vulnerabilitiesPatches thick and fast: October bulletins from Microsoft and others
Microsoft’s October Patch Tuesday bulletin is breaking records again — it addresses 1,414 vulnerabilities. Here’s what you need to know.
Latest
side-channel attacksInjectEave: unavoidable eavesdropping method
We look at an unusual eavesdropping method that leverages the fundamental physical properties of electronic components.
ransomwareNew ransomware trends: hijacking Active Directory instead of encrypting data
In April, our experts investigated the PAYLOAD campaign — where the leverage wasn’t data encryption but a malicious AD group policy object.
AIThe direct impact of “tokenomics” on cybersecurity processes
We examine the impact of AI dependency on an organization’s cybersecurity.
Grand Scam Auto: how scammers target GTA VI fans before its release
Scammers are promising downloads of leaked copies of GTA VI, early access to the game, or a chance to become a beta tester. Here’s how you can spot these schemes and avoid falling into the trap.
Google patches 110 vulnerabilities in Pixel smartphones
Google has released its September security update for Pixel smartphones – fixing 110 vulnerabilities. One of the vulnerabilities appears to be being used actively in targeted attacks.
kaspersky academyHow can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it?
University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
WordPress arbitrary code execution vulnerability
CVE-2026-87902, a new critical vulnerability in the WordPress core, is already being actively exploited in real-world attacks.
“Denial of wallet” as a new DDoS attack against AI agents
What tokenomics is, and how the value of AI tokens has become a cybersecurity issue.
Gamers
Bad advice for gamers: ClickFix hits Steam forums
Steam forums are the latest battleground for ClickFix attacks. We break down how attackers disguise themselves as helpful commenters to trick gamers into installing a crypto miner on their PCs.
Vulnerability in Unity game engine
Any game based on the popular Unity engine made in the last eight years can allow attackers to get into your computer or smartphone. Here’s what to do about it.
Gamers under fire: malware on official websites
Official gaming websites and platforms may seem safe, but even there gamers occasionally encounter malware. We break down infection cases involving Endgame Gear, Steam, and Minecraft.
Gamers beware: Trojans have invaded Steam
If you still think that Steam, Google Play, and the App Store are malware-free, then read this fascinating story about PirateFi and other hacker creations disguised as games.
How scammers attack young gamers
Autumn is here, kids are going back to school and also meeting up with friends in their favorite online games. With that in mind, we have just carried out one of our biggest ever studies of the threats young gamers are most likely to encounter.
Live hack: Apex Legends esports tournament scandal
Hackers have long been engaging with the gaming world: from cracking games and creating cheats, to, more recently, attacking esports players live during an Apex Legends tournament. Regarding the latter, we break down what happened and how it could have been avoided.
Mario Forever, malware too: a free game with a miner and Trojans inside
Malicious versions of the free-to-download game Super Mario 3: Mario Forever plant a miner and a stealer on gamers’ machines.
Business
Not just a box to check: how small and medium-sized businesses can turn cybersecurity into a growth driver
We believe that investing in cybersecurity, like any other investment, should pay off. This post explains what a small company needs to make its security setup work for the business instead of staying a formality.
Exotic files: unexpected sources of cyberthreats
We break down the file formats that can be unfamiliar to some users, and that aren’t always scanned by security solutions but can still pose cyberthreats.
A dangerous matryoshka: everything needed to be known about polyglot malware files
Attackers are crafting files that devices can read as two different document types at once, and using these “nesting dolls” to smuggle in malware. How to detect and neutralize these two-faced files?
Lessons from the Hugging Face breach caused by OpenAI agents
An analysis of key characteristics of AI agent-driven cyberattacks, why open-source models are sufficient to execute them, and what measures can help defend an organization.
When ScreenConnect works for cybercriminals
How attackers distribute ScreenConnect under the guise of free software to deploy AsyncRAT.
I firmly believe that the concept of cybersecurity will soon become obsolete, and cyberimmunity will take its place.
Eugene Kaspersky
Business
