OpenAI Shipped an Exploit-Writing Model. The Base Model Could Already Do It.
GPT-5.6-Cyber completes 95 per cent of exploit-chain prompts against 1.5 per cent for the general model it is built on....
Wire
ASEAN edition · Fri, 2 Oct 2026 · Signal over noise
Cybersecurity News
AI-curated tech news, ASEAN business intelligence, and cybersecurity updates — written for the region.
1056 articles
65 this week
14 desks
Health & Wellness
56
Cyber Threat Intel
48
Privacy & Data
47
Consumer Tech
45
Science
35
Cloud & Infra
28
Sustainability
17
Statistics
9
Advertisement
One Unrevoked Token, Three Tools Deep: Inside the LiteLLM Breach
Two poisoned LiteLLM releases were live on PyPI for forty minutes in March. CloudSEK has now mapped roughly 434,000 capt...
Microsoft Fixed 421 Flaws. Or 400. Only One Is Being Exploited.
Three different totals are circulating for the same Patch Tuesday, and all are defensible. The one number that matters i...
A SIM Card Can Order Your Phone Onto 2G. That Is in the Specification.
Birmingham researchers surveyed 26 devices and found nine expose an interface that lets the SIM issue modem commands. Th...
Three Days to Patch. CISA's Deadline Used to Be Three Weeks.
Every vulnerability CISA catalogued in the first week of August carried a three-day federal deadline. We measured the ca...
A Poisoned JSON Feed Made Hidden Admins on WordPress Sites
No plugin update was published. Attackers reached BdThemes storage, poisoned a feed the plugins pull into the admin dash...
A Signup Form Sent Passwords to Facebook and Google for Nearly Two Years
Klaviyo's signup form was misconfigured so third-party marketing trackers captured what users typed, including passwords...
You Patched SonicWall in Three Days. That May Not Have Been Enough.
Ransomware crews are now chaining two SonicWall SMA1000 flaws that CISA gave federal agencies three days to fix. If your...
Poland's Power Plants Were Reached Through the Mobile Network Nobody Watches
CERT Polska has documented the first real-world use of a private APN as a route into operational technology. Thirty wind...
A Zero-Day in a Dashboard Tool Took Framework's Entire Customer List
Framework and Tally were both breached on 3 August through a zero-day in Metabase, the business-intelligence tool they u...
Water Systems in Twelve States Were Broken Into. The Fix Is a Budget Line, Not Advice.
Water systems in at least twelve US states have been broken into, with attackers changing controller passwords and IP ad...
China Opened a Formal Review of Palo Alto. It Had Already Banned the Products.
China's Cybersecurity Review Office opened a formal review into Palo Alto Networks products on 6 August — seven months a...
MIT Broke Spectre v2 Defences. AMD Will Patch, Intel Will Not.
MIT researchers showed that Spectre v2 mitigations can be stepped around on current Intel and AMD processors, breaking K...
N-able's Patch Did Not Hold. The Second Hotfix Came Four Days Later.
N-able patched a critical authentication bypass in N-central, attackers found a path the patch did not block, and a seco...
Four VMware Flaws, and the One That Scores Lowest Is the One Hosting Providers Should Fix First
Two flaws score 9.8. The 9.3 lets an attacker with admin rights inside a virtual machine execute code on the host beneat...
A Researcher Found a Way to Switch Off a Singapore-Built Security Product
Three flaws in CatchPulse, the worst letting an unprivileged local user bypass policy enforcement. Reported 26 June, pat...
The Tomcat Flaw Being Exploited Today Was Created by a Security Fix
CVE-2026-34486 exists because of the fix for CVE-2026-29146. CSA reports active exploitation, and the catalogue lists th...
The Langflow Patch Deadline Is Today. Singapore Reported Active Exploitation Yesterday
CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments. CISA allowed three days; CSA...
The Test Data Was Supposed to Be Fake. It Held 70,000 Real NRIC Numbers
A Singapore Land Authority test dataset created in 1998 was meant to hold only mock records. It held real names, NRIC nu...
Three Days to Patch N-able. A Year Ago 92% of KEV Entries Got Three Weeks
CISA gave three days to fix an actively exploited N-able bypass. Across the catalogue, the three-week remediation window...
Singapore's Cyber Command Ran Its First Scam Sweep. It Was the Third in Six Weeks
Singapore stood up a dedicated Cyber Command on 3 July. Its first islandwide scam sweep was the third such operation in...
The Coldcard Entropy Failure Was a Build-Configuration Bug, Not a Cryptography Bug
A macro was defined and set to zero. One guard tested whether it existed rather than what it held, the linker bound sile...
Attackers Sweep 1,367 Bitcoin From Coldcard Wallets After Five-Year Firmware Flaw
Three waves of automated sweeps have taken about $89 million in bitcoin from 4,585 addresses since 30 July. The cause is...
A Password Was Built Into Cisco's Firewall Manager. It Is Being Exploited, and Agencies Had Three Days to Fix It
CVE-2026-20316 scores 5.3 — a medium. CISA still gave federal agencies three days and told them to check for compromise....
Advertisement