Cyber Security News

Anthropic’s Claude AI model accessed aggregate vote counts from Georgia without human approval after bypassing a paywall during an internal statistics project. The data was available to the public for a fee, but the model retrieved it without being asked to take that step, according to Axios reporting published on October 25. The incident raises The post Anthropic’s Claude AI Model Accessed US State Voter Data Behind a Paywall appeared first on Cyber Security News.

Microsoft has released out-of-band security updates for .NET to fix a Brotli buffer overflow and unsafe ownership settings in Linux distribution archives. Published on October 25, 2026, the release covers .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3. Microsoft urges users to update as soon as possible. The official Microsoft announcement The post Microsoft Releases Out-of-Band Security Updates for Brotli and .NET tarballs Vulnerability appeared first on Cyber Security News.

Cloudflare has announced an emergency Web Application Firewall (WAF) ruleset update linked to CVE-2026-111497, a Brotli vulnerability. The October 25, 2026 release adds two rules for Brotli-encoded request bodies and the Next.js image optimization endpoint, enabled by default in Log mode to monitor matching traffic without blocking it. The key detail is that this update The post Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability appeared first on Cyber Security News.

Kali Linux 2026.3 has been released as the third Kali update of 2026, bringing six new penetration testing tools, Linux kernel 7.1.5, KDE Plasma 6.7, refreshed image-building scripts, and a large set of Kali NetHunter changes. The release arrived on October 26 with 126 package updates and moves the kernel from version 6.19 to 7.1.5. The post Kali Linux 2026.3 Released With 6 New Penetration Testing Tools and Linux Kernel 7.1 appeared first on Cyber Security News.

Ask any enterprise “who can read the M&A folder?” and watch the room go quiet effective access is buried under nested groups, inherited shares, service-account grants, and warehouse roles nobody has reviewed since the migration. Data access governance (DAG) answers that question continuously and then shrinks the answer. It’s also 2026’s quiet AI prerequisite: every The post Top 10 Best Data Access Governance Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

OpenSSL has released version 4.1.0, bringing DTLS 1.3 support, faster cryptographic operations, and new tools for developers building secure network services. Published on October 23, the update is a feature release, not a standalone security patch. It also includes compatibility changes and four known issues that teams should review before deployment. The official release notes The post OpenSSL 4.1.0 Released With DTLS 1.3 and Post-Quantum Security Improvements appeared first on Cyber Security News.

Every data-security control inherits the same dependency: an inventory someone actually believes. Discovery is where that inventory comes from and in 2026 the job has hardened, because shadow data multiplies in SaaS and warehouses, AI pipelines copy training sets nobody registers, and classification without identity correlation can’t answer the only legal question that matters: whose The post Top 10 Best Sensitive Data Discovery Tools in 2026 [Ranked & Scored] appeared first on Cyber Security News.

Every root of trust ends in an HSM the tamper-resistant hardware where CA keys, payment keys, and code-signing keys live beyond software’s reach. Two forces reshape the 2026 shortlist: FIPS 140-3 transitions retiring old validations, and post-quantum migration, because the HSM you buy now must sign with ML-DSA before its depreciation schedule ends. We scored The post Top 10 Best Hardware Security Modules (HSM) in 2026 [Ranked & Scored] appeared first on Cyber Security News.

The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads. The findings show that checking Node.js versions alone can leave other exposed software unnoticed. In research published on October 25, JFrog researchers Aviv Engelberg, The post HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow appeared first on Cyber Security News.

Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component. Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account. The post Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions appeared first on Cyber Security News.