Researchers from Michigan State University and three partner institutions conducted an experiment demonstrating how easily a new smartphone can be taken off a cellular network. They purchased a Samsung Galaxy Z Fold 7, copied its identification number from the sealed box, and reported the phone as lost to its carrier. Once they opened the box and set up the device, it was unable to connect to the network due to this fraudulent reporting. The researchers identified six vulnerabilities in the process that allowed them to disable the phone. This incident raises concerns about the security of mobile devices and the potential for misuse of identification numbers, which could lead to more widespread targeting of users' devices by malicious actors.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
In a recent video, Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, discusses the importance of having a ransomware decision tree in place before an attack occurs. She emphasizes four key areas that organizations need to address ahead of time, starting with how to contain the breach without disrupting critical operations. This involves understanding the network well enough to make informed decisions about taking systems offline. Additionally, organizations need to designate who is authorized to negotiate with attackers and what terms are acceptable. By preparing these strategies in advance, companies can respond more effectively when a ransomware incident strikes, potentially minimizing damage and recovery time. This proactive approach is crucial given the increasing frequency of ransomware attacks affecting various sectors.
Help Net Security
A recent report from Pistachio has raised concerns about how companies evaluate their resilience against phishing attacks. Instead of focusing solely on the percentage of employees who click on simulated phishing emails, the report suggests that organizations should also consider other factors such as credential submission rates. The analysis included data from 648 organizations and over 123,000 users over a year. This broader approach to measuring phishing resilience is crucial because it can provide a clearer picture of an organization's vulnerability to real-world attacks. By understanding how employees interact with phishing attempts beyond just clicks, companies can better prepare themselves against actual phishing threats.
Help Net Security
Salesforce security practices are evolving due to the rise of artificial intelligence. A paper by WithSecure emphasizes that organizations must go beyond traditional security measures, which primarily focus on identities and access controls. It argues that companies need to understand the information they depend on, how trust is established across interconnected systems, and the consequences of actions taken within these environments. This shift is crucial as it highlights the need for a broader perspective on security that includes the dynamics of trust between people, systems, and services. As AI becomes more integrated into Salesforce environments, organizations must adapt their governance strategies to ensure data security and trustworthiness.
Canonical has released Ubuntu 24.04.5 LTS, which includes important security updates and fixes for high-severity vulnerabilities. This update is significant because it is integrated into new installation media, meaning that users who install this version will have these security corrections included right from the start, reducing the number of updates needed post-installation. The release affects not only the standard desktop and server editions of Ubuntu but also nine other flavors such as Kubuntu, Xubuntu, and Ubuntu MATE. This is crucial for users and organizations looking to maintain a secure computing environment, as it helps protect against known vulnerabilities from the outset. Keeping systems updated is essential to defend against potential attacks that could exploit these weaknesses.
Indonesia is facing a cybersecurity threat from a group known as GoldFactory, which is using a technique involving the Android Work Profile feature to distribute the Gigabud Trojan. This malicious software targets Android banking apps, allowing attackers to steal sensitive financial information from users. Another group, Mantax Otax, is reportedly spreading malware independently. This situation raises concerns for Android users in Indonesia, particularly those who rely on banking apps for financial transactions. The ability of these groups to exploit legitimate features in Android underscores the need for heightened vigilance among users and better security measures from app developers.
Windows Server administrators are facing significant issues following the September 2026 security updates. Users report that Remote Desktop Services (RDS) on Windows Server 2019, 2022, and 2025 are failing, which is preventing connections and sometimes necessitating a hard reset to regain functionality. This disruption impacts businesses that rely on remote access for their operations, potentially leading to downtime and reduced productivity. The situation is particularly concerning as many organizations depend on RDS for remote work capabilities. Administrators are advised to monitor the situation closely and consider rolling back the updates if they encounter severe issues.
Oleksii Lytvynenko, a member of the infamous Conti ransomware group, has been sentenced to four years in prison for his role in cyberattacks targeting at least 12 companies. Lytvynenko joined the group in 2021, participating in schemes that extorted businesses by encrypting their data and demanding ransom payments. His sentencing serves as a reminder of the legal consequences facing cybercriminals. The Conti group has been linked to numerous high-profile attacks, making this ruling significant in the ongoing battle against ransomware. The case reflects the increasing focus on holding individuals accountable for their actions in the cyber realm.
A recent cybersecurity incident has revealed that a group of likely Russian-speaking attackers exploited vulnerabilities in PaperCut NG/MF servers to compromise 395 organizations worldwide. Using a network of AI agents, they launched a sophisticated campaign that took advantage of unpatched flaws in these widely used print management solutions. The attackers targeted these servers, which are commonly found in businesses and educational institutions, making the breach particularly concerning for sensitive data exposure. Organizations using PaperCut products should urgently assess their systems for vulnerabilities and apply necessary security updates to protect against potential exploitation. This incident underscores the need for robust security practices, especially for software that handles critical operational functions.
AI systems are advancing rapidly, but the safeguards meant to protect against their potential misuse are lagging behind. Jacob Coxon, a researcher who previously worked at OpenAI and Anthropic, recently left his position and issued a warning about the risks posed by increasingly capable AI agents. He emphasized the need for better permissions, isolation, and oversight to prevent harmful actions from these technologies. As AI continues to integrate into various sectors, the lack of adequate safety measures raises concerns about how these systems could be misused or cause unintended harm. This situation calls for urgent attention from AI developers and regulators to ensure that safety protocols keep pace with technological advancements.
A researcher from Anthropic has resigned, citing serious concerns about the potential dangers associated with artificial intelligence development. This resignation follows a trend of similar departures from both Anthropic and OpenAI, where individuals have voiced worries about the safety protocols in AI research. The implications of these resignations raise questions about the ethical responsibilities of AI companies and the need for stricter safety measures. As AI technology continues to advance rapidly, the concerns highlighted by this researcher could impact the future direction of AI development and regulation. The discussion around AI safety is becoming increasingly urgent as more experts call for a reevaluation of current practices.
In a recent investigation by Prophet Security, it was found that identity-related attacks accounted for about half of all confirmed malicious activities from May to July 2026. The analysis identified four main attack patterns that impacted various customer environments. The report also examined why some attacks were successful while others were thwarted. This information is crucial for organizations as it sheds light on the current tactics being used by cybercriminals, particularly focusing on identity theft and related fraud. Companies need to reassess their security measures to effectively protect against these prevalent threats, which could lead to significant data breaches and financial losses.
Infosecurity Magazine
The Cybersecurity and Infrastructure Security Agency (CISA) has revised its insider threat guide to address contemporary issues like remote work and the use of artificial intelligence. The updated guide provides organizations with new strategies for detecting and mitigating the risks posed by insider threats, especially as many employees continue to work from home. This is significant as insider threats can originate from both employees and contractors, making it essential for companies to adopt effective measures to safeguard sensitive information. The guidance aims to enhance awareness and preparedness against potential breaches from within, which can be particularly damaging. Organizations are encouraged to implement these new recommendations to improve their security posture against insider risks.
Sean Cairncross, the U.S. National Cyber Director, commented on the ongoing struggle between technological innovation and cybersecurity. He emphasized that while artificial intelligence is often viewed as a new challenge, it actually exposes existing vulnerabilities in cyber systems. This statement reflects a broader concern among governments that they are merely 'buying time' to address these issues rather than effectively solving them. The implications are significant as they indicate that rapid advancements in technology may outpace the security measures currently in place, leaving systems vulnerable to attacks. This ongoing race between innovation and security could have serious ramifications for national security and the safety of digital infrastructure.
A serious vulnerability, identified as CVE-2026-19490, has been found in NetScaler products that allows attackers to bypass authentication. This flaw has been actively exploited since at least September 3, raising concerns for organizations using affected systems. The vulnerability affects various versions of NetScaler and poses a significant risk as it could allow unauthorized access to sensitive information. Companies using NetScaler should prioritize patching their systems to mitigate potential breaches. The exploitation of this vulnerability highlights the ongoing risks associated with widely used network infrastructure.