Do Son OpenAI completed its transformation into a Public Benefit Corporation at a $500B valuation, with Microsoft retaining IP rights through 2032 and OpenAI committing $250B to Azure.
Apple Pay VP confirmed US Passports can soon be added to Apple Wallet as REAL ID for domestic air travel, though not for international border crossings.
Adobe's Firefly now features a timeline-based Video Editor (beta), Generate Soundtrack for licensed music, and Generate Speech for voiceovers, spanning the entire creative workflow.
ASEC exposed a flaw in Gunra Linux ransomware: its ChaCha20 keys are generated using an insecure time()/rand() seed, potentially allowing victims to brute-force decryption and recover files.
Herodotus is a new Android banking Trojan that evades anti-fraud systems by simulating human input: it inserts randomized typing delays (300-3000ms) during remote-control attacks in Italy and Brazil.
A path traversal flaw (CVE-2025-62725) in Docker Compose lets attackers overwrite host files via remote OCI artifact annotations, triggered by read-only commands.
Kaspersky exposed BlueNoroff's GhostCall/GhostHire campaigns, which use AI-enhanced lures (GPT-4o images) and trojanized apps to target executives and developers, deploying SilentSiphon spyware on macOS.
A flaw (CVE-2025-12080) in Google Messages for Wear OS allows any installed app to send SMS/RCS messages without permission by abusing ACTION_SENDTO intents.
Akamai warns of active exploitation of Magento's SessionReaper flaw (CVE-2025-54236). The critical (CVSS 9.8) vulnerability allows session hijacking and unauthenticated RCE via web shells.
AhnLab exposed Beast ransomware (Monster evolution) as a new RaaS threat, with 16+ victims by August 2025. It uses ChaCha20 encryption, deletes Shadow Copies, and features a hidden GUI control panel.
A Critical (CVSS 10.0) flaw (CVE-2025-61481) in MikroTik RouterOS/SwOS exposes the WebFig management interface over unencrypted HTTP by default, allowing remote credential theft via MitM.
Trend exposed the Water Saci worm, a self-propagating campaign that hijacks WhatsApp Web using Selenium/PowerShell. It uses a stealthy IMAP email C2 channel with HTTP fallback.
AhnLab exposed Rhadamanthys Infostealer hiding in games built with the Ren'Py engine. It uses a fake 1M-second loading screen to distract victims while injecting malware via a malicious Python script.
QNAP warns its NetBak PC Agent users to patch a critical ASP.NET Core flaw (CVSS 9.8) that allows attackers to hijack credentials via HTTP request smuggling.
Microsoft Teams is rolling out a new opt-in feature in December to automatically detect if employees are in the office by monitoring their Wi-Fi connection.
Elon Musk's xAI launched Grokipedia, an AI-generated encyclopedia powered by Grok that aims to challenge Wikipedia's bias with transparent sourcing
X is retiring the Twitter.com domain, requiring users with passkeys or security keys to re-enroll by Nov 10 to avoid being locked out of their accounts.
Amazon is reportedly planning to cut 30,000 corporate jobs across logistics, payments, and AWS as part of a major post-pandemic cost reduction effort.
Starting Nov 3, all new Firefox extensions must explicitly declare whether they collect user data. By mid-2026, this disclosure will be mandatory for all add-ons.
The Python Software Foundation (PSF) declined a $1.5M federal grant for security, citing US government stipulations that banned promoting DEI programs.
Google denies claims of a mass Gmail breach, clarifying that a new HIBP dump of 183M credentials stems from third-party infostealer malware, not a platform hack.
Cisco Talos reports Qilin RaaS is one of 2025’s biggest threats (40+ victims/month), abusing Cyberduck and Backblaze for data exfiltration and exploiting WDigest to steal admin passwords.