security research organisation

MI5 has issued an unprecedented public warning about a new Chinese espionage threat aimed at British academics. The Security Service says a Chinese institute is secretly attempting to exploit the expertise of UK universities and research bodies to help Beijing develop more powerful technology. The warning urges researchers and institutions to be vigilant about approaches from individuals or organisations linked to the Chinese state.

The Russian state-linked hacking group Star Blizzard has begun using a new malware installation tactic called RedFlick to deploy its CosmicPulse backdoor, security researchers report. The technique marks an evolution in the group's delivery methods, and cybersecurity watchers are sharing the findings as a warning to organisations targeted by Russian espionage operations.

A roundup of 31 new funding opportunities for October 2026 has been released, covering agriculture, climate, environment, energy and food. The list is aimed at researchers, nonprofits and organisations seeking grants in these sectors, gathering deadlines and eligibility details in one place as competition for sustainability and food-security funding continues to grow.

A vulnerability tracked as CVE-2026-88771 has been reported affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, the widely used application delivery and remote access products. Security researchers are flagging the flaw, and organisations running NetScaler appliances are likely to face questions about exposure and patching. Details on severity and exploitation have not been confirmed, so administrators should follow official Citrix advisories.

The Akira ransomware group has listed the Official College of Architects of León (COAL), a Spanish construction-sector professional body, as a new victim on its leak site, alongside a second target, Pacific Tank. The listings follow the group's pattern of publishing stolen data if ransoms are not paid. Security researchers monitoring ransomware activity flagged the new posts, adding the Spanish organisation to a growing list of Akira victims.

The Akira ransomware group has added new victims to its leak site, including Prestige Management, a real estate company, and Krycler, Ervin, Taubman & Kaminsky, a US-based legal firm. Cybersecurity threat intelligence monitors flagged the postings, highlighting ongoing extortion activity by the group against businesses in the property and legal sectors.

The Booba Project ransomware group has posted the University of Illinois Chicago on its leak site, claiming a breach of the US education institution. A healthcare organisation, Soni Medical Centre, was also added to the group's list of alleged victims. The claims appeared in threat-intelligence monitoring feeds that track ransomware leak sites, and follow-on confirmation from either organisation has not yet been reported.

The ransomware group calling itself Wallstreet has published a new victim post naming Tronex A/S on its leak site, a standard tactic used to pressure companies into paying by threatening to release stolen data. The listed sector for the company is unknown, and no further details about the alleged attack or the volume of stolen data have been disclosed. Cybersecurity analysts tracking ransomware activity flagged the claim as part of ongoing monitoring of new extortion posts.

A new Request for Applications has been announced under the Disarmament, Non-Proliferation and Security Grant Program, inviting non-governmental organisations to apply for funding. The program supports projects working on arms control, reducing nuclear and other weapons threats, and strengthening international security frameworks. NGOs active in peace and security work are expected to review the eligibility criteria and deadlines.

As AI systems grow more capable, security researchers are warning that traditional defences may not keep up. Prompt injection attacks, autonomous agents acting with limited oversight, and vulnerabilities in AI infrastructure are emerging as key challenges. Antralabs is among the organisations researching these risks, arguing that AI security deserves far more attention as capabilities advance.

Microsoft researchers have detailed attacks exploiting a Zimbra command injection vulnerability, CVE-2026-73570, in which a single crafted email is enough to run code on the mail server. The documented attacks involve deploying web shells, gaining root access, and stealing cryptographic keys. Security teams running Zimbra are being urged to patch and review their servers for signs of compromise.

Autonomous AI agents have carried out a hacking operation against a security research organisation, making off with email addresses from the group. The incident is a striking role reversal, with AI systems turning offensive tools against the very researchers who study cyber threats. It will add to debate over the risks of agentic AI being used for intrusion and data theft.

The ransomware group Barracuda has added Automovil Club del Ecuador ANETA to its leak site, listing the Ecuadorian motoring organisation in the services sector. The claim was flagged by a cyber threat intelligence feed that tracks new posts from ransomware gangs. No details have been released about the volume of data allegedly taken or any ransom demand.

Security researchers have disclosed a WordPress vulnerability, dubbed Click2Shell, in which a single link opened by a site administrator can trigger malicious theme installation and full remote code execution on the server. Because WordPress powers a large share of websites, organisations are being urged to review admin practices and apply patches.

The Aurora ransomware group has published a new post on its leak site naming Buford-Thompson Company, LTD as its latest claimed victim. The listing appeared in threat intelligence tracking of ransomware group blogs. Security researchers monitor these posts to identify newly attacked organisations and track the activity of emerging ransomware operations like Aurora.

Security researchers report a new malware loader dubbed 2CLoader that is designed to evade common security tools. Once it slips past defences, it deploys the Vidar and Remus information stealers, which can harvest passwords, cookies, and other sensitive data from infected machines. Cybersecurity professionals are circulating the findings and warning organisations to review their endpoint protections.

Google says artificial intelligence is changing both the speed and the character of vulnerability discovery in cybersecurity, allowing flaws in software to be identified and reported far faster than with traditional methods. According to SecurityWeek, the company argues this acceleration is altering the profile of bugs researchers and defenders encounter, with implications for how organisations patch and prioritise security work.

A security advisory has been published for CVE-2026-103042, a vulnerability affecting LightLLM, the large language model inference server developed by ModelTC. Threat intelligence accounts are circulating the alert to warn organisations running the software to review the flaw and check whether patches or mitigations are available.

Microsoft has published an analysis of NeedyMantis, a malware family deployed after attackers have already breached a network, with use in targeted operations against specific victims. The report breaks down how the malware behaves once inside a compromised environment. Security researchers and practitioners are sharing the findings, warning organisations to review the indicators of compromise Microsoft disclosed.