A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their control panels open on the internet.
The agents tried more than 1,200 sites and reached websites belonging to more than 100 companies, including farm-equipment maker Deere, appliance company
A test account protected by "Password1" helped an intruder steal personal data relating to 3,300 people, mostly children, in a ransomware attack that has drawn regulatory rebukes for two Welsh organizations. The Information Commission's Office (ICO) issued reprimands rather than fines to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, also known as Data Cymru. According to the ICO, altnet ONL provided server and connectivity infrastructure, licensing, and support to Data Cymru, which helps public bodies across Wales make effective use of data. On November 1, 2024, Data Cymru suffered a ransomware attack after a miscreant exploited a test account called Test2 to infiltrate its network and encrypt 182.7 GB of data housed in a file server and an internal database server. "Before deploying the ransomware, the threat actor exfiltrated 42 GB of data from a primary domain controller, a file server and an SQL server," the ICO said on Tuesday in its reprimand of ONL [PDF]. ONL told the ICO it created the test account on January 13, 2012, during its initial project for Data Cymru. "ONL confirmed that the creation of the 'Test2' account was likely intended to test user account access before migrating 'real' users to its services," the ICO said. "When it was created, the 'Test2' account was given the password of 'Password1'." The ICO cited Bitwarden's password strength tool, which rated "Password1" as "very weak" and estimated a cracking time of less than a second. "The local administrator accounts on the three impacted systems all had the same password. This meant that once one system had been breached, the local account hashes could be collected and used by the threat actor to authenticate access to other systems on the Data Cymru network," the regulator added. "ONL confirmed that it did not carry out any reviews of local administrator accounts following their initial deployment. This meant these accounts remained active, regardless of whether they were used, and continued to use the same default passwords set at the time of their creation in January 2012, as part of ONL's initial project with Data Cymru, for more than 12.5 years." The data watchdog reprimanded ONL under Article 32 of the UK GDPR because it failed to put in place "appropriate technical and organisational measures" to ensure processing systems and services were safe, and it didn't regularly assess or evaluate those measures. It found ONL had no auditing procedures to review user accounts within Data Cymru's Active Directory. The ICO's separate reprimand of Data Cymru [PDF] also detailed failures in its security arrangements. "Password1 is not an appropriate password, it is a wide-open door to nefarious actors," said ICO head of investigations David Doodson. "This incident shows how a single weak password, attached to an account that was no longer needed, can leave the door open to a serious cyber-attack that can affect thousands. "The responsibility for these failures did not sit with one organisation alone. ONL created the test account whilst Data Cymru retained overall control of its network, including the ability to instruct ONL to create or remove accounts. Neither had put in place sufficiently clear and effective measures to ensure that old accounts were routinely identified and removed." ®
TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.
The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19.
The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or
Bullhorn is the latest tech giant finding itself on the wrong end of a cyberattack, forcing the recruitment software provider to shut down its platform while it investigates. The US-based company, which serves more than 10,000 customers worldwide, says its systems are now back online in the UK, US, and Australia. Unfortunately for customers hoping to get back to work, online doesn't necessarily mean working. In its latest status update, published on Tuesday, Bullhorn confirmed that some users were still struggling with single sign-on (SSO), password resets, and customizations, while several products continued to report degraded performance. Things started going sideways on Friday, October 16, when Bullhorn flagged problems getting job postings onto Indeed. By the following morning, the platform was suffering a full-blown outage, and Bullhorn confirmed later that day that it was dealing with something rather more serious than a technical hiccup. "We have detected a cyber incident on the Bullhorn Platform. We have temporarily disabled access to our systems in order to contain the activity while we investigate further," the company said, noting that it had roped in cybersecurity specialists from CrowdStrike to help investigate the attack and restore its services. For recruitment agencies using Bullhorn, the outage meant losing access to candidate records, job applications, placements and, in some cases, the systems used to get people paid. Services began returning on Monday, but recovery has been anything but seamless. As of Tuesday morning, Bullhorn's status page still listed degraded performance across several products, including its automation tools, Talent Platform, Onboarding365 and Time & Expense. While Bullhorn is making progress getting customers back into their accounts, it has yet to answer arguably the bigger question: whether the attackers stole anything. In its customer FAQ, it said a forensic investigation is ongoing, and has not yet determined whether attackers exfiltrated customer data. Bullhorn says it will contact affected customers if the investigation finds their information was compromised, and it also warned people to watch out for opportunistic crooks looking to exploit the chaos. "Threat actors may pose as Bullhorn personnel via email, text, or phone calls, using the incident as a pretext to request credentials or sensitive information," it warned on Tuesday, stressing that its employees would never ask customers to disclose passwords, multi-factor authentication codes, or verification tokens. The company has also required password resets for users who don’t log in through SSO, while customers using API integrations have been instructed to rotate their credentials. The cause of the intrusion remains unknown, and Bullhorn has not publicly identified the attackers or confirmed whether ransomware was involved. The company didn’t respond to The Register’s questions at publication time. The outage may be coming to an end, but Bullhorn's investigation into what the attackers actually did is far from over. ®
Britain's national digital ID scheme may be dead, but Whitehall appears to have forgotten to tell the infrastructure. Despite the government scrapping its controversial plans, officials told MPs on Monday that work continues on GOV.UK One Login, digital wallets, and a growing collection of digital credentials designed to help people prove who they are. The abandoned scheme was one of Keir Starmer's flagship policies, originally pitched as a compulsory digital ID card to crack down on illegal working. Privacy campaigners weren't impressed, warning of surveillance and government overreach, and ministers eventually made it voluntary before Andy Burnham, decided to bin the whole thing. But scrapping the scheme hasn't dented Whitehall's digital identity ambitions. Officials told MPs this week that more than 80 types of documents are earmarked for the government's digital wallet, including proof of benefits, driving test certificates, and Disclosure and Barring Service (DBS) certificates. That's quite a lot of paperwork for something that's supposedly dead. The revelations came during a Public Accounts Committee hearing on Monday, where MPs wanted to know what exactly had been scrapped. "But is it not the case, based on the answers you've given us this afternoon, that the infrastructure of digital ID in the public sector is still being pursued?" asked Sarah Green, Liberal Democrat MP for Chesham and Amersham. Susannah Storey, DCMS permanent secretary, was keen to draw a line between the national scheme ministers had scrapped and the digital identity projects Whitehall had no intention of abandoning. One Login already allows people to prove who they are online, she said, but "that is not the same as a national digital identity strategy." Rod Latham, DCMS director for cybersecurity and digital identity, had a convenient explanation for why so much of digital ID was still standing: the government had only scrapped plans for a new identity product. "We already had One Login and the Gov Wallet," he told MPs, adding that work on the digital identity trust framework was also underway before the national scheme was announced. Whitehall isn't wasting time putting that technology to use, with officials confirming that testing is already underway to enable digital credentials to work with private businesses. Natalie Jones, the senior responsible owner for GOV.UK One Login, revealed that the government had opened a testing environment for private sector providers to integrate with its digital wallet technology. This would let people use digital driving licenses to prove their age in pubs, collect parcels, or verify their identity online. "We've got a bit of a chicken and egg situation. A digital driving license is only useful if there are people ready and shops and businesses ready to receive it,” Jones said, noting that further testing is planned for December, with a national rollout of digital driving licenses targeted for 2027. MPs also pressed officials on privacy, particularly whether citizens would have to consent before their information was shared between government departments. "In the confines of digital ID used in digital services, then consent is the model," said Christine Bellamy, interim director general for digital products at the Government Digital Service. There's a catch, of course. Government departments can already share data without asking permission, and officials couldn't quite explain how that squares with their promises about consent. "The strategy needs to be fully finished," Bellamy admitted, which might not be the reassurance MPs were hoping for. Jones insisted that One Login was "not a big data lake," saying it stores identity information separately and cannot see what users do inside government services. "One Login does not issue a single identifier to people," she added. Rupert Lowe MP remained unconvinced, warning that Britain could end up getting digital ID "by the back door rather than the front door." Officials maintained that the canceled national scheme was fundamentally different from the services still being developed, and that people would retain alternatives to digital identification. National digital ID may be officially dead, but between One Login, digital wallets, and dozens of planned credentials, Whitehall still has plenty of identity-related work to keep it busy. ®
The UK's financial regulator says firms' incident reporting must cover significant AI failures and near-misses as increasingly autonomous systems raise new risks. Speaking at Bloomberg's UK Policy Series on Monday, Financial Conduct Authority chief data, information and intelligence officer Jessica Rusu said the regulator wants Britain to lead safe AI adoption in financial services. Greater autonomy, however, requires clear accountability. "Poorly governed AI can create consumer harm, cyber vulnerabilities, and operational failures, potentially at much greater speed and scale," she said. "Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses. As the AI Minister has recognized, near-miss reporting for agentic AI is becoming a national security priority. It is a regulatory priority too." The UK punches above its weight in financial services. The sector contributed £223.6 billion to the UK economy in 2025, or 8 percent of national output. That share was the fourth highest among OECD countries. Last week, UK artificial intelligence minister Kanishka Narayan said the government plans to work with Parliament and technical experts to assess how it could strengthen the regime to better protect Britain from AI-driven cyber threats and loss-of-control risks. "That includes identifying and reporting on serious incidents and near misses, including reducing AI-driven risk across essential services, and ensuring serious AI incidents can be properly reviewed," he said. Steven Adler, co-founder and chief scientist of independent nonprofit Guidelight AI Standards, also told MPs last week that AI oversight could learn from aviation, where reporting of near-misses is mandatory in most jurisdictions. "The way this works in aviation is that you not only want to learn about the serious crashes where someone has in fact died; you want to learn about the near-misses, because you can learn from those and help avoid them in the future," he said. However, the government has yet to commit to adding AI-specific measures to the Cyber Security and Resilience (Network and Information Systems) Bill. Alexandra Jones, Director General for Growth, Science and International at the Department for Science, Innovation and Technology, told MPs last week that amendments remain under consideration. In January, the House of Commons Treasury Committee called on financial regulators to conduct stress tests to ensure businesses are ready for AI-driven market shocks. The committee said there should be clear lines of accountability when AI systems produce harmful or unfair outcomes. ®
The UK public sector has reached a cyber resilience inflection point. A new Prime Minister has taken office, and significant machinery-of-government changes have already been announced, including the scrapping of DSIT, the department that had become the center of government digital, technology and cyber policy. Its responsibilities are now being redistributed across other parts of Whitehall, creating a new policy and delivery landscape for public sector leaders to navigate. For years, cyber security was treated as a specialist operational discipline that was essential but largely delegated to technical teams. That model is no longer sustainable. Pressure is now coming from three directions at once, as policy raises expectations for boards and senior leaders, organizational reform reshapes how services, systems and suppliers connect, and technology change, from cloud and hybrid work to AI, expands both opportunity and exposure. Together, these forces mean cyber resilience can no longer sit below board level. Public services, from healthcare and benefits to transport, education, local government and emergency response, are now so digitally dependent that a cyber incident is not simply an IT outage. It is a risk to public trust, public safety and the continuity of government itself. Recent history shows what this means in practice. The 2024 ransomware attack on Synnovis, a pathology services provider to parts of the NHS, significantly reduced the capacity to process blood, urine and specimen tests, caused disruption across south-east London and contributed to delays affecting more than 11,000 outpatient and elective procedure appointments. Incidents like this turn abstract cyber risk into real-world service disruption, making resilience a boardroom issue rather than a back-office concern. Cyber resilience is no longer a technical aspiration, but a leadership obligation shaped by policy, organizational and technology change. Policy change has made cyber resilience a leadership obligation The direction from government and the National Cyber Security Centre is clear. The Cyber Resilience Pledge asks organizations to make cyber security a board-level responsibility, register for NCSC Early Warning and take a risk-based approach to Cyber Essentials across their supply chains. The NCSC’s Cyber Governance Code of Practice reinforces the point that cyber risk must be governed like any other material organizational risk. The Cyber Security and Resilience Bill will further expand expectations across essential and digital services, strengthening incident reporting and bringing more critical suppliers into scope. This matters because the scale and impact of cyber threats facing the UK are increasing sharply. The NCSC handled 204 nationally significant cyber incidents in the year to September 2025, up from 89 the previous year. That means the UK is now experiencing an average of four nationally significant cyber attacks every week. Policy has therefore changed the boardroom question. Leaders should no longer ask only whether an organization has invested in security tools. They need to ask whether they can prove resilience, evidence accountability and continue delivering critical services when systems are under pressure, suppliers are compromised, data access is disrupted or attackers are already inside the network. Organisational change is creating hidden cyber risk The second force is organizational change. Local Government Reorganisation is redrawing structures and responsibilities across England. Rail renationalization and other shifts in public ownership are changing who owns, manages and secures critical data and systems. Departmental priorities and delivery models are also evolving under a new Prime Minister, with DSIT being dismantled and functions including digital transformation, public sector AI adoption, information resilience and online harms moving into different departments and central government structures. Every one of these transitions creates potential gaps. Systems need to be integrated. Identity and access privileges need to be reassessed. Data needs to move between teams, agencies and suppliers. Contracts and responsibilities need to be redefined. During periods of change, the attack surface expands, and accountability can become blurred. This is why cyber resilience must be built into public sector reform from the outset. The question is not simply how to restructure services efficiently. It is how to ensure citizens can continue to access those services securely throughout the transition. Reorganization without resilience is a risk to the public. Technology change demands continuous assurance The third force is technology change. Public sector work now happens across hybrid environments, shared services, cloud platforms, partner ecosystems and complex supply chains. Traditional security models were built for a more stable world of fixed offices, predictable networks, known users and clearly defined organizational boundaries. That world no longer exists. AI makes this problem more urgent. AI is already being used across the public sector to improve productivity, analyze information and support better service delivery. But without governance, organizations can quickly lose track of which tools are being used, what data they can access and whether sensitive information is being exposed. Shadow AI is not a future risk. It is a present governance challenge. Resilience in this environment requires continuous assurance. Access should not be granted simply because a user is on a trusted network. Every request should be verified based on identity, context, device posture and risk. Users should only receive the access they need, when they need it. Applications should be protected from unnecessary exposure. Data should be segmented so that compromise in one area does not automatically spread across the organization. What public sector boards should do now Making cyber resilience a board-level priority does not mean every director needs to become a technical expert. It means senior leaders need the right governance, evidence and accountability to respond to the three forces reshaping risk across the public sector. That starts with treating cyber resilience as a standing board agenda item, linked directly to service continuity, citizen trust, regulatory exposure and reform delivery. It also requires boards to understand which critical services depend on which systems, suppliers and datasets, where single points of failure exist, and how disruption in one part of the ecosystem could affect citizens’ ability to access essential services. Supply chain assurance must be part of that same conversation. Public services are delivered through ecosystems, so resilience cannot stop at the boundary of a single department, council, agency or trust. Cyber Essentials, supplier checks, contractual obligations and clear incident reporting expectations should be embedded into procurement and contract management. At the same time, public bodies need to move away from implicit trust based on networks or locations and towards continuous verification based on identity, context, device posture and risk. Users should have only the access they need, when they need it, and AI adoption should be governed before it scales so innovation does not create unmanaged routes to sensitive information. Resilience is now a test of public sector leadership The UK’s policy environment has changed. Public sector organizations are changing. Technology is changing even faster. The only way to manage that complexity is to build cyber resilience into the way public services are governed, transformed and delivered. The public sector cannot afford to treat resilience as something to retrofit after legislation tightens, reform programs are complete or AI adoption has already accelerated. It must be designed in from the outset, measured at leadership level and tested continuously. Cyber resilience is not just about protecting systems. It is about protecting the public’s ability to rely on government when policy, organizations and technology are all changing at once. That makes it a board-level priority by definition. More Information on how Zscaler supports public organizations can be found here. Contributed by Zscaler
ICANN has started testing authentication schemes that will allow law enforcement agencies to make urgent requests for non-public WHOIS information – when needed to address threats to life, critical infrastructure, or child exploitation. Domain registrars collect information about their customers and in the past that data was publicly available in WHOIS records. Some domain registrars offer services that substitute their own contact details, to preserve customer privacy. In recent years, laws like GDPR mean registrars are sometimes required to hide WHOIS data. That’s fair enough but makes it hard for law enforcement to contact a domain holder if their resources are being misused – intentionally or otherwise – for purposes such as hosting malware, acting as command-and-control infrastructure for malware, or facilitating phishing. ICANN’s definition for the kind of behaviour it thinks justifies urgent requests for WHOIS info is “imminent threat to life, of serious bodily injury, to critical infrastructure, or of child exploitation.” The org has convened an Input Group on Law Enforcement Agency Authentication Mechanisms to consider the issue, and that group yesterday explained its progress during ICANN’s annual meeting in Bali, Indonesia. At this point, readers may have concerns that this proposal could allow law enforcement authorities to make inappropriate requests for WHOIS information. Several factors may ease such concerns. One is that representatives of domain registrars Namecheap and Verisign spoke during the session about the proposal, and both were supportive. Another is that the Input Group’s work is largely technical. Once it devises a mechanism to allow requests, other groups within ICANN dedicated to policy will work out acceptable use and related issues. This is the way internet governance gets done! Specialists work on their own bits of a problem and then collaborate to create a robust system that works at a technical level, is practical, and enforceable in multiple jurisdictions. How they’ll do it At this point, ICANN’s preferred approach is to use Security Assertion Markup Language (SAML) so that authenticated users at law enforcement agencies can log into the governance org’s Registration Data Request Service (RDRS) and file requests to access non-public WHOIS info. ICANN is already testing this approach with the FBI and Interpol but is open to other authentication mechanisms to allow other agencies access RDRS. The Input Group’s aim is to publish a spec those agencies can conform to. ICANN will pass requests filed in RDRS to whichever registrar sold the domain. The registrar will have 24 hours to consider the request – or up to 72 hours for complex queries. Registrars will also be able to deny requests if they feel the query does not meet the urgency threshold. Register readers might worry that a colossal agency like the FBI could flood RDRS with requests from thousands of individual agents, swamping domain registries. ICANN’s plan is to avoid that by requiring law enforcement agencies to nominate certain personnel who are permitted to make requests, and to enforce that permission using a token shared during SAML handshakes. The content of that token is the kind of policy question that the Input Group expects others at ICANN to finalize later. Another issue under consideration is how to protect the identity of law enforcement workers who make RDRS requests, as ICANN feels they could become targets of harassment (or worse) if their requests to see WHOIS data include email addresses. ®
The US Department of Homeland Security on Monday issued an order directing federal civilian agencies not to use technology products from Chinese AI lab DeepSeek, and to remove any existing implementations. The order [PDF] is broad, as it requires agencies to ditch "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations." Complying will be tricky as it is not clear which third-party products and services have been developed using DeepSeek's wares. Nor is it clear whether "developed using" means providing ongoing access to DeepSeek models via API or simply refers to any app vibe-coded with the help of DeepSeek. It also leaves open the question of AI gateways. Services such as OpenRouter and Vercel AI Gateway make DeepSeek's models available through APIs. And those using gateway services may find themselves using DeepSeek models without meaning to do so. OpenRouter, for example, "routes requests to the best available providers for your model." It selects what the service deems to be the best fit provider of AI services. Vercel AI Gateway does the same by default. So federal civilian agencies could be using DeepSeek models inadvertently, if they haven't taken steps to constrain their AI providers. A DHS spokesperson did not immediately respond to a request for comment. US officials have contemplated a ban on DeepSeek since the China-based AI lab released DeepSeek-R1 in early 2025. On February 6, 2025, US Representative Darin LaHood (R-IL) and US Representative Josh Gottheimer (D-NJ) introduced the No DeepSeek on Government Devices Act. The lawmakers characterised DeepSeek as a national security threat because its AI models purportedly capture data on US citizens and provide it to the Chinese government. The bill never made it out of committee, but various government agencies followed through. The US Defense community and lawmakers have already exiled DeepSeek. The Defense Information Systems Agency (DISA) started blocking DeepSeek on the Pentagon’s IT networks in January 2025. The US Navy, NASA, and the US House of Representatives took similar steps. So did various US states. While the DHS announcement has taken a long time to reach civilian agencies, its timing may be a boon for American AI companies which, like Anthropic, hope to soon go public. That's because open weight models represent competition, and those from China have proven particularly popular both in terms of capabilities and cost. Government agencies that cannot deploy such models (and the taxpayers who fund those agencies) may be stuck paying the prices set by favored US model makers. Concerns about the security and privacy of DeepSeek's iOS mobile app surfaced shortly after DeepSeek-R1 debuted. Several months later, a December 2025 report on the DeekSeek mobile app for Android and iOS cited similar concerns, including plaintext information leaks, links to servers run by Chinese tech firms, and shortcomings like lack of SSL pinning. These issues, however, are mainly mobile security problems that afflict many apps, particularly those that integrate third-party advertising SDKs from companies based outside the US. They don't really address the additional risks posed by the capture of text prompts and responses, or how local secrets and other sensitive information can be ingested by AI agents. Katie Moussouris, founder and CEO of Luta Security, told The Register in an email that while there are legitimate national security reasons to keep DeepSeek's app and servers away from government systems, the way this particular order is written exceeds that requirement in ways that aren't practical. "Banning DeepSeek's own app and API is workable," said Moussouris. "The problem is the ban on 'third-party products and services developed using DeepSeek implementations.' The order doesn't say what 'developed using' means. It could technically cover any model derived from DeepSeek and more importantly, any software whose developers used DeepSeek to write or test code. An AI software bill of materials doesn't record which tools developers used, so it would be no real help. Every vendor would have to attest that nothing it relies on ever touched DeepSeek. There's no practical way to verify that." Moussouris also took issue with the breadth of the order, noting that applying the rules to US-hosted versions of DeepSeek's models goes too far. "The risks the order cites are mostly about data flowing to DeepSeek's servers in China, its data collection, and its app," she said. "US hosting avoids most of those. "For the model itself, the order says only that it may contain malware or vulnerabilities, which is true of all software. NIST found DeepSeek more vulnerable to prompt injection than US models, though every model has that problem. NIST also found it easier to jailbreak, but jailbreak guardrails often get in the way of defenders." ®
Dutch grocery giant Ahold Delhaize, which operates US supermarket chains Food Lion, Giant Food, and Stop & Shop, said it proactively took IT systems offline following a cyberattack, affecting most of its US and European brands. The multinational chain originally disclosed the incident on October 12. “Ahold Delhaize is experiencing a security issue within its network,” it said at the time, adding that security teams, working to mitigate the issues, took “some” IT systems offline. On Monday, the company confirmed that it proactively took certain IT systems, including websites and apps, offline, affecting most of its brands, and said that “malicious actions of others” caused the security issue. “Taking systems offline to help protect them was a precautionary measure that affected most of our brands across Europe and the United States,” Frans Muller, president and CEO of Ahold Delhaize, said in a Monday statement. “The investigation to date confirms this was the right decision.” At this time, all of the physical stores remain open, and the investigation hasn’t uncovered any evidence to suggest the miscreants stole any “sensitive customer, associate, or partner data,” the disclosure said. The company last week notified the Dutch National Cyber Security Centre about the digital intruders, and on Monday filed a report with the Dutch police, according to the statement. Albert Heijn’s website and app are back online, and the company expects home deliveries to resume on Friday. Belgian e-commerce is fully operational, and e-commerce services at Ahold Delhaize’s American brands (Food Lion, Giant Food, Martin’s, Hannaford, and Stop & Shop) are expected to work “in the coming days.” The Etos and Gall & Gall websites are also up and running, along with the “majority of websites and apps” across brands serving central and southeastern Europe. Ahold Delhaize did not immediately respond to The Register’s questions about the cyberattack, including whether it was linked to attacks on refrigeration controllers at hundreds of French supermarkets beginning October 11. The attacks reportedly pushed temperatures as high as 122°F (50°C), spoiling food and causing fires at some locations. This latest cyberattack is Ahold Delhaize’s second in two years. A November 2024 digital break-in disrupted brands across the organization, with some Stop & Shop stores struggling to fill prescriptions, while Food Lion employees reported delayed and missing deliveries. INC Ransom claimed responsibility for the attack at the time and leaked some documents reportedly taken from the retailer's systems. Ahold Delhaize ultimately determined more than 2.2 million people’s data - including personal, financial, and health details - had been compromised. ®
Updating your software only gets you so far. A scary scenario - security fixes themselves being bypassed - is becoming more common, according to AI penetration-testing startup Terra Security, which found a sharp rise in reported patch failures in 2026 after years of relatively low numbers. And no, it’s not a coincidence that AI vulnerability discovery and patching also exploded this year. For example, Russian government cyberspies exploited a zero-day Windows Shell security bypass bug, CVE-2026-21510, at least a month before Microsoft patched the flaw in February. Redmond’s patch, however, was incomplete, and left a second flaw - a zero-click authentication coercion vulnerability (CVE-2026-32202) - that was also found and abused before Microsoft fixed it in April. Terra researchers reviewed every published CVE record and GitHub-reviewed advisory looking for broken fixes, and found a distinct pattern. After six years of relatively few patch bypasses, this changed in 2026: “A fix would ship, a bypass would be found, and another fix would go out.” The share of GitHub security fixes that required a follow-up advisory reporting a failed patch within 90 days remained at about 0.2 percent between 2019 and 2025. This year, this figure had jumped to 2.3 percent, according to the researchers. Meanwhile, vulnerabilities whose fixes were later bypassed were about four times as likely to appear on the US Cybersecurity and Infrastructure Security Agency's (CISA's) Known Exploited Vulnerabilities list as other bugs affecting the same vendors, according to Terra. Of these, server-side request forgery fixes and prototype-pollution patches break the most. Compared with their share of all CVEs, prototype-pollution vulnerabilities were about 11 times as common among broken-fix CVEs, while server-side request forgery vulnerabilities were 4.6 times as common, according to Terra. This has to do with the way these types of bug classes are fixed: using a reject-list of inputs such as hostnames, paths, and object keys. There’s a “simple” reason for this, according to Terra. “If the blocklist doesn't foresee every encoding of a bad input, the attacker only needs to find one,” the researchers said. Fixes for Linux kernel vulnerabilities are also more likely to cause new bugs, according to kernel CNA records as of October 8. “In fact, 3.2 percent of kernel CVEs were introduced by the fix for another CVE, and about 10 percent in busy subsystems like fs/smb and net/sched,” the bug hunters noted. The silver lining in all of this, we’re told, is that it should be a wake-up call for software vendors and network defenders to break the “patch and move on habit.” Instead, before shipping patches, software vendors should consider three questions: Does it fix the root cause? Does it cover the whole bug class? Does it break something else? And for sysadmins and patch managers: consider the same things before applying the fix. “If a vendor fixes an exploited bug, assume someone is reading the patch for a way around it,” the pen testers advise. ®
WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one.
The text sat in the pages' code, never shown on screen, until it was removed by October 18. Whether the
A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces manual work, and soon becomes part of the team’s daily routine. Across the same organization, employees are building useful apps, agents, and automations faster than existing processes can support them
Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys.
Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not
Login
