Author: Gary Behan

The United States Department of Justice has handed down the Cameron Wagenius hacking sentence: 70 months in federal prison, plus $294,978 in restitution, for a campaign that targeted at least ten US technology and telecommunications companies between April 2023 and December 2024. Wagenius, 22 at sentencing, is a former US Army soldier who was most recently stationed in Texas and went by the online handles ‘kiberphant0m’ and ‘cyb3rph4nt0m’.He was arrested in Texas in December 2024 and pleaded guilty in February 2025 to hacking AT&T and Verizon after being charged on two counts of unlawfully transferring confidential phone records. A second…

An OpenAI always-on assistant codenamed ‘o’ has surfaced in ChatGPT’s own product listings before any official announcement, offering a rare glimpse at where the company’s consumer AI is heading. References to the unannounced feature appeared briefly on the ChatGPT Pro plan page, where ‘o, your always-on assistant’ was listed as one of the plan’s benefits, before being quietly pulled.The listing placed ‘o’ alongside other Pro-tier perks: additional Work and Codex usage, maximum memory, 100GB of file storage, and early access to new features. That context matters. Bundling an always-on assistant with memory and generous storage suggests OpenAI is thinking of…

Two Citrix NetScaler zero-day RCE vulnerabilities, now formally identified as CVE-2026-88771 and CVE-2026-88772, were actively exploited against customer environments worldwide before Citrix published patches on 27 September 2026. The story began not with an official advisory but with administrators receiving urgent, detail-free phone calls from their IT suppliers telling them to pull their NetScaler appliances offline immediately. Warnings Spread Through Private Channels Before Any Official Disclosure The first public signs of alarm surfaced on Reddit, where Citrix administrators described being contacted by IT suppliers, security teams, law enforcement, CERTs and national cybersecurity agencies, all advising the same thing: shut down…

The ShinyHunters WAF bypass targeting Oracle PeopleSoft has resumed widespread exploitation, with the extortion gang now using a URL-encoding trick to slip past the firewall rules that organisations had deployed as a temporary shield against CVE-2026-35273. Google’s Mandiant and Threat Intelligence Group (GTIG) published a new assessment confirming the technique, and warning that patch installation (not WAF rules) is the only reliable protection. How the ShinyHunters WAF bypass PeopleSoft trick works The vulnerability at the centre of this campaign is CVE-2026-35273, rated CVSS 9.8. According to Decryption Digest, it is an unauthenticated server-side request forgery to remote code execution chain…

The Claude Opus 5.5 writing style has moved measurably closer to how humans write, with new analysis showing a near-elimination of em dashes, shorter sentences, and a sharper drop in semicolon use compared with its predecessor. The catch, if you want to call it one, is that the model has become more verbose in the process.Arena, an AI benchmarking tool, analysed high-reasoning Text Arena responses from August and September 2026 and found that 10 of 12 writing measures moved in what it considers a better direction for Opus 5.5 versus Opus 5. The headline figure is the em dash: Opus…

Microsoft has paused the distribution of KB5002907 after the update triggered KB5002907 Office licence deactivation across perpetual Office 2016 and Office 2019 installations, and, in a smaller number of cases, removed Office entirely from affected machines. The update, formally titled ‘Optional update for out-of-date Microsoft 365 Apps installations’, was designed to nudge Microsoft 365 Apps installations that are more than 90 days out of date back onto a current build for their assigned update channel. According to the KB5002907 release notes, it targets devices using Current Channel or Monthly Enterprise Channel, and Microsoft described it as optional, not something that…

Kiteworks has told customers worldwide to take their servers offline as part of a Kiteworks zero-day server shutdown precaution, after the company said it received credible threat intelligence from federal authorities warning that an attack may be imminent. The request, which is preventative rather than a response to any confirmed breach, asks customers to keep systems dark for a six-hour window.According to Sophos, reports emerged on 25 September that Kiteworks emailed customers warning that law enforcement had alerted the company to a potentially imminent cyberattack, possibly involving the exploitation of a zero-day vulnerability. The recommended shutdown window was between 02:00…

A cross-site request forgery (CSRF) flaw in the Elementor WordPress plugin, now tracked as CVE-2026-62062, can allow an unauthenticated attacker to create administrator accounts on affected sites, and doing so requires nothing more than a single malicious link opened by a logged-in admin. The Elementor CSRF admin account vulnerability has been assigned a CVSS score of 8.8, according to Beacon Lab, placing it firmly in the high-severity bracket. How the Elementor CSRF Admin Account Vulnerability Works The flaw lives in Elementor’s Editor Events module. When processing requests, that module checks the raw request URI for the string elementor/v1/events/ and, if…

Anthropic has opened up Claude Code cloud sessions to all eligible subscribers and is handing out up to $250 in free promotional credits to get them started. The catch, as with most promotional offers, is in the fine print: there are deadlines, eligibility rules, and a GitHub account requirement that not everyone will be expecting.Cloud sessions let Claude Code run on Anthropic’s own infrastructure rather than on your local machine. ‘Cloud sessions run on Anthropic-hosted infrastructure, so the work keeps going even without your computer running,’ Anthropic explained. You kick off a task, close the lid, and come back to…

Ardit Kutleshi has pleaded guilty over his role administering the Rydox marketplace, an illegal platform that traded in stolen personal data, login credentials, credit card details and cybercrime tools, leaving him facing a maximum of 22 years in federal prison. The Rydox marketplace guilty plea caps a case that began with coordinated arrests across two countries and a server seizure on the other side of the world.Kosovo law enforcement and Albania’s Special Anti-Corruption Body (SPAK) arrested Kutleshi, then 28, alongside two fellow Rydox administrators, Jetmir Kutleshi and Shpend Sokoli, in December 2024. The operation simultaneously shut down the platform, seized…