Secure World News

Thirty years ago this week, a hacker writing as Aleph One published “Smashing the Stack for Fun and Profit” in Phrack. The article showed readers how to hijack a program by feeding it more data than it could safely hold, and it brought buffer-overflow exploits to a mass audience.

For decades, software security has relied on two quiet assumptions. Finding and weaponizing a vulnerability took rare skill, and defenders had time to triage and patch what turned up.

We have spent decades strengthening our network perimeter, encrypting communication channels, implementing TLS, deploying API gateways, and enforcing identity-based access controls. But here is an important question: “If our network communication becomes quantum-resistant, are the applications and data flowing through those networks equally protected?”

The emergency operations center of a major regional power utility went dead at 2:14 a.m.

Three weeks after attackers turned up the heat on roughly 700 French supermarkets, they’ve done it again—and this time the map is a lot bigger.

U.S. NIST recently released IR 8547, outlining the roadmap for transitioning to quantum-resistant standards. While the guidance is comprehensive, much of the public debate still fixates on a single threat vector: harvest now, decrypt later (HNDL).

AI agents are getting the keys to the enterprise, and in many organizations, they are getting them the worst possible way: borrowed from a human.

The record for the largest cryptocurrency theft in history stood for about 20 months. On the evening of October 29, it fell by a factor of four.

In August 2025, McKinsey made a bold case: agentic AI could change how banks fight financial crime by handing entire tasks, not just individual steps, to teams of AI agents, with humans reserved for validation, exceptions, and coaching. The firm floated a 20-fold productivity potential.

For most of the last decade, the IoT security question was simple: can this device be hacked? The 2026 IoT Security Landscape Report from Bitdefender and NETGEAR argues that question is now too small.

Most of the quantum computing story is told as an opportunity story: trillions of dollars in value, drug discovery, new materials, faster AI. McKinsey & Company’s new report, “Three horizons of quantum: A business road map to the future computing economy,” tells that story too. Its headline estimate is that quantum computing alone could create $1.3 trillion to $2.7 trillion in economic value worldwide by 2035.

Let’s start with vulnerability prioritization metrics and signals. Many organizations still rely heavily on CVSS, a framework first introduced in 2005 and revised several times since. Fixation on this single severity score is a primary cause of remediation paralysis. Why, in 2026, are we still triaging vulnerabilities by this single metric when EPSS, KEV, and vendor trend scores have been around for years?

Some of the people logging in to accounts at America’s largest banks aren’t the account holders. Major U.S. banks are detecting unauthorized third-party AI agents operating inside customer accounts, Axios reported Thursday, and some appear to act independently of user instructions.

Two days after PHP shipped emergency fixes for the PHP2Shell vulnerabilities, the project has disclosed a third way an attacker could run code on a PHP server. This time, there is no emergency release. The interim fix is a configuration setting that, earlier in the week, was widely described as only a partial defense.

Every fall, the U.S.-based National Cybersecurity Alliance (NCA) and CybSafe take the public’s temperature on security, and every year the diagnosis rhymes: people know what to do, and then they don’t do it.

For roughly four days in early October, anyone who connected to an SSH server over Tor had a meaningful chance of passing through an attacker’s hands. More than 300 Tor exit relays were quietly reconfigured to send SSH traffic to interception servers built to harvest passwords. At the campaign’s peak on October 4, the hijacked relays carried 7.46% of Tor’s total exit capacity, according to an analysis of public Tor directory data posted to the tor-relays mailing list.

The U.S. National Security Agency doesn’t often tell organizations to pull systems off the network. This week, it did.

Imagine you’re working your way through a queue of security alerts when a report comes in from accounts payable. A supplier has asked to update its bank details ahead of an invoice due date. The company name is correct, and the email sits inside what appears to be an existing thread. The only thing that caught the clerk’s attention was that the new account didn’t match the one on file, so instead of approving the payment, they confirmed with the supplier through a known contact and forwarded the message to you.

The McKinsey Global Institute’s new report, “Workforce in Motion: Skills and Pathways to Future Jobs in the United States,” is not a cybersecurity study. It never uses the word “SOC.” But read it as a cybersecurity leader and it describes, in remarkable detail, the operating environment your program will have to defend for the next decade: millions of people changing roles, nearly every job being rewritten around AI, and hiring gates that keep qualified people out.

On the night of October 16, an unauthorized party got into a legacy system that OpenCode was in the middle of shutting down. That system still held the OpenAI, Anthropic, and Google API keys customers had saved in OpenCode Console, the company’s hosted service for sharing model access across teams. By the time affected users read OpenCode’s notification the next morning, some had already found charges on their provider accounts for usage they never ran.