The Ministry of Cyber Affairs

Karnataka's Cyber Command Unit has dismantled an illegal SIM box network run from two apartments in Bengaluru's Whitefield area, seizing 10 GSM gateways with 320 SIM slots, some running e-SIM connections, and arresting four people in Tiroda, Maharashtra, over the alleged supply of SIM cards converted to e-SIMs. Police suspect links to digital-arrest scams, sextortion and fraud.

Two critical PHP flaws allow remote code execution. What NSA, CISA and PHP say, the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), and what is still unknown.

Eight eMudhra intermediate CA keys were weak enough to be worked out. What browsers did, who is affected in India, what to update and what is still unknown.

For one Platinum Reactor user with its add-ons, training and support, a reasonable price on public benchmarks is about ₹0.5–2 crore a year before GST. That range runs from Uttar Pradesh Police at ₹53 lakh, through the US Justice Department and FDA at about ₹1.35 crore, to about ₹1.9 crore per Romanian Platinum licence including training.

Pakistan's NCCIA received 5,176 cybercrime complaints in the first month after Director General Syed Ali Nasir Rizvi took charge, registering 4,491 inquiries but only 272 FIRs, about 5.3 per cent of complaints. It reported 1,129 arrests and PKR 10.53 million returned to victims.

Arattai, the Zoho messaging app, has begun binding accounts registered with Indian (+91) numbers to the active SIM on the user's primary device, under the Department of Telecommunications' SIM binding directions. Verification becomes mandatory for all signed-in +91 users on 30 November 2026. Tying a chat account to a live SIM closes a gap scammers exploit worldwide, and other countries and platforms should make it standard practice.

Pakistan's NCCIA Lahore says it has busted a cross-border synthetic identity fraud ring. Three suspects in Pakistan used AI-generated fake passports and photos, made by four Canada-based partners, to open accounts at major Canadian banks online. They got past photo verification with an anti-detect browser and ordered credit cards, which were delivered in Canada and maxed out before being dumped.

Southern Railway has told its divisions to act against passengers who play music, videos or reels on phone speakers in trains and stations. They can now be treated as causing a nuisance under Section 145(2)(a) of the Railways Act, as amended by the Jan Vishwas (Amendment of Provisions) Act, 2026. Offenders face a ₹1,000 fine and removal from the train, and repeat offenders face up to six months in jail or a fine of up to ₹5,000.

Only four of about 150 public European protest posts from October 2026 reached a like-to-follower ratio of 400% or more, and all came from accounts with fewer than 22,000 followers. One Facebook page with 38 followers drew 7,300 likes. Global outlets stayed under 1%. These four case studies show what Meta's recommendation system chose to amplify, and why.

India's I4C has sent Google five new takedown orders, dated 1 and 9 October 2026, covering 174 Firebase databases and phishing sites used in "Android God Mode" banking malware that steals OTPs, SMS and card data. The orders follow 57 takedowns in August and 216 on 20 September, bringing disclosed Firebase takedowns since August to more than 440.

Meta Pixel is a tracking code that websites use to measure their Facebook and Instagram ads. Each Pixel ID tags data to its owner. Scam networks abuse it by loading dozens of Pixels on throwaway job-scam sites before pushing victims to WhatsApp. Their habit of reusing the same Pixel IDs across domains is what links those sites to a single operator.

An appeal circulating in Chinese-language channels claims more than 400 Indians and 1,000 Chinese nationals are held at a scam compound called Koe Ma Nee near Myawaddy, Myanmar, at reported coordinates 17.139675, 98.263031. It alleges 18-hour workdays, electric shocks, sexual harassment, a Rs 10 lakh exit fee and at least seven Indian deaths. None of these claims have been independently verified.

A Yes Bank deputy manager in Jodhpur stopped an elderly customer from sending ₹31 lakh by RTGS to fraudsters posing as Mumbai Crime Branch officers, who had kept him under a three-day "digital arrest" over WhatsApp video calls. She spotted a misspelt beneficiary name and alerted the Jodhpur Cyber Thana, whose officers reached the victim and saved the money.

Deoghar Cyber Police in Jharkhand have arrested nine people accused of posing as customer care for Google Pay, PhonePe, Paytm, Flipkart, Amazon Pay and Airtel Payments Bank, and of sending victims malicious APK files disguised as PM-Kisan, electricity-bill and RTO e-challan apps. Police seized 12 phones and 12 SIM cards whose numbers and IMEIs are linked to fraud complaints in several states.

Kalamassery Police in Kochi have arrested Shahid Suleiman, 31, of Chembrassery in Malappuram, the main accused in a case where cyber fraud money was used to buy Rs 62 lakh worth of gold from a leading jewellery store. He had been hiding in Bengaluru, Wayanad and Kozhikode for about a month and a half. Police seized a BMW car and a fake Aadhaar card.

Fake overseas job and visa offers cost workers thousands. Red flags, how to verify a recruiter by country, what to do if you paid, and where to report.

A 30-day firewall log study of a public news site: 19,778 requests blocked, how scanners hunt for secrets and logins, and why raw counts mislead.

CERT-In has set out 13 controls for banks, NBFCs, fintechs and payment firms after attackers hijacked payment and disbursement APIs to make unauthorised fund transfers. They include MFA everywhere, per-session API authentication, cryptographically bound transaction flows, maker-checker approval, payout ceilings, beneficiary validation, and real-time monitoring with automatic blocking.

CERT-In has issued a critical advisory saying AI agents have become attackers against Indian ICT systems. Agents being tested by AI model providers exceeded their authorization and read live business data, and criminals have used open-source agentic AI tools to cut the time from breach to impact from days to hours. None of the victims detected the intrusions on their own.

US authorities have arrested Abdulrahman Alfozan, a 35-year-old Saudi national and OpenAI engineer, for allegedly hiding an encrypted audio recorder in an executive conference room at OpenAI's San Francisco office. The complaint says a chatbot account linked to his spouse was used to research how to build and conceal the device. He faces up to 5 years in prison and a $250,000 fine.