The U.S. Army's 2nd Cavalry Regiment in Bavaria says it conducted a live kinetic strike using an Orqa MRM2-10 drone its own soldiers assembled, fitted with a 3D-printed casing and electronic arming device dubbed the 'Dragoon Bomb.' Unit commanders say the explosive payload can be modified with ball bearings for anti-personnel use or shaped charges against light armor, and describe the strike as conducted without contractor or outside unit support.
tomshardware.com
· 2026-10-04
Three masked men broke into a Solihull home, beat the male resident with hammers and threatened his seven-months-pregnant wife, forcing him to transfer cryptocurrency worth hundreds of thousands of pounds. The attackers, guided by an accomplice on a live video call, took his phone and extracted his crypto holdings before fleeing in a getaway car. Crimestoppers is offering £10,000 for information, and police are investigating with help from home security footage.
bbc.co.uk
· 2026-10-01
In his new book, Our Own Worst Enemies, Robert Pape presents data from the Chicago Project on Security and Threats showing that 90 percent of those charged over the January 6, 2021 Capitol attack had no ties to militias or militant groups. His analysis found 22 percent were business owners, nearly 30 percent held college degrees, and almost 40 percent worked white-collar jobs, with only 8 percent unemployed.
wired.com
· 2026-10-01
The Dutch Institute for Vulnerability Disclosure said its network was breached via a chain of two zero-day flaws in the open-source Zammad ticketing platform, tracked as CVE-2026-102489 and CVE-2026-102490. DIVD said the attack was carried out by an autonomous AI agent that hijacked sessions, executed code remotely, and escalated to root privileges within seconds. Network segmentation and DIVD's response reportedly stopped the attacker from moving further into its systems.
bleepingcomputer.com
· 2026-09-30
An IT audit leader argues that enterprises are granting autonomous AI agents broad production access via long-lived service accounts, API tokens, and delegated cloud permissions, while focusing security spending on human-user authentication like MFA. These agents can execute code, provision resources, and modify records, effectively acting as privileged users outside traditional interactive access controls.
darkreading.com
· 2026-09-28
Keio Corporation, a Japanese railway and hotel operator, confirmed a ransomware attack detected early Saturday that disrupted business systems, primarily affecting its hospitality division. The company shut down its network, reported the incident to police, and is investigating with external experts whether customer or partner data was accessed. Local media say the attack disrupted payment systems, while train operations appear unaffected.
bleepingcomputer.com
· 2026-09-28
Ungleich Hosting reported that a customer became the target of a massive DDoS attack on August 11, 2026, which spilled over to affect the provider's own services hours later. The attack generated an estimated peak of 500-600 Gbit/s in waves lasting from Tuesday evening until Thursday afternoon, hitting Deploio, the company website, Cockpit, and its ticketing system intermittently. The company confirmed no data was accessed or compromised, and independent telemetry from Nokia's Deepfield threat research team corroborated the attack's scale and pattern.
nine.ch
· 2026-09-28
A Russian drone struck a business centre in Kyiv's Solomianskyi district on September 25, killing four people and injuring seven, while damaging a data center belonging to telecom firm Datagroup. Datagroup said no employees were hurt and customer data was safe, with services shifted to backup sites. Russia's defence ministry confirmed it targeted the facility, alleging it processed military intelligence, and separately claimed strikes on other providers including New Telco, United DC, Kyivstar and Parkovyi, with Ukraine's digital ministry reporting about 100,000 households lost internet access after related attacks.
techspot.com
· 2026-09-27
Researchers from UC San Diego and Inria Nancy have published a paper describing a new attack that significantly reduces the number of operations needed to factor RSA keys used in the 'textbook' or 'raw' RSA variant. For 1024-bit keys, the required calculations drop from roughly 2^80 to 2^65, with similar reductions across 2048-, 3072-, and 4096-bit key lengths. The findings have not yet completed peer review.
tomshardware.com
· 2026-09-26
GitHub Actions repositories actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled in May after being compromised in the Mini Shai-Hulud supply-chain attack, were reinstated by their maintainer starting September 16 without removing the malicious code. Socket researchers found the release tags still pointed to the original tainted commit, meaning any workflow referencing those version tags resumed downloading and executing the malware payload through at least September 25.
bleepingcomputer.com
· 2026-09-26
Secure file-sharing vendor Kiteworks emailed customers globally, urging a six-hour server shutdown this weekend after receiving threat intelligence from law enforcement about a possible imminent attack. The company confirmed to BleepingComputer that federal intelligence authorities warned a threat actor may target some customer systems, and recommended shutting down even systems not internet-facing. Kiteworks said it has no evidence of any actual compromise and described the move as precautionary.
bleepingcomputer.com
· 2026-09-25
The Cutting Room Floor (TCRF), which had implemented a feature banning visitors using a 'Claude-code' user agent, became the target of a large-scale distributed denial-of-service attack. The site's operator says the attack began shortly after a Twitter user was banned under this policy, spread false claims about the incident, and stirred online backlash. Unlike prior bot-based DDoS attempts against the site, this attack flooded the network connection directly, forcing host Linode to null-route the server's traffic.
blog.xkeeper.net
· 2026-09-24
GoKawiil