Anthropic’s Claude AI Model Accessed US Voter Data

Did Claude AI hack voter data? Security leaders discuss.

https://www.securitymagazine.com/articles/102696-anthropics-claude-ai-model-accessed-us-voter-data

8 Million Records Allegedly Stolen by AI Hacking Group

South Korean law enforcement apprehended seven suspects in connection with a cybercrime ring.

https://www.securitymagazine.com/articles/102695-8-million-records-allegedly-stolen-by-ai-hacking-group

PHP2Shell Exploited in the Wild

PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been exploited in the wild.

https://www.securitymagazine.com/articles/102693-php2shell-exploited-in-the-wild

Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Industrial giants such as Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have published advisories to inform customers about the impact of the recently disclosed PHP2Shell vulnerabilities on their products.

Several of these companies have confirmed that some of their industrial and operational technology (OT) products are affected. Others are still assessing exposure or have determined that their products are not impacted.

PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that can be exploited for unauthenticated remote code execution. PHP patched them on October 21 with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after information leaked online ahead of the planned disclosure.

The first exploitation attempt was seen on October 17, before the fixes were released, and Cloudflare has since reported millions of attempts. While the cybersecurity industry initially saw no successful PHP2Shell exploitation, the first confirmed attacks (aimed at honeypots) were reported over the weekend.

Schneider Electric has determined that three of its products are affected: EcoStruxure Security Expert, ProLeiT LINEoptimize (formerly Plant iT LMS), and EcoStruxure Control Engineering.

Customers can obtain the patched Security Expert version 1.48.4.0 from Schneider’s Customer Care Center, while ProLeiT support can provide a remediation for LINEoptimize. EcoStruxure Control Engineering users can only rely on mitigations for the time being.

Advertisement. Scroll to continue reading.

Siemens has informed customers that Ruggedcom APE1808 devices running Palo Alto Networks’ PAN-OS versions 10.2, 11.1, 11.2, 12.1 and 12.2 are affected. Customers have been told to contact Siemens support for patch information and to apply the workarounds provided by Palo Alto Networks.

In a separate advisory, Siemens shared a list of products confirmed as unaffected, including CADRA, DFMExpress, HyperLynx, Opcenter, PADS, Polarion, QuadView, Simcenter, Teamcenter, and Xpedition products.

ABB warned that Manufacturing Execution System (MES) deliveries that include DokuWiki, which is used to display help pages, are affected. Customers need to update the PHP packages on the servers hosting DokuWiki. ABB subsidiary B&R said its APROL process control system is affected in versions up to R 4.4-65. Patches were expected on October 26 and October 29.

Rockwell Automation is checking whether any of its products rely on a vulnerable PHP version. “As of the date of this notice, no Rockwell Automation products have been confirmed as affected,” the company said in an advisory.

Other OT vendors investigating PHP2Shell impact

Johnson Controls has released patches for several Illustra product lines, including Flex4, Pro4, Gen5 and Essentials Gen 4 devices. Its Visonic PowerManage product has been fixed in version 5.0.45.

Belden said all versions of its NetModule NRSW are affected, including the latest mainline release, and a patched version has yet to be released. In the meantime, the company recommends disabling the web interface. Belden’s macmon versions 6.x and 7.x are affected as well. A patch is available for 7.x, while 6.x users have been advised to upgrade.

HMS Networks has released a firmware update for Netbiter devices. HMS also said it has patched or removed vulnerable PHP versions from its Talk2M services and Argos documentation server, and that it found no indicators of compromise. Anybus products are not affected.

Wibu-Systems said the web interface of CodeMeter License Central and its PHP-based extensions are affected. The company has released updates.

Hitachi Energy is investigating whether any of its products are affected, and Moxa determined that none are impacted.

https://www.securityweek.com/industrial-vendors-check-products-for-php2shell-vulnerabilities/

Genesys Hack Exposes Customer Data From Internal Systems

Customer experience company Genesys says it has contained a cyberattack that involved unauthorized access to data.

Headquartered in Menlo Park, California, Genesys is a provider of customer experience and call center technology for mid-sized and large organizations.

On October 19, the company announced that hackers had accessed internal business systems, including a learning management system (LMS) and a customer relationship management (CRM) environment.

The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms have not been compromised, and the customer and partner data stored within those systems was not affected, it said.

As part of the incident, the attackers accessed and likely downloaded information such as “business and account information used to manage relationships with existing and prospective customers.”

The potentially compromised data includes names, phone numbers, business email addresses, job titles, company and account information, and other customer interaction information.

Advertisement. Scroll to continue reading.

Genesys immediately deployed containment measures, which included suspending the LMS platform, and on October 23 announced that the incident has been fully contained.

“We have confirmed that the Genesys Cloud, Genesys Engage and Genesys Engage Cloud platforms were not compromised, and there was no unauthorized access to the platforms, customer and partner environments, or customer and partner data stored or processed within these platforms,” the company said.

On Friday, Genesys said its investigation into the scope and impact of the incident remains ongoing, but promised additional details as it reviews the information accessed and as material facts are confirmed.

The company cautioned customers to watch for suspicious communications impersonating Genesys, stressing that it would never ask customers for sensitive information such as passwords via email or other unsolicited channels.

Genesys has not named the attacker, but a recently emerged group called ScarlettGroup has claimed the attack on its leak site.

https://www.securityweek.com/genesys-hack-exposes-customer-data-from-internal-systems/

Stolen AI Reasoning Could Help China Build Cheaper Rivals

OpenAI, Grok, Claude and Gemini don’t simply help us, they have also been tricked into helping China produce cheap rivals.

Frontier AI generally includes a public API to let developers interface specialized apps with their AI engine. It allows a user application to query the AI and receive a response. The response generally includes the model’s reasoning steps in reaching its response. The reasoning is returned to the model in any subsequent query, allowing the model to maintain contextual continuity of ‘thought’.

The size of this process is kept reasonable through a process of context compaction, where the accumulated conversation history, tool calls, and workspace state are compressed into a summary before overflowing the context window.

Attackers consider any API a potential doorway into a target. In this case, can any secrets be gleaned from the reasoning output, and/or can the model itself be poisoned by malicious input? In August 2026, Stealing Reasoning Traces from Proprietary LLM APIs reported an ability to extract PII via this reasoning process. “The paper showed that encrypted reasoning from a frontier model can be replayed into a weaker model from the same provider, which can then be coerced into transcribing it,” explains Xint in a new report.

The original paper started the standard process of developer-hardening and researcher-probing. For example, OpenAI rapidly deployed mitigations to this threat, and Xint has subsequently discovered a way (which it calls Compaction Smuggling) to bypass these mitigations – which OpenAI has now also mitigated.

While OpenAI’s first mitigations reduced the threat of PII exposure and model poisoning, knowledge of a model’s reasoning process can still be stolen (compaction smuggling) and used to cheaply build a new rival AI model (distillation). Distillation is the process of using stolen AI reasoning secrets from an advanced model to help cheaply build a rival model.

Advertisement. Scroll to continue reading.

OpenAI confirmed the new issue of compaction smuggling, fixed it and awarded Xint a $6,000 bounty on October 23, 2026. Compaction smuggling moves one model’s reasoning to another model by encoding it inside a compaction requiring three steps. The first step is to obtain reasoning by submitting a task (for example, from gpt-5.6-sol). The second is to steer or shape the returned compaction. The third is to send the result to a different AI model (for example, gpt-4.1 and gpt-4o) with the request (reports Xint), “to output its input exactly as-is, which they happily did.”

Simplistically, although the process detail is more complex, Xint’s new attack still just asks a second model to decipher and decode the first model’s security. “This works because OpenAI’s August mitigations only block replaying reasoning into a different model, and the compaction call runs on the same model that produced the reasoning. The attack worked at every reasoning effort we tried,” reports Xint.

Compaction smuggling allows large-scale distillation of frontier OpenAI models. While this distillation may not seem a serious threat, it seriously is. In early September, CISA issued a warning, stating: “Likely with Chinese government awareness, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024. DeepSeek has conducted organized campaigns since at least 2024 targeting reasoning capabilities, specialized optimizations, and domain-specific functions to train its R1 and V3 models.”

The examples of Chinese AI being used against US interests are myriad. The tragic irony is that much of this capability may have been stolen (distilled) from western AI.

https://www.securityweek.com/stolen-ai-reasoning-could-help-china-build-cheaper-rivals/

Taxpayers May Pay Up to $25,000 to Address County Data Breach

Taxpayers may be paying the price for a data breach.

https://www.securitymagazine.com/articles/102692-taxpayers-may-pay-up-to-25-000-to-address-county-data-breach

Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave

Tel Aviv-based Mave was founded in 2025 by Unit 8200 alumni Guy Eshel (CTO) and Raziel Oren (CEO).

The funding announced on October 22, 2026 comprises $6 million seed funding (raised at the time of founding) and a new $28 million Series A round led by Red Dot Capital Partners, with participation from Lumir Growth Partners. Dell Technologies Capital and Emerge Ventures, who led Mave’s $6 million seed round, also participated in the Series A round.

The funding will be used to accelerate Mave’s frontier AI research, strengthen the firm’s enterprise product lines and grow the company’s global presence. Current staff levels are around 30, but this will be increased with new hires focused on go-to-market and AI research roles.

Mave employs AI to solve some of the problems created by AI. Firstly, adversarial use of AI has dramatically increased the speed of attacks. At the same time, internal use of AI generates huge volumes of useful data that could be used to counter the attacks – if the security operations team could see, manage and act on the data with sufficient speed.

“Enterprise security teams are overwhelmed by huge amounts of data and dozens of security tools, and still cannot respond fast enough when a real incident occurs,” explains Mave. Put simply, the traditional SIEM defenses cannot keep up with the speed of the increasingly automated kill chain used by AI-assisted attackers. Current security stacks may see the attack but cannot present the data to the security team in a useful form and speed. There’s a simple motto: you need to use AI to counter the effect of AI.

“Security teams still investigate threats one tool at a time, manually piecing together evidence before they can reach a verdict. Attackers do not wait. Every pivot adds delay, and every delay creates risk,” comments Oren.

Advertisement. Scroll to continue reading.

Mave’s solution is to use AI agents to create and automate SecOps with a single agentic defense system. It pulls live context from the existing security stack and works with fine-tuned SLMs and frontier LLMs to generate context-based reasoning for the security team in near real time.

“Mave is built to reduce risk, by giving security teams AI that can keep pace with attackers, show its work, and know when human judgment is required,” Oren continues. “Security operations is where we start, but the goal is more ambitious – to make AI a responsible and accountable part of how the modern enterprise protects itself.”

For now, Mave is not promising end-to-end automation. Technically, AI agents are able to physically complete the actions that are suggested by its own data analysis. Mave currently stands back from this. “Autonomy without control is a risk. The right model is governed: least-privileged integrations, approval gates when needed, and a full audit trail of every action and decision.” This is what it offers now – but we are still in the very early days of agentic AI development and evolution.

Mave’s agentic SecOps will undoubtedly reduce alert fatigue among the remaining security operations team members. It will also reduce the cost of staff overheads to the company, simply because many humans will be replaced by agents. This is the automated march of progress: more work performed with less human error by fewer humans – and fewer positions available within the cybersecurity marketplace.

https://www.securityweek.com/former-unit-8200-officers-raise-34-million-for-agentic-secops-startup-mave/

Knicks sent employees fake offer of championship rings in phishing test: Report

“Ring orders, designs, and measurements can take time, and not every coaching staff for every defending champion gets its rings on ring night… The Knicks assistants were told they would receive championship rings eventually, but many longtime employees at Madison Square Garden, including some who work in the Knicks’ business operations, will not receive rings at all, team sources told The Athletic,” Vardon wrote.

MSG employee hopes were raised “at the end of September when the Knicks sent an email to a long list of employees, which gave recipients a first glimpse at their would-be championship rings,” Vardon wrote. The email included “a graphic of two differently styled rings” that the lucky employees could supposedly choose from, the article said.

“(Employee name), this one is on the house. MSG is issuing a complimentary employee championship ring. The same jeweler, the same craftsmanship, personalized with your name. No cost to you,” the email said. “There are two designs to choose from: Championship Gold and Garden Classic. Reserve the one you want below.”

Vardon wrote that “multiple team sources” confirmed the email was a phishing test. It’s not clear how many employees clicked the link, and it wasn’t immediately clear how many employees will eventually get some type of championship ring.

We contacted the Madison Square Garden Sports organization with these questions and received a statement after this article was published. The statement called the phishing test “an unfortunate mistake,” and detailed plans to give rings to staff.

MSG’s statement said the company “sent out an email to its corporate team as a simulation of a phishing attack designed to strengthen our security against hackers. MSG was recently hacked and extorted using an employee login and password obtained through a similar phishing attack. Using the rings as a lure to gain employees’ attention was an unfortunate mistake.”

As for the ring-distribution plan, MSG said it “is gifting more than 275 championship rings and jewelry to players, coaches, employees and other members of the Knicks family, worth more than $3.7 million, in recognition of their contributions and celebrating this achievement.”

This article was updated with MSG’s statement.

https://arstechnica.com/tech-policy/2026/10/knicks-sent-employees-fake-offer-of-championship-rings-in-phishing-test-report/

U.S. Banks Detect Unauthorized AI Agents Accessing Accounts

Unauthorized third-party AI agents are accessing banks in the United States, with some attempting to act independent of user instructions.

Major U.S. banks have detected this activity and have warned that differentiating legitimate customer activity from autonomous AI agents with credentials is a challenge. As a result, many institutions are limiting third-party AI access or restricting agents to read-only permissions.

Below, security leaders share their concerns and insights.

Security Leaders Weigh In

John Strand, Owner, Black Hills Information Security:

This is a real gap in traditional penetration testing. Financial institutions often have very clearly defined lines that testers cannot cross, and gaining access to actual customer accounts is usually off-limits. For good reason.

Good testing firms work with the institution to set up dedicated test accounts and controls so those attack paths can still be evaluated safely. But that approach isn’t applied consistently, and restrictions intended to protect customers can leave a security blind spot if there’s no safe way to test those paths.

Attackers don’t have those restrictions. Neither do the AI agents they deploy. They don’t care about your scope or your rules of engagement. If there’s a weakness in how someone can gain access to a financial account, they’re going to try to exploit it.

I suspect we’ll see more of these attacks as ransomware groups and nation-state actors use AI to test those paths at scale. Authentication and account access need to be tested more thoroughly. Keeping customer accounts out of scope cannot mean leaving the controls protecting those accounts untested.

Ted Miracco, CEO, Approov:

There is no “machine gone rogue” in this story. There are only irresponsible people handing banking credentials to AI software, and vendors shipping agents that ask for them. Both are human decisions and both should carry the financial consequences; however, right now neither clearly does.

We are building agents to impersonate customers and then using shared credentials which means a bank cannot tell an authorized agent from an attacker using the exact same login. That is more of an identity failure than an AI failure. Until agents carry verifiable identities, scoped permissions and an audit trail, blocking them is the best defensible control a bank has.

John Carberry, Solution Sleuth, Xcape Inc.:

The business impact is the collision between open banking mandates and credential-driven artificial intelligence automation, creating immediate fraud and compliance risks for financial institutions. AI companies are aggressively deploying products designed to parse through financial records, which has directly led to this situation where automated tools operate with delegated credentials. While sensationalized as rogue agents, the technical reality is that consumers are willingly handing over access to third-party tools that execute poorly scoped workflows. Security leaders must differentiate between authenticated human sessions and automated toolchains by enforcing API-based access controls and rate limiting. Prioritize transitioning away from legacy credential sharing by accelerating Section 1033 compliant OAuth flows and restricting unauthorized bots to read-only access. Defenders should anticipate this exact threat model migrating quickly to other sectors: healthcare records are next, as similar AI parsing products already exist in that space.

Critical Takeaways:

AI tools parsing financial records are driving an increase in automated, credential-based access that traditional controls struggle to identify.
Banks must deprecate legacy credential sharing and accelerate API-based, read-only OAuth flows.
The healthcare sector is the next immediate target for these autonomous data-parsing agents due to the proliferation of similar AI products

If you think the financial bots are bad, wait until they start diagnosing your medical history.

https://www.securitymagazine.com/articles/102690-us-banks-detect-unauthorized-ai-agents-accessing-accounts