"Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday.

Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week.

These costs are expected to decline over time, though, with the contractors in place to help ease the initial burden of patching a large number of flaws, an issue that shouldn’t be so pronounced in the longer term."

ConnectWise posted to their status page that they're investigating unauthorized access events in the Cloud Backup platform (which used to be SkyKick).

So far they have NOT confirmed that anyone successfully got in, but third-party intelligence sources are saying that not only did someone get in, but also that the threat actor pivoted to the live O365 environments of customers of MSP's using ConnectWise Cloud Backup.

For reference, Cloud Backup is used by MSP's to back up all of O365, including EntraID. So if someone did break in and access data files... this is gonna be bad.

https://status.connectwise.com/

I’ve been thinking about this after reading more stories about attackers getting access through help desks rather than actually hacking anything. If someone already knows an employee’s full name, job title, manager, phone number, company email maybe even internal terminology from LinkedIn or leaked data, what is the help desk realistically supposed to ask that proves they’re actually talking to that employee?

Security questions seem useless, SMS can be SIM swapped, caller ID can be spoofed and now even voice or video isn’t something I’d completely trust. Obviously you can require manager approval or hardware keys for certain recovery flows but eventually somebody has to make a human judgment somewhere. For people working in enterprise security, what are you actually using for high risk account recovery or identity verification now? Is there a standard approach that works well or is everyone still building their own process?

i made my own c++ antivirus from scratch for more you can check this link-https://ozentime-antivirus.vercel.app/

Around 30000 repos were compromised with a supply chain attack

https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html?m=1

I have a new Libreboot release ready, that I'd like news sites to cover. Libreboot is free/opensource boot firmware that replaces proprietary BIOS/UEFI firmware and recently integrated EDK2 MrChromebox payload for full UEFI support - and added a lot of modern hardware. The 26.10 Ominous Olive release, released yesterday. I am Libreboot's founder and lead developer.

Highlights in this release include:

* MrChromebox EDK2 payload by default on most boards, with SeaBIOS CSM (CSMWrap) and GRUB EFI provided in-flash for backward compatibility.
* 233 new Chromebooks added; every board supported by MrChromebox coreboot. With our GRUB EFI/SeaBIOS CSM build added
* 15h.org coreboot fork used on KCMA-D8, KGPE-D16 boards for improved raminit.
* GRUB EFI build uses terminal_input console and no nativedisk; it piggybacks off of EDK2 drivers, like distros. It even works on Chromebooks (eMMC boot).
* Intel HAP bit set by default on Chromebooks, and IFD regions unlocked where appropriate
* Dell OptiPlex 5050 SFF, Supermicro X11SSH-F, ThinkPad X280, X270.

Modern Linux distros boot, with e.g. UKI/systemd-boot. Windows also compatible now (previous releases lacked UEFI).

Hi everyone,

I’m planning to do a Master’s in cybersecurity and I’d really like to hear from people who are already working in the field before I commit.

A few questions:

1. How is IT/cybersecurity going for you? Are you happy with the career, the workload, the pay, and the day-to-day work?
2. Is a Master’s worth it? Did you get your first job with a Master’s, or did certifications and experience matter more?
3. How hard is it to land an entry-level job after graduating? I keep reading that the market is tough for juniors, and I want an honest picture of whether that’s true.
4. What would you recommend I do during the Master’s (internships, home labs, CTFs, certs like Security+ or eJPT) to make myself employable by graduation?
5. Which roles are realistic starting points? SOC analyst, junior pentester, GRC, something else?

I’d appreciate any advice, including the blunt kind. Thanks in advance!

Threat Notice: Cisco NX-OS Nexus 3000 and 9000 Series Switches. Cisco disclosed five critical vulnerabilities in NX-OS, the operating system powering Nexus 3000 and 9000 Series data center switches last week. Making sure this gets seen more broadly. Action: apply the NX-OS updates.

References: Cisco Advisory: CVE-2026-76471 (NX-API): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j . Cisco Advisory: CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 (NGOAM): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU. Cisco Advisory: CVE-2026-76465 (MPLS OAM): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7

This year seriously feels like the year of the mega platform. Sign up with one vendor and say “good enough” for firewall, end point, DLP, email security, AI security, data security, etc etc etc