Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk

The Florida Department of Education (FLDOE) says hackers breached its student financial aid website, potentially exposing the personal information of roughly 4.9 million people.

The department discovered the intrusion on October 19. It says it launched its incident response procedures after detecting the threat and has since contained the breach.

“At this time, we believe the incident was limited to the Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org) and may have impacted approximately 4.9 million individuals,” the department said.

The website is the online hub for Florida’s state-funded scholarship and grant programs. FLDOE warns that anyone who has applied for financial aid in the state in the past could be among those affected.

Names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, and gender codes are among the data types the attackers may have accessed.

“Not all individuals were necessarily affected, and the specific information involved may vary by person,” FLDOE noted.

Advertisement. Scroll to continue reading.

The department has not disclosed how the attackers got in or who is responsible, and no threat group appears to have publicly claimed the attack. The Florida Digital Service and the Florida Department of Law Enforcement are assisting with the response.

The department has cautioned that some of its websites and online services may be disrupted for a time as remediation continues.

According to FLDOE, students’ existing aid is safe. The breach will not delay the disbursements and tuition payments it handles, nor will it change eligibility for its scholarships, grants, and student loans.

The breach follows a September incident at the Florida Department of Highway Safety and Motor Vehicles (FLHSMV). That agency confirmed hackers had accessed its driver database after the ShinyHunters extortion group claimed to have stolen more than 200,000 driver records.

FLHSMV traced the intrusion to compromised credentials belonging to a local police department user but did not name ShinyHunters.

https://www.securityweek.com/florida-student-aid-website-hack-puts-data-of-4-9-million-people-at-risk/

Revolve Data Breach Impacts at Least 200,000 People

Online fashion retailer Revolve is notifying at least 200,000 individuals that their personal and payment card information was stolen in a data breach.

The incident occurred on September 11 and involved unauthorized access to certain systems, including the company’s online shopping platform.

Immediately after learning of the cyberattack, Revolve initiated incident response and contained and remediated the unauthorized activity.

The company’s investigation into the incident determined that the hackers may have accessed and exfiltrated the names, addresses, payment card numbers, and payment card expiration dates of customers who saved the data to their accounts on the company’s e-commerce platform.

“This incident has not resulted in operational disruption or interrupted service to any customers, and as of the date of this report, the company does not believe this incident will have a material impact on its business,” Revolve said in a filing with the US Securities and Exchange Commission.

The fashion retailer said it has notified law enforcement and retained a cybersecurity company to help with the remediation efforts.

Advertisement. Scroll to continue reading.

Last week, the company started notifying the potentially affected individuals of the data breach. Based on notices filed with the Attorney General’s offices in Iowa, Massachusetts, South Carolina, Texas, and Vermont, Revolve sent notification letters to at least 197,072 people.

The company is not providing the affected individuals with free identity theft or credit monitoring services, but reminds them to review their account statements and remain vigilant for incidents of fraud or identity theft.

Revolve has not shared the number of impacted individuals or details on who hacked it and how. SecurityWeek has emailed the company for additional information on the data breach and will update this article if it responds.

*Updated the number of affected people to add 17,813 South Carolina residents.

https://www.securityweek.com/revolve-data-breach-impacts-at-least-180000-people/

Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new $250,000 top-tier reward for security weaknesses that could lead to full administrative control.

The premier payout is “specifically designed to recognize high-impact architectural research” and will be handed out to researchers who can demonstrate gaining ‘roles/owner’ privileges or complete IAM control over arbitrary Google Cloud organizations or projects.

According to the internet giant, to qualify for the reward, the exploit path should not depend on pre-existing access to a project, previously compromised credentials, or user interaction/social engineering.

Reports that demonstrate remote code execution (RCE) in Borg (Google’s underlying production infrastructure) or root-in-production will also be evaluated for the new $250,000 root-in-cloud reward.

“Because code execution in Borg has the potential to impact service availability or cross-tenant data, researchers must halt all probing immediately upon achieving any execution in Borg. Escalation, extracting production credentials, and lateral movement are not allowed and will result in researcher disqualification,” Google Cloud CISO Chris Betz said.

The company has added the root-in-cloud validation criteria to its Cloud VRP page, explaining that it will award the bug bounty if its analysis of the initial entry point, execution context, and attack surface demonstrates that full arbitrary tenant or project takeover is possible.

Advertisement. Scroll to continue reading.

“Identifying tenant-isolation bypasses and complex cross-service logic flaws requires human creativity, intuition, and rigorous systems analysis combined with the power of agentic systems,” Betz noted.

According to Michael Cote, Google Cloud’s vulnerability reward program lead, first-time researchers who combine their own intuition with agentic tools are finding more interesting bugs, on average, than novices did two years ago.

He also pointed out that finding bugs eligible for the new root-in-cloud tier requires deep architectural intuition and AI.

“High incentives require clear, safe rules of engagement. We never want researchers testing exploits against real customer projects. Instead, we created a deterministic proof-of-root mechanism using a designated service account. Researchers can cryptographically prove unauthorized access against that identity,” Cote said.

https://www.securityweek.com/google-introduces-250000-root-in-cloud-bug-bounty-reward/

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Cursor users have been targeted with malicious versions of Anthropic’s Claude Code extension in a new supply chain attack.

The incident occurred on October 29 and involved versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension, which were live in the Cursor VS Code Extension Marketplace for roughly 11 hours.

Aiming at both macOS and Windows users, the extension contained JavaScript code designed to run when modules were loaded to establish a reverse SSH tunnel.

Roughly 5,000 developer systems might have downloaded the malicious versions, security researcher Kevin Beaumont notes.

The modified extension versions were not developed by Anthropic, and neither was pushed to the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry.

“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Rieseberg said.

Advertisement. Scroll to continue reading.

To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.

Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.

Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.

“We have no evidence that other versions of the extension or the official distribution are affected,” Cursor said.

The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.

“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,” Microsoft notes.

The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.

According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.

Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.

“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.

https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/

Chainalysis Discloses Data Breach Following AI-Driven Cyberattack

Blockchain analytics company Chainalysis has announced falling victim to an AI-driven cyberattack that resulted in a data breach.

“This month, Chainalysis detected an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools,” the company said.

The incident, it pointed out, is not related to the recent $6.36 billion Binance heist that was blamed on North Korean hackers.

According to Chainalysis, the attack did not result in the compromise of investigation content, transaction or query results, passwords in clear text, or other credentials and secrets.

“Some non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform were accessed, including such information relating to your organization and users,” Chainalysis said.

The company continues to investigate the full scope of the data breach and has not disclosed how many individuals were potentially affected.

Advertisement. Scroll to continue reading.

“Our teams have been working around the clock to investigate unauthorized activity, patch vulnerabilities, and harden our systems,” it said.

Chainalysis noted that it has observed an industry-wide rise in AI-driven cyberattacks, as many other tech platforms have been hit in recent weeks.

The company has been working with external cybersecurity experts and LLMs to review its security posture and strengthen it against these evolving threats.

Because names and email addresses were compromised, it recommends that users watch for unexpected authentication prompts and password reset requests, and make sure they have MFA enabled.

https://www.securityweek.com/chainalysis-discloses-data-breach-following-ai-driven-cyberattack/

How Digital Mapping Supports Operations, Safety and ROI

A security director at a 12-building healthcare campus gets asked a question she hears more often now than five years ago: “Does your tech stack do anything besides security?”

It’s a fair question. Every system purchase gets scrutinized by finance, IT, operations and the C-suite. A platform that only serves one department is harder to justify than one that serves four. Security directors who understand that digital mapping supports far more than their own team have a stronger case for the investment and a bigger seat at the table when enterprise technology decisions get made.

The Security Case Is Clear

Indoor mapping gives security teams something most existing platforms don’t: a shared digital map layer that every other system can point to. A camera feed gets context when it’s anchored to a specific hallway on a live map. An access control event becomes actionable when an operator can see the door relative to stairwells, elevators, and adjacent access points. An intrusion alert stops being abstract when it’s pinned to a room a security guard can navigate to with turn-by-turn directions on a mobile device.

Most security stacks already have the detection covered. VMS, access control, intrusion sensors, fire panels and IoT devices all generate alerts. What they don’t do well is answer the location questions that matter during an incident: where exactly is this happening, what’s nearby, and what’s the fastest route there? Indoor mapping answers those questions once, for every system simultaneously.

That value is well established. What’s less discussed is the practicality of how one map powers multiple uses for different teams in the same organization.

Same Map, Different Views

A facilities manager at a 600,000-square-foot commercial property deals with work orders, equipment inspections, HVAC zones, fire suppression and electrical panels. Most of that information lives in spreadsheets, legacy maintenance platforms, or the institutional memory of staff who have been around long enough to know where things are.

When indoor maps are available to facilities, every piece of equipment ties to a specific location. A work order for a leaking pipe on the fourth floor becomes a pin on a map showing the nearest shut-off valve, the access route, and whether the affected area overlaps with tenant space. Preventive maintenance schedules can be visualized, reducing time technicians spend searching for equipment and locations.

Facilities teams don’t need a different map than security. They need a different view of the same map. When a water leak happens at 2:00 AM, security is the first to respond, not maintenance. A shared map with permission-based access lets each department see the view and layers relevant to their work, having the exact same intel without maintaining competing versions.

Operations, Events and Visitor Experience

Large venues run events that require coordination across many teams. Setup crews, catering, AV, guest services, medical staff and security all need to know the layout. For outside vendors, working in an unfamiliar space for the first time can be intimidating. A shared digital map eliminates that feeling. Event teams can plan layouts, assign zones, and distribute the map to every vendor before the event starts.

The same maps solve another common problem: people getting lost inside complex buildings. Hospitals, airports, universities, stadiums and commercial properties all deal with it. Wayfinding gives visitors turn-by-turn navigation on their phone, running on the same indoor map. A security operator sees cameras and alert pins. A visitor sees a consumer-friendly map with directions. Operations teams change venue layouts for different events. Same data foundation, different front end. For property managers, wayfinding also becomes a tenant amenity, a self-touring option, and a leasing tool that signals a well-managed residence.

Space Utilization Becomes Visual and Vital

Occupancy data from IoT sensors, badge swipes and Wi-Fi analytics is more useful when it’s mapped. Knowing that “Zone 3” had 40% utilization last quarter means little until you can see it’s a cluster of meeting rooms on the second floor, consistently underbooked while first-floor rooms are overutilized. Corporate real estate teams making decisions about lease renewals or office consolidation need that spatial context. Overlay foot traffic data, search locations, and dwell time for a better understanding of how space is used throughout the day, week, or month. When the mapping layer is already in place, extending it to other uses such as space planning is incremental, not a new project.

The ROI Conversation Changes

Security directors typically justify spend through risk reduction, response time and compliance. Those arguments work well, but they resonate mostly within the security function. When the same platform also supports facilities, event operations, visitor experience, and space planning, the conversation shifts from “security expense” to “enterprise infrastructure investment.”

A digital mapping platform that serves five departments costs less per department than five separate solutions serving each one. It also eliminates the maintenance burden of keeping multiple floor plan sources in sync, a problem anyone who’s coordinated updates across PDF floor plans, CAD files, and legacy schematics knows too well.

The organizations getting the most from indoor mapping recognized this early. The possibility that any team could have initiated the investment in an indoor mapping platform because the need was urgent is worth highlighting. Security wanted to modernize their legacy floor plans. Then facilities plugged in, then operations, then guest services. The map became shared infrastructure underneath all of them.

The Question for Security Leaders

Most security directors never realized they would pitch enterprise infrastructure platforms. But the ones who recognize that their mapping investment serves the broader organization get their proposals approved faster, with bigger budgets, and with more organizational support.

The building doesn’t belong to one department. The map shouldn’t either.

https://www.securitymagazine.com/articles/102639-how-digital-mapping-supports-operations-safety-and-roi

Hackers Hijacked DebugBear’s DNS To Serve Malicious JavaScript via @sejournal, @vahandev

Malicious JavaScript was found in DebugBear’s monitoring script on October 29, 2026. DebugBear later confirmed that attackers had compromised its DNS records.
DebugBear told customers to remove its Real User Monitoring script from their websites.
SEO teams should ask developers and security staff to check for unauthorized access, malicious changes and backdoors.

DebugBear, a Real User Monitoring tool widely used by SEO experts, reported an attack. Site owners must remove its script and check for unauthorized access.

https://www.searchenginejournal.com/debugbear-rum-attack-seo-site-owner-actions/595412/

Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities.

The post Syrian Hacker Gets Prison Time in US After Over a Decade on the Run appeared first on SecurityWeek.

https://www.securityweek.com/syrian-hacker-gets-prison-time-in-us-after-over-a-decade-on-the-run/

Anthropic VS code extension on Cursor backdoored for nearly 12 hours

An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday. Anthropic so far has yet to warn customers of the incident.

The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday. The malicious version, 2.1.313, subsequently affected “at most 5,000 users,” presumably when they either downloaded it or their systems automatically fetched and installed it. Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont. Both Beaumont and the CTO and co-founder of security firm Phorian said that version 2.1.313 was distributed through Anthropic’s official account on Cursor. So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account.

In search of cloud credentials

“It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Phorian CTO and co-founder Luke Roberts told Ars. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.” Phorian has more details here.

Read full article

Comments

https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/

North Korea May Be Behind the $6.3B Binance Hack

Security expert insight on the $6.3 billion cryptocurrency heist.

https://www.securitymagazine.com/articles/102719-north-korea-may-be-behind-the-63b-binance-hack