26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it.
Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28. Most were keys for cloud and AI services, led by
Source: The Hacker News · 2026-10-29
Akamai research reveals that scam detections topped six million in Q2 2026
Source: Infosecurity Magazine · 2026-10-29
Apple’s latest updates include a fix for a CoreGraphics bug that may have been exploited in targeted attacks. The fix is now available for older iPhones and iPads.
Apple released security updates on October 26. Apple first fixed the flaw in iOS 26.7.1. Its latest updates also bring the fix to older devices that can’t run iOS 26, including the iPhone XS, iPhone XS Max, iPhone XR, and seventh-generation iPad.
The iOS 18.7.11 update is a backport: it brings a fix from a newer software version to an older one. Here, Apple has made the fix available to older devices running iOS 18, so they can be protected without upgrading to an operating system they don’t support.
The table below shows which updates are available and links to Apple’s security information for each one.
| Name and information link | Available for |
| iOS 27.2 and iPadOS 27.2 | iPhone 11 and later, iPad Pro 12.9-inch 4th generation and later, iPad Pro 11-inch 2nd generation and later, iPad Air 4th generation and later, iPad 9th generation and later, and iPad mini 6th generation and later |
| iOS 26.7.2 and iPadOS 26.7.2 | iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later |
| iOS 18.7.11 and iPadOS 18.7.11 | iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation |
| macOS Golden Gate 27.2 | macOS Golden Gate |
| macOS Tahoe 26.7.2 | macOS Tahoe |
| macOS Sequoia 15.8.2 | macOS Sequoia |
| tvOS 27.2 | Apple TV 4K 2nd generation and later |
| watchOS 27.2 | Apple Watch Series 9 and later |
| visionOS 27.2 | Apple Vision Pro (all models) |
| Safari 27.2 | macOS Sequoia and macOS Tahoe |
| tvOS 26.6.1 (no published CVE entries) | Apple TV HD and Apple TV 4K 1st generation |
For iOS and iPadOS users, here’s how to check if you’re using the latest software version:
Go to Settings > General > Software Update. You will see if there are updates available and be guided through installing them.
Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.
To update macOS on any supported Mac, use the Software Update feature, which Apple designed to work consistently across all recent versions. Here are the steps:
Safari updates are included with macOS updates, so installing the latest version of macOS will also update Safari. To check manually:
The headline bug is CVE-2026-86950, in CoreGraphics, Apple’s framework for drawing graphics, images and PDF content. It’s an out-of-bounds write flaw, where software writes data outside the memory set aside for it. The result is that “processing a maliciously crafted file may lead to arbitrary code execution.”
Apple says it is aware of a report that the flaw may have been exploited in an “extremely sophisticated attack against specific targeted individuals” on versions of iOS before iOS 27.
That wording indicates Apple believes the bug was used in real attacks against a limited group of users.
Usually, journalists, activists and officials are the targets of this kind of attack. If you think you could be a target of highly sophisticated spyware, you should update, restart your phone, and consider applying Apple’s Lockdown Mode.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(–global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}
Source: Malwarebytes Labs · 2026-10-29
Cisco has released patches to address a high-severity security flaw in Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that it said has been exploited in the wild.
The vulnerability, tracked as CVE-2026-76418, is rated 8.6 on the CVSS scoring system. Successful exploitation could allow an unauthenticated, remote attacker to cause the
Source: The Hacker News · 2026-10-29
Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid exploitation of software flaws the vendors didn’t know about yet. Black Lotus sent hundreds of victim notifications along the way, and the investigations that followed revealed the exploitation of at least four confirmed zero-days and one likely.
“Volt Typhoon’s Silent Train is a covert network designed to gain and maintain access to the technologies businesses rely on to manage devices, networks and critical operations.” reads the report published by Lumen. “Black Lotus Labs® tracked how the group used rapidly changing chains of compromised infrastructure to conceal its activity while exploiting previously unknown vulnerabilities in centralized management platforms.”
Silent Train first showed up in November 2023, shortly before the first takedown of the KV-botnet, Volt Typhoon’s earlier network of hijacked routers. Activity rose after the second disruption. The group dropped persistent infrastructure and moved to disposable chains of compromised devices that it could rebuild whenever it wanted.
Each session began on a rented server outside the United States. It then passed through another server and compromised small-office routers, home devices and IoT equipment in other countries. Finally, the traffic passed through a compromised device in the U.S., close to the target. This helped the attackers make their activity look like normal local traffic and bypass location-based blocks and IP reputation filters. On average, the chains passed through about four devices before reaching a U.S. IP address. Some used as many as six.
Lumen identified more than 27 types of devices used in the network, including TP-Link routers and Fortinet appliances. Some of these devices had no known vulnerabilities, suggesting that Volt Typhoon may have used previously unknown exploits to compromise them and create relay points.
“We observed more than 27 device classes exploited and used in Silent Train operations, ranging from SOHO and IoT devices like TP-Link routers and Netgear Orbi devices to enterprise platforms like Fortinet appliances and CyberPanel servers.” the report continues. “Some relay device types lack known vulnerabilities, suggesting Volt Typhoon leveraged undisclosed zero-day exploits to set up a single relay in a four-to-six hop chain and indicating a willingness to commit significant resources to protecting future access capabilities.”
The attackers exploited exposed web interfaces and installed only the tools needed to connect the devices through SSH. These included temporary SSH services, keys, configuration files and tools already available on the systems. At the end of each session, they removed all traces of their activity and dismantled the relay chain. Sessions lasted about four hours on average, although some lasted only minutes. The attackers could also build a new chain in less than two minutes, suggesting that they had partly automated the process.
The group worked with strict discipline. New device types arrived about one per quarter, and about one per month during the 2023 and 2024 build-out, always tested outside the U.S. first. Roles never changed: Intelbras modems served only as overseas relays, Netgear Orbi devices only as the U.S. hops facing victims, and the server providers stayed separated by layer too.
By early 2025, enterprise platforms like Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel joined as final hops. They stayed up one to three months and supported several intrusions. The group also added reverse tunnels using the open-source proxies Chisel and FRP, and the old and new methods ran in parallel.
Volt Typhoon used Silent Train only during key stages of its attacks, including exploiting vulnerabilities, stealing credentials and data, and maintaining access to compromised systems. Each session targeted between one and five victims, often just one organization. The activity was carried out by human operators, mainly from Monday to Friday, between 9 a.m. and 10 p.m. China Standard Time. The group also paused operations for several weeks around Chinese New Year.
The group targeted tools used to manage endpoints and networks, as well as SD-WAN systems and other control platforms. These systems can manage hundreds or thousands of devices, allowing attackers to reach many systems without moving through the network in the usual way. This approach also helped them leave fewer traces. After the attacks, investigators found webshells running in memory, stolen credentials, misuse of built-in features such as remote file transfers, and deleted logs.
The four confirmed zero-day campaigns hit Versa Director in 2024, N-able N-central through CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN through CVE-2026-20127, and VeloCloud Orchestrator through CVE-2026-16812. The Cisco bug is a CVSS 10.0 flaw, and the group kept exploiting it well after Cisco disclosed it in February 2026. In the Versa case, the group used an in-memory JAR webshell to limit forensic evidence and reach downstream customers.
The likely fifth is Quest KACE. The campaign hit more than 30 victims and faded after Quest’s October 2025 security updates.
“The campaign affected more than 30 victims, followed vendor remediation timelines and declined after Quest’s October 2025 security updates.” the report states. “Despite limited forensic evidence, the available data supports a moderate-confidence assessment that Volt Typhoon exploited a zero-day vulnerability.”
The actor stayed on the KACE server and used its admin features to take credentials.
Victims include telecoms, government agencies, defense contractors, satellite and emergency communications, universities with ROTC programs, managed service and IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail and aviation. What they share is access to bigger networks or customers. Hawaii, California and Texas were the top locations for several years. Lumen can’t say why, but the pattern fits pre-positioning for a crisis in the Indo-Pacific.
“For enterprise leaders, the lesson is clear: systems with broad administrative reach can become high-value gateways to the entire organization and its customers. Reducing internet exposure, accelerating patching, strengthening access controls and preserving security telemetry are essential to detecting threats earlier and limiting their impact.” Lumen concludes.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, China)
Source: Security Affairs · 2026-10-29
Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.
Source: WIRED Security · 2026-10-29
The UK’s privacy regulator has issued a reprimand to Staffordshire Police following a serious breach of personal information
Source: Infosecurity Magazine · 2026-10-29
GitHub has announced that it’s introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time.
“The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate,” GitHub said.
The feature, which currently supports only npm packages, is available in public preview
Source: The Hacker News · 2026-10-29
The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale — but with key security features turned off.
Source: Dark Reading · 2026-10-29
The artificial intelligence industry was poised to act as a kingmaker in the midterm elections.
Super PAC networks bankrolled with millions of dollars from Anthropic and OpenAI executives spent heavily in competitive primaries earlier this year, including a high-profile race in New York City. They were touted as the looming successor to another single-issue group, the American Israel Public Affairs Committee, as AIPAC moved its spending underground.
Yet as public outrage over data centers and AI’s threat to jobs soared, artificial intelligence super PACs dramatically throttled back spending on congressional races compared to the primaries. The biggest AI super PAC network has spent only modestly ahead of next week’s general election — and mostly in safe seats.
An Intercept analysis of AI spending in the 2026 midterms, based on Federal Election Commission records and independent race ratings, shows that only 5 percent of their direct expenditures have gone to contested general election races. The industry’s avoidance of the contested races that could determine control of the next Congress suggest that the PACs have realized how the public has soured on the tech, campaign finance and industry observers told The Intercept.
“Essentially these companies underestimated how much the public despises the data center buildout, and the inescapability of AI systems that no one asked for that say they will automate jobs and maybe kill us all,” said Rick Claypool, a research director for the president’s office at Public Citizen, a nonprofit campaign finance watchdog.
Although there is still time for a last-minute flurry of spending, the story of AI’s role in the 2026 midterm elections may turn out to be the story of a single race — a primary in New York — that forced the industry to step away from the limelight.
Claypool’s group released an analysis earlier this year of “corporate supremacist” super PACs, a new breed of campaign committees modeled on a crypto super PAC called Fairshake that spent tens of millions on the 2024 elections.
The model was to amass a massive war chest and use it to punish candidates who opposed the company’s preferred government regulations, while throwing cash at allies or potential allies from both parties.
The first big AI super PAC to launch in August 2025 was Leading the Future, which was bankrolled by the president of OpenAI and its investors. A rival super PAC network, Public First, launched months later with the goal of countering Leading the Future’s influence. Its donors include Anthropic CEO Dario Amodei, who gave $1 million. Anthropic has also given a nonprofit associated with Public First millions of dollars, while stipulating that the money cannot be used on elections. Public First says that it supports tighter regulations than its rival.
The two networks plowed $50.7 million into the primaries, campaign finance records show. Most of that money was spent on primary races where the outcome was in doubt, driven by an eye-popping $21.3 million the networks spent on supporting or opposing a single congressional candidate, Alex Bores, in the Democratic primary for New York’s 12th Congressional District.
Bores, a New York State Assembly member, attracted the ire of those in the industry who favor a laissez-faire approach by authoring an AI regulation bill in the state legislature.
Leading the Future succeeded in defeating Bores, who lost to his State Assembly colleague Micah Lasher in June. But the group drew intense blowback in the process. Many observers suggested Leading the Future’s spending had boosted Bores rather than hurt him, because it gave him a chance to position himself as a foe of the AI industry — while also benefiting from a PAC aligned with the Public First network.
“Down to the wire, they were sweating,” Bores told The Intercept, referring to Leading the Future. “I think people who have been in politics for a while will realize that their spending really served to elevate the issue of AI.”
Leading the Future did not respond to a request for comment.
After wading into contested primary elections, the two leading AI super PAC networks have held back from spending on competitive general elections — even though they have plenty of money in the bank.
Until a few days ago, Public First had spent nothing on general election races. Leading the Future has spent only $7.4 million on general election races as of October 26, according to the FEC data, despite having $34 million in cash on hand across its network as of its most recent report.
Only 31 percent of that total has gone toward competitive races, as measured by the independent analytics website FiftyPlusOne. The only reason Leading the Future has spent money on competitive general election races at all is because it’s backing U.S. Sen. Darline Graham, R-S.C., who filled the seat of her late brother Lindsey Graham and is now facing an unexpectedly fierce challenge from a Democrat to win a full term in ruby-red South Carolina.
“They are not going to have an impact on the balance of power in Congress,” said Shaunna Thomas, one of the founders of Guardrails Alliance, another new super PAC set up to counter Leading the Future’s influence. “They are spending money on candidates who they think will protect their ability to control if and how they are regulated.”
Public First has only recently started spending a relatively small sum on a handful of general election races. The spending had amounted to $1.1 million as of the morning of October 26, according to processed FEC data.
Asked for comment on how its strategy has changed since the primaries, a Public First spokesperson said that it was still trying to support “strong advocates for AI regulation.”
“Public First was founded as a counterweight to Leading the Future, and that fight looks very different today. Leading the Future is going dark. Its biggest backers are walking away,” said Anthony Rivera-Rodriguez, the spokesperson.
Into that gap have stepped new groups pushing for tougher AI regulation such as the Guardrails Alliance, which bills itself as a grassroots alternative to corporate-backed super PACs. It is funded in large part by Silicon Valley tech workers but has taken a more aggressive stance against “tech oligarchs.” Guardrails has spent about $2 million thus far and reported having $1.2 million on hand as of October 14.
About three-quarters of voters are less likely to support a candidate they know has received support from an AI super PAC, according to a Data for Progress poll of more than 3,000 likely voters in Iowa, Michigan, and Ohio commissioned by Guardrails. Voters were more concerned about spending from AI companies than from crypto companies or AIPAC.
Voters were more concerned about spending from AI companies than from crypto companies or AIPAC.
The dislike for data centers and AI cuts across party lines. In Michigan’s purple 7th Congressional District, Democratic candidate Will Lawrence has seized on data centers as one of his leading issues.
“The politics of this are terrible. Eighty percent of everybody is against it, whether you’re a Democrat, independent, or Republican,” he told supporters at a recent town hall.
Notably, neither of the super PAC networks has intervened in Lawrence’s race, despite it being one of the closest in the nation. (Lawrence’s campaign has pointed out that Elon Musk, who leads AI company xAI, has spent against Lawrence via his America PAC.)
There are emerging signs that the big AI super PAC networks are changing tactics in response to that public distaste. Public First’s dark-money affiliate donated $3 million since August to a preexisting super PAC supporting California state Sen. Scott Wiener, one of two Democrats vying to replace retiring Rep. Nancy Pelosi in California.
Leading the Future, meanwhile, gave a $500,000 donation on October 9 to a pro-data center nonprofit called Build American AI.
AI super PAC critics are also watching to see what Leading the Future will do, given its large war chest.
“I think they are going to continue to spend. I think they are going to try to do more and more spending that isn’t as easily tracked, because they are such political dead weight,” said Bores.
When single-issue super PACs know their issue is unpopular, they use vague names, “pop-up” affiliates, and other dubious tactics to hide their activities from voters.
Add another one to the list: Leading the Future has routed more than $30 million of spending through newly minted Delaware corporations, blocking transparency during an election that has been defined by voter backlash against the industry.
Those apparent shell corporations have accounted for the lion’s share of the largest artificial intelligence super PAC network’s expenses during this year’s election.
The practice is a flagrant violation of Federal Election Commission guidelines that require campaign organizations to disclose which consultants, pollsters, and advertisers they are paying, a campaign watchdog alleged in a complaint filed in May.
There may be little recourse for observers worried about the lack of transparency for now, however. The FEC is short of the quorum that would allow it to take action on complaints such as the one filed by the Campaign Legal Center. (Leading the Future, which did not respond to a request for comment, has previously defended its tactics as legal in a statement to Wired.)
The Leading the Future network was funded in large part by an executive at or investors in OpenAI, one of the world’s largest AI companies. (In 2024, The Intercept sued OpenAI in federal court over the company’s use of copyrighted articles to train its chatbot ChatGPT. The case is ongoing.)
Company president Greg Brockman and his wife, Anna Brockman, donated $25 million to the network last year. When it came time to spend that money, the Leading the Future network leaned on two affiliate super PACs, one for Democratic candidates called Think Big and the other for Republican candidates called American Mission.
That is a typical tactic of the new breed of single-issue super PACs popularized by the crypto industry. Campaign finance reform advocates say it may help obscure the origin of campaign ads from voters but does not run afoul of any laws itself.
What those super PACs did next raised red flags for watchdogs, however. Since December, American Mission has reported spending $17.4 million through a Delaware-incorporated limited liability corporation called Summit Ridge Media Group, on services ranging from media placement to ad production to consulting.
Think Big has spent $21.3 million through a different Delaware corporation, Lantern Production Consultants, on a similarly wide range of expenses.
The grab bag of expenses is a giveaway that the super PACs are likely using the newly created corporations to hide their true vendors, according to Shanna Ports, a senior legal counsel at the Campaign Legal Center.
“There’s no way of knowing what is motivating this arrangement — but I know there is backlash to AI. It is possible that the vendors who are working with American Mission and Think Big don’t want to be identified in FEC reports,” Ports said.
Thomas, of the rival super PAC Guardrails Alliance, told The Intercept she thinks the network is obscuring its spending because a lax regulatory approach has become “politically toxic.”
“Their donors don’t want to be associated, their candidates don’t want their support, and their vendors don’t want to be associated,” Thomas said. “If you were public, you are running away. If you are not, you are interested in not being exposed.”
This story was supported by a grant from the Tarbell Center for AI Journalism.
Source: The Intercept · 2026-10-29
