The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from the Chinese AI company's affiliates and third-party products and services built using DeepSeek technology. DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd) develops large language models and offers a chatbot, API services, and models suitable for coding and reasoning tasks. Its AI tools became extremely popular early on, but were but were soon followed by reports of security risks [1, 2, 3, 4] and concerns about the potential for Chinese authorities to access users’ conversations. The DHS is now taking regulatory action to limit the use of DeepSeek and derivatives on critical systems in the United States, and has issued a notice of order for agencies to:
A data breach exposed AfD emails, while an anonymous site published AI summaries of 421,000 messages, raising questions about authenticity and privacy. Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails. “In September 2026 there was a hacking attack on a hosting provider used by our party.” By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party’s emails. In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical. International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026. According to the summaries ICD relayed, Gauland, the party’s 85-year-old honorary chairman and former co-leader, forwarded a 2018 email about a “Hitler pilgrimage” by a former judge on the party’s internal court in Thuringia.” AfD told told Bild. “A district board member sent a Christmas card with a swastika and the words “Heil Hitler”. Staff at the party’s Berlin headquarters discussed luring a photographer to an event and throwing him out by force, in a thread signed off “hail and victory”. The AfD’s statement gave a limited account of the incident. The party said the attackers copied parts of a few mailboxes, most of which had not been used for years, and did not access the leadership’s current accounts. However, the online index includes messages dated as recently as September 12, 2026, raising questions about the party’s account. The website hexane.cc does not publish the emails themselves. Instead, it provides AI-generated summaries grouped into categories such as racism and antisemitism, with severity ratings from Low to Critical. The site operators have not identified the AI software used to create them. When users try to open a record, the site displays the message “source text not published for this record.” So far, none of the summaries has been linked to an original email that can be verified. That’s an important detail that’s getting lost in the coverage. The summaries describe swastikas, Nazi greetings, Christmas cards bearing Heil Hitler, and a thread at the federal party headquarters signed off with “hail and victory.” If authenticated, some of this material would matter significantly in ongoing court proceedings about whether the party can be banned. But right now all of it is filtered through an anonymous operator’s software, and the original texts remain unpublished. Bild is the only German news outlet confirmed to have examined files from the archive directly, although it reviewed only a very small sample. The files appeared to be genuine party records, including identity documents, invoices, bank statements, membership applications, and regional member lists. They also included the identity card of Markus Frohnmaier, deputy leader of the AfD’s parliamentary group in the Bundestag. Berlin-based security researcher Lilith Wittmann, who exposed a flaw in the CDU’s campaign app in 2021, wrote on X that she believed the leak was genuine and the reported attack method was plausible. The hacker reportedly told the International Cyber Digest account on X that they gained access through “a single unpatched party website” and then reached the mail servers. The AfD has confirmed that its hosting provider was targeted, but the reported entry method has not been independently verified. The archive’s own file names offer another clue: one server is labeled “afd_exfil.” The term “exfil” is commonly used for a system that stages stolen data before attackers transfer it out of a network. The AfD is currently contesting in court its classification as a confirmed right-wing extremist organization by Germany’s domestic intelligence agency. Lawmakers in the Bundestag and Thuringia are separately debating whether to seek a formal party ban, which under German law can only come from the Federal Constitutional Court. The leak appeared on October 19, while the Cologne Administrative Court is actively weighing whether the intelligence agency may publicly apply the extremist designation, and two months before the AfD plans to seek the election of one of its leaders as state premier in Saxony-Anhalt. Within two hours of the first posts about the archive on X, some accounts were using it to argue that the AfD should be banned. If authenticated, the most legally relevant emails would be those showing how the party’s national headquarters operates and handles internal disciplinary cases. This is because a ban case focuses on the party as an organization, not on individual members. So far, none of the summaries has been linked to an original email. The website describes itself as an independent archive published in the public interest and claims to have minimized personal data. However, Bild found that the files it reviewed included membership applications and member lists containing full names and home addresses of people whose only apparent connection to the story was their party membership. By the afternoon of October 19, the site’s About, Method, and Support pages were returning server errors, leaving visitors unable to access its own explanations of how the archive was created and managed. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AfD)
Microsoft urges organizations to secure AI Agents as insider threats, using dynamic permissions, continuous risk monitoring and automated containment. Microsoft published a detailed blog post explaining how organizations should secure AI agents. Microsoft sees them as a growing insider threat, not just a possible risk in the future. AI agents are not dangerous by nature, but they can access critical systems and may fail, be manipulated, or be compromised. “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.” said Satya Nadella This is not just a theory. It is a principle that should guide how organizations design and secure AI systems. The post makes a distinction worth holding onto. An agent that starts a task with the right permissions and behaves correctly can still become dangerous if its context changes mid-run. A prompt injection in an external document, a piece of untrusted data that shifts the agent’s reasoning, a task that evolves in a direction nobody anticipated, none of these require the agent to be compromised in the traditional sense. The model produces variable outputs, the context changes, and the agent’s behavior drifts. At machine speed, the window between that drift starting and it causing damage is very short. Microsoft’s proposed answer is continuous containment rather than upfront trust. You define what the agent is allowed to do before it acts, you monitor what it actually does while it runs, and you adjust its permissions in real time as its behavior or the risk calculation changes. An expense approval agent should start with access scoped exactly to reviewing and approving expenses, nothing broader, and those permissions should shrink or disappear the moment the agent tries something outside that task. The post introduces Dynamic Permissions to apply the principle of least privilege to AI agents. An agent should not automatically get the same access rights as the employee who deployed it. It starts with no permissions and receives only the access needed for its approved task. These permissions remain active only while the task is running. “The employee retains the employee’s access.” Microsoft states. “The agent receives its own identity, permissions and its own authority scoped to its current task and for the duration of the task only.” Alongside that, Dynamic Agent Risk is a continuously updated score that combines signals from identity, endpoints, network, cloud, runtime, and the agent’s own behavior to assess whether what the agent is currently doing still matches what it was authorized to do. The response when risk rises is graduated rather than binary: preserve reads while blocking writes, narrow accessible resources, require human approval for high-impact steps, or stop execution entirely if the risk warrants it. “Dynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity. It considers how securely the agent is configured, what resources it can reach, the potential impact if something goes wrong, and whether its actions are drifting from the user’s or organization’s intent.” Microsoft states. “The result is not a one-time score assigned at onboarding. It is a continuously updated understanding of the agent’s current risk and whether its current authority still matches that risk. “ Organizations frequently have AI agents running locally or introduced through third-party tools that were never formally registered in any central system. Microsoft says it’s expanding discovery to 60 types of local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Getting those into a unified registry with accountable identities is the prerequisite for applying any of the governance controls described in the rest of the post. You can’t set least-privilege permissions for an agent you don’t know exists. You can’t detect behavioral drift from an agent that doesn’t have a tracked identity. The agent registration problem is logistically harder than it sounds, especially for organizations where individual employees can spin up agents without IT involvement, which is most organizations right now. Microsoft recognizes that organizations cannot manually review every risk alert when they run hundreds of thousands of AI agents. Its solution is Guardian Agents, AI agents focused on security. They follow playbooks created by human operators, investigate changes in risk, apply or recommend security measures, and use what they learn to improve security policies. Humans set the goals and approve important decisions, while the agents handle continuous monitoring and response. However, this approach raises another concern. Guardian Agents are also AI agents, so they can fail or be manipulated, just like the agents they are supposed to control. Microsoft says security controls must operate outside the AI model and must not be changed by it. But this raises an important question: how can organizations ensure these controls remain reliable when the system enforcing them is also an AI agent? This is a challenge that real-world deployments will need to address in the coming years. “Organizations are adopting agents to serve customers better, solve problems faster, and give people more time for the work that matters most. The goal is not to make every model perfectly predictable before it can be useful.” Microsoft concludes. “The goal is to build systems that remain secure even when the model is not.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI Agents)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) appeared first on Unit 42.
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but most records contained no identifying info. The company said that 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records. The remaining 1.68 million records contain no identifiers, the company said, and no credit card information was exposed. Nikkei Inc. is a major Japanese business news and financial information group, owner of Financial Times, the country’s largest business-focused media company. The company employs over 10,100 people and has an annual revenue of $2.5 billion (¥393.8 billion).
The UK Electoral Commission is building an AI system to alert candidates to damaging deepfakes within three hours. The UK’s Electoral Commission is building an AI-powered system to tell candidates about significant deepfakes within three hours of posting. Its chief executive, Vijay Rangarajan, said so at a panel at the Conservative Party’s annual conference last week, as Tech Policy Press points out that it’s a rare public intervention from a man who has run the regulator since 2024 and who mostly speaks to Parliament in evidence sessions. He began with an example from another country. During Ireland’s 2025 presidential election, a deepfake video falsely showed candidate Catherine Connolly saying the election had been cancelled and that she was withdrawing from the race. The video also urged her supporters not to vote. None of this was true, and Connolly went on to win the election. Rangarajan said a similar video during a UK election could influence a significant number of votes. However, he stressed that the Electoral Commission has clear limits to its role. It does not settle disputes over political claims made during a campaign. Its focus is on false statements that could disrupt the election process itself. ““If that happens to the British election, that will move a significant amount of votes,” he said, adding that it was not the Electoral Commission’s role to arbitrate rival claims made by candidates during the cut and thrust of a campaign, but rather to focus on statements such as this one that could undermine the administration of the election itself. “To address that risk, the commission conducted a pilot program during the UK’s local elections in May 2026, Rangarajan said. “We ran a full pilot, analyzed about three million posts through an AI,” he explained. “So, this is a good example of how AI can work: 147 bits of content were flagged. Humans then looked at those — not a terribly pleasant job in some cases — ten were really quite misleading, and we referred to the social media companies or to the police.”” Tech Policy Press reports. The Commission has tested the idea. During the local elections in May 2026 it ran a full pilot, and an AI analyzed about three million posts. It flagged 147 pieces of content, humans reviewed them (he called that unpleasant in some cases), and ten were really quite misleading, so they went to the social media companies or the police. Rangarajan said the posts had little impact. However, the trial showed that the Electoral Commission now has a system to help voters, journalists and political parties deal with deepfakes. He expects attempts to use them to disrupt UK elections. The pilot began earlier in 2026 and monitored fake audio and videos designed to mislead voters about the election process or falsely show candidates doing or saying things. The Commission said it would publish the results. The system has a clear focus. Identifying and prosecuting the people behind deepfakes can take weeks or months, often long after an election. Instead, the Commission aims to act without first identifying who created the content. AI scans social media posts in real time and flags suspicious material for human review. If a post meets the required criteria, the Commission alerts the relevant candidates or parties, ideally within three hours of its first appearance. Rangarajan said this is roughly the time it takes for content to go viral. That narrow scope has edges. Full Fact, whose AI tools were monitoring more than a thousand candidates in the May elections, found a Glasgow candidate’s campaign videos built with AI. The Commission told Full Fact the clips fell outside its pilot because each was labeled an illustrative AI scene, even though the label sat at the end of the caption. The legal backdrop is the real problem. Rangarajan said the Commission was set up for money and people, and now it’s all about information, so it has to work out how laws from 1983 or 2000 apply in 2026. Earlier this year the Guardian reported, according to a summary on the Resilient Media for Democracy Observatory, that the Commission was seeking legally enforceable takedown powers from the government. Then there’s the part with no legal answer at all. Rangarajan said he believes at least one social network showed signs of algorithmic bias at election time, though he didn’t name it. His scenario is a platform that changes its recommendations during an election without warning, suggesting neighbors with one political view and suppressing others, so users think their neighbors have changed their minds. The Commission believes it has already detected some algorithmic bias in social media campaigns, but Rangarajan said UK law offers no clear solution. Experts and campaigners have also raised concerns about X’s role in UK politics and TikTok’s Chinese ownership. The Commission faces 30,000 to 40,000 cyberattacks a month, sometimes reaching 10,000 a day, including botnet attacks and phishing. Rangarajan wants stronger, more independent security capabilities and believes major social media monitoring could be handled by another body. Tech Policy Press sees his comments as a call to update election laws and possibly create new offenses. The next general election must take place by August 2029, but it could be called earlier, and it remains unclear whether lawmakers will act in time. For now, what the Commission has is a three-hour promise and a pilot that worked at small scale. Rangarajan describes the threat it’s meant for as “an absolutely certain attempt to use some of these deepfakes against the UK.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Deepfakes)
A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802.11 implementation that has been present in their SDK since at least 2010. The bug allows an attacker to get unauthenticated remote code execution on affected routers without knowing the WiFi password or going through the normal WPS setup process. As of October 15, 2026, none of the affected devices in Belgium had received a patch. “A vulnerability affecting Broadcom’s proprietary implementation of 802.11 has been present in their SDK since at least 2010. An incomplete patch was silently released in 2018, followed by Broadcom’s recommendation to move to hostapd instead, making it a definitive forever day on eCos-based platforms (BCM3380, BCM3383, BCM33834) and a potential forever day on Linux platforms (BCM3390, BCM65xx, BCM68xx) unless affected Original Equipment Manufacturers (OEMs) are willing to migrate.” states Kaiser. “The vulnerability can be triggered remotely over WiFi without knowledge of the network key or completion of a normal WPS enrollment. Exploitation provides controlled information disclosure and arbitrary code execution.” The vulnerability affects the WPS EAP reassembly code, which handles part of the wireless setup process used by many consumer routers. An attacker within Wi-Fi range can exploit the flaw without knowing the Wi-Fi password, completing the setup process, or requiring any action from the user. The attack can expose information and allow the attacker to run code on the router. In his demonstration, Kaiser extracted the Wi-Fi password from the router’s memory and sent it over the wireless connection. He then used the password to connect to the network. These attacks are not just theoretical. Kaiser demonstrated working exploits against two devices: the Orange Belgium ASKEY TCG3000 and the Proximus Sagemcom F@st/BBOX3V+. Both allowed an attacker to run code without authentication. In one demonstration, the attacker opened a reverse shell using only Wi-Fi frames, without needing a command server accessible over the internet. The attack can work from a distance. The close antenna placement shown in the video was only for the laboratory setup and is not a requirement for the attack. In the video below, Kaiser exploited an Orange Belgium router (ASKEY TCG3000). The attack allowed him to run code on the device without authentication. The code retrieves the Wi-Fi password (PSK) from the router’s NVRAM and sends it back to the attacker over Wi-Fi. He then used the stolen password to connect to the network, confirming that the exploit works and that the password is correct. Do not be misled by how close the antenna is in the video. The attack can work over much longer distances. In the next video, the researcher exploited a Proximus router (BBOX3V+, also known as Sagemcom F@st). This attack also allows code execution without authentication. He used it to open a reverse shell over Wi-Fi frames, without needing a command-and-control (C2) server hosted in the cloud. Broadcom quietly released an incomplete fix in 2018, then told customers to migrate to a different software stack entirely rather than shipping a complete patch for their own code. On eCos-based platforms, covering chipsets like BCM3380, BCM3383, and BCM33834, that makes this a permanent unfixable bug by design. On Linux-based platforms (BCM3390, BCM65xx, BCM68xx) the situation depends entirely on whether individual manufacturers decide to act. Kaiser reported the bugs to Broadcom in July 2026. Broadcom said a patch was available and told him to ask the affected device manufacturers to contact Broadcom directly. The company refused to assign a CVE or share the notification it had sent through its customer portal. CERT/CC opened a case but closed it the same day after confirming that Broadcom could assign CVEs itself and had no intention of doing so. This was not a proper disclosure process. It was a dead end, with a paper trail. Kaiser’s rough calculation, done with Belgian telecom market data, puts the affected device count at around 850,000 for Proximus, 500,000 for VOO’s legacy fleet, and 210,000 for Orange Belgium, totalling somewhere north of 1.5 million potentially exposed gateways in one small country. Telenet may also be affected through Sagemcom devices but Kaiser couldn’t confirm because he couldn’t get hold of one. The affected manufacturers sell into markets well beyond Belgium. The chipsets in question appear in devices across dozens of vendors and hundreds of products worldwide. Kaiser is publishing a fingerprinting script and a YARA rule specifically to help map the full scope of affected deployments, because right now nobody has a complete picture. A vulnerability introduced in 2010 and only partly fixed in 2018 still affects routers in use today. Kaiser says AI-assisted analysis helped him find the bugs in less than a week, instead of months. This can help defenders find vulnerabilities faster, but attackers can do the same. The risk is greatest in targeted attacks where an attacker is within Wi-Fi range, such as hotel network attacks or surveillance of nearby targets. Compromised routers are difficult to monitor, and attackers can quietly intercept or collect network traffic. Most users and security teams rarely check the firmware on ISP-provided routers. “Although I could have done this research by myself, it would have taken me months to get there. With AI frontier models it took me less than a week.” Kaiser concludes. “Which is a good thing because we can start looking into deeper and deeper layers of our technical infrastructure for a fraction of the cost.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Broadcom Wi-Fi)
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is OpenCode's optional hosted service: a workspace saves its own OpenAI, Anthropic, or Google key there, and Console uses that key to call the provider so team members can use the models without
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to the application identities and compromised Microsoft 365 tenants. The disabled identities are listed below - ConnectWise Cloud Backup - 506e08f9-6e9a-4da4-942b-a099a03644ae ConnectWise
Confirm this action.
Leaving now will discard your changes.