Search: “aviation”

Cyberattack causes a flight delay? Airlines won’t owe you a hotel or meal

A new DOT rule exempts airlines from providing meal vouchers or hotels for cyberattack-caused delays if carriers comply with applicable cybersecurity regulations.

A Department of Transportation rule published in September 2026 adds "cybersecurity attacks" to a list of 10 "not controllable" flight disruption causes, creating a new delay tracking category and relieving compliant airlines of customer service obligations like meal vouchers and hotels. The rule stems from the FAA Reauthorization Act of 2024 and applies only when carriers demonstrate compliance with applicable cybersecurity regulations. Consumer groups reacted cautiously: FlyersRights criticized the lack of public comment, while the National Consumers League saw both certainty benefits and risks from ambiguous wording. The article cites prior aviation incidents including Scattered Spider's airline attacks and the 2024 Collins Aerospace hack that disrupted European flights.

CyberScoop·Sep 11, 21:26 UTC · 5d agoPolicy & legal

Iranian cyber spies target aviation, fintech developers with new malware

Kaspersky links Iranian espionage group Mirage Kitten to fake job offers delivering new NodeRabbit and PollCat malware at aviation and fintech targets.

Kaspersky attributes the campaign to Iran-linked Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm and Nimbus Manticore), which targeted developers and specialists in Egypt, Ethiopia and Afghanistan via fake recruiter contacts on LinkedIn and job platforms. Victims were lured into running malicious coding assessments that deployed two previously unknown families: NodeRabbit, a cross-platform RAT for Windows, Linux and macOS, and PollCat, which provides persistence and delivers additional payloads. The group masks activity behind legitimate Microsoft Azure and Cloudflare infrastructure, sometimes embedding victim organization names in Azure subdomains. The group has been active since at least 2022, focusing on aviation, aerospace and financial technology sectors in Africa and the Middle East.

The Record·Sep 1, 12:38 UTC · 16d agoThreat actor1

Saving Jet Fuel

Tutorial optimizes flight paths to cut jet fuel costs using open-source Scikit-decide planning framework and OpenAP aircraft performance models.

A technical walkthrough demonstrates wind-aware flight path optimization using Scikit-decide, an open-source framework for reinforcement learning and automated planning, paired with OpenAP fuel-consumption models built by Dr. Junzi Sun at TU Delft and NOAA wind data. A Boeing 787-9 flying EWR to FCO can require roughly $68K in fuel, and adjusted routing could save thousands. The post uses Python 3.12, DuckDB with spatial extensions, and QGIS for map rendering.

Hacker News · AI·Sep 15, 23:17 UTC · 1d agoAI tools & infraHN 45↑ · 19 comments

Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Kaspersky reports Mirage Kitten targeting aviation and fintech organizations across the Middle East and Africa with new NodeRabbit and PollCat backdoors.

Kaspersky researchers documented new Mirage Kitten operations against aviation and fintech organizations in the Middle East and Africa. The campaign uses two previously undocumented backdoors: NodeRabbit, written in Node.js, and PollCat, written in JavaScript. The findings expand the group's known toolset and TTPs.

Kaspersky Securelist·Sep 1, 07:00 UTC · 16d agoThreat actor in the wild1

Deep Learning-Based Detection of Electrical Faults and Power Quality Disturbances in Aerospace Power Systems

Compact ResNet detects electrical faults in 400 Hz aircraft power systems with 95.87 percent accuracy after deployment on Xilinx Zynq MPSoC.

The study targets multiclass fault and power quality disturbance detection in 400 Hz aerospace networks using a high-fidelity simulation model inspired by the Boeing 787 electrical architecture, covering 21 normal, disturbance, switching, open-circuit, and short-circuit conditions. Two 73,500-sample datasets are built from 1D waveforms and STFT time-frequency representations, augmented with domain randomization and class-specific GANs, and the time-series dataset is released via IEEE DataPort. A compact ResNet with 175,685 parameters achieved 96.94 percent software test accuracy, and 95.87 percent after 8-bit quantization on a Xilinx Zynq UltraScale Plus ZCU102 with 6.90 ms mean accelerator latency per record.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 17:19 UTC · 7d agoAI research

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

Unit 42 links new Elirks backdoor variants attacking Japanese organizations to 2012 Taiwan attacks, delivered via spear-phishing PDFs exploiting Adobe Flash CVE-2011-0611.

Unit 42 analyzed new Elirks backdoor variants found in an attack on a Japanese business, noting strong similarities to 2012 attacks on Taiwanese ministries. The backdoor retrieves its C2 address from attacker-created accounts on Japanese blog and SNS services. Recent deliveries used an airline e-ticket lure named "E-TKT" with a PDF exploiting Adobe Flash CVE-2011-0611. Shared infrastructure and tactics with the Scarlet Mimic campaign suggest possible ongoing cyber espionage across East Asia.

Palo Alto Unit 42·Aug 17, 12:56 UTC · Aug 17, 2026Threat actor in the wildCVE-2011-0611

AIR raises $50M to help companies vet the skills and add-ons AI agents use

AI security startup AIR exits stealth with $50M across two seed rounds to continuously vet skills, plugins, and MCP servers used by enterprise AI agents.

AIR, founded by Unit 8200 veterans Yair Saban and Niv Hoffman, raised $10 million led by Sequoia and $40 million led by Greenoaks to secure the emerging AI agent software supply chain. Its platform discovers agents in enterprise environments, intercepts their actions, and continuously vets skills, add-ons, and MCP servers against a maintained whitelist, filtering out about 27% of found add-ons. The company claims over 20 customers, roughly a quarter large enterprises, with strong demand in financial services and pharma, and competes with Noma Security, Zenity, Astrix Security, and Operant AI.

TechCrunch · Security·Sep 1, 15:45 UTC · 15d agoAI industry

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.

Cyber Security News·Sep 9, 14:07 UTC · 7d agoMalware in the wild

Using AI for Weapons Development

Anthropic report reveals Yemen-based actors used Claude Code to build guidance software for guided rockets and ballistic missiles.

Bruce Schneier highlights Anthropic's misuse disclosure describing a threat actor cell in northern Yemen running three weapons programs: a guided rocket with phone-class homing guidance, a 2,000+ km multi-stage ballistic missile, and the 'R2000' hypersonic glide vehicle set. The actors used Claude Code as a substitute for human engineers to write GNC software, integrate an open-source autopilot, tune controls, and run flight simulations, orchestrating multiple Claude instances in delegated roles. Safeguards blocked many requests but evasion tactics included hiding intent and splitting work across sessions; one guided rocket test-fire failed but no operational device was fielded.

Schneier on Security·Sep 14, 16:07 UTC · 2d agoAI safety & security in the wild

The latest AI news we announced in August 2026

Google's August 2026 AI recap includes launches of Gemini 3.7 Flash, Gemini 3.5 Transcribe, and the Pixel 11 series, plus 1 billion Gemini users.

Google's monthly recap covers the Gemini 3.7 Flash workhorse model for coding and agents, released three weeks after 3.6 Flash at half its per-million-token cost, and the Gemini app surpassing 1 billion monthly users. The Pixel 11 series launched with the Tensor G6 chip running Gemini Nano, alongside Gemini 3.5 Transcribe for real-time speech-to-text and Gemini Omni 1.1 Flash for studio-quality video generation. Other announcements include a free year of Google AI for college students, Gemma's 1 billion downloads, and AI weather forecasts for aviation contrail reduction.

Google · AI·Sep 1, 20:45 UTC · 15d agoAI industry

Understanding Operator Attitudes Toward AI-Supported Decision Making in Maritime Operations

A survey of maritime professionals finds positive but scenario-sensitive attitudes toward AI collision-avoidance assistants, urging design for calibrated reliance.

The study surveyed maritime stakeholders on attitudes toward AI-supported collision-avoidance assistants for Maritime Autonomous Surface Ships, measuring technology anxiety, trust in automation, and explanation quality with established questionnaires plus thematic analysis of open responses. Results show generally positive disposition, no clear age-related openness differences, stable trust across scenarios, and multidimensional, scenario-sensitive explanation ratings. Participants valued decision support and situation awareness but worried about AI reliability, over-reliance, and skill loss; the authors recommend designing for calibrated reliance with domain experts in the loop rather than maximizing automation or trust.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 16:57 UTC · 6d agoAI research1

Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware

Kaspersky reports Iran-linked Mirage Kitten delivers new NodeRabbit and PollCat malware to fintech and aviation targets via fake LinkedIn coding assessments.

Kaspersky researchers documented two previously undocumented Node.js malware families, NodeRabbit and PollCat, attributed with high confidence to Iran-linked APT group Mirage Kitten. The malware is delivered via fake recruiter personas on LinkedIn offering coding assessments hosted on Amazon S3, with instructions banning AI assistants so AI code-review tools would not flag the trojanized npm packages. NodeRabbit is cross-platform (Windows, Linux, macOS), uses AES-256-GCM-encrypted C2 on Azure, includes sandbox checks, and one variant installs a fake 'GitHub Copilot Helper' VS Code extension plus Git hook persistence. Victims identified so far are in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan.

Security Affairs·Sep 2, 10:37 UTC · 15d agoThreat actor in the wild2

Data from drones in Ukraine is fueling a new Wild West marketplace

Ukraine's defense ministry opened millions of battlefield drone data points to over 100 companies, fueling a fast-growing AI training data marketplace.

Ukraine's Ministry of Defense announced in January it would make millions of data points from tens of thousands of drone flights available to military contractors and commercial companies, with more than 100 companies and the UK government gaining access. Enabled Intelligence says it has processed over 500,000 hours of Ukrainian drone footage for use in future AI training. The article argues this creates a commercial battlefield-data marketplace with risks including lost training-data provenance, an extractive economy benefiting wealthier countries, and a governance vacuum requiring international rules.

MIT Technology Review · AI·Sep 4, 09:25 UTC · 13d agoAI industry1

Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

Check Point details an Operation Dream Job wave using trojanized PDF viewers to hit defense, aerospace, and aviation targets since early 2026.

Since early 2026, Check Point Research has tracked a wave of the Operation Dream Job campaign primarily targeting the global defense sector, with emphasis on aerospace and aviation companies. The threat actor distributes modified PDF viewers that execute malicious payloads embedded in specially crafted files, delivered under fake job-offer pretexts. Check Point characterizes the operation as a zero-day attack.

Check Point Research·Aug 11, 17:30 UTC · Aug 11, 2026Threat actor in the wild

Batten the Hatches: Cybersecurity with Military Mariners

Interviews with 20 U.S. Navy and Coast Guard mariners reveal informal, safety-oriented shipboard cyber risk models that may delay attribution and containment.

The study conducts semi-structured interviews with 20 military mariners from U.S. Navy and Coast Guard vessels to understand how service members recognize and respond to cyber risk aboard ships. Unique consequences of compromising military systems identified include weapon takeover and purposeful geopolitical escalation. Cybersecurity is organizationally abstract on ships, so mariners build cyber risk models from informal experience rather than formal instruction. A safety-oriented incident-response model creates resilience but may delay cyber attribution and containment.

arXiv cs.CR·Sep 11, 13:04 UTC · 6d agoResearch

Delta investigates in-flight Wi-Fi spoofing on post

A passenger on Delta flight 591 allegedly spoofed the airline's in-flight Wi-Fi with a rogue access point, prompting an FBI and FAA investigation.

Delta Airlines is investigating an incident on flight 591 from Las Vegas to Atlanta in which a passenger reportedly created a rogue Wi-Fi network named 'Delta WiFi Fast' to steal sensitive passenger data. The cabin crew deactivated the aircraft's Wi-Fi for roughly 30 minutes, and Delta says flight safety and aircraft operating systems were never affected. The FBI's Atlanta office and the FAA acknowledged awareness of the incident, which bears hallmarks of an evil twin attack involving spoofed login portals and credential harvesting. DEF CON organizers said this year's conference in Las Vegas also suffered multiple similar deauthentication Wi-Fi attacks.

CyberScoop·Aug 11, 21:35 UTC · Aug 11, 2026Phishing & fraud in the wild

Houthis Used Claude Code to Develop Missile Guidance Software: Anthropic

Anthropic's threat report details a Houthi-linked Yemeni cell using parallel Claude Code sessions to build missile guidance software, evading safeguards by fragmenting tasks.

Anthropic's September threat report describes a Yemen-based cell, assessed as highly likely Houthi-linked, that used Claude Code across multiple parallel instances to develop guidance software for a tactical guided rocket, a ballistic missile with over 2,000 km range, and a hypersonic glide vehicle concept called 'R2000'. The operators integrated open-source autopilot software, built six-degree-of-freedom trajectory simulations, and used reinforcement learning to tune flight-control algorithms, ultimately compiling an offline executable. The group test-fired a guided rocket that failed, then used Claude within hours to analyze launch telemetry. Anthropic blocked numerous requests, but operators evaded safeguards by obscuring intent and dividing work across separate conversations before accounts were banned; the case is one of six conventional-weapons cases (three China-linked, two Russia-linked) in a report covering disrupted operations from December 2025 to August 2026.

Hacker News · AI·Sep 13, 14:15 UTC · 3d agoAI safety & securityHN 47↑ · 38 comments1

Manchester Airports Group breached, millions of customers’ data stolen

Manchester Airports Group confirmed attackers stole customer booking and WiFi signup data affecting about 8.7 million customers across three UK airports.

Manchester Airports Group (MAG) confirmed an unauthorized third party obtained customer data tied to car park, lounge and Fast Track bookings and WiFi sign-ups at Manchester, Stansted and East Midlands airports. Stolen data includes email addresses, phone numbers, vehicle registrations and postcodes; no payment or banking details were held in the affected systems. UK media reported roughly 8.7 million customers affected. The Manage My Booking portal was disabled as a precaution, authorities were informed, and airport operations were not disrupted.

Help Net Security·Aug 31, 05:28 UTC · 17d agoData breach in the wild

Large Language Models for HVAC Operations in Building Energy Systems: A Critical Review of Methods, Applications, and Deployment Readiness

Systematic review of 66 studies finds LLMs for HVAC operations are mostly research-stage, with no ready-now deployment and only four pilot-level studies.

A critical review of 66 peer-reviewed studies from 2023 to March 2026 examines LLMs for HVAC operations in building energy systems. Only four studies reach pilot-level evidence, none reports sustained operational deployment, and 63 of 66 are research-only. Conventional ML, MPC, and RL remain dominant for high-frequency control and short-horizon forecasting, and the evidence supports LLMs primarily as semantic and workflow layers rather than autonomous controllers.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:08 UTC · 12d agoAI research

Panic builds over bankrupt Spirit’s looming data sale to Google

Startups object to Google's bankruptcy-auction purchase of Spirit Airlines operational data, claiming proprietary IP is being sold without consent.

Google won an auction to acquire a large enterprise dataset from bankrupt Spirit Airlines, which it says will help improve its products and AI models, with no personal information included. Springshot, whose airline logistics platform powered Spirit's stack, filed a limited objection arguing the vaguely defined data categories could transfer third-party IP and trade secrets it owns; International Aero Engines filed a similar objection. The EFF called it the first public bankruptcy proceeding over selling company and employee data as an asset, and objectors warn of a precedent letting large companies acquire startup IP through bankruptcy courts.

Ars Technica · AI·Sep 10, 18:14 UTC · 6d agoAI industry

31st August – Threat Intelligence Report

Manchester Airports Group disclosed a cyberattack exposing contact details of about 8.7 million customers across Manchester, Stansted, and East Midlands airports.

Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, disclosed a cyberattack that exposed data belonging to roughly 8.7 million customers. Check Point's weekly threat intelligence bulletin reports the compromised information includes contact details. The disclosure appeared in Check Point's 31 August Threat Intelligence Report covering the week's top attacks and breaches.

Check Point Research·Aug 31, 12:58 UTC · 17d agoData breach in the wild

Extortion Group FulcrumSec Claims 86GB Manchester Airports Data Theft

Extortion group FulcrumSec claims stealing 86GB of Manchester Airports Group data, exposing 8.7 million customers' personal and booking details.

Manchester Airports Group disclosed a breach on August 27 affecting parking, lounge, Fast Track and WiFi registrations at Manchester, London Stansted and East Midlands airports, impacting 8.7 million customers, most exposed only email addresses. FulcrumSec claims it stole about 86GB via airport-specific Iterable API credentials exposed in client-side JavaScript, including a 21.5GB Manchester export with booking histories, marketing data and nearly 200,000 records on upcoming 2026 travel. BleepingComputer verified sample records against a real traveler's Fast Track history; MAG declined to address the group's specific claims. Researchers warn the combination of UK postcodes, vehicle registrations and booking details could enable convincing targeted phishing, and MAG says no payment card or banking data was exposed.

Security Affairs·Aug 30, 17:23 UTC · 17d agoData breach in the wild

U.S. Defense Manufacturer IEH Hit by Phishing Attack, Exposing Potentially Export

Security Affairs·Aug 9, 16:44 UTC · Aug 9, 2026Phishing & fraud

Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.

On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.

Risky Business News·Sep 2, 02:55 UTC · 15d agoData breach in the wild1

Cybercrooks jet off with Manchester Airports Group customer data

Manchester Airports Group says cybercriminals took customer data affecting an estimated 8.7 million customers at the UK's largest airport operator.

The Register reports that Manchester Airports Group, the UK's largest airport operator, believes approximately 8.7 million customers were affected by a cyber incident. The attackers are described as cybercriminals, with data tied to bookings and Wi-Fi registrations at Manchester, Stansted and East Midlands airports. This report adds a scale estimate to the group's breach disclosure.

The Register · Security·Aug 27, 12:52 UTC · 21d agoData breach in the wild

Building AI to accelerate science and improve lives

Google highlights AI-for-science advances: AlphaGenome Atlas mapping 9 billion genetic variants, WeatherNext 3 weather model, and global health AI tools.

Google detailed AI advances across science and health, including AlphaGenome Atlas, which mapped all 9 billion possible single-letter genetic changes in the human genome and was made openly available. WeatherNext 3 delivers 50% more accurate precipitation forecasts a day or more ahead and is already in products. AlphaFold is used by 4 million researchers in 190 countries, TB chest X-ray screening has processed 25,000+ scans across six nations, and the diabetic retinopathy model has supported 1.15 million screenings. Google also released its AI & Economy ATLAS global usage insights.

Google · AI·Sep 15, 16:00 UTC · 1d agoAI industry

Multi-Agent Reinforcement Learning for Autonomous UAV Exploration in Wildfire Response

Researchers trained multi-agent deep reinforcement learning UAV agents for autonomous wildfire monitoring, with converging policies tracking fire boundaries in simulation.

The study develops a deep reinforcement learning framework for training UAV agents to navigate and monitor simulated wildfire environments. Agents showed increasingly stable and effective behavior over time, evidenced by converging loss trends, improved rewards, and consistent navigation patterns such as fire-boundary tracking. The findings highlight DRL-based UAV potential for autonomous wildfire monitoring and show that environmental structure and reward design influence policy effectiveness.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:45 UTC · 7d agoAI research1

First Galileo SAS Authenticated Time Solution

Researchers demonstrate the first timing solution computed from Galileo's new Signal Authentication Service, protecting receivers against GNSS spoofing.

Galileo's new Signal Authentication Service (SAS) on the E6-C signal directly authenticates ranging measurements, closing a gap left by OSNMA, which only protects navigation data. Researchers built a snapshot software receiver implementing a simplified SAS protocol and computed an authenticated receiver clock bias from recordings of both SAS-capable satellites, collected with a Septentrio SDR prototype. The results demonstrate feasible authenticated timing ahead of full SAS operational deployment.

arXiv cs.CR·Sep 14, 16:26 UTC · 2d agoResearch

Users in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic Says

Anthropic says Claude users in Houthi-held northern Yemen attempted hypersonic missile and guidance software development; accounts were blocked, no operational weapon fielded.

Anthropic's third misuse report since March 2025, covering December through August, says users in northern Yemen ran three weapons programs, including a multi-variant hypersonic glide missile and a warhead maneuvered mid-course with mobile phone hardware. The users used Claude Code instead of human engineers to develop guidance, navigation and control software, conducted one failed guided rocket test, and built an offline simulation toolkit before Anthropic banned the accounts. Houthis denied relying on open sources for weapons development, and analysts noted they lack the industrial capacity to actually build hypersonic missiles.

SecurityWeek·Sep 12, 01:50 UTC · 5d agoAI safety & security

Cyberattack on Manchester Airports Group exposes data of 8.7 million customers

Manchester Airports Group reported a cyberattack exposing booking data of about 8.7 million customers across three English airports.

Manchester Airports Group (MAG), operator of Manchester, London Stansted, and East Midlands airports, disclosed that an unauthorized third party accessed customer data linked to car park, lounge, Fast Track bookings, and Wi-Fi sign-ups. The compromised data includes email addresses, phone numbers, vehicle registrations, and postcodes; no payment or banking details were exposed. The airports handled over 65 million passengers last year, and MAG has suspended its online Manage My Booking service as a precaution. MAG warned affected customers to watch for phishing attempts.

The Record·Aug 27, 13:18 UTC · 21d agoData breach

Manchester Airports Group Hit by Cyber Incident

Manchester Airports Group disclosed that an unauthorized third party accessed customer data from bookings and airport Wi-Fi registrations.

Manchester Airports Group, which operates Manchester, Stansted and East Midlands airports, reported a cyber incident in which an unauthorized third party accessed customer data. Affected data is linked to bookings and airport Wi-Fi registrations. The number of affected customers was not stated in this report.

Infosecurity Magazine·Aug 27, 13:00 UTC · 21d agoData breach in the wild

Crooks Behind Manchester Airports Group Hack Leaked Data of 8.8 Million People

FulcrumSec leaked about 550 GB of Manchester Airports Group data, exposing emails, phones and vehicle registrations of roughly 8.8 million people after a refused ransom.

Manchester Airports Group, operator of Manchester, London Stansted and East Midlands airports, confirmed a breach of a third-party database after extortion group FulcrumSec leaked roughly 550 GB of data. The exposed data includes about 8.8 million email addresses and phone numbers, 108,077 vehicle registration plates, 2.48 million purchases and 1.16 billion email events, with no payment-card data accessed. FulcrumSec claims it gained access using Iterable admin keys hardcoded in the frontend JavaScript of all three airport websites, a claim MAG has not confirmed. Have I Been Pwned added the incident to its breach database.

Security Affairs·Sep 4, 19:37 UTC · 12d agoData breach

AI for Military Support

Study of 2,015 Israeli military personnel found algorithmic aversion toward AI targeting decision support, reduced when explainable AI features were added.

The paper 'Black Box Warfare' reconstructed a real-world military AI decision-support system used in targeting and tested a high-fidelity replica in two experiments with 2,015 Israeli military personnel. Contrary to automation-bias fears, participants showed strong algorithmic aversion, especially in high-collateral-damage scenarios. Integrating explainable AI features reduced aversion and promoted more thoughtful evaluation of algorithmic recommendations. The authors conclude that trust in military AI is dynamic and that human agency remains central in high-stakes decisions.

Schneier on Security·Aug 11, 11:18 UTC · Aug 11, 2026AI research

Cybersecurity jobs available right now: March 31, 2026

Help Net Security's job roundup lists cybersecurity vacancies worldwide, from malware research director to SOC, IAM, and GRC roles, mostly already closed.

The roundup aggregates cybersecurity openings across Israel, Ireland, India, the UK, Australia, France, Germany, Canada, the US and the UAE. Roles include Android malware research director, cloud security engineer, IAM analyst, SOC lead, GRC specialist, and vulnerability management positions at employers such as Iceland Foods, Pernod Ricard, A10 Networks, and TOMRA. Most listings were marked as no longer accepting applications at publication.

Help Net Security·Aug 28, 09:05 UTC · 20d agoIndustry

China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure—Is the US Ready?

WIRED examines Volt Typhoon pre-positioning 'digital bombs' in US civilian infrastructure via a war game simulation discussion.

WIRED's Uncanny Valley podcast features reporter Andy Greenberg discussing a war game simulating a cyberattack by Chinese hacking group Volt Typhoon. The episode examines Volt Typhoon's practice of planting persistent access in US civilian infrastructure that could be activated during conflict, and questions whether the US is prepared.

WIRED · Security·Aug 20, 20:03 UTC · 27d agoThreat actor

Bidding war for defunct Spirit Airlines’ employee data will not die

AI firm Micro1 bid $12.5 million for Spirit Airlines' 600 million employee email and chat records, challenging Google's $10 million auction win.

After Spirit Airlines entered bankruptcy, Google won an auction for the airline's data trove with a $10 million bid, beating Mercor's $7.5 million offer, but Micro1 has now counter-offered $12.5 million. The data includes about 600 million email and chat records from 17,000 employees, 17 million OneDrive files, 20.5 million SharePoint items, and over 30 million customer service calls, valuable for AI training. Former employees' unions, including the Association of Flight Attendants-CWA representing 5,500 flight attendants, have taken legal action to block the sale over privacy concerns.

CSO Online·Sep 4, 13:29 UTC · 13d agoAI industry

The world must establish red lines for autonomous AI weapons

Opinion piece calls for international red lines on autonomous AI weapons after a Russian AI-guided drone autonomously killed three civilians in Zaporizhzhia.

The author urges enforceable international agreements governing autonomous weapon systems, citing a July 2026 incident where a Russian drone struck a gas station in Zaporizhzhia, killing three Ukrainian civilians. Ukrainian investigators found the drone carried an Nvidia Jetson Orin chip, and the onboard AI reportedly selected the specific target without a human making the final decision. The piece argues existing international humanitarian law lacks specific standards for weapons that independently select and engage targets, and points to UN and ICRC deliberations plus the Global Council for Responsible AI's red-line framework.

Help Net Security·04:00 UTC · 10h agoAI policy

Iran-Linked Hackers Use Fake LinkedIn Job Offers to Deploy NodeRabbit and PollCat RATs

Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.

Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.

GBHackers·Sep 9, 12:52 UTC · 8d agoThreat actor in the wild1

Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data

Exposed Vietnam-linked APIS database held 220.8 million passenger and crew records with passport and flight data from January 2017 to April 2026.

Kinryū Labs discovered an exposed Elasticsearch cluster named 'pax-info' containing 220.8 million passenger and crew records, about 107 GB across 29 indices, hosted on IP space assigned to Viettel in Hanoi. The records include names, birth dates, nationalities, passport numbers, and detailed flight information from airlines across Asia-Pacific, Europe and the Middle East. Researchers reported the exposure on June 3 and the database was secured by June 8 with Singapore Airlines coordinating; no evidence of theft was found, but missing server logs mean access cannot be ruled out.

Security Affairs·Sep 8, 11:01 UTC · 9d agoData breach

New CISO appointments 2026

Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.

CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.

CSO Online·Sep 7, 10:09 UTC · 10d agoIndustry1