Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday. Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week. These costs are expected to decline over time, though, with the contractors in place to help ease the initial burden of patching a large number of flaws, an issue that shouldn’t be so pronounced in the longer term. He went on to tell CNBC that the bank brought in outside help after concerns grew over how it would quickly tackle all the work associated with Mythos’ discoveries. The same concerns were shared globally, in part due to how Anthropic marketed Mythos as an all-powerful model that threatened the status quo of cybersecurity. While it ultimately turned out to be highly effective and capable of identifying complex vulnerabilities quicker than humans, leading to the massive influx of patches, some early adopters say it was no smarter than elite researchers. Mozilla CTO Bobby Holley said in April: "So far we've found no category or complexity of vulnerability that humans can find that this model can't," after Mythos found 271 flaws in Firefox 150. "We also haven't seen any bugs that couldn't have been found by an elite human researcher." The 1,000 contractors brought in by the bank in its Q2 added to its existing 3,000 technical staff. The contractors remain at the bank for now, although their assistance won’t be needed in the longer term. Moynihan told financial analysts on the bank’s earnings call that BoA has made its tech engineering workforce around 10 percent more efficient, and that each of the circa 130 AI-related projects it has running is expected to achieve a 2x or 3x return on investment over time. In 2026 alone, the CEO expects AI projects to deliver between $250 million and $300 million in benefits – a sum he expects to shoot up to $700 million by the end of 2027. He didn't detail how. The bank has also reduced around 3,000 roles, including a 5 percent decrease in the number of managers on the payroll, although it didn't specify how much of a role AI played. Moynihan didn’t break down how much of the “couple of hundred million plus” in remediation costs were devoted to AI or Mythos, compared to costs associated with cleaning up its AML issues, both of which the CEO lumped together. BoA’s share price slid more than 8 percent on Wednesday morning after it reported a 17 percent drop in profits owing to the $1.21 billion settlement it agreed to with the Treasury’s Financial Crimes Enforcement Network (FinCEN). The FinCEN order relates to BoA’s failure to police national security risks, including Chinese money laundering, and a failure to report over $5 billion in suspicious activity. FinCEN’s order was issued concurrently with a $750 million penalty from the Office of the Comptroller of the Currency, related to Bank Secrecy Act and AML compliance deficiencies. BoA also agreed an $11.6 million settlement with the Office of Foreign Assets Control for sanctions violations, including those related to Iran, Russia, narcotics, and global terrorism. ®
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.
There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit.
A fourth lets an attacker forge a TLS session that could
X says it has nuked more than 13,000 accounts involved in three suspected foreign influence operations targeting US political debate. In a post on Wednesday evening, the platform linked the operations to Iran, Russia, and China. It said the networks used inauthentic accounts to post and amplify political content targeting candidates and public figures across the political spectrum. The announcement comes ahead of the US midterm elections on November 3. "People come to X to talk about what's happening in the world, including the upcoming 2026 US midterms," the platform said. "Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen. Our job is to keep that conversation authentic, open, and safe." X did not publicly explain the evidence behind its attribution. Separately, it highlighted its Civic Integrity policy, which covers misleading information about how, when, and where to vote, as well as content intended to discourage participation. Reports submitted under "Civic Integrity" are routed into requests for Community Notes. X says it uses the crowdsourced feature alongside platform moderation and may label policy-breaking posts in critical cases. Community Notes has faced scrutiny. When the European Commission launched formal proceedings against X under the Digital Services Act in 2023, it raised questions about the feature's effectiveness for validating a post's accuracy. X's reliance on crowdsourced context follows layoffs and senior departures from its moderation teams after Musk acquired Twitter. Foreign influence campaigns aren't confined to US elections. MI5 chief Sir Ken McCallum said this week that Russia had attempted to interfere in the 2016 Brexit referendum, but cautioned against treating that as evidence it changed the result. ®
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw.
One code-execution flaw is in React Server Components, and the other in librsvg, the open-source library Next.js uses through the sharp package to handle SVG images.
The fixes are in
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.
An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public sandbox analyses to fake AI campaigns between April and October of 2026.
The campaigns also increase operational pressure on MSSPs serving US businesses, which accounted for 16% of country-attributed targets.
Similar attacks
Hackers who broke into the UK's Legal Aid Agency last year stole records dating back nearly five decades, the government has admitted, revealing the breach was far more extensive than previously thought. The Legal Aid Agency said on Wednesday that around 250,000 records stolen in the April 2025 attack date from before 2007, including one going back to 1978. That's much further back than the agency previously estimated – it initially said the stolen data covered legal aid applications, claims, and payments from 2007. Most of the newly identified records date from the 1990s and 2000s, with only a “fractionally small number” originating before 1990. Still, the discovery raises an awkward question about just how much historical personal information was sitting in government systems when the attackers came knocking. That wasn't the only surprise in the stolen data, as the Ministry of Justice (MoJ) has also discovered that hackers accessed information from HM Prison and Probation Service (HMPPS), including names, dates of birth, nationalities, and case reference numbers for offenders supervised by probation services between 2010 and 2017. The government says the probation records concern a relatively small number of offenders, with more than 99 percent of the affected data relating to people under supervision in 2016 and 2017. It stressed that none of the stolen probation information relates to victims of crime. The latest revelations come almost 18 months after the Legal Aid Agency disclosed that criminals had accessed and downloaded a significant amount of sensitive personal information. The agency first detected the intrusion on April 23, 2025, but officials didn't establish the scale of the compromise until May 16. The government subsequently took the LAA's online services offline, leaving lawyers struggling to access the systems they needed to submit claims and manage cases. The disruption dragged on for months, with the agency's troubled return to service in December leaving legal aid providers battling delays and ongoing technical problems. Further forensic work has now revealed that the data theft goes back much further than officials originally believed. The compromised information varies by individual but could include names, addresses, dates of birth, National Insurance numbers, financial details, and information about legal proceedings. Some records also contain details of criminal charges, pleas, convictions, and sentences. Among the older material are records relating to legal aid benefit assessments dating from 1978 to 2012, and payments made under the Very High Cost Cases scheme between 1981 and 2004. The government cautioned that the presence of historical records doesn’t mean that everyone who applied for legal aid before 2007 had their information stolen, nor does the 250,000 figure represent a confirmed number of affected individuals. Explaining why it has taken so long to pin down the extent of the theft, the MoJ said the attackers stole information spread across several complex systems, much of it unstructured, fragmented, or incomplete. "Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised," the agency said. The government says it has no indication that the stolen information has been published or shared, although that offers little certainty to anyone whose personal details may now be in criminal hands. Since the attack, the MoJ says it has tightened authentication and access controls, improved security monitoring, addressed vulnerabilities and begun retiring or isolating higher-risk technology. Work to modernize its legacy systems is also underway. The question of why records stretching back to the 1970s remained accessible in the first place is one the latest update does not answer. ®
AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing more confident in their own output faster than practitioners are developing reliable ways to verify it. Without governance models and validation standards in place, that gap compounds and rarely stays contained to a workstation: an
The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls.
To that end, the Department of Telecommunications has issued a circular urging service
Welcome, once again, to PWNED, the weekly column where we gawk at organizations that have made serious security mistakes. Normally, we’re talking about businesses or maybe the odd school that messes up, but today we’re writing about a serious IT screwup in the world’s most powerful military. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Today’s tale comes from Justin Henkel, the CISO of IT monitoring and service company SolarWinds. Henkel previously worked in IT security for the Air Force and one day in the early 2000s saw a practice that just wouldn’t fly today. Before USB drives became popular, burning CDs with mission data was the modus operandi, and those discs were put in both unclassified and classified systems. “They would write a CD, and then they would take that CD and then put it in a classified system and do the remainder of the mission planning,” Henkel told us. “Then they would take that disc and then put it in the airplane.” Inside the airplane, the data on the CD would help the pilot navigate and contain information about threats they might encounter. Later, when thumb drives became a thing, pilots used them instead of discs. “They didn't really think about the overall impact of classified versus unclassified systems,” Henkel said of the pilots. “Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.” According to Henkel, Air Force personnel would buy their flash drives from local vendors rather than sourcing them from official military contractors. If they were in Afghanistan, those drives could literally come from a store in Kabul. And it wasn’t exactly the equivalent of Best Buy. “It was more difficult to bring a US-based computer into the nation than it was just to buy local,” he said. “So they were just going out into the local market in Kabul or whatever city that they were out [in]. And I used to do this: go out, make relationships with the local vendors. ‘Hey I need 100 USB sticks.’” Unfortunately, enemies of the US noticed and soon started selling infected USB drives to local vendors in the Middle East. Henkel knew that using a sneakernet with classified systems was a recipe for disaster. It’s just that no one would listen to him. “It was just a shock,” he told us. “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they’re doing is a violation.” In 2008, the US Department of Defense was infected by malware after somebody attached an infected USB flash drive to a laptop with access to US Central Command. The worm, dubbed Agent.BTZ, could collect information from infected computers and communicate with remote servers. A 2016 report from the FBI and DHS attributed the malware to one or more Russian groups. It took the Pentagon 14 months to scrub it from its systems. It took this attack for the Pentagon to wise up in 2008 and ban the use of USB drives, instead forcing data transfers to go through more secure systems. Eventually, in 2010, the drives were allowed again under certain circumstances. ®
Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.
0day Rubbish Research Team is publicly disclosing a vulnerability in Synametrics
Syncrify 6.2 build 1178, the closed-source incremental backup and
file-replication server from Synametrics Technologies, Inc. (United States). The
product is written in Java, distributed for Linux as a tarball archive, and
served by an embedded Tomcat 9.0.113 through the vendor's in-house sradef
framework, whose single front controller routes every request as...
0day Rubbish Research Team is publicly disclosing a vulnerability chain in South
River Technologies Titan MFT Server 26.0.0.364, the NextGen generation of the
commercial managed file transfer server from South River Technologies (Annapolis,
Maryland, United States). The product runs as a single .NET 8 process,
titanmft.exe, registered as the Windows service SrtTitanMFTServerService under
LocalSystem, serves a Blazor Server administration...
0day Rubbish Research Team is publicly disclosing a vulnerability in SmartBear
Collaborator Server 15.1.15101, the closed-source peer and technical code-review
platform from SmartBear that runs as a Java web application on Apache Tomcat. One
low-privilege authenticated account plants a Groovy Server Page in the Tomcat
webroot through an archive-extraction path traversal, and any anonymous client -
a crawler, a scanner, anyone - then executes it...
Login
