Warta kaamanan siber panganyarna, insiden, jeung kamekaran modél SI — diobservasi sarta dianalisis pikeun korban jeung panalungtik dina wates white-hat anu sah. Taya cara ngerjakeun intrusi atawa exploit.
Artikel ieu ditarjamahkeun ku mesin.
- Cyberattack response: country-by-country guides
Nine country guides, local-language editions and downloadable non-executable BPMN response processes.
- Cyberattack response for companies in the United States
Evidence, reports, counsel, insurance and public communications after a cyberattack in the United States.
- Cyberattack response for companies in the United Kingdom
Evidence, reports, counsel, insurance and public communications after a cyberattack in the United Kingdom.
- Cyberattack response for companies in Canada
Evidence, reports, counsel, insurance and public communications after a cyberattack in Canada.
- Cyberattack response for companies in Australia
Evidence, reports, counsel, insurance and public communications after a cyberattack in Australia.
- Cyberattack response for companies in Germany
Evidence, reports, counsel, insurance and public communications after a cyberattack in Germany.
- Cyberattack response for companies in France
Evidence, reports, counsel, insurance and public communications after a cyberattack in France.
- Cyberattack response for companies in the Netherlands
Evidence, reports, counsel, insurance and public communications after a cyberattack in the Netherlands.
- Cyberattack response for companies in Singapore
Evidence, reports, counsel, insurance and public communications after a cyberattack in Singapore.
- Cyberattack response for companies in Japan
Evidence, reports, counsel, insurance and public communications after a cyberattack in Japan.
- Cybersecurity daily — 1 November 2026: MCP migration and corrected extension scope
Smithery's connection-management shutdown date has arrived; Cursor's notice also names 2.1.312. Distinguish planned shutdown, observed operation and verification time.
- Cybersecurity daily — 31 October 2026: extension removal is not incident recovery
Cursor extension follow-up, Wasmtime UDP authorization bypass, and updated AWS Brotli mitigation status. Check host privileges, network authorization and deployed patches.
- Cybersecurity daily — 30 October 2026: verify enforcement beyond configuration
Clerk adds passkeys as a second factor; an older PDF MCP authentication flaw enters the advisory database. Verify enforcement, not just settings and logs.
- Cybersecurity daily — 29 October 2026: verify that Brotli patches are active
AWS details Brotli mitigation: phased Lambda rollout, Node.js 24 verification, container rebuilds and upstream-response decoding.
- Cybersecurity daily — 28 October 2026: separate detection, delegation and runtime authorization
Zuma/Agent Gateway runtime authorization and Socure Agent Intelligence: distinguish release stages and authority boundaries.
- Cybersecurity daily — 27 October 2026: the boundary around agent-managed IAM
Google Cloud introduces IAM Helper. Separate diagnostics and simulation from permission changes, and verify the approval-to-execution boundary.
- Why Faster Cybercrime Intake May Not Reduce Case Backlogs
Public Japanese statistics and an explicit queueing model show why faster intake may shift a bottleneck downstream. Evidence preservation, international assistance, and deterrence require distinct measurements.
- Crypto fraud and theft: Japanese requests for Canadian asset restraint and seizure
For Japanese victims and receiving police officers: RCMP cooperation, formal central-authority requests, evidence and translations, procedural-stage conditions and asset return.
- Prompt injection is not SQL injection: the NCSC design lesson
The NCSC blog says prompt injection is not SQL injection: current large language models do not separate instructions from data, and the risk may never be fully removed the way parameterized queries remove SQL injection (https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection). The NCSC news warns that the comparison is dangerous and challenges claims that the issue can be stopped (https://www.ncsc.gov.uk/news/mistaking-ai-vulnerability-could-lead-to-large-scale-breaches). Design lesson only. Not an attack guide and not legal advice.
- Naon anu kudu dicarioskeun ka klien ngeunaan labél Article 50 EU AI Act
Kaca Article 50 Commission netepkeun kawajiban provider jeung deployer pikeun béwara interaksi, tanda anu bisa dibaca ku mesin, jeung kabuka deep fake (https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50). Béwara ti kantor advokat nyarios yén kawajiban éta jadi lumaku dina 2 August 2026 jeung henteu diundurkeun babarengan jeung aturan résiko luhur (https://www.goodwinlaw.com/en/insights/publications/2026/08/alerts-technology-dpc-eu-ai-act-transparency-obligations-now-in-force). Inpormasi umum, sanes naséhat hukum.
- Latihan kaamanan siber anu nuturkeun alur gawé industri
24 pandangan industri, 18 permukaan téknis, jeung dalapan latihan tanpa jaringan anu nyambungkeun diajar CTF ka kontinuitas, perbaikan, jeung pamulihan.
- Vidéo AI, paniruan sora, jeung wates otoritas
Ulasan anu boga sumber ngeunaan Tavus, panyalahgunaan AI anu dilaporkeun, sarta wates idéntitas, idin, jeung otoritas alat anu kedah diuji ku anu ngadopsi.
- System One Coding: nyusun kode ngaliwatan kaputusan
Blok anu boga tipe, verifikasi bertahap, babandingan anu diukur, jeung pilot gratis anu kadaptar.
- Lamun akun dicokot: tabel runtuyan waktos jeung daptar bukti anu dijieun saméméh konsultasi ka pulisi (tiasa disalin jeung dianggo)
Saatos akun dicandak, naon anu kedah disimpen tanpa dihapus. Citakan garis waktos sareng daptar bukti. Teras kontak pulisi atanapi layanan laporan kajahatan siber nagara anjeun, sareng bank atanapi panyadia pamayaran anjeun.
- Lamun katarajang panipuan aset kripto: cara nyieun «tabel kiriman» pikeun dibawa ka pulisi jeung tukeur
Dina panipuan kripto atanapi investasi, sateuacan transfer deui atanapi «operator pamulihan», lebetkeun unggal pamayaran sareng pesen dina 1 lembar. Teras kontak pulisi atanapi layanan laporan kajahatan siber nagara anjeun, bank atanapi panyadia pamayaran anjeun, sareng bursa. Kaca ieu henteu ngajangjikeun pamulihan.
- Lembar kerja keluhan IC3: naon anu dikumpulkeun saméméh ngajukeun (panipuan kripto jeung online)
Siapkeun unggal widang anu dipénta ku IC3 FBI — karugian, hash transaksi, rincian pihak séjén, header — tuluy ajukeun hiji keluhan anu lengkep jeung simpen salinanna.
- Naha pausahaan peryogi twin, jeung kumaha Mithril nyayogikeunana
Produksi lain tempat anu leres pikeun diajar saha anu tiasa dugi ka sistem sénsitip, kumaha panolakan katingali, atanapi naha kluster anu ngajalankeun cocog jeung anu dinyatakeun. Twin nyimpen ngaran-ngaran éta jeung henteu nerapkeun hasilna. Mithril ngajadikeun twin éta dokumén: komponén reverse-domain nyusun, lumpatan mulangkeun réspon jeung kaputusan, jeung kluster dipariksa kana observasi tanpa dimimitian.
- Sanes konci anu dipaling, $351 yuta dina sajam — palanggaran hot wallet Bitget jeung wates kapercayaan alur persetujuan
Bitget ngonfirmasi dina 25 Séptémber yén kira-kira $351.6 yuta kaluar tina sabagian hot wallet jeung warm wallet-na dina transfer tanpa idin anu kadetéksi dina 18:31 UTC tanggal 24 Séptémber. Cold wallet offline dilaporkeun teu kapangaruhan, narikan dieureunkeun samentawis, jeung tukeur nyarios User Protection Fund $464 yuta nutupan sakabéh karugian. Numutkeun Bitget, panyerang teu nyokot private key, nanging ngahontal sistem backend jeung ngapalsukeun data transaksi pikeun ngarahkeun alur persetujuan nepi ka ngaleupaskeun dana. Urang nalungtik patarosan atribusi Lazarus jeung isomorfisme jeung téma widang manajemén jeung idéntitas anu observatorium ieu bahas dina sababaraha minggu panungtung.
- Pekan nalika pamedal idéntitas sorangan murag — zero-day OAuth F5 BIG-IP APM (CVE-2026-94127) jeung konsentrasi KEV dina widang manajemén jeung idéntitas
F5 ngungkabkeun dina 22 Séptémber yén zero-day kritis dina jalur OAuth BIG-IP APM (CVE-2026-94127, CVSS 9.8) ngidinan éksekusi kode jarak jauh tanpa auténtikasi, jeung ngonfirmasi éksploitasi di alam liar. CISA nambahanana kana katalog KEV dina poé anu sami kalayan wates waktos fédéral 25 Séptémber. Arista VCO jeung dua cacad server manajemén Check Point ogé asup ka KEV dina poé éta — urang nalungtik kumpulna serangan dina widang manajemén jeung idéntitas pakakas wates.
- Pekan nalika jalan ka root lokal kabuka sakaligus — LPE kernel Linux asup katalog KEV CISA nalika éksploitasi publik medal
Dina 18 Séptémber, CISA nambahan tilu cacad kernel Linux anu diéksploitasi aktip (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) kana katalog KEV jeung Red Hat ngonfirmasi kode éksploitasi publik aya. Dina poé anu sami, éksploitasi anu tiasa dianggo pikeun opat LPE kernel (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) diterbitkeun dina pangungkab anu dikoordinasi. Urang nalungtik naha éskalasi hak dina host babarengan nuturkeun pakakas wates ka sorotan.
- Bypass auténtikasi parahna maksimal ngenaan otoritas idéntitas sorangan — Cisco ISE CVE-2026-76460 jeung pola anu malikan kompromi root pakakas wates
Bypass auténtikasi Cisco ISE / ISE-PIC CVE-2026-76460 (CVSS 10.0) keur diéksploitasi aktip. CISA nambahanana kana katalog KEV dina 16 Séptémber kalayan wates rémédiasi fédéral 19 Séptémber; teu aya workaround jeung iACL ngan mitigasi. Urang nalungtik pola kompromi root pakakas wates — anu lumpat sajajar jeung zero-day Secure Email Gateway (CVE-2026-76461) anu dibuka 14 Séptémber — jeung naon hartina nalika log pakakas anu dikompromi sorangan eureun jadi sumber utama.
- Gerbang AI jadi permukaan serangan — daptar KEV LiteLLM jeung jalur ngaliwatan konci, MCP, jeung cloud
Bypass auténtikasi MCP BerriAI LiteLLM (CVE-2026-59822) geus asup katalog KEV CISA, jeung Microsoft ngalaporkeun panyerang nganggo gerbang LiteLLM pikeun ngirim XMRig. Panalungtikan Wiz manggihan kira-kira 1 tina 10 tina ~3,000 instance publik narima konci gawan sk-1234 atanapi lumpat tanpa auténtikasi. Urang nalungtik naon hartina infrastruktur AI nyaéta brankas krédénsial.
- Nalika awak agén dibajak — hiji éksténsi anu nyetir asisten AI dina lima produk
Forever Security nunjukkeun yén hiji éksténsi browser biasa tiasa nyetir AI bawaan lima produk — Chrome, Comet, Edge, Opera Neon, jeung Claude. Papisah, Mandiant ngalaporkeun panyerang ngabajak sési asisten coding AI jeung nyebarkeun cacing Shai-Hulud dina kira-kira 100 répositori. Urang nyusun peta wates kapercayaan runtime agén.
- Ranté zero-day «sela tambalan» — kalemahan anu geus dilereskeun dina Chromium nanging acan dina Chrome dianggo babarengan ku sababaraha kelompok mata-mata dina 1 pekan
Katingal yén ranté serangan BlueMoon, anu ngagantengkeun kaluar tina sandbox V8 Chrome jeung panyalahgunaan ALPC Windows, dianggo babarengan sahenteuna ku sababaraha kluster anu disebut asalna ti China numutkeun observasi Volexity. Lereskeun geus asup ka Chromium nanging acan kacermin dina Chrome stabil, jeung urang nyusun bahaya «sela tambalan» ieu.
- Ringkesan VC: SYN Ventures — dana spésialis kaamanan siber anu dipingpin ku operator
Dana anu dipingpin ku operator kalayan AUM $900M, diwangun ku urut CISO jeung pangadeg. Urang nyusun peta dua dana jeung portofolio ~40 pausahaan kana posisi mithril.fund.
- Zero-day Cisco Secure Email Gateway CVE-2026-76461 — nalika injéksi SQL parsing surélék réngsé dina éksekusi root
CVE-2026-76461 (CVSS 9.8) keur diéksploitasi aktip jeung ditambahkeun kana katalog KEV CISA. Urang ngaurai pola anu malikan «kompromi root pakakas wates» — jeung naon hartina nalika log pakakas sorangan teu tiasa dipercaya deui.
- Ngenalkeun blog Observatorium Kaamanan
Observasi jeung analisis unggal poé ngeunaan warta kaamanan siber, insiden, jeung kamekaran modél AI, diterbitkeun di dieu.
- Nyieun file tanpa autenticasi leuwih panto tukang gateway surelek — zero-day FortiMail CVE-2026-104286 jeung fitur IBE
Dina 1 Oktober, Fortinet ngadumakeun zero-day path traversal di jero FortiMail (CVE-2026-104286, CVSS 9.8) nu ngijinkeun nyieun file anu sarbapan tanpa autenticasi, sarta ngajénkeun yen éksploitasi geus kajadian di jero alam. CISA nyetélkeun ka katalog KEV dina nu sarua kalayan tenggat federal 4 Oktober. Teu aya rilis nu geus dibenerkeun di cabang nu kapangaruhan opat, kituna nyabret IBE jadi léngkah samentara — urang ngameanakeunana dina konteks lonjakan KEV akhir Séptémber.
- Ti korban panipuan ka white hat pausahaan: peta lanskap kaamanan siber (2026)
Tilu belas kategori, ti pitulung korban panipuan nepi ka tés kaamanan pausahaan, kalayan karugian anu dilaporkeun, pangdanaan anu diumumkeun, ramalan pasar dumasar pamedal, jeung status jujur ngeunaan di mana Mithril nangtung.
- Léngkah méori nu ngagunakeun SAML di NetScaler — CVE-2026-88779 asup ka KEV (watesna 7 Oktober)
Citrix ngaluarkeun kagagalan watesan buffer méori di NetScaler ADC / Gateway (CVE-2026-88779, CVSS v4.0 8.7, CWE-119). Citrix nyebutkeun yén aranjeunna ningali serangan nu ditujukeun ka déployémén nu teu acan dimitigasi, anu tiasa nyababkeun denial of service. Éntri KEV CISA netepkeun eksploitasi kerentanan ieu, sareng pedaran pondokna nyebutkeun cacad éta tiasa ngamungkinkeun denial of service. Teu aya sumber anu ngonfirmasi yén déployémén nu kapangaruhan bener-bener eureun. CISA nambahkeunana dina 4 Oktober, watesan federal 7 Oktober. Babarengan jeung CVE-2026-88771 sareng CVE-2026-88772 (duanana ditambahkeun 27 Séptémber), ieu éntri KEV NetScaler katilu nu ditambahkeun dina dua minggu, sanés éntri katilu produk sacara sadayana (éntri baheula kalebet CVE-2023-4966). Tanda tangan Global Deny List (v24 atawa salajengna) mangrupa mitigasi sementara, sareng perbaikan aya dina 14.1-73.41 / 13.1-64.28 atawa salajengna.
- Unauthenticated API access in Cisco Catalyst SD-WAN Manager — CVE-2026-76504 Added to KEV (Due October 3)
Cisco published CVE-2026-76504 (CVSS 3.1 9.8 per Cisco, CWE-177) in advisory cisco-sa-sdwan-webauth-xr8beuuU: improper URI-encoding handling in the API session-based authentication management of Cisco Catalyst SD-WAN Manager can let an unauthenticated remote attacker reach the API with admin privileges. CISA added it to KEV on September 30, 2026, with a federal due date of October 3. Fixed releases start at 20.9.10.1 / 20.12.8.2 / 20.15.6.1 / 20.18.4.1 / 26.1.2.1 / 26.2.1 (earlier branches migrate). No known workarounds exist; interim mitigation is restricting internet access to trusted hosts, plus the optional Live Protect shield. Cisco has confirmed exploitation in the wild.
- Apple CoreGraphics zero-day added to KEV — CVE-2026-86950, report of exploitation in an extremely sophisticated targeted attack (Due October 2)
On September 28, 2026, Apple released iOS 26.7.1 / iPadOS 26.7.1 / macOS Tahoe 26.7.1 / macOS Sequoia 15.8.1, fixing an out-of-bounds write (CVE-2026-86950, CWE-787) in CoreGraphics. Processing a maliciously crafted file may lead to arbitrary code execution; Apple says it is aware of a report that the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27. CISA added the vulnerability to KEV on September 29, 2026, with a federal due date of October 2 (forensicTriage Yes). The CISA-ADP CVSS 3.1 base is 8.8 (High). The fix is the listed releases only; the primary sources reviewed for this post state no interim workaround.
- Binance: 'No wallet key leaked' - the largest hot-wallet incident on record (10/29) and first observations
From the night of October 29 UTC Binance disclosed a security incident involving unauthorized withdrawals from its hot wallets. Its verified frozen total stood at $2.54B (23:22Z) and then 'around $3 billion' (10/30 00:52Z); it states it will cover all losses and suspended deposits and withdrawals. Its initial investigation 'may involve a compromised DevOps engineer's laptop' through which an attacker reached a service container and submitted unauthorized withdrawal transactions, with no evidence of a wallet private-key leak. Reported stolen amounts range $5.6B-$6.3B with no confirmed total. This article records the first passive observation of 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 (named by ZachXBT after the Arbitrum Security Council's ~$30.5M freeze; first tx 10/29 21:29:47Z, 3 EVM txs, 0.0038 ETH) the on-chain verification of the Arbitrum freeze transaction (from = the address itself), and two converging third-party attribution claims (TRM Labs: TraderTraitor; Specter: commingling with the DPRK-attributed Bitget exploit via THORChain).