Security Tech News.

Threat actors targeted Plex servers using a chain of four vulnerabilities one day after public disclosure on October 16. The attackers deployed a cryptocurrency miner and proxy software to access corporate networks via residential IPs, bypassing security controls that Plex had patched on September 1.

Educational Testing Service (ETS) disclosed that a compromised login credential allowed unauthorized access to a secure file transfer system from May 22, 2026 to September 18, 2026. The breach exposed personal data for more than 5.7 million current and former California public school students, including names, addresses, and test results.

Hackers stole passwords and credentials from Russian hosting provider FirstVDS by exploiting a vulnerability in VMmanager 6 software. The attack occurred on Saturday and affected part of the infrastructure without disrupting operations. FirstVDS warned customers to change passwords while patches were deployed overnight on Monday.

Chinese retailer Temu agreed to pay Texas $3 million to settle a data privacy case filed in February 2026. The deal requires storing shopper data on US servers and mandates annual security assessments. Violations could trigger an $8 million penalty per year.

Developer UntilHEX used Claude Code to identify and remove a hidden crypto miner named xmrig from their overheating Mac. The agent detected the malware consuming 1175% CPU and 12 cores, reaching 112 degrees Celsius. After the AI cleaned the infection, a subsequent Malwarebytes scan confirmed the system was secure.

Prosecutors state OpenAI engineer Abdulrahman Alfozan frequently messaged a Saudi royal during 2025 and 2026. The last contact occurred on Oct. 5, four days before his arrest on Oct. 9. Alfozan, 35, faces up to five years in prison for eavesdropping. He was charged with using a device to intercept oral communications in a meeting room.

Researchers demonstrate a vision-language model system that solves visual CAPTCHAs with 85.4% accuracy, surpassing specialized detectors. The system uses a fine-tuned YOLOv8 detector paired with an open-weight VLM to learn from screenshots, recovering from adversarial perturbations within one or two encounters without human annotation during a simulated year-long arms race.

MeitY established a sovereign-cloud committee in August to frame policy after consulting with Google, AWS, and Apple in September. C-DAC subsequently issued an Expression of Interest for sovereign cloud services and a tender for sovereign AI cloud and data-centre infrastructure to address national security concerns regarding AI infrastructure control.

Zcash developer Zakura proposes one-time viewing keys to stop quantum computers from linking shielded swaps via NEAR Intents. The fix requires no network upgrade and will reach wallets like Vizor in coming weeks. Around $600 million to $700 million flowed through this route by May, making the vulnerability significant.

A fake Web3 accelerator named Apex Accelerator uses malicious npm packages to spread malware and hijack AI agent traffic. The scheme targets cryptocurrency startups by offering free credits for Anthropic Claude and Google Gemini tools. Researchers found the operation distributed information stealers and backdoors for Windows and macOS systems since late July 2026.

A Chinese-speaking hacker used AI agents to breach over 100 company websites, attempting 1,200 intrusions. Victims included Deere, SharkNinja, and Cummins. The campaign cost roughly $5,000 in tokens and targeted sites in the US, Canada, Australia, and Japan starting September 25. Successful intrusions took around 23 hours.

A report released on Monday by the digital advocacy group Tech Transparency Project found that US teens can access 'nudify' apps despite parental controls. Researchers using accounts registered as 13 years old downloaded 135 apps with features to strip clothes or swap faces. While Apple and Google removed 25 and six apps respectively, users retained access to previously downloaded versions.

JPMorgan Chase invested $5 billion in startups during the first year of its U.S. security initiative, a faster pace than the planned $10 billion over a decade. The bank backed Hadrian, which uses 10 robots per human employee, and Castelion, a maker of the Blackbeard hypersonic missile founded in late 2022 by former SpaceX engineers.

Horizon3, a Singapore-based security validation company, received a strategic investment from EDBI and SG Growth Capital. The deal amount was not disclosed, following a US$250M Series E round in August 2026 that valued the firm at more than US$2 Billion. Horizon3 plans to use funds for expansion in Southeast Asia, Australia, and Japan.