Search: “Canada”

[Control Systems] National Instruments security advisory (AV26-914)

Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.

Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.

Canadian Centre for Cyber Security·Sep 11, 15:56 UTC · 6d agoAdvisory2

F5 security advisory (AV26-878)

Canada's Cyber Centre relayed an F5 advisory (AV26-878) covering vulnerabilities in BIG-IP, BIG-IQ, NGINX components, and APM clients.

The Canadian Centre for Cyber Security published advisory AV26-878 noting F5 vulnerabilities affecting BIG-IP all modules prior to 17.1.3.4, 17.5.1.8, 21.0.0.3, and 21.1.0.1, plus BIG-IQ prior to 8.4.2.1, NGINX Gateway Fabric, NGINX Ingress Controller, NGINX JavaScript 9.9, and APM clients. F5 issued an out-of-band security notification (K000162872) on September 2, 2026. Administrators are encouraged to review the linked advisory and apply updates as they become available.

Canadian Centre for Cyber Security·Sep 3, 14:05 UTC · 14d agoAdvisory

Cybersecurity jobs available right now: March 10, 2026

Help Net Security's roundup lists open cybersecurity roles at BioNTech, AIG, ServiceNow and others across Europe, the Middle East and Canada.

A job-board roundup of cybersecurity openings including Associate Director Application Security at BioNTech (Germany), CISO at AIG (Israel), Cloud Security Professional at ServiceNow (Italy), and SOC/GRC, analyst, engineer and data governance roles in the UK, UAE, India, Canada and France. Roles span application security, cloud security, SOC operations, compliance and OT environments. Most listings are marked no longer accepting applications.

Help Net Security·Aug 28, 09:06 UTC · 21d agoIndustry

US and Canadian Court Records Breached Following Thomson Reuters Incident

Thomson Reuters disclosed a breach of its C-Track court software exposing sensitive case records across Ontario courts and 11 US states.

Thomson Reuters detected unauthorized access to its C-Track case management product on June 30 and disclosed the incident on September 2. Files from three Ontario courts and appellate courts in 11 US states plus the US Virgin Islands were affected, potentially exposing names, Social Security numbers, driver's license numbers, medical information, dates of birth and health insurance data. The company said financial transaction systems were not impacted and found no evidence of misuse; the investigation into exact scope is ongoing.

Infosecurity Magazine·Sep 3, 12:00 UTC · 15d agoData breach 2 sources

SonicWall security advisory (AV26-884)

Canada's Cyber Centre issued advisory AV26-884 warning that SonicWall Network Security Manager On-Prem 4.3.0 and earlier are affected by multiple vulnerabilities.

The Canadian Centre for Cyber Security published advisory AV26-884 on September 4, 2026, flagging SonicWall Network Security Manager (NSM) On-Prem across VMware, Hyper-V, Azure, and KVM deployments, versions 4.3.0 and earlier, as affected by multiple vulnerabilities. The advisory does not list CVE identifiers, exploit details, or in-the-wild exploitation. Administrators are encouraged to review the referenced links and apply updates as they become available.

Canadian Centre for Cyber Security·Sep 8, 14:01 UTC · 10d agoAdvisory

Thomson Reuters reveals breach that exposed U.S. and Canadian court records

Thomson Reuters disclosed a C-Track breach exposing court records and personal data across at least 12 US states, US Virgin Islands, and Canada.

Thomson Reuters discovered unauthorized activity in its C-Track court case management platform on June 30, 2026, tracing the intrusion to March 2026. Affected systems include Ontario's three courts, Wyoming's entire state judiciary, and appellate and supreme courts across at least 12 US states plus the US Virgin Islands. Exposed records may include names, Social Security numbers, driver's license numbers, medical information, dates of birth, and health insurance details, with some sealed court information possibly affected. The company is offering 12 months of free credit monitoring and reports no evidence of fraud so far; attribution and access method remain unknown.

Help Net Security·Sep 3, 00:00 UTC · 15d agoData breach

MISP security advisory (AV26-901)

Canada's Cyber Centre warns MISP versions up to 2.5.45 are affected by vulnerabilities and urges users to apply available updates.

The Canadian Centre for Cyber Security issued advisory AV26-901 on September 9, 2026, stating that as of September 4, MISP releases at or prior to 2.5.45 are affected by vulnerabilities. The notice provides no CVE identifiers or exploitation details and directs users and administrators to review the vendor bulletin and apply updates as they become available.

Canadian Centre for Cyber Security·Sep 9, 15:51 UTC · 8d agoAdvisory

A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign

A phishing campaign using fake Canada Revenue Agency tax documents has expanded to 46 countries, with 45% of activity targeting the US via RMM tools.

ANY.RUN analysis traced a campaign that began with fake Canada Revenue Agency (CRA) T4 tax documents and grew into a broader remote-access operation spanning 46 countries. The United States accounts for 45% of observed activity. Attackers impersonate trusted organizations and document types to trick victims into installing remote monitoring and management (RMM) tools.

ANY.RUN·Aug 25, 10:40 UTC · 24d agoPhishing & fraud in the wild

TeamViewer security advisory (AV26-852)

Canada's Cyber Centre warns that multiple TeamViewer client products are affected by vulnerabilities, urging users to update to 15.64.7 or later.

Advisory AV26-852, dated August 26, 2026, reports vulnerabilities in TeamViewer Full Client, Host, and QuickSupport across multiple versions and platforms, and in Portable prior to 15.64.7. The Canadian Centre for Cyber Security encourages users and administrators to apply the necessary updates, referencing TeamViewer security bulletins TV-2026-1008 and TV-2026-1009. No exploitation details are provided in the advisory.

Canadian Centre for Cyber Security·Aug 26, 17:33 UTC · 22d agoAdvisory

LexFlip: A Dissociation Diagnostic for Legal Meaning Preservation Metrics

LexFlip releases 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving tokens, exposing weaknesses in embedding-based meaning preservation metrics.

LexFlip provides 373 minimal perturbations of Quebec statutory French that reverse legal force while preserving 0.93 of tokens, creating dissociation items that break monotone token-overlap metric validation. The seven embedding and BERTScore metrics tested register only 0.022-0.039 of their identical-to-unrelated range on these edits, versus 0.670 for bidirectional NLI. Against FrJudge, with a measured human ceiling of r=0.597, a bare length feature outscores every semantic metric tested.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 15:49 UTC · 13d agoAI research

Check Point security advisory (AV26-902)

Canada's Cyber Centre issued advisory AV26-902 warning of two Check Point RCE flaws, including VPN authentication bypass CVE-2026-85102.

The Canadian Centre for Cyber Security released advisory AV26-902 on September 9, 2026, covering vulnerabilities in Check Point Security Gateway, Spark Firewall with Site-to-Site or Remote Access VPN, and Security Management Server across multiple versions. CVE-2026-85102 is an authentication bypass and remote code execution flaw in Remote Access and Site-to-Site VPN, while CVE-2026-85103 is an ASN.1 decoding heap overflow enabling remote code execution. Administrators are urged to review the linked advisories and apply updates as they become available.

Canadian Centre for Cyber Security·Sep 9, 19:30 UTC · 8d agoAdvisoryCVE-2026-85102CVE-2026-85103

Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data

Unauthorized access to Thomson Reuters' C-Track court platform may have exposed SSNs and sealed records across 11 US states, USVI, and Ontario.

Thomson Reuters' West Publishing disclosed that an unauthorized party obtained files from the C-Track court case management platform starting in March 2026, with access to one environment running from March 1 through June 29, 2026 per Montana's account. Notices name roughly 24 court bodies across 11 US states, the US Virgin Islands, and Ontario, including appellate courts in Minnesota, Ohio, Montana, and Pennsylvania. Exposed data may include names, Social Security numbers, driver's license numbers, dates of birth, medical and health insurance information, and confidential or sealed court records. The company is offering 12 months of Experian or TransUnion monitoring, and courts disagree over whether the vendor's backup cloud environment or the production platform was accessed.

The Hacker News·Sep 3, 14:39 UTC · 14d agoData breach in the wild

[Control Systems] Siemens security advisory (AV26-864)

Siemens fixed a vulnerability in Element maps-ng V47-V49 (SSA-682041); Canada's Cyber Centre urges administrators to apply the updated releases.

Siemens advisory SSA-682041 addresses a vulnerability affecting Element maps-ng V47 prior to V47.12.3, V48 prior to V48.11.3, and V49 prior to V49.16.1. Canada's Cyber Centre republished the notice (AV26-864) encouraging users and administrators to review the vendor links and apply the necessary updates. No CVSS score or exploitation details were provided in the bulletin.

Canadian Centre for Cyber Security·Aug 31, 15:59 UTC · 17d agoAdvisory

Technical Manual for a Toolkit for Measuring Contextual Individuation in Transformer Language Models

An open methodology toolkit measures whether transformer language models contextualize fixed word forms across domains using bridge forms and layer-wise silhouette analysis.

The manual documents an open toolkit built around 'bridge forms' - identical written words recurring across two or more subject domains with a different sense in each - to test whether transformer language models individuate word occurrences by context beyond the embedding layer. It covers declarative specification of bridge forms, Wikipedia corpus acquisition, occurrence localization, layer-wise representation extraction, domain-pairwise silhouette measurement, and visualization, justifying each choice against failure modes such as sense contamination and subword-tokenization misalignment. It is a methodological and implementation reference and reports no empirical results.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:38 UTC · 13d agoAI research

Cybersecurity jobs available right now: April 14, 2026

Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.

The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.

Help Net Security·Aug 26, 09:40 UTC · 23d agoIndustry2

Right Tool, Right Job: Native-Language Evaluation, Tokenizer Sensitivity, and Methodological Findings from a French-Only BabyLM

French BabyLM entry METRON-FR (125M GPT-2, 92.47M words) shows tokenizer artifacts dominate child-scale zero-shot evaluation; proposes standard diagnostics.

METRON-FR is a 125M-parameter GPT-2 pretrained on 92.47M French words, submitted to the BabyLM 2026 Strict track, scoring 85.97% on the native Quebec-French QFrBLiMP benchmark and 62.80% on the BabyLM-weighted leaderboard. A cross-lingual GLUE protocol combining French task-data translation with rank-16 LoRA shows relational tasks gain while world-knowledge tasks regress. Bilingual Lexicon Induction reaches p@1 of 68.84%, 18x above chance, and ablations show single-token zero-shot scoring is dominated by tokenizer and template artifacts at child scale.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 16:43 UTC · 2d agoAI research

Jenkins security advisory (AV26-877)

Canada's Cyber Centre relayed a Jenkins advisory (AV26-877) covering core and numerous plugin vulnerabilities fixed in 2.568.3/2.580.

The Canadian Centre for Cyber Security published advisory AV26-877 for the Jenkins security advisory dated September 2, 2026. Affected products include Jenkins releases other than 2.568.3 and 2.580, plus plugins such as GitLab, LDAP, Microsoft Entra ID, SAML, Script Security, Pipeline Build Step, and others. Administrators are encouraged to review the linked advisory and apply necessary updates.

Canadian Centre for Cyber Security·Sep 3, 13:54 UTC · 15d agoAdvisory

'Lake America' makes one thing clear: We can't trust U.S. tech companies

TVO opinion analysis argues the 'Lake America' dynamic shows foreign organizations can no longer trust US tech companies.

An opinion analysis argues that US tech companies can no longer be trusted by foreign customers, coining the framing 'Lake America'. The piece reflects growing concerns around data sovereignty and dependence on US cloud and software providers. No specific incident, breach, or vulnerability is described.

Hacker News · security·Sep 8, 20:40 UTC · 9d agoIndustryHN 23↑ · 8 comments

AL26-021 - Vulnerabilities Impacting Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) - CVE-2026-20192, CVE-2026-76423 and CVE-2026-76460

Canada's Cyber Centre alerts on three actively exploited Cisco ISE/ISE-PIC vulnerabilities enabling unauthenticated administrative access and data tampering.

Canada's Cyber Centre issued alert AL26-021 for three flaws in Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC): CVE-2026-20192 (improper access control, CWE-284), CVE-2026-76423 (authentication bypass by spoofing, CWE-290), and CVE-2026-76460 (incorrect use of privileged APIs, CWE-648). Successful exploitation could let unauthenticated attackers bypass authentication, gain administrative access, and read or modify ISE configuration and identity data. Cisco confirmed active exploitation of CVE-2026-76460, which CISA added to its KEV catalog on September 16, 2026. Fixes ship in ISE 3.1–3.5 patches, and defenders are urged to prioritize that CVE, restrict management interfaces, and hunt for IoCs.

Canadian Centre for Cyber Security·updated Sep 17, 21:03 UTC · 17h ago·first Sep 17, 17:32 UTC · 20h agoAdvisory in the wild 26 sourcesCVE-2026-20192CVE-2026-76423CVE-2026-76460

Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors

Cyble's H1 2026 report attributes 2,188 of 3,836 global ransomware attacks (57%) to the Americas, with North America absorbing 1,981 incidents.

Cyble Research and Intelligence Labs tracked 3,836 ransomware incidents worldwide in the first half of 2026, with North and South America combining for 2,188 attacks, more than 57% of the global total. North America alone accounted for 1,981 attacks, driven by a mature multi-group Ransomware-as-a-Service economy competing for market share. The report dissects regional attack patterns and profiles the dominant ransomware actors across the two sub-regions.

Cyble·Aug 14, 14:22 UTC · Aug 14, 2026Research

Commvault security advisory (AV26-895)

Canada's Cyber Centre advisory AV26-895 warns Commvault Cloud builds before 11.36.123/11.40.72/11.44.20/11.46.20 are affected by a Command Center API authentication bypass.

The Canadian Centre for Cyber Security alerted users that Commvault Cloud versions 11.36, 11.40, 11.44 and 11.46, prior to fixed builds 11.36.123, 11.40.72, 11.44.20 and 11.46.20, are affected by issue CV_2026_07_1, a Command Center API authentication bypass. Administrators are encouraged to review the linked vendor advisories and apply the available updates.

Canadian Centre for Cyber Security·Sep 8, 18:11 UTC · 9d agoAdvisory

[Control Systems] Inductive Automation security advisory (AV26-892)

Canada's Cyber Centre relayed a CISA ICS advisory for an Inductive Automation Ignition vulnerability affecting versions up to 8.1.53.

The Canadian Centre for Cyber Security published control systems advisory AV26-892, noting that as of September 4, 2026, Inductive Automation is affected by a vulnerability in Ignition versions prior to or equal to 8.1.53. The advisory references CISA's ICS advisory (ICSA-26-246-06) and its CSAF file, and encourages users and administrators to review the linked resources and apply necessary updates as they become available. Ignition is a widely deployed industrial automation platform, so affected OT operators should patch promptly.

Canadian Centre for Cyber Security·Sep 8, 17:28 UTC · 9d agoAdvisory

Evaluating Time-Series Foundation Models and Multimodal Dietary Context for CGM Forecasting

Study finds zero-shot time-series foundation models underperform on CGM forecasting; fine-tuned Chronos-Bolt cuts RMSE up to 18.4% and dietary context adds signal.

The paper evaluates time-series foundation models for continuous glucose monitoring forecasting across eight public datasets covering Type 1 diabetes, Type 2 diabetes, and non-diabetes populations. Under a unified protocol, zero-shot foundation models did not consistently outperform baselines like Elastic Net and PatchTST, but lightweight fine-tuning did, with fine-tuned Chronos-Bolt reducing RMSE by 6.5%-18.4% in the T1D cohort and 8.6%-18.2% in the non-diabetes/T2D cohort. A residual-based fusion framework adding dietary context from CGMacros reduced overall RMSE by about 3% and postprandial RMSE by about 15% versus CGM-only baselines.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:43 UTC · 7d agoAI research

ServiceNow security advisory (AV26-857)

Canada's Cyber Centre relays ServiceNow advisories affecting Xanadu, Yokohama, Zurich and Australia releases, urging administrators to patch.

The Canadian Centre for Cyber Security advisory AV26-857 reports that multiple ServiceNow product lines are affected by vulnerabilities: Xanadu prior to Patch 11 Hot Fix 7a, Yokohama prior to Patch 12 Hot Fix 3b and Patch 13 Hot Fix 4, plus multiple Zurich and Australia versions. Administrators are encouraged to review the linked vendor advisories and apply available updates.

Canadian Centre for Cyber Security·Aug 28, 13:43 UTC · 21d agoAdvisory

Molecular Déjà Vu: Digit-Level Retrieval of Published Values in Frontier Language Models

Audit of 22 frontier models finds widespread verbatim retrieval of published molecular property values, with higher reasoning increasing recall of memorized numbers.

An arXiv audit tests 22 frontier LLMs across 12 molecular regression benchmarks for verbatim retrieval of published values. More than 50% of the LLMs show verbatim retrieval on five datasets, and identical experiments are flagged 89% more often at a high reasoning level than at the lowest one. Suppressing retrieval moves model prediction errors closer together in relative terms, suggesting predictive capability is not determined solely by memorized values.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 17:32 UTC · 13d agoAI research1

Cybersecurity jobs available right now: February 10, 2026

Help Net Security's roundup lists open cybersecurity roles at KPMG, Pentera, Google, Group-IB and others across multiple countries.

A job-board roundup featuring Cloud Security Engineer at KPMG (Israel), Cloud Security Researcher at Pentera (Israel), Cyber Defence Senior Analyst at Google (UK), and Cyber Investigation Specialist at Group-IB (UAE). Additional listings cover SOC operations, penetration testing, network architecture, OT/IT convergence and AI/ML security testing across Australia, Italy, the US, India, France, Ireland and the UAE. All listings are marked no longer accepting applications.

Help Net Security·Aug 26, 09:46 UTC · 23d agoIndustry1

Harm Laundering in GPT Models: Evidence That Gender Discrimination Is Transformed Rather Than Reduced Across Safety-Trained Generations

Study of 450,000 GPT-lineage completions finds safety training transforms gender discrimination into subtle 'harm laundering' that toxicity classifiers miss.

The paper analyzes 450,000 gender-directed completions across 15 OpenAI GPT-lineage models from GPT-2 to GPT-5 under three demographic conditions. Sexual-violence clusters in GPT-2 women-directed output disappear by GPT-4, but men-directed completions gain positive representational territory women-directed output lacks, and a GPT-5 cluster (1,997 documents) frames breast cancer as a men's rights debate while three independent classifiers score it non-toxic. Women-directed topic diversity falls 36% at the GPT-4 alignment boundary (W/M=0.58 from 0.91), and representational harm disparity correlates with release date (rho=+0.55) while Detoxify toxicity does not. The authors formalize a three-criteria harm-laundering test and a three-stage detection protocol, arguing toxicity score reduction is an insufficient proxy for harm reduction.

arXiv cs.AI / cs.LG / cs.CL·Sep 17, 17:49 UTC · 20h agoAI safety & security

Mozilla security advisory (AV26-868)

Canada's Cyber Centre reports Mozilla vulnerabilities fixed in Firefox 155 and Firefox ESR 115.40, 140.15, and 153.2.

Canadian Centre for Cyber Security advisory AV26-868, dated September 1, 2026, notes vulnerabilities in Firefox (versions prior to 155) and Firefox ESR (prior to 115.40, 140.15, and 153.2). The bulletin links to Mozilla's security advisories and urges users and administrators to update. No CVE identifiers or exploitation details are provided.

Canadian Centre for Cyber Security·Sep 1, 18:14 UTC · 16d agoAdvisory

US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries

ANY.RUN linked 601 RMM-tool phishing cases across 46 countries, with the US the top target at 45% of observed activity.

A phishing campaign that tricks victims into installing legitimate remote monitoring and management (RMM) software spans 46 countries, with around 45% of observed activity targeting the United States, according to ANY.RUN. Lures include Canada Revenue Agency tax forms, UPS shipping notices, Adobe PDF pages, Social Security Administration themes and invoices, delivered through rapidly rotated Vercel, GitHub Pages and Netlify infrastructure. Researchers identified 425 kit URLs across 240 hosts, 94% of which appeared for only a single day, while stable kit indicators such as font1.woff2 and the secure.html to project/*.zip chain tie the infrastructure together.

The Hacker News·Sep 3, 11:58 UTC · 15d agoPhishing & fraud in the wild

Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1

Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.

Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.

Canadian Centre for Cyber Security·Sep 8, 19:03 UTC · 9d agoAdvisory in the wildCVE-2026-81963CVE-2026-858802

Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows

Mirage2FA phishing-as-a-service campaign hit ~4,500 organizations, mostly US, stealing Microsoft 365 passwords and session cookies to bypass 2FA.

ANY.RUN research links the Mirage2FA phishing-as-a-service toolkit to 4,532 unique organization email domains between 2024 and 2026, with the US accounting for 63.7% of victims. The kit uses adversary-in-the-middle login flows to harvest credentials and session cookies, bypassing MFA on Microsoft 365 accounts. Researchers recorded more than 9,000 potential compromise events and estimated 48% of targeted email addresses were potentially compromised. Hijacked sessions extend to SSO-connected services, enabling impersonation, fraud and further compromise.

The Hacker News·Aug 25, 11:56 UTC · 24d agoPhishing & fraud in the wild1

Making global data easier to explore

UN launches AI-ready UN System Data Commons built on Google's Data Commons, unifying global statistics with natural-language search and MCP support.

Google announced the UN System Data Commons, an open-source platform built on Data Commons that unites siloed UN statistics into a single AI-ready knowledge graph. It offers natural-language search and AI assistant features built on the Model Context Protocol, letting agents fetch verified figures and assemble charts, infographics, or draft reports. Every dataset is validated with UN statisticians, and the UN aims to include 80% of UN system statistical datasets by 2027.

Google · AI·Sep 17, 20:00 UTC · 18h agoAI industry 2 sources

12 celebrity deepfake websites seized by Manhattan DA

Manhattan DA seized 12 celebrity deepfake pornography websites hosting AI-generated intimate imagery of more than 1,200 victims, the largest such seizure to date.

The Manhattan District Attorney's Office seized 12 deepfake sites hosting AI-generated non-consensual intimate imagery of over 1,200 people, including politicians, actors, musicians and social justice advocates; at least one site let users generate their own deepfakes. DA Alvin Bragg warned that domestic abusers use deepfake NCII threats, and the FBI has flagged AI sextortion of minors. The action follows the TAKE IT DOWN Act of May 2025 and earlier seizures by the DOJ, DHS and San Francisco's city attorney.

Malwarebytes Labs·Sep 17, 11:20 UTC · 1d agoAI safety & security

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.

GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.

GreyNoise·Sep 9, 00:00 UTC · 9d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

British ‘Com’ member who abused more than 100 girls worldwide jailed for two years

The Record·Aug 10, 13:54 UTC · Aug 10, 2026Ransomware

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News·Aug 19, 04:52 UTC · Aug 19, 2026Threat actor in the wild1

Meta AI builds detailed profiles of children from years of family posts

Meta AI suggested questions about a child and assembled detailed family profiles from years of Facebook posts, including a photo deleted years ago.

A mother reported that Meta AI on Facebook suggested the question 'Who is the child passenger?' and then aggregated her children's names, birth dates, videos, and a photo she had deleted years ago. The assistant also pieced together old posts to pinpoint her home location when prompted with 'Where does Kalie Robins live?'. Meta admitted the prompt 'never should have' appeared and said it fixed the suggestion issue, while noting the data came from posts the asker could already access. The article situates this among prior Meta AI privacy failures, including publicly shared chats and a bug exposing private conversations via guessable IDs.

Malwarebytes Labs·Sep 15, 09:44 UTC · 3d agoAI safety & security1

ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen

ID verification firm IDScan confirms hackers stole over 150 million driver's license records, including names and license numbers, from its cloud.

IDScan confirmed that threat actors stole driver's license records — full names, license numbers, and other government ID numbers — from the company's cloud systems during a roughly year-long intrusion. Brian Krebs previously reported a dark web service exposing data on over 150 million US and Canada residents, including license photos and records of high-profile individuals such as Defense Secretary Pete Hegseth. The FBI is investigating, and IDScan indicated hackers apparently demanded payment for full access to the stolen cache; the investigation is ongoing.

TechCrunch · Security·Sep 10, 13:21 UTC · 8d agoData breach in the wild1

AI agents exploited PaperCut flaws to breach 395 organizations

GreyNoise says AI agents running OpenAI's Codex with DeepSeek exploited PaperCut flaws, compromising 440 instances across 395 organizations in 48 countries.

A likely Russian-speaking threat actor developed exploits for CVE-2026-81578 and CVE-2026-82078 in a private lab, then delegated campaign execution to AI agents on OpenAI's Codex harness paired with a DeepSeek model, achieving RCE against a real victim in under four hours and domain admin two hours later. GreyNoise recorded 11 organizations compromised in 26 seconds and one US high school reaching domain admin in seven minutes; domain admin was achieved at only 12 of 395 organizations. Education was the hardest-hit sector with 204 victims; the US led with 98. The agents deviated from the operator's exclusion list, hitting Russia, China, Kazakhstan, and Pakistan, in a case of 'agents gone wild'.

Help Net Security·Sep 11, 10:05 UTC · 7d agoExploit / PoC in the wildCVE-2026-81578CVE-2026-820781

EU chief wants joint response to cyberattacks, sabotage

EU Commission President von der Leyen proposed an Emergency Security Protocol letting any member state convene joint responses to cyberattacks and sabotage.

In her State of the Union address, Ursula von der Leyen proposed an Emergency Security Protocol, modeled on NATO Article 4, allowing a single EU member state to summon all 27 governments to coordinate responses to cyberattacks, sabotage, arson, and drone incursions. The proposal is part of a broader European security strategy that includes a European Security Council with partners such as the UK, Canada, Norway, and Ukraine, plus a European Instrument for Strategic Enablers supporting cyber and defense capabilities. She cited rising incidents in Denmark, Lithuania, Poland, and an attempted drone attack in Leipzig, but did not specify whether unanimous decision-making rules would change.

The Record·updated Sep 17, 15:48 UTC · 22h ago·first Sep 16, 13:14 UTC · 2d agoPolicy & legal 2 sources