Pawarta pangreksan siber paling anyar, kedadeyan, lan perkembangan model SI — dipirsani lan ditliti kanggo korban lan panaliti ing wates white-hat sing sah. Ora ana cara ngrusak mlebu utawa carane exploit.
Artikel iki dijarwakake dening mesin.
- Cyberattack response: country-by-country guides
Nine country guides, local-language editions and downloadable non-executable BPMN response processes.
- Cyberattack response for companies in the United States
Evidence, reports, counsel, insurance and public communications after a cyberattack in the United States.
- Cyberattack response for companies in the United Kingdom
Evidence, reports, counsel, insurance and public communications after a cyberattack in the United Kingdom.
- Cyberattack response for companies in Canada
Evidence, reports, counsel, insurance and public communications after a cyberattack in Canada.
- Cyberattack response for companies in Australia
Evidence, reports, counsel, insurance and public communications after a cyberattack in Australia.
- Cyberattack response for companies in Germany
Evidence, reports, counsel, insurance and public communications after a cyberattack in Germany.
- Cyberattack response for companies in France
Evidence, reports, counsel, insurance and public communications after a cyberattack in France.
- Cyberattack response for companies in the Netherlands
Evidence, reports, counsel, insurance and public communications after a cyberattack in the Netherlands.
- Cyberattack response for companies in Singapore
Evidence, reports, counsel, insurance and public communications after a cyberattack in Singapore.
- Cyberattack response for companies in Japan
Evidence, reports, counsel, insurance and public communications after a cyberattack in Japan.
- Cybersecurity daily — 1 November 2026: MCP migration and corrected extension scope
Smithery's connection-management shutdown date has arrived; Cursor's notice also names 2.1.312. Distinguish planned shutdown, observed operation and verification time.
- Cybersecurity daily — 31 October 2026: extension removal is not incident recovery
Cursor extension follow-up, Wasmtime UDP authorization bypass, and updated AWS Brotli mitigation status. Check host privileges, network authorization and deployed patches.
- Cybersecurity daily — 30 October 2026: verify enforcement beyond configuration
Clerk adds passkeys as a second factor; an older PDF MCP authentication flaw enters the advisory database. Verify enforcement, not just settings and logs.
- Cybersecurity daily — 29 October 2026: verify that Brotli patches are active
AWS details Brotli mitigation: phased Lambda rollout, Node.js 24 verification, container rebuilds and upstream-response decoding.
- Cybersecurity daily — 28 October 2026: separate detection, delegation and runtime authorization
Zuma/Agent Gateway runtime authorization and Socure Agent Intelligence: distinguish release stages and authority boundaries.
- Cybersecurity daily — 27 October 2026: the boundary around agent-managed IAM
Google Cloud introduces IAM Helper. Separate diagnostics and simulation from permission changes, and verify the approval-to-execution boundary.
- Why Faster Cybercrime Intake May Not Reduce Case Backlogs
Public Japanese statistics and an explicit queueing model show why faster intake may shift a bottleneck downstream. Evidence preservation, international assistance, and deterrence require distinct measurements.
- Crypto fraud and theft: Japanese requests for Canadian asset restraint and seizure
For Japanese victims and receiving police officers: RCMP cooperation, formal central-authority requests, evidence and translations, procedural-stage conditions and asset return.
- Prompt injection is not SQL injection: the NCSC design lesson
The NCSC blog says prompt injection is not SQL injection: current large language models do not separate instructions from data, and the risk may never be fully removed the way parameterized queries remove SQL injection (https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection). The NCSC news warns that the comparison is dangerous and challenges claims that the issue can be stopped (https://www.ncsc.gov.uk/news/mistaking-ai-vulnerability-could-lead-to-large-scale-breaches). Design lesson only. Not an attack guide and not legal advice.
- Apa sing kudu diomongake marang klien bab label Article 50 EU AI Act
Kaca Article 50 Commission misahake tugas provider lan deployer kanggo pawarta interaksi, tandha sing bisa diwaca mesin, lan pambuka deep fake (https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50). Sawijining tandha saka kantor hukum ngomong yen tugas kuwi dadi berlaku ing 2 August 2026 lan ora ditundha bareng aturan risiko dhuwur (https://www.goodwinlaw.com/en/insights/publications/2026/08/alerts-technology-dpc-eu-ai-act-transparency-obligations-now-in-force). Informasi umum, dudu pitutur hukum.
- Latihan pangreksan siber sing nuruti alur kerja industri
24 pandelengan industri, 18 lumah teknis, lan wolung latihan offline sing nyambungake pasinaon CTF menyang kesinambungan, dandanan, lan pamulihan.
- Video AI, niru swara, lan wates wewenang
Ulasan mawa sumber babagan Tavus, salah panganggo AI sing dilaporake, lan wates identitas, idin, lan wewenang piranti sing kudu dites dening sing ngadopsi.
- System One Coding: nyusun kode liwat putusan
Blok sing duwe tipe, verifikasi miturut tataran, bandhingan sing diukur, lan pilot gratis sing kadhaptar.
- Yen akun direbut: nggawe «tabel urutan wektu» lan «dhaptar bukti» sadurunge konsultasi karo polisi (bisa disalin lan dianggo)
Sawise akun dijupuk, apa sing kudu disimpen tanpa dibusak. Cithakan garis wektu lan dhaptar bukti. Banjur hubungi polisi utawa layanan lapor kejahatan siber negaramu, lan bank utawa panyedhiya pembayaranmu.
- Yen kena apus-apus aset kripto: cara nggawe «tabel kiriman» sing digawa menyang polisi lan bursa
Ing penipuan kripto utawa investasi, sadurunge transfer maneh utawa «operator pemulihan», lebokake saben pembayaran lan pesen ing 1 lembar. Banjur hubungi polisi utawa layanan lapor kejahatan siber negaramu, bank utawa panyedhiya pembayaranmu, lan bursa. Kaca iki ora janji pemulihan.
- Kertas kerja lapuran IC3: apa sing dikumpulake sadurunge ngajokake (apus-apus kripto lan online)
Siapake saben kolom sing dijaluk IC3 FBI — kerugian, hash transaksi, rincian pihak liyane, header — banjur ajokake 1 lapuran sing lengkap lan simpen salinane.
- Yagene perusahaan perlu twin, lan kepriye Mithril nyedhiyakake
Produksi dudu papan sing bener kanggo sinau sapa sing bisa tekan sistem sensitif, kepriye panolakan katon, utawa apa kluster sing mlaku cocog karo sing diumumake. Twin njaga jeneng-jeneng kuwi lan ora ngetrapake asile. Mithril ndadekake twin kuwi dadi dokumen: komponen domain-walik nyusun, lakuan mbalikake wangsulan lan putusan, lan kluster dicocogake karo pangamatan tanpa diwiwiti.
- Ora ana kunci sing dicolong, $351 yuta ing sak jam — pelanggaran dompet hot Bitget lan wates percaya alur idin
Bitget mesthekake ing 25 September yen kurang luwih $351.6 yuta metu saka sapérangan dompet hot lan warm-e ing transfer tanpa idin sing dideteksi jam 18:31 UTC ing 24 September. Dompet cold offline dilapurake ora kena, metokake dhuwit dijeda, lan bursa kandha User Protection Fund $464 yuta nutupi kabeh kerugian. Miturut Bitget, panyerang ora njupuk private key, nanging tekan sistem backend lan memalsu data transaksi kanggo ngarahake alur idin supaya ngetokake dhuwit. Awake dhewe nliti pitakon atribusi Lazarus lan isomorfisme karo tema bidang manajemen lan identitas sing observatorium iki bahas ing pirang-pirang peken pungkasan.
- Peken nalika panerbit identitas dhewe tiba — zero-day OAuth F5 BIG-IP APM (CVE-2026-94127) lan konsentrasi KEV ing bidang manajemen lan identitas
F5 mbukak ing tanggal 22 September yen zero-day kritis ing jalur OAuth BIG-IP APM (CVE-2026-94127, CVSS 9.8) ngidini eksekusi kode jarak jauh tanpa autentikasi, lan mesthekake eksploitasi ing kahanan nyata. CISA nambahake menyang katalog KEV ing dina sing padha kanthi wates wektu federal tanggal 25 September. Arista VCO lan 2 cacat server manajemen Check Point uga mlebu KEV ing dina iku — tulisan iki nliti kumpule panyerangan marang bidang manajemen lan identitas piranti wates.
- Peken nalika dalan menyang root lokal kebukak bebarengan — LPE kernel Linux mlebu katalog KEV CISA nalika eksploitasi umum teka
Ing tanggal 18 September, CISA nambahake 3 cacat kernel Linux sing dieksploitasi kanthi aktif (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) menyang katalog KEV lan Red Hat mesthekake yen kode eksploitasi umum ana. Ing dina sing padha, eksploitasi sing bisa dianggo kanggo 4 LPE kernel (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) kababar ing pambukak sing dikordinasi. Tulisan iki nliti yagene eskalasi hak ing host sing dianggo bareng ngetutake piranti wates menyang sorotan.
- Bypass autentikasi tingkat paling dhuwur ngenani panguwasa identitas dhewe — Cisco ISE CVE-2026-76460 lan pola bola-bali kompromi root piranti wates
Bypass autentikasi Cisco ISE / ISE-PIC CVE-2026-76460 (CVSS 10.0) lagi dieksploitasi kanthi aktif. CISA nambahake menyang katalog KEV ing tanggal 16 September kanthi wates wektu dandan federal tanggal 19 September; ora ana dalan ngubengi lan iACL mung mitigasi. Tulisan iki nliti pola kompromi root piranti wates — mlaku bareng karo zero-day Secure Email Gateway (CVE-2026-76461) sing kababar tanggal 14 September — lan apa artine nalika log piranti sing wis dikompromi dhewe mandheg dadi sumber utama.
- Gateway AI dadi lumah panyerangan — kadhaptar KEV LiteLLM lan dalan liwat kunci, MCP, lan cloud
Bypass autentikasi MCP BerriAI LiteLLM (CVE-2026-59822) wis mlebu katalog KEV CISA, lan Microsoft nglaporake panyerang nganggo gateway LiteLLM kanggo ngirim XMRig. Riset Wiz nemokake kurang luwih 1 saka 10 saka ~3,000 instansi umum nampa kunci gawan sk-1234 utawa mlaku tanpa autentikasi. Tulisan iki nliti apa artine prasarana AI dadi brankas kredensial.
- Nalika awak agen direbut — 1 ekstensi nglakokake asisten AI ing 5 produk
Forever Security nuduhake yen 1 ekstensi browser biasa bisa nglakokake AI bawaan 5 produk — Chrome, Comet, Edge, Opera Neon, lan Claude. Kapisah, Mandiant nglaporake panyerang ngrebut sesi asisten coding AI lan nyebarake cacing Shai-Hulud ing kurang luwih 100 repositori. Tulisan iki nggambar wates percaya runtime agen.
- Rantai zero-day patch-gap — cacat sing wis ditambal ing Chromium nanging durung ing Chrome dianggo bareng dening pirang-pirang klompok mata-mata sajrone 1 peken
Rantai panyerangan BlueMoon sing nggandhengake uwal saka sandbox V8 Chrome lan eksploitasi ALPC Windows, miturut pangamatan Volexity, ketok dianggo bareng paling ora dening pirang-pirang kluster sing asale saka Cina. Tulisan iki nata bebaya «patch gap»: dandan wis mlebu ing Chromium nanging durung mlebu ing Chrome sing stabil.
- Ringkesan VC: SYN Ventures — dana spesialis kaamanan siber sing dipandhegani operator
Dana AUM $900M sing dipandhegani operator, dibangun dening mantan CISO lan pangadeg. Tulisan iki nggambar 2 dana lan portofolio ~40 perusahaan tumrap posisi mithril.fund.
- Zero-day Cisco Secure Email Gateway CVE-2026-76461 — nalika injeksi SQL parsing email rampung ing eksekusi root
CVE-2026-76461 (CVSS 9.8) lagi dieksploitasi kanthi aktif lan wis ditambahake menyang katalog KEV CISA. Tulisan iki njlentrehake pola bola-bali «kompromi root piranti wates» — lan apa artine nalika log piranti dhewe ora bisa dipercaya maneh.
- Ngenalake Blog Observatorium Kaamanan
Pangamatan lan analisis saben dina bab pawarta kaamanan siber, kedadeyan, lan pangembangan model AI, kababar ing kene.
- Nulis file tanpa autentikasi ngalihi pintu mburi gerbang surel — zero-day FortiMail CVE-2026-104286 lan fitur IBE
Tanggal 1 Oktober, Fortinet ngumumake zero-day path traversal ing FortiMail (CVE-2026-104286, CVSS 9.8) sing ngidini nulis file sing sembarang tanpa autentikasi, lan mbenakake yen eksploitasi wis kedadeyan ing donya. CISA mènèhaké menyang katalog KEV dina sing padha kanthi tenggat federal 4 Oktober. Ora ana rilis sing wis dibeneraké ing cabang sing kena pengaruh papat, mula mateni IBE dadi langkah sementara — kita ngertèkaké ing konteks lonjakan KEW pungkasan Sèptèmber.
- Saka korban apus-apus menyang white hat perusahaan: peta lanskap pangreksan siber (2026)
Telulas kategori, saka pitulungan kanggo korban apus-apus nganti tes pangreksan perusahaan, kanthi kerugian sing dilaporake, dana sing diumumake, prakiran pasar miturut penerbit, lan status jujur ing endi Mithril mapan.
- Leresan memori sing kaitan karo SAML ing NetScaler — CVE-2026-88779 mlebu KEV (watesan 7 Oktober)
Citrix ngumumake cacat watesan buffer memori ing NetScaler ADC / Gateway (CVE-2026-88779, CVSS v4.0 8.7, CWE-119). Citrix ngandika yen wis ngamati serangan sing ditargetake ing deployment sing durung dimitigasi, sing bisa nyebabake denial of service. Entri KEV CISA netepake eksploitasi kerentanan iki, lan katrangan cendhake ngandika cacat kasebut bisa ngidini denial of service. Ora ana sumber sing ngonfirmasi yen deployment sing kena pengaruh bener-bener mandheg. CISA nambahake ing 4 Oktober, watesan federal 7 Oktober. Bebarengan karo CVE-2026-88771 lan CVE-2026-88772 (loro-lorone ditambah 27 September), iki entri KEV NetScaler katelu sing ditambah ing rong minggu, dudu entri katelu produk sakabehe (entri sadurunge kalebu CVE-2023-4966). Tandha Global Deny List (v24 utawa luwih anyar) yaiku mitigasi sementara, lan perbaikan ana ing 14.1-73.41 / 13.1-64.28 utawa luwih anyar.
- Unauthenticated API access in Cisco Catalyst SD-WAN Manager — CVE-2026-76504 Added to KEV (Due October 3)
Cisco published CVE-2026-76504 (CVSS 3.1 9.8 per Cisco, CWE-177) in advisory cisco-sa-sdwan-webauth-xr8beuuU: improper URI-encoding handling in the API session-based authentication management of Cisco Catalyst SD-WAN Manager can let an unauthenticated remote attacker reach the API with admin privileges. CISA added it to KEV on September 30, 2026, with a federal due date of October 3. Fixed releases start at 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 (earlier branches migrate). No known workarounds exist; interim mitigation is restricting internet access to trusted hosts, plus the optional Live Protect shield. Cisco has confirmed exploitation in the wild.
- Apple CoreGraphics zero-day added to KEV — CVE-2026-86950, report of exploitation in an extremely sophisticated targeted attack (Due October 2)
On September 28, 2026, Apple released iOS 26.7.1 / iPadOS 26.7.1 / macOS Tahoe 26.7.1 / macOS Sequoia 15.8.1, fixing an out-of-bounds write (CVE-2026-86950, CWE-787) in CoreGraphics. Processing a maliciously crafted file may lead to arbitrary code execution; Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. CISA added the vulnerability to KEV on September 29, 2026, with a federal due date of October 2 (forensicTriage Yes). The CISA-ADP CVSS 3.1 base is 8.8 (High). The fix is the listed releases only; the primary sources reviewed for this post state no interim workaround.
- Binance: 'No wallet key leaked' - the largest hot-wallet incident on record (10/29) and first observations
From the night of October 29 UTC Binance disclosed a security incident involving unauthorized withdrawals from its hot wallets. Its verified frozen total stood at $2.54B (23:22Z) and then 'around $3 billion' (10/30 00:52Z); it states it will cover all losses and suspended deposits and withdrawals. Its initial investigation 'may involve a compromised DevOps engineer's laptop' through which an attacker reached a service container and submitted unauthorized withdrawal transactions, with no evidence of a wallet private-key leak. Reported stolen amounts range $5.6B-$6.3B with no confirmed total. This article records the first passive observation of 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 (named by ZachXBT after the Arbitrum Security Council's ~$30.5M freeze; first tx 10/29 21:29:47Z, 3 EVM txs, 0.0038 ETH) the on-chain verification of the Arbitrum freeze transaction (from = the address itself), and two converging third-party attribution claims (TRM Labs: TraderTraitor; Specter: commingling with the DPRK-attributed Bitget exploit via THORChain).