reported by one of those streams. HackNotice may also [...]
Marking Services, Inc.
HackNotice is a service that notices trends and patterns in publically available data so as to identify possible data breaches, leaks, hacks, and other data incidents on behalf of our clients. HackNotice monitors data streams related to breaches, leaks, and hacks and Marking Services, Inc. was reported by one of those streams. HackNotice may also [...]
Leadec
HackNotice is a service that notices trends and patterns in publically available data so as to identify possible data breaches, leaks, hacks, and other data incidents on behalf of our clients. HackNotice monitors data streams related to breaches, leaks, and hacks and Leadec was reported by one of those streams. HackNotice may also have the [...]
Beyond Support: How Flashpoint Redefines the Customer Success Experience
In this post, we look at the key differentiators behind Flashpoint’s Customer Success & Support (CS) — and why Forrester recognized us as a Customer Favorite. The post Beyond Support: How Flashpoint Redefines the Customer Success Experience appeared first on Flashpoint.
From the World Cup to the Olympics: Scaling Event Security with LA Metro’s Robert Gummer
In this episode Keeping a major event safe means protecting more than the stadium. Robert Gummer, Deputy Chief of Emergency Management and Security at LA Metro, joins Fred Burton to discuss lessons from the World Cup and how they’re informing preparations for the 2028 Olympics. He shares how integrating security across business units and strengthening… The post From the World Cup to the Olympics: Scaling Event Security with LA Metro’s Robert Gummer appeared first on Ontic.
Agentic Hunting Needs Guardrails. Start With Your Methodology.
Is your team running each new threat report through AI to generate a hunt? The SANS 2026 Threat Hunting Survey found that usage of formally defined threat hunting methodologies fell for a second straight year, to 37%, down from 46% in 2025 and 51% in 2024.
Cybersecurity Tokenomics: Denial of Wallet Attacks and the Cost of SOC Operations | Kaspersky official blog
How to prevent budget overruns in the information security department, and what cyber risks the cost of AI tokens poses to the SOC.
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have
What Is Attack Surface Analysis for Threat Modeling?
Attack surface analysis is the process of identifying every point where an attacker can interact with a system, including APIs, cloud services, identities, and third-party integrations, and then evaluating each... The post What Is Attack Surface Analysis for Threat Modeling? appeared first on VerSprite.
CVE-2026-21589: Critical Atlassian File Access
CVE-2026-21589: Critical Atlassian File Access Atlassian has disclosed CVE-2026-21589 , a critical unauthenticated arbitrary file-access vulnerability affecting eight self-hosted products. The flaw carries a CVSS v4.0 sc
Exposed Agent Keys Can Become a Route into Infrastructure: What Leaked AI and MCP Credentials Actually Expose
By Adrian Cheek, Senior Cybercrime Researcher One record in the corpus carries the argument before we even start counting. It’s a project configuration file for an AI coding assistant that wires several named tool servers behind a single agent. The file does not hold the secrets, but it points to them: an environment block, a […] The post Exposed Agent Keys Can Become a Route into Infrastructure: What Leaked AI and MCP Credentials Actually Expose appeared first on Flare | Identity First Th
Your Customer Shouldn’t Be the Canary in a Coal Mine
When an organization gains end-to-end visibility into its network and application environment, teams can spot issues before they become full-blown problems.
FortiBleed Is Still Active, Locking Organizations Out
FortiBleed Is Still Active, Locking Organizations Out On October 6, 2026, the FBI and the U.S. Secret Service published a joint Cybersecurity Advisory on FortiBleed, the active global credential compromise campaign again