An attacker who gained access to Keystone’s website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26.
Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve
Source: The Hacker News · 2026-10-27
Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations.
Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain
Source: The Hacker News · 2026-10-27
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.
According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It’s assessed to pick up
Source: The Hacker News · 2026-10-27
Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”
Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
Source: Schneier on Security · 2026-10-27
Hackers have stolen personal information on over 520,000 people from the University of Copenhagen
Source: Infosecurity Magazine · 2026-10-27
A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent.
The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room.
The software logged events such as dogs barking and babies crying, log4j said, adding that these events are counted and reported back to Samsung.
Samsung advertises similar features on some of its AI-enabled TVs. The company says its Pet Care and Family Care features use on-device AI to detect a dog barking or a baby crying and alert users. This doesn’t confirm log4j’s claims about the package or the data it reports.
However, log4j says that on TVs without microphones, the software searches for connected devices such as soundbars or Bluetooth microphones and uses those to listen instead.
The TV was also collecting geolocation data and mapping local networks, they said, adding that it ran a service on the TV that analyzes traffic on the local network.
log4j also says that the system uses a neural network tailored to a particular region to analyze your viewing habits. A neural network is a type of machine-learning model. log4j said:
“…in youtube it’s looking for videos you watch, ads you skip, progress in a video, etc.”
While log4j’s claims haven’t been independently verified, Samsung has used automatic content recognition (ACR), a system that identifies what’s on screen. Earlier this year, Texas Attorney General Ken Paxton settled with Samsung, getting the company to agree that it would get Texans’ express consent before collecting or processing ACR viewing data.
A class action complaint filed in New York in January also accused Samsung of using ACR to record video and audio passing through the TV. The complaint accused Samsung of using machine-learning algorithms to analyze and link this data back to consumers. This includes information displayed when the TV is used as a computer monitor, it said, adding that the information can be linked to different people using the TV. The case was voluntarily dismissed in July.
The New York complaint added:
“Samsung exploits this Sensitive Information by (a) selling targeted advertisements to its corporate advertising clients, and (b) providing it to third-party advertising companies such as Google and X (f/k/a Twitter) for targeted advertising.”
A separate class action complaint filed in California this month accuses Samsung Electronics America of not being transparent about its ACR data collection.
This isn’t the first time that Samsung has been criticized for allegedly picking up in-room audio. In 2015, privacy group EPIC filed a complaint with the FTC, accusing Samsung of recording conversations and relaying them elsewhere. The nonprofit said at the time:
“Everything a user says in front of the Samsung SmartTV is recorded and transmitted over the internet to a third party regardless of whether it is related to the provision of the service.”
EPIC identified text-to-speech company Nuance as the third party.
We can’t confirm all of log4j’s allegations, and Samsung doesn’t appear to have commented. But there have been multiple complaints about the data smart TVs collect. You can turn off features such as ACR, internet-based advertising, and voice recognition where possible.
log4j has also raised concerns about whether monitoring services are truly off. They said:
“ACR off via your preferences menu on samsung TVs should not be assumed to actually disable ACR telemetry.
i’ve found several instances where the checks (whether deliberate or not) are either incorrectly implemented or not checked at all.”
log4j says disconnecting your TV from Wi-Fi is the best option for immediate peace of mind, though that also means losing internet-based TV features. They also suggest using an Apple TV or a modifiable Android TV box with open-source software.
What do cybercriminals know about you?
Use Malwarebytes’ free Digital Footprint scan to see whether your personal information has been exposed online.
Source: Malwarebytes Labs · 2026-10-27
ISC2 is seeking 3000 volunteers to enrol to a pilot exam phase for its upcoming AI security certification
Source: Infosecurity Magazine · 2026-10-27
What does it mean to be “blue collar” for the blue team? Amy sat down with security researcher Ryan Fetterman to discuss his journey from federal agency work to his new role at Talos. He shares the realities of detection engineering — including the creative, often frustrating ways attackers evolve their tactics to stay one step ahead of traditional defenses.
Beyond the technical grind, Ryan shares his philosophy on building a career in security without burning out. From the value of project-based learning to the importance of finding time to step away from the keyboard, here’s Ryan’s take on what it really means to navigate today’s cybersecurity industry.
Amy Ciminnisi: Tell me a little bit about the journey that has taken you to Talos, from early on in your career through to now. How did you get here? I actually don’t know that much about it.
Ryan Fetterman: I’ve been doing security about 15 years now, and my career was largely shaped by where I started in the DC area. I spent about a decade there. I started out in consulting and then pivoted over to research, but that was a great place to get started.
I got a lot of great experience in federal agencies and government consulting, continued my education down there, got trained up, got certifications and things like that. And that was where I got my first exposure to doing actual security operations, which is what I really stuck with. It was my first exposure to Splunk.
Querying lots of log data and building visualizations and analytics in Splunk was the first time in my career that I felt it was kind of my natural inclination. It seems like it should have been more obvious to me looking back on it, but it’s something that I try to explain to people a lot. When you first get into security, there’s a desire to kind of find your specialization and start working towards it. But in my experience, it’s just not something that you can rush.
I met the people connected with that space, which eventually led to me going to work for Splunk. I worked on the Splunk research team, SURGe. And then after the Cisco acquisition of Splunk, I ultimately became reorganized into Talos.
AC: I’m sure there have been so many challenges, so many obstacles in your way as you’re trying to do this research. Can you share one that you’ve faced and how it shaped your perspective on cybersecurity?
RF: Something that stuck with me was actually my first advanced persistent threat (APT) incident. Now, you can look this up. It’s called Pandora Song if you search for the C2. I was in the DC area working in a federal SOC, and I was doing some of the first host-based analytics at the time, which have now become kind of the concentration of a lot of detection. Engineering and analytics are host-based, so this was kind of pioneering at the time.
I was looking at a lot of host-based sensors and writing analytics in Splunk, actually, and we had been tipped off to this incident by a third party. I was looking through the details of the incident and how the attacker was carrying out the progression of their attack…
Want to see more? Watch the full interview, and don’t forget to subscribe to our YouTube channel for future episodes of Humans of Talos.
Source: Cisco Talos Intelligence · 2026-10-27
UK police forces and fire and rescue services have been urged to strengthen cybersecurity as rising cyber threats outpace current defenses
Source: Infosecurity Magazine · 2026-10-27
In June 2023, staff at an Oklahoma regulatory agency were fed up. The state isn’t known for cracking down on oil and gas companies for polluting the environment, but for over a year, the staff had been building a case to punish Citation Oil & Gas, one of the nation’s largest privately owned oil companies.
About 30 miles north of the Texas border, toxic wastewater was gushing from the ground outside the small city of Ardmore. In the mile-wide oil field known as the Bayou, an oily sheen glistened on creeks and long streaks of salt scarred the land. The so-called purges, bubbling up among stands of oak and walnut trees, also threatened drinking water sources, drawing attention from the Environmental Protection Agency, according to a federal report.
State investigators pinned the blame on Citation’s injection wells, which pump wastewater from oil production back underground at high pressures and volumes in order to produce more oil. But this injection came with risks.
Days earlier, the agency had asked Citation to cut injection pressures in half. The company refused, prompting staff at the oil division of the Oklahoma Corporation Commission, the state’s oil and gas regulator, to recommend an official punishment through the agency’s court system.
“This will be an important case to get some of these purges stopped and particularly concerning Citation’s operations,” Danny Ray, an agency manager at the time, emailed his colleagues.
He restated the urgency three days later in an email to oil division leaders and Citation officials: “We consider this an emergency situation that needs to be addressed promptly.”
To stop the flow of wastewater, the agency temporarily shut down the Bayou’s 22 injection wells — all but three of which were owned by Citation — kicking off a yearlong fight over the terms under which injection could restart.
Under state rules, companies must not pollute, and oil and gas regulators at the Corporation Commission can revoke injection permits and issue fines to those that violate regulations.
But agency leadership ultimately did not follow staff guidance to punish Citation through the commission’s administrative law court. Instead, in April 2024, state officials, including the oil division’s then-Director Robyn Strickland, would allow Citation to restart injection at higher-than-recommended pressures.
Agency leaders’ reluctance to punish Citation reflects a longstanding pattern of Oklahoma regulators letting oil companies contaminate drinking water, farmland and people’s homes with scant consequences, The Frontier and ProPublica have found in a yearlong investigation.
In fact the commission has no record of ever fining or completing an enforcement case against Citation, the company named more than any other in the agency’s database of pollution reports and other rule violations, listed more than 1,000 times over the past decade. That’s hundreds more incidents than any other operator, including comparably sized companies. In recent years, purges linked to Citation include some of Oklahoma’s longest, most damaging oil field pollution events.
Current and former employees at the Oklahoma Corporation Commission describe top agency officials as wary of going after habitual violators like Citation. Citation has become Oklahoma’s second-largest well owner after taking over collections of aging, low-producing wells from oil giants that have largely left the state for more lucrative oil fields in Texas and elsewhere; the company acquired its Bayou wells in 2010. Regulators treat Citation gently, current and former agency employees say, because the company holds onto aging wells that are worth little — wells that could easily become a financial liability for the state if Citation were to sell or walk away from them.
A spokesperson for the Oklahoma Corporation Commission declined to answer questions about the regulatory agency’s handling of Citation’s record, noting the possibility of future enforcement actions or litigation involving the company.
“The OCC Oil and Gas Conservation Division must remain mindful of its regulatory and adjudicatory responsibilities and avoid making public statements that could potentially affect future proceedings or legal considerations,” spokesperson Jack Damrill said in an email.
Strickland has since left the agency for a job as chief projects officer for the Interstate Oil and Gas Compact Commission, a quasi-governmental organization that often advocates for industry interests. She did not respond to requests for comment.
A Citation executive declined to comment in response to written questions.
Regulators in other jurisdictions have at times come down hard on Citation, which owns wells in 11 other states. In 2017, the company settled with the U.S. Department of Justice for $2.25 million over allegations of underpaid royalties from drilling on federal land in Wyoming, though the settlement did not rule that the company was liable in the case. And in 2025, Utah reached a $700,000 settlement with the company after a crude oil and wastewater spill. Texas and Colorado have also fined Citation in recent years for violations.
“Citation has been the thorn in my side for a long time,” said a current manager at the Oklahoma agency who spoke on the condition of anonymity to protect their job. “They just operate however they want. They’ve had major pollution issues, and you can’t really touch them.”
In November 2023, five months into the wells’ shutdown, Citation was getting antsy. Its officials had repeatedly demanded permission to restart their wells and had even challenged the state through the commission’s court to prove the connection between the Bayou purges and its operations. Regulators and company officials packed into a small conference room in the Oklahoma Corporation Commission’s Oklahoma City headquarters to discuss how that might happen. More than a dozen others joined via video.
On the state’s side, a team of consultants took the lead, displaying a report with evidence that tied Citation’s injection to the wastewater that gushed to the surface in the Bayou. The state had hired the environmental engineering firm Halff earlier that year on a $550,000 contract to investigate the fast-growing number of oil field wastewater eruptions around Oklahoma. The consultants and agency staff presented a unified front in identifying the problem: Citation’s nearly two dozen Bayou injection wells were operating at unsafely high pressures, according to a video recording of the meeting obtained by The Frontier and ProPublica. Over the years, the injected wastewater had shattered underground rock layers, allowing the toxic fluid to spread uncontrollably.
“You definitely have overpressurization,” Carolyn May, Halff’s director of environmental remediation, told Citation officials as she presented her team’s calculations, which were based on well records, field data collected by agency staff and a standard set by the federal government. “It’s allowing that rock to fracture.”
The consultants were meant to serve as independent experts to mediate any disagreements within the agency over what to do about the wastewater eruptions, according to current and former commission officials.
In the meeting, May and agency staffers ticked off a number of problems with Citation’s wells that regulators had overlooked for years. Not only had they allowed the company to inject wastewater at excessive pressures, regulators had also given out more than a dozen exemptions to testing and well-construction standards that endangered groundwater. Several wells had checkered compliance records; agency documents noted that one had been in “perpetual violation” of its permit for “nine years running,” injecting tens of millions of gallons of wastewater beyond the legal limit.
Citation’s active wells weren’t the only issue, they said. Nearby were dozens of abandoned, unplugged wells that offered the pressurized wastewater open pathways to reach shallow freshwater sources and the surface. May singled out a handful of those wells that especially troubled her team, and oil division deputy director Mike McGinnis suggested that Citation permanently plug them.
May noted that imaging below the surface by agency staff showed a distinct plume of highly polluted wastewater rising from deep underground, where injection took place. This posed a threat to the freshwater sources beneath the Bayou, she said — water that some residents rely on for drinking and cooking. “That’s our primary concern here.”
The consultants were not alone in this fear. Earlier in 2023, the Environmental Protection Agency had warned of “potential endangerment to underground sources of drinking water” in the Bayou from oil field injection. Groundwater tests taken near the purge sites showed evidence of oil field wastewater pollution, including high levels of salt, bromide and the carcinogen benzene, which exceeded the EPA drinking water standard by five times.
For its part, Citation came to the meeting armed with a very different argument: the pollution was caused by a combination of historic oil drilling and recent rainfall — not by the company.
It was a claim the company had repeatedly made, especially in the months since the agency had shut down its wells. To bolster its case, the company’s consultants had produced a series of detailed reports citing the area’s history of oil production, along with Citation’s own water testing data. Oil drilling began in the Bayou in the 1920s, a time of lawless extraction, and for decades, companies would simply dump their wastewater into large, unlined pits, allowing the fluid to seep into the ground. Old pollution that saturated the land was being flushed to the surface by rainfall, the reports argued. Each one concluded that there was no link between Citation’s injection and the Bayou pollution.
At the meeting with regulators, company representatives reiterated these arguments. Jeff Lewis, a Citation engineering manager, assured the agency that the company’s data indicated that its wells were not behind the Bayou purges and that it could safely inject at pressures higher than Halff had recommended. He proposed that the company restart injection on its deeper wells because they were separated by layers of rock from the abandoned wells that Halff identified as likely pathways for the wastewater to surface.
Agency staff did not buy this. In prior internal meetings and emails, staff and consultants had criticized Citation’s water sampling practices as biased in favor of the company’s conclusion that rainfall was causing old pollution to resurface. There was no question that old pollution covered the Bayou, but in recent purges, wastewater had pushed to the surface in significant volumes, covering creek beds in layers of snow-white salt. Old pollution would not be this forceful, according to internal documents written by agency staff.
“A purge is created by pressure and is not due to old pits,” Ray, the agency manager, wrote in a memo distributed months earlier within the oil division that urged agency leaders not to allow Citation to restart injection.
May, the agency’s consultant, echoed these rebuttals during the meeting and said the state’s evidence pointed to an injection problem. She concluded her presentation with a warning: Citation must change its injection practices in the Bayou.
“If y’all want to start injecting again,” she told company representatives, “I think we’re going to have to look at those pressures and the volumes very carefully.”
The meeting ended without a resolution.
Over the next four months, Citation and state regulators would continue to debate the terms of restarting the Bayou. Neither side budged. By the time they gathered for another face-off in March 2024, oil division leaders appeared weary of fighting.
May and the Halff geologists from the consulting firm began by again insisting that Citation substantially reduce pressures in order to be allowed to restart a handful of wells. But even as they presented their case, Citation representatives including Lewis, the engineer, and Bob Redweik, a company vice president, repeatedly spoke over them. After more than two hours of disagreement, Redweik and Citation’s attorney ended the meeting abruptly. “We’re not going anywhere,” Redweik said.
Several top oil division officials attended, including Strickland, McGinnis and commission attorney Tyler Trout. They remained largely silent throughout.
The next week, Trout tried to end the impasse by passing along a memo from Citation.
“In an effort to reach an agreement and move this situation forward,” Trout wrote to top oil division officials and May, “would we consider meeting Citation in the middle as far as recommended injection pressures are concerned?”
May stood firm. “From Halff’s standpoint, our recommendations aren’t going to change,” she responded, adding that it would ultimately be up to agency leaders.
In early April, the agency went with a compromise, approving a plan to bring seven of Citation’s 19 Bayou injection wells back online. The company would be able to inject at pressures higher than Halff had recommended, though less than Citation had requested.
Current and former employees say that the decision to restart injection came from the top of the oil division, including Strickland and McGinnis, among others — bypassing staff who objected to the plan. Like Strickland, McGinnis did not respond to requests for comment.
“They wore us out,” said an agency manager who spoke on the condition of anonymity to protect their job.
Before injection restarted, three oil division officials chosen by Strickland conducted a walkthrough of the Bayou with Halff and Citation, according to an email from Strickland. The rest of the division was left in the dark. That same day, a pollution abatement manager noted in an email to the commission’s general counsel that agency critics of the plan had not been invited.
Around the time agency leaders allowed Citation to restart injection in the Bayou, staff were drafting an extensive contempt case against the company for rule violations in other parts of the state, according to public records obtained by The Frontier and ProPublica. Field staff and consultants were still turning up considerable problems related to Citation’s injection, including excessive pressures at the sites of destructive eruptions of wastewater. The staff complaint called for the agency to issue fines and to terminate well permits. But oil division leaders never signed the paperwork for the case.
There was ongoing trouble in the Bayou as well. Weeks after Citation restarted injection, field staff discovered a “severely contaminated” private water well nearby that had been polluted by oil field waste. Testing showed high levels of salt as well as the “highest levels of bromide that we have ever sampled,” according to internal emails, referring to another chemical constituent of oil and gas waste that poses a public health risk. (The landowners declined to comment because of an ongoing lawsuit against Citation, but according to court records, they do not drink from the well. The company, which has fought the family’s claims, says in a court filing that it has spent hundreds of thousands of dollars addressing the pollution on their land as part of a plan approved by the commission.)
By the end of 2024, oil division leaders had allowed six more Citation wells back online, bringing the total to 13. And the next spring, the agency closed the Bayou investigation, along with several others related to Citation, without taking further action.
In the year and a half since the Bayou case closed, several of the oil division staff who had pushed agency leaders to punish Citation have left the agency, as have a handful of senior leaders. Staffers told The Frontier and ProPublica they grew frustrated with the agency’s unwillingness to crack down on repeat corporate offenders that agency staff had spent months — at times, years — investigating.
Tracy Case, an attorney for the oil and gas division, admitted as much at a national conference for oil regulators in Oklahoma City in May. “I’ve been there 11 years doing this and we’ve never pursued what we call our ‘bad actors,’” she said, according to a recording of a meeting obtained by the news outlets. She explained that the oil division is extremely short-staffed while dealing with hundreds of potential enforcement cases at any one time. An agency spokesperson declined to comment on behalf of Case.
Less than a third of the roughly 750 enforcement cases filed by the oil division in the agency’s administrative law courts since 2023 have resulted in punishment so far, according to a review by The Frontier and ProPublica. The average fine given out by the agency was about $1,700. The most common punishment was a $500 fine, combined with using company insurance money to plug unused wells.
Neither the Oklahoma Corporation Commission nor Halff responded to questions about whether the consulting firm still has a role at the state agency.
At the Bayou, nearly all of Citation’s wastewater injection wells are back on, many operating at pressures beyond Halff’s recommendations. And industry data indicates that Citation has ramped up oil production to pre-shutdown levels even as evidence of new purges continues to emerge. In September, fresh layers of salt — residue of the wastewater — covered the dirt near yellowish puddles of standing water. Nearby, streaks of oil shone on the ground. The preceding weeks had been hot and dry, with hardly any rain.
In early October, an agency field staffer requested that Citation install a specialized well in the Bayou to pump out polluted groundwater, according to a report in the agency’s incident database.
A slew of new pollution complaints against Citation have continued to appear in that state database, including more than 60 spills and leaks at well sites over the past year. Among the complaints were three purges that blew out in southern Oklahoma over the last three months. All those investigations remain active, according to state records.
Another ongoing complaint against Citation originated about 10 miles east of the Bayou, where a rancher named Mike Faulkner noticed an unusual amount of salt water gurgling to the surface and flowing down a creek on his land in April. Nearby, dozens of Citation wells pump wastewater underground.
In response, Citation once again blamed the pollution on old drilling practices, according to an email from one of the company’s engineers to the Oklahoma Corporation Commission.
Nevertheless, the agency told the company to temporarily shut down some of its nearby injection wells, and, according to Faulkner, the purge on his land dried up for the first time in years.
“That tells me that they know the why and the how of that saltwater purging,” he said in July.
The agency also instructed Citation to install monitoring wells to test for pollution and to build a pit with a rock dam on Faulkner’s land to catch the polluted water, along with a fence to keep the cattle out.
But in the months since, the agency has given Citation multiple extensions on the deadline to build the dam and the fencing. In September, Faulkner learned that the agency granted Citation yet another extension — until December, seven months after his initial pollution report.
As of October, he said, the wells where the state had asked Citation to pause operations are injecting — at reduced pressure.
Faulkner said he is fed up with Citation’s yearslong pattern of degrading his pastures. But he blames state officials for their unwillingness to rein in the company.
“They’re like a spoiled kid,” he said. “They’ve just gotten away with it for a long time.”
Source: ProPublica · 2026-10-27