| Dream says a suspected China-nexus actor chained the PHP2Shell flaws with a kernel bug to root 25 PAN-OS firewall and management servers, with Claude Code in its attack infrastructure Moved from The Hacker News to Dream's own post. The date is now October 26, the post's own publication date, not October 28. The quotation "the use of AI to augment the development process" was removed because it is not on Dream's page; Dream says the code's structure and style "suggest AI-assisted development" and that it has no direct evidence AI tools wrote the exploit or scripts. The 25 rooted machines are now described as PAN-OS firewall and management servers, and the three in the US government-affiliated environment as two firewalls and the internal management server. | |
| Chainalysis says an attacker using "offensive agentic techniques" got into its systems and internal tools Moved from The Hacker News to Chainalysis's own disclosure. The card had said investigation content, authentication credentials and session tokens were not accessed; Chainalysis's October 30 wording was that it had found no evidence of such access, and its November 4 update says an on-path attack exposed a subset of customer passwords. The card now says both. | |
| Upwind raises about $300 million at a roughly $3.8 billion valuation, less than eight months after its Series B Not altered, but superseded on its figure: the September 2 card carries CTech's report of about $300 million; Upwind's own release of October 28 says the Series C closed at $400 million at the same $3.8 billion valuation, carried as a separate item. | |
| A Dutch vulnerability-disclosure nonprofit says an autonomous agent, not a person, ran the attack on it Re-sourced from BleepingComputer to DIVD's own case file (DIVD-2026-00014) and raised from press to confirmed. The sentence stating that DIVD had not said which vulnerability was exploited was removed: DIVD named two Zammad zero-days on September 30, now carried as a separate item. The agentic attribution, the quotes and the statement that no model or lab is named are unchanged. | |
| Google says its agentic vulnerability-discovery system found 100-plus critical flaws in two days Date corrected from Aug 19 to Aug 18, the date of Google's own post, and a press figure for the number of pipeline stages replaced with the primary's description. Source moved from Help Net Security to Mandiant/GTIG. | |
| CISA flags active exploitation of a critical Ray AI-framework flaw, giving federal agencies three days to patch A sentence tying this CVE to Oligo Security's ShadowRay 2.0 campaign was removed. ShadowRay 2.0 exploits a different, older Ray flaw (CVE-2023-48022); the sources do not link the two. Source moved from press to the NIST NVD record. | |
| OpenAI says it cannot rule out a 'Critical' cyber capability in its unreleased Astra model and is holding back internal work Date corrected from Aug 10 to Aug 7, the date of OpenAI's own post, and the headline and summary softened to match it: the primary describes pausing internal Astra work that does not meet strengthened security controls, not a public release delay. Source moved from Axios to OpenAI. | |
| OpenAI launches Daybreak, gating a cyber-tuned GPT-5.6-Cyber model to vetted security partners Re-checked against OpenAI's own post. A press-only partner count and list, and a characterisation that partners received findings rather than the models, were removed as unsupported by the primary, which names three partners receiving model access. |