The US Treasury Department's Office of Foreign Assets Control (OFAC) said on 28 October 2026 that it had sanctioned 10 individuals and one entity for their roles in North Korean (DPRK) government-run IT worker schemes that defraud US businesses and generate revenue for North Korea's weapons of mass destruction and ballistic missile programs. Treasury says Russian national Vitold Viktorovich Obertas is an intermediary for illicit DPRK financial transactions, including for Amnokgang Technology Development Company (designated by OFAC on 12 March 2026), and has since January 2025 conducted nearly $2 million worth of cryptocurrency conversions and at least $1.25 million in other currency transactions for DPRK officials. Russian national Ilya Aleksandrovich Boykov has since 2024 supported Limited Liability Company Alis (designated in March 2024) by exchanging and converting an equivalent of $3.5 million in cryptocurrency transactions and providing logistical support. Kim Ki Hyok leads a Russia-based delegation of Alis IT workers and has transferred cryptocurrency for it valued at nearly $500,000 since 2024; Kim Hyo Dong leads a separate Russia-based Chinyong-subordinate delegation and has facilitated the transfer of over $100,000 in financial assets. The First Financial and Technical Development Center (FFTDC), a DPRK-controlled entity in Russia, was designated for exporting North Korean workers; Treasury says its IT workers use 'Super Intelligence (SI) tools' and complex cryptocurrency transfers, and that six Russia-based DPRK IT workers (Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il), also designated, collectively generated over $750,000 for it since 2025. Treasury says DPRK IT workers have also used their access to corporate networks to deploy malware, exfiltrate sensitive data and steal proprietary information, and that the United States is joined this month by Australia and the European Union in designating individuals and entities supporting the DPRK. The Record (28 Oct) also reported the action.
U.S. Department of the Treasury — Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses (28 Oct 2026)
In a research post published 27 October 2026, Anthropic says that over the past few months it used an unreleased, internal research model to find critical vulnerabilities in widely used software and shares details of five attack chains (an exploit chain links several flaws into one attack; a proof of concept is a working demonstration exploit). Anthropic says it reported each vulnerability to the affected vendor under its coordinated vulnerability disclosure policy, which gives developers 90 days to patch and a further 45 days before it discusses details beyond a public advisory. Per Anthropic: in Chrome, after initial prompting, Claude wrote a full chain (a V8 heap corruption bug, a V8 sandbox escape, a CacheStorage race condition and a use-after-free in FedCM) that runs arbitrary code outside the browser sandbox, with a proof of concept that launches Calculator on stock Chrome for macOS within seconds of a page loading, without further user interaction; Anthropic says 62 CVEs reported to Google have been assigned and patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes. In Safari, a data-only chain (a JavaScriptCore use-after-free, a Gigacage bypass and a WebContent sandbox IPC flaw) let any website bypass the same-origin policy and read Safari history, cookies and other data; Anthropic says Apple acknowledged the report the same day and its fix is available. On Android, an exploit chaining three flaws let an attacker extract photos and other personal data from a locked, stolen phone, tested on a Google Pixel 9. On Windows, an out-of-bounds read in the kernel's QUIC implementation let an attacker remotely crash machines that respond to HTTP/3 requests; Anthropic says Microsoft resolved it as CVE-2026-33096. On Linux, a race-condition use-after-free in the kernel networking stack lets a remote attacker run commands as root on servers with a multipath TCP listener; Anthropic says this flaw, CVE-2026-98432, was patched upstream and backported to all maintained stable kernel branches, and its proof of concept took 48 minutes to leak a kernel pointer and five more minutes to reach command execution. Anthropic says frontier models can now do this with little human involvement. Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Anthropic)
Anthropic — Discovering and exploiting vulnerabilities in critical, real-world software with Claude (27 Oct 2026)
His Majesty's Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published a report on Tuesday 27 October 2026 finding that hackers have repeatedly compromised third-party suppliers holding British police data since 2021, The Record reported. According to The Record, the inspectorate said the Police Digital Service and the National Police Chiefs' Council shared "information on multiple cyberattacks" affecting "third-party ICT supply chains which held police information", but the report does not say how many attacks took place, which suppliers or forces were affected, or whether data was stolen, and the inspectorate said it removed operational details it considered unsuitable for the public domain. The Record reports the Police Digital Service recorded 252 cybersecurity incidents affecting policing in the first three months of 2026, plus 796 "near misses", and warned that police data held on suppliers' systems is among the sector's biggest risks because it sits outside its monitoring. Inspectors found most police supplier contracts included no ongoing cybersecurity assurance, that in some cases staff could not say whether suppliers had to report incidents promptly, and that in several organisations supplier-held system logs were not routinely visible to in-house teams, according to The Record. The inspectorate also criticised the government for leaving policing and fire services out of the National Risk Register 2025, the Government Cyber Action Plan and the Cyber Security and Resilience Bill. "A major cyberattack is not a hypothetical scenario," said His Majesty's Inspector of Constabulary Michelle Skeer, as quoted by The Record. The Record says neither the Home Office nor the National Police Chiefs' Council responded to questions about whether police data was compromised in the supplier attacks. (source: The Record) The HMICFRS page could not be read by Cyberstack.
The Record — Hackers repeatedly breached suppliers holding UK police data, watchdog finds (27 Oct 2026)
The Parliamentary Information and Cyber Resilience (PICR) program has a budget of about $40 million over four years, Department of Parliamentary Services (DPS) chief operating officer and deputy secretary Nicola Hinder told Senate estimates, iTnews reported on 27 October 2026; the figure had been left out of budget papers, and Ms Hinder said the funding was first provided on a not-for-publication basis for commercial sensitivities. According to iTnews, Ms Hinder said the money is split across three streams: information assurance, cyber uplift and work on the Parliamentary Computing Network (PCN), and the electronic security systems that underpin Australian Parliament House. iTnews reports she said one of the first PICR streams is segmenting the PCN, which is used by parliamentarians, senators and staff and connects Parliament House to ministerial and electorate offices, so that parliamentary departments set and are accountable for their own staff's settings rather than sharing the broad permissions applied to parliamentarians; the multi-year uplift runs to 2029/30. iTnews also reports that after an audit found DPS lacked a single source of truth for cyber security risks, a new cyber governance, risk and assurance team built a centralised risk register and identified 104 historical risk assessments that were marked complete but had no assessment evidence, which it is now reviewing, and that Ms Hinder said the cyber security branch has been fully staffed for close to 12 months.
iTnews — Parliamentary Information and Cyber Resilience upgrade has $40m budget (27 Oct 2026)
The US Cybersecurity and Infrastructure Security Agency (CISA) released its new strategy, CISA 2030: Defend, Harden, Prevail, in a press release dated 26 October 2026. CISA says the strategy advances President Trump's Cyber Strategy for America and National Resilience Strategy and has three parts: Defend: Lead National Cyber Defense; Harden: Prioritize National Infrastructure Security; and Prevail: Mobilize National Resilience. CISA says it will work with public- and private-sector partners to strengthen the security and resilience of operational technology, advance software security, support secure emerging technologies and improve continuity of National Security and Emergency Preparedness communications, and that, in alignment with the Cyber Strategy for America, it will move from a passive defence posture toward an aggressive, anticipatory stance focused on identifying, mitigating and reducing malicious access to critical infrastructure. CISA Acting Director Nick Andersen said: "I call on every company and organization in the critical infrastructure community—from owners and operators to vendors and technology manufacturers—to act now." CISA sets out its priorities for the coming year: within 60 days it will begin reviewing its core services and capabilities, within 180 days it will provide a plan to implement the strategy and measure its results, and within 365 days it will report on its progress (source: CISA). According to Help Net Security, the Defend pillar includes leading national analysis and coordination to secure new technologies, including superintelligence and quantum computing, and under Prevail CISA will equip advisors across its ten regional offices. (source: Help Net Security)
CISA — CISA Unveils New Strategy to Strengthen National Cyber Defense and Critical Infrastructure Security (26 Oct 2026)
According to iTnews (23 October 2026), Australia has imposed targeted financial sanctions and travel bans on two North Korean individuals, Yu Pu Ung and Sim Hyon Sop, and two companies, Korea Mangyongdae Computer Technology Company and Chinyong Information Technology Cooperation Company, which help the regime place IT workers in remote jobs abroad to bring in foreign currency. iTnews says all four were already under United States Treasury sanctions. iTnews reports that the Australian government said the workers obtained remote employment while posing as nationals of other countries, breaching UN Security Council resolutions that prohibit North Korea's export of labour, and that the listings act on findings by the Multilateral Sanctions Monitoring Team (MSMT), which the government said had exposed North Korea's sanctions-evasion networks and 'the serious cyber security risks those networks pose to affected businesses'. Foreign Minister Penny Wong said in a statement, as quoted by iTnews: 'We are taking this action in coordination with international partners, including the European Union.' According to iTnews, the listings follow a warning from the Australian Sanctions Office (ASO) that North Korean workers are using stolen and doctored Australian drivers' licences and passports to win remote contracts. iTnews reports the ASO said Australia's competitive salaries and demand for contract IT staff make the country an attractive target, that local companies have been approached through LinkedIn, Fiverr and Freelancer as well as through recruitment firms, and that businesses should not rely on recruiters' due diligence and should watch for warning signs such as AI-generated interview answers, face-swap filters on video calls and logins from several countries in quick succession. iTnews says making an asset available to a listed person or entity without ministerial authorisation is a criminal offence: individuals face up to 10 years' jail and fines of up to $910,000 or three times the value of the transactions, whichever is greater, and companies face fines of up to $3.64 million on the same basis, though a business can defend itself by showing it took reasonable precautions and exercised due diligence. (source: iTnews) Correction (24 Oct 2026): this card previously credited the DFAT notice, the Foreign Minister's media release and the ASO advisory note directly; those pages could not be loaded to verify, so the card now credits iTnews and drops details iTnews does not report (the penalty-unit figures, the advisory note's publication dates and further red flags and advice). It also corrects the spelling of Mangyongdae. (source: iTnews)
iTnews — Australia sanctions North Korean IT worker bosses and financiers (Juha Saarinen, 23 Oct 2026)
Vodafone's parent company TPG Telecom said it analysed millions of scam calls on the Vodafone network between July 2025 and July 2026 and found that 98 per cent of them, more than 24 million calls, came via Symbio, a little-known internet phone company owned by Aussie Broadband, according to ABC News, which reported the analysis on 22 October 2026. TPG executive Vanessa Hicks told the ABC that every time it sees such a campaign it gives the evidence to Aussie Broadband to investigate and block the bad actors, and that it wants more urgent action closer to the source. According to the ABC, Vodafone's fraud team found that police stations in Western Australia, Queensland and South Australia and the Australian Federal Police had been impersonated by calls from Symbio's network, with over 2,400 calls in one scam in a single week in September, Hicks said. Aussie Broadband chief executive Brian Maher told the ABC that Symbio has about 500 customers who on-sell its phone numbers, that Symbio has no oversight of who they sell numbers to, which makes stopping scammers very difficult, and that 'where we find a persistent bad actor, then we will disconnect them'; he said the company uses detection software and a team of more than 20 people, and has made 'significant progress' over the past month. The Australian Communications and Media Authority (ACMA) said in a statement to the ABC that checks on that particular police-impersonation scam showed regulation was working, that the traffic was identified, notifications were passed upstream and blocking occurred, that the apparent sources were multiple overseas telcos, and that it did not identify non-compliance by an Australian telco. The ABC reports that ACMA warned Symbio in 2024 after finding it did not properly investigate scam calls and failed to share information quickly with other telcos, and in 2022 over failing to investigate and trace scam calls. Information Age (ACS) reported on 27 October that Vodafone's analysis of 25 million scam calls found 24.8 million (98.35 per cent) came from Symbio's voice network, and that Vodafone contacted regulators more than 160 times. (sources: ABC News; Information Age)
ABC News — Vodafone's owner accuses rival Aussie Broadband of being behind millions of scam calls to customers (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-110063, 'VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability': improper link resolution before file access ('link following', CWE-59) in VM Inspector for Azure Virtual Machines allows an unauthorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own cards. (sources: Microsoft Security Response Center; CVE record)
Microsoft Security Response Center — CVE-2026-110063, VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-96185, 'Microsoft Exchange Online Remote Code Execution Vulnerability': a stack-based buffer overflow (CWE-121) in Microsoft Exchange Online allows an authorised attacker to execute code over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own cards. (sources: Microsoft Security Response Center; CVE record)
Microsoft Security Response Center — CVE-2026-96185, Microsoft Exchange Online Remote Code Execution Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-105014, 'Azure Pipelines Remote Code Execution Vulnerability': command injection (CWE-77) in Azure Pipelines allows an unauthorised attacker to execute code over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Microsoft's temporal metrics mark exploit code maturity as proof-of-concept (E:P). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own cards. (sources: Microsoft Security Response Center; CVE record)
Microsoft Security Response Center — CVE-2026-105014, Azure Pipelines Remote Code Execution Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-83938, 'Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability': missing authentication for a critical function (CWE-306) in Azure Kubernetes Configuration Service allows an unauthorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own cards. (sources: Microsoft Security Response Center; CVE record)
Microsoft Security Response Center — CVE-2026-83938, Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability (22 Oct 2026)
On 22 October 2026 Microsoft's Security Update Guide published CVE-2026-108456, 'Azure AI Foundry Elevation of Privilege Vulnerability': server-side request forgery (CWE-918) in Azure AI Foundry allows an authorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency. Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own cards. (sources: Microsoft Security Response Center; CVE record)
Microsoft Security Response Center — CVE-2026-108456, Azure AI Foundry Elevation of Privilege Vulnerability (22 Oct 2026)
