Archive · 51 articles · page 1/3
Every analysis published by Cyberiack, newest first.
Startup AIR found a way to bypass Vercel Sandbox's network filtering and exfiltrate data. Vercel is still working out how to fix the flaw, which AIR says is not being exploited at this stage.
Since October 13, Gemini 4 Argon has been available via API and in Google's paid plans, at a launch price that will double on November 30. Its performance claims rest mostly on Google's own measurements.
In a study published October 12, two Anthropic researchers estimate that small open models could, within months, spread on their own across poorly secured connected devices.
Chatbot service Character.AI has filed for Chapter 11 protection in the United States. Disney's offer sets a price floor, and the platform stays open during the proceedings.
On October 13, the European Data Protection Board published a statement on smart glasses: manufacturers cannot shift their GDPR obligations onto wearers.
XBOW received $250,000 from Google for a chain of three Chrome vulnerabilities on Windows, found and exploited by four researchers assisted by GPT-5.6 Sol. The flaws have been patched.
Ivanti has patched CVE-2026-104935, exploited since early October on its VPN gateways. But the attack chain also relies on a privilege escalation flaw that remains unpatched.
In its October 13 Patch Day, SAP fixes a critical flaw in the Cloud SDK for Python that could expose OAuth2 secrets, along with three other critical vulnerabilities.
Docker has fixed CVE-2026-105445: by converting an account into an organization, an attacker could act on the registry as another user. Docker found no evidence of exploitation.
Apple is launching HomeView, its smart home display, but not in the European Union: its Siri AI assistant is blocked on iPhone there, which Apple blames on the DMA.
Since August, cryptanalysis work has put Classic McEliece below its claimed security level. The BSI advises against it for new projects, though no practical attack exists to date.
Microsoft ends updates for Windows 11 24H2 Home and Pro on October 13, 2026. Windows Server 2022 leaves mainstream support the same day. Here is how to check your version and migrate.
Microsoft unveiled Maia 300 on October 12, its third-generation AI chip. It targets AI agent inference, with 288 GB of HBM4 memory per chip. The announced gains were measured by Microsoft alone.
On October 12, Meta unveiled Muse Wonder and Muse Wonder Full, its most advanced AI models. An independent evaluation places them close to the best, but they are not open.
Let's Encrypt is cutting the lifetime of its TLS certificates from 90 to 64 days in February 2027, then to 45 days in 2028. Testing begins October 14: now is the time to check your renewals.
Flaw CVE-2026-85097 lets an unauthenticated attacker take over a WordPress site running Bricksforge. Patchstack has observed automated attacks. Users should update to version 3.1.8.10.
Since October 11, Ahold Delhaize has taken part of its systems offline. Websites, apps and online orders are disrupted in Belgium, the Netherlands and the United States.
After the forced defrosting of hundreds of supermarkets, CERT-FR reports numerous compromises of Danfoss controllers. Danfoss blames outdated equipment, and the Paris prosecutor's office is investigating.
Published in the Journal officiel on October 11, Decree No. 2026-944 gives ANSSI, France's national cybersecurity agency, the job of notifying and overseeing the bodies that will assess digital products' conformity with the CRA.
Norway's data protection authority, Datatilsynet, has fined Xandr, Microsoft's advertising subsidiary, NOK 92 million for processing sensitive Grindr user data without a legal basis.
On October 12, GitLab fixed 24 vulnerabilities, including CVE-2026-97229, which could allow unauthenticated code execution on the server. Self-hosted installations must be updated.
The crypto wallet maker found an unauthorized implant in a device sold by a Southeast Asian reseller. According to researchers, between $86 million and $93 million may have been stolen.
Overnight on October 11–12, hackers remotely altered the temperature of refrigerated display cases in supermarkets across France. The Paris prosecutor's office has opened an investigation; Danfoss, a supplier to Les Mousquetaires, was reportedly targeted.
The GlobalProtect vulnerability patched in May is still an entry point for ransomware. On October 11, ReliaQuest named the Qilin and Settra groups. Updating is not enough: organizations must also hunt for suspicious VPN access.
