Chrome is getting new scam protections that use Gemini to detect deceptive websites and warn users when they copy suspicious commands from ClickFix attacks. The changes are part of Enhanced Protection in Safe Browsing, which Google claims makes users ten times safer from phishing, social engineering, notification abuse, and other scams compared with Standard Protection. Chrome is also adding a new "suspicious site" warning for pages that show deceptive patterns but haven't reached the confidence level required for its existing full-page red warning. "Suspicious site warnings notify users when a page exhibits deceptive patterns commonly associated with known malicious sites," the company explained. "By tailoring the warning UI in this way, we are able to safely expand our coverage to display a higher volume of protective warnings."
Microsoft says it mistakenly flagged a bug causing Always On VPN connection issues as fixed in the October 2026 Windows 11 cumulative updates. Always On VPN replaced the legacy DirectAccess technology and supports domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices running Windows 10, Windows 11, and Windows Server. It runs in the background and establishes secure tunnels back to the user's corporate network whenever their device connects to the internet. Microsoft first acknowledged the issue in a service alert sent to IT administrators in late September, saying it was triggered on systems running Windows 11 24H2 and later after installing the September 2026 security updates when the initial Always On VPN connection failed (e.g., when using automatic protocol selection with IKEv2 and SSTP).
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from. The state-owned bank, India's largest, said in a stock-exchange filing dated October 21 that it "has experienced an incident involving the loss of certain data." The count is
CJIS v6.1 requires agencies to maintain strong authentication, account security, and audit controls while demonstrating ongoing compliance. Specops outlines five practical priorities covering MFA, account management, passwords, logging, and audit readiness.
A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. 40-year-old Chukwuemeka Victor Amachukwu (also known as Chukwuemeka Victor Eletuo and So Kwan Leung) has pleaded guilty to conspiracy to commit computer intrusions and wire fraud after being extradited from France to the United States in August 2025. "Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes," said US Attorney Jamie McDonald in a Monday press release. "Amachukwu took part in sophisticated schemes to hack into US businesses, steal and use stolen identity information of victims, and commit fraud. These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant."
A data breach exposed AfD emails, while an anonymous site published AI summaries of 421,000 messages, raising questions about authenticity and privacy. Germany’s Alternative für Deutschland (AfD) confirmed on October 19 that its hosting provider was hacked in September and that mailboxes were copied. By the time the confirmation reached Bild, a website called hexane.cc had already been online for hours offering an index of what it claims are 421,179 internal party emails. “In September 2026 there was a hacking attack on a hosting provider used by our party.” By then the website hexane.cc had been online for several hours with an index of what it says are 421,179 of the party’s emails. In place of the emails, the site shows summaries written by software, sorted into categories that include racism and antisemitism and graded from Low to Critical. International Cyber Digest (ICD), a cybersecurity news account on X, examined it on 19 October and reported that the index includes Gauland’s mailbox and that the newest message is dated 12 September 2026. According to the summaries ICD relayed, Gauland, the party’s 85-year-old honorary chairman and former co-leader, forwarded a 2018 email about a “Hitler pilgrimage” by a former judge on the party’s internal court in Thuringia.” AfD told told Bild. “A district board member sent a Christmas card with a swastika and the words “Heil Hitler”. Staff at the party’s Berlin headquarters discussed luring a photographer to an event and throwing him out by force, in a thread signed off “hail and victory”. The AfD’s statement gave a limited account of the incident. The party said the attackers copied parts of a few mailboxes, most of which had not been used for years, and did not access the leadership’s current accounts. However, the online index includes messages dated as recently as September 12, 2026, raising questions about the party’s account. The website hexane.cc does not publish the emails themselves. Instead, it provides AI-generated summaries grouped into categories such as racism and antisemitism, with severity ratings from Low to Critical. The site operators have not identified the AI software used to create them. When users try to open a record, the site displays the message “source text not published for this record.” So far, none of the summaries has been linked to an original email that can be verified. That’s an important detail that’s getting lost in the coverage. The summaries describe swastikas, Nazi greetings, Christmas cards bearing Heil Hitler, and a thread at the federal party headquarters signed off with “hail and victory.” If authenticated, some of this material would matter significantly in ongoing court proceedings about whether the party can be banned. But right now all of it is filtered through an anonymous operator’s software, and the original texts remain unpublished. Bild is the only German news outlet confirmed to have examined files from the archive directly, although it reviewed only a very small sample. The files appeared to be genuine party records, including identity documents, invoices, bank statements, membership applications, and regional member lists. They also included the identity card of Markus Frohnmaier, deputy leader of the AfD’s parliamentary group in the Bundestag. Berlin-based security researcher Lilith Wittmann, who exposed a flaw in the CDU’s campaign app in 2021, wrote on X that she believed the leak was genuine and the reported attack method was plausible. The hacker reportedly told the International Cyber Digest account on X that they gained access through “a single unpatched party website” and then reached the mail servers. The AfD has confirmed that its hosting provider was targeted, but the reported entry method has not been independently verified. The archive’s own file names offer another clue: one server is labeled “afd_exfil.” The term “exfil” is commonly used for a system that stages stolen data before attackers transfer it out of a network. The AfD is currently contesting in court its classification as a confirmed right-wing extremist organization by Germany’s domestic intelligence agency. Lawmakers in the Bundestag and Thuringia are separately debating whether to seek a formal party ban, which under German law can only come from the Federal Constitutional Court. The leak appeared on October 19, while the Cologne Administrative Court is actively weighing whether the intelligence agency may publicly apply the extremist designation, and two months before the AfD plans to seek the election of one of its leaders as state premier in Saxony-Anhalt. Within two hours of the first posts about the archive on X, some accounts were using it to argue that the AfD should be banned. If authenticated, the most legally relevant emails would be those showing how the party’s national headquarters operates and handles internal disciplinary cases. This is because a ban case focuses on the party as an organization, not on individual members. So far, none of the summaries has been linked to an original email. The website describes itself as an independent archive published in the public interest and claims to have minimized personal data. However, Bild found that the files it reviewed included membership applications and member lists containing full names and home addresses of people whose only apparent connection to the story was their party membership. By the afternoon of October 19, the site’s About, Method, and Support pages were returning server errors, leaving visitors unable to access its own explanations of how the archive was created and managed. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AfD)
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC,
Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records. The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but most records contained no identifying info. The company said that 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records. The remaining 1.68 million records contain no identifiers, the company said, and no credit card information was exposed. Nikkei Inc. is a major Japanese business news and financial information group, owner of Financial Times, the country’s largest business-focused media company. The company employs over 10,100 people and has an annual revenue of $2.5 billion (¥393.8 billion).
Staffing software company Bullhorn has disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company says it has isolated the issue and eradicated the immediate threat. Currently, its team is working to restore services following thorough security reviews conducted with help from CrowdStrike specialists. Bullhorn is an American software company specializing in cloud-based staffing and recruitment solutions. Its platform helps staffing firms manage the recruitment lifecycle, including candidate tracking, onboarding, and payroll. The company says it serves more than 10,000 customers worldwide. According to a status page on the incident, customers started to experience issues with job posting in the Bullhorn application on Friday. The next day, the company said it was "experiencing a system-wide outage affecting the Bullhorn platform," and later confirmed that the issues were caused by a cyberattack.
The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach. Multiple users reported that the incident led to unauthorized API charges and suspended projects in Google Cloud. According to the project maintainer, the breach affected 1.4% of OpenCode Console users, with some reporting more than $1,700 in unauthorized charges overnight. OpenCode is a model-agnostic AI coding agent that helps users understand code, write features, and fix bugs using natural-language instructions, through a terminal, desktop app, or code editor. Users can connect AI models from multiple AI providers to the OpenCode console to streamline and automate the development process. On Saturday, OpenCode announced that it suffered a large distillation attack that impacted only developers who linked external providers, including Anthropic, OpenAI, and Google.
Confirm this action.
Leaving now will discard your changes.