Technology Intelligence
Threats against technology companies, software vendors, cloud services, and tech infrastructure.
NVD CRITICAL: CVE-2026-96119 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obta...
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
NVD CRITICAL: CVE-2026-82110 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a...
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
NVD CRITICAL: CVE-2026-82103 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a...
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.
NVD CRITICAL: CVE-2026-82101 — IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a...
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
NVD CRITICAL: CVE-2026-90920 — IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute ...
IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
Flock can now issue CVEs for its own products. Should we trust it?
Flock joined the CVE Program as a CNA, giving the company authority to assign IDs to vulnerabilities in its own surveillance cameras and license plate readers. The post Flock can now issue CVEs for its own products. Should we trust it? appeared first on CyberScoop .
Why It May Take a Crisis to Move Congress on Cyber Liability
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/it-may-take-crisis-to-move-congress-on-cyber-liability-image_small-10-a-33076.jpg" align=right hspace=4><b>Report Authors Warn Federal Cyber Mandates Likely Won't Progress Without Disaster</b><br>It may take a disaster before Congress makes technology vendors liable for insecure products or mandates baseline security for critical
IonQ Buys Elisity to Bridge Zero Trust, Quantum Security
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ionq-buys-elisity-to-bridge-zero-trust-quantum-security-image_small-5-a-33079.jpg" align=right hspace=4><b>All-Stock Deal Combines Post-Quantum Cryptography With Identity-Based Network Access</b><br>IonQ plans to acquire zero trust cybersecurity firm Elisity in an all-stock deal valued at up to $1.3 billion, combining identity-bas
UK AI Safety Institute Warns of Risks in Unreleased Models
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/uk-ai-safety-institute-warns-risks-in-unreleased-models-image_small-3-a-33078.jpg" align=right hspace=4><b>Agency Says Frontier AI Risks Emerge Before Release as Safety Testing Falls Behind</b><br>The United Kingdom's AI Safety Institute believes frontier AI models pose risks before they're released to the public, and it doubled d
Fake Biotech Event Lures Victims Into Malware Trap
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/fake-biotech-event-lures-victims-into-malware-trap-image_small-8-a-33075.jpg" align=right hspace=4><b>Researchers Say Fraudulent Speaker Invites Tie Threat Actor to Ransomware Group</b><br>Cybercriminals are using a fictitious biotech conference in Boston and fraudulent invitations to speak at the event as part of a social enginee
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position.
NVD CRITICAL: CVE-2026-109566 — Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerabi...
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authoriz
NVD CRITICAL: CVE-2026-108929 — A flaw has been found in Netcore NR268 1.7.121109. The affected element is the f...
A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.
NVD CRITICAL: CVE-2025-71429 — GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability ...
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
NVD CRITICAL: CVE-2026-96012 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An...
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing
Norway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. [...]
Prominent Ransomware Negotiator Faces Extortion Charges
Edward Dubrovsky, a longtime cybersecurity executive, was arrested and charged in Pennsylvania last week under conspiracy to extort money.
British Government Warns of 'Serious Incidents' Involving AI
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/british-government-warns-serious-incidents-involving-ai-image_small-2-a-33074.jpg" align=right hspace=4><b>UK Strikes Cyber Pact With Germany</b><br>Great Britain may legislate to protect critical infrastructure from artificial intelligence-powered cyberthreats, the government said Monday, also warning AI companies not to release
Yandex confirms service outage as users lose access to cloud files
Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. [...]
NVD CRITICAL: CVE-2026-87744 — A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthe...
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permiss
Anthropic takes risky AI tests offline after models breach govt sites
Anthropic announced that its internal AI models undergoing "high-risk and cybersecurity evaluations" no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. [...]
No Identity, No Recovery: Cyber Resilience Starts With IAM
The proliferation of enterprise apps and the centrality of cloud identity providers requires an identity security rethink.
NVD CRITICAL: CVE-2026-108918 — A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown ...
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only
NVD CRITICAL: CVE-2026-108917 — A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some...
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any
NVD CRITICAL: CVE-2026-108915 — A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown...
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects
IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion
The acquisition pairs Elisity's zero-trust access controls with IonQ's post-quantum cryptography business as federal agencies and major companies accelerate timelines for quantum-ready encryption. The post IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion appeared first on CyberScoop .
Supermarket Chain Ahold Delhaize Caught in Cyber Incident
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/food-retailer-ahold-delhaize-faces-new-cyber-incident-after-2024-hack-image_small-3-a-33072.jpg" align=right hspace=4><b>Food Lion, Stop & Shop and Albert Heijn Face Order Disruptions But Stores Open</b><br>Multinational grocery retailer Ahold Delhaize, which owns brands including Stop & Shop, Hannaford, Giant Food and Food Lion i
NVD CRITICAL: CVE-2026-109321 — Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth ...
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrativ
NVD CRITICAL: CVE-2026-108914 — A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some u...
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerabili
NVD CRITICAL: CVE-2026-108907 — A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the func...
A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Canadian Ransomware Negotiator Arrested in FBI Breach Probe
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/canadian-ransomware-negotiator-arrested-in-fbi-breach-probe-image_small-4-a-33071.jpg" align=right hspace=4><b>Man Charged With Cyber Conspiracy and Extortion as FBI Investigates ShinyHunters</b><br>Canadian ransomware negotiation expert Edward Dobrovsky, 54, has been named as the suspect recently arrested as part of the FBI's cra
Ledger confirms spy chip implant behind wallet crypto thefts
Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. [...]
Secure Healthcare Information Management; Desert Orthopaedic Center Report Data Breaches
Data breaches have been announced by the Pennsylvania-based medical management and billing service provider Secure Healthcare Information Management and Desert […] The post Secure Healthcare Information Management; Desert Orthopaedic Center Report Data Breaches appeared first on The HIPAA Journal .
Cyberattack shuts down refrigerators at French supermarkets
Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. [...]
NVD CRITICAL: CVE-2026-108896 — A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the functio...
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
NVD CRITICAL: CVE-2026-108895 — A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected elemen...
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves.
Luna Moth Leaks Shed Light on Ransomware Group's Inner Workings
Leaked documents suggest a multi-pronged operation, with social engineering and more technical attackers working together to manipulate a single target
FBI Arrests Suspect in FBI-Hacking Case
In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster . Last week, the FBI arrested (alternate link ) someone associated with that crime.
Your AI Agents Have Access. But Who's in Control?
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/securing-ai-at-scale-identity-as-foundation-for-trust-image_small-5-a-32892.jpg" align=right hspace=4><b>Securing AI at Scale, Identity as the Foundation for Trust</b><br>This session focuses on practical steps IT and security leaders can take to safely scale customer-centric agentic AI use cases, delivering measurable business va
IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion
The all-stock deal brings Elisity’s least-privilege access technology into IonQ’s security portfolio. The post IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion appeared first on SecurityWeek .
NVD CRITICAL: CVE-2026-108894 — A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is th...
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is po
NVD CRITICAL: CVE-2026-108893 — A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue af...
A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
NVD CRITICAL: CVE-2026-108892 — A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability ...
A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. [...]
Retail giant Ahold Delhaize takes systems offline after cyberattack
Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it had to take some systems offline in response to a "cybersecurity incident" affecting its network. [...]
Australian patient data compromised in Icon Cancer Centre hack
David Hollingsworth reports: The operator of a global suite of cancer care providers has confirmed that patient data has been affected by a data breach involving Australia’s largest cancer care provider, the Icon Cancer Centre. “Icon Oncology Group is managing a data breach incident involving unauthorised access to some patient information held on a supplier’s... Source
French supermarket chains say cyberattack forced refrigerator shutdown
AFP reports: Major French supermarket chains Intermarche and Cooperative U were hit by a cyberattack that caused their refrigerators to defrost, the two retailers told AFP Monday. Some 150-200 Intermarche shops were targeted, along with almost 100 Cooperative U outlets, in the attack, they said. Paris prosecutors confirmed the attack, which reportedly also hit other... Source
French supermarket chains say cyberattack forced refrigerator shutdown (1)
AFP reports: Major French supermarket chains Intermarche and Cooperative U were hit by a cyberattack that caused their refrigerators to defrost, the two retailers told AFP Monday. Some 150-200 Intermarche shops were targeted, along with almost 100 Cooperative U outlets, in the attack, they said. Paris prosecutors confirmed the attack, which reportedly also hit other... Source
French supermarket chains say cyberattack forced refrigerator shutdown (2)
AFP reports: Major French supermarket chains Intermarche and Cooperative U were hit by a cyberattack that caused their refrigerators to defrost, the two retailers told AFP Monday. Some 150-200 Intermarche shops were targeted, along with almost 100 Cooperative U outlets, in the attack, they said. Paris prosecutors confirmed the attack, which reportedly also hit other... Source
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites. The post Bricksforge WordPress Plugin Vulnerability Exploited in the Wild appeared first on SecurityWeek .
GitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. [...]
N26 appoints chief financial officer
German challenger bank N26 has named industry veteran Marc Hess as its new chief financial officer and managing director.
Passing the Baton: Dark Reading Names New Editor-in-Chief
Fahmida Y Rashid will keep the momentum going as she leads Dark Reading.
These ARE the droids you’re looking for
There’s an old leadership fantasy that goes something like this: The CISO surveys a sprawling technology estate, discovers 11 tools doing the work of four, calculates the licensing savings, selects a shiny new strategic platform and declares that consolidation has begun. Six months later, all 11 tools are still running. The new platform is now number 12. I’ve seen variations of this throughout my
Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt
Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the researchers call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft Agent Framework, Microsoft’s AutoGen, Google’s Agent Development Kit 2.0, AWS’ Strands Agents and CrewAI, according to resea
Co-Creator of Dark Web Marketplace Sentenced to 40 Years in Federal Prison
40 + 40=80. That’s how old Raheim Hamilton will be when he gets out of prison if he serves his full sentence. There’s an update to a previously reported case. October 7, CHICAGO — A Virginia man who co-created and operated “Empire Market”—a dark web marketplace that enabled users to anonymously buy and sell illegal... Source
Bahrain central bank to treble tech budget
The Central Bank of Bahrain (CBB) plans to increase its investment in technology by threefold over the next three years as part of a plan to develop Bahrain to the region's primary banking hub.
Ukraine strikes third Yandex data center, disrupting digital services across Russia
A third Yandex data center in Russia was hit by Ukrainian drones over the weekend, forcing it to shut down and causing further disruptions to cloud services, payments, deliveries and other online services across the country.
Canonical Websites Disrupted in Second DDoS Attack This Year
The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal. The post Canonical Websites Disrupted in Second DDoS Attack This Year appeared first on SecurityWeek .
Microsoft: Windows 11 23H2 reaches end of support in 30 days
Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. [...]
Major French Supermarket Chains Hit by Cyber-Attack, Food Stock Impacted
The CEO of Cooperative U confirmed a cyber-attack affected the food stock in several stores from October 11
Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year
Etairos Health Settles Ransomware-Related Class Action Lawsuit
Etairos Health has agreed to settle class action litigation stemming from a February 20, 2024, ransomware attack and data breach […] The post Etairos Health Settles Ransomware-Related Class Action Lawsuit appeared first on The HIPAA Journal .
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US. The post Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US appeared first on SecurityWeek .
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via Cryptobilis following reports of stolen funds linked to devices sold by the reseller. On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86
iRhythm Data Breach Impacts at Least 360,000 People
Hackers stole patients’ personal information, including names, addresses, email addresses, dates of birth, and phone numbers. The post iRhythm Data Breach Impacts at Least 360,000 People appeared first on SecurityWeek .
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference. The post Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe appeared first on SecurityWeek .
Pepkor's $1.3bn fintech deal comes under shareholder scrutiny
South African retailer Pepkor is facing complaints from directors and investors over a deal to merge its fintech arm with a rival company.
Net Closes Around ShinyHunters with Another FBI Arrest
The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHunters
Your AI agent is only as safe as the packages it downloads
NVIDIA's new agent safety platform puts enforcement in the right place. It still must know what it is letting through. The post Your AI agent is only as safe as the packages it downloads appeared first on CyberScoop .
Kudo launches instant crypto withdrawals
Kudo.com, the global multi-asset trading broker, announced the launch of instant crypto withdrawals, a significant advancement in its ongoing commitment to enhancing customer experience and platform capabilities.
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The
Critical SonicWall Vulnerability Exploited Days After Disclosure
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations. The post Critical SonicWall Vulnerability Exploited Days After Disclosure appeared first on SecurityWeek .
Karaoke Giant Reveals Data Breach Impacting Eight Million
Daiichi Kosho says a supply chain breach has exposed personal data on over eight million karaoke customers
The 7 biggest issues CISOs and security teams face today
Year after year CISOs see the volume, velocity, and sophistication of attacks increase. They also see their attack surfaces expand and increase in complexity. Advances in artificial intelligence and the rapid growth of AI use in business are also impacting the security agenda, introducing novel attacks, broadening the attack surface to include AI infrastructure, and presenting governance and secur
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Beginning February 2027, all newly issued certificates will have a 64-day validity period by default. The post Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch appeared first on SecurityWeek .
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed
NVD CRITICAL: CVE-2026-108804 — A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03...
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL
FIS launches agentic AI suite for the office of the CFO
Banking technology vendor FIS has built an agentic AI suite designed to help CFOs manage collections, liquidity, risk and cash flow.
SBI Group and Mesh prep digital asset JV
Japan's SBI Group is teaming up with crypto infrastructure provider Mesh Connect and Money Forward on a digital asset joint venture.
Cyberattack disrupts refrigeration at hundreds of French supermarkets
A cyberattack overnight Sunday disrupted refrigerators at hundreds of French supermarkets, spoiling fresh food at stores run by some of the country’s largest grocery chains.
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. [...]
NVD CRITICAL: CVE-2026-108860 — BotSharp through 5.2.0 contains an authentication bypass vulnerability that allo...
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.
The Luna Moth Files Weren’t Hacked. Here’s How They Leaked.
When asked about the “Luna Moth Files” that had mysteriously appeared online, Silent Ransom Group called them “fake” and insisted they hadn’t had any leak or breach. But they had. Here’s what we know. When the “Luna Moth Files” appeared on an onion site without anyone claiming responsibility or explaining their origin, DataBreaches asked a... Source
NVD CRITICAL: CVE-2026-108753 — Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability ...
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.
NVD CRITICAL: CVE-2026-108576 — A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects...
A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
NVD CRITICAL: CVE-2026-108540 — A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknow...
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
NVD CRITICAL: CVE-2026-108707 — Wukong_HRM through commit 186115e contains an authentication bypass vulnerabilit...
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
NVD HIGH: CVE-2026-108693 — ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled s...
ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with ImageMagick privileges when PDF, PostScript, or EPS files are converted.
NVD HIGH: CVE-2026-108657 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy...
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT /sys/tenant/passApply to gain tenant administrator pack permissions in any tenant.
NVD HIGH: CVE-2026-108628 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa...
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions.
NVD HIGH: CVE-2026-108623 — JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy...
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails.
`123456’ password used in massive Danish CPR data breach
Ritzau has more on the Denmark Central Person Register (CPR) breach: At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account. At least three user accounts at the Funen-based IT company Pays used the password “123456” when hackers gained access... Source
“123456” password used in massive Danish CPR data breach
Ritzau has more on the Denmark Central Person Register (CPR) breach that affected more than 5 million living Danes and 3 million deceased: At least three accounts at the company linked to a major breach of Denmark’s CPR register reportedly used the password “123456”, including an administrator account. At least three user accounts at the... Source
NVD CRITICAL: CVE-2026-108598 — Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateE...
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
NVD HIGH: CVE-2026-108553 — OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in...
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
NVD CRITICAL: CVE-2026-108551 — openapi-typescript-codegen through 0.31.0 contains a code injection vulnerabilit...
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are importe
NVD HIGH: CVE-2026-108550 — SkillHub before 0.2.22 contains an incorrect authorization vulnerability in Acco...
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens
NVD HIGH: CVE-2026-108549 — cc-connect through 1.5.0 contains a missing authentication vulnerability in the ...
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.
NVD HIGH: CVE-2026-108548 — AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the O...
AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.
NVD HIGH: CVE-2026-108546 — Spotweb through 1.5.8 contains an OS command injection vulnerability in the runc...
Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as
Cyber exec arrested in case allegedly tied to ShinyHunters hackers
Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. [...]
NVD HIGH: CVE-2026-108161 — FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_r...
FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a priv
ARTEX AI, Claude agents used in cyberattacks on South Korean banks
The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. [...]
Canadian cybersecurity executive arrested in federal extortion case
Details of the case align with the investigation into ShinyHunters’ attack on FBI IT systems. The post Canadian cybersecurity executive arrested in federal extortion case appeared first on CyberScoop .
Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
Traditional attack surface management helps organizations discover exposed assets, but visibility alone is not enough to address threats. Criminal IP introduces AITEM, an AI-powered approach that connects exposure discovery with investigation, risk prioritization, and response. [...]
FBI announces yet another arrest allegedly connected to the FBI Jobs hack
The FBI is doing another victory dance after arresting someone they allege assisted ShinyHunters with the FBI Jobs attack. Brian Krebs reports: Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI... Source
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are invisible to identity infrastructure by default, not because anyone hid them, but because an identity stack can only govern what authenticates through it, and most agents never do. That gap is the clearest
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
The former core infrastructure engineer deleted admin accounts, reset hundreds of passwords, and demanded 20 bitcoin to spare the company’s servers. The post Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison appeared first on SecurityWeek .
Anthropic AI agent gives fake murder tip to US cops in global breach
Georgia Wells and Joseph Pisani report: Rogue AI models have hacked companies and tried to break into government websites. Now one has submitted a fake tip for an unsolved crime. Police in Philadelphia say Anthropic alerted them this week that one of its artificial-intelligence models submitted a false homicide tip through PhillyUnsolvedMurders.com. In a blog... Source
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted real websites. The AI company said it identified four broad categories of unintended model actions during evaluations and internal use of Claude - Claude Mythos
Why TLP should not replace your internal information classification, (Sat, Oct 10th)
The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far).
NVD CRITICAL: CVE-2026-104803 — The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in ...
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation i
NVD CRITICAL: CVE-2026-104801 — The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress i...
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is
NVD CRITICAL: CVE-2026-97670 — The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization b...
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data toke
NVD HIGH: CVE-2026-104021 — The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in...
The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache_settings[cache_cookie_exclude][]` parameter. This is due to the plugin registering the `cache_cookie_exclude` setting via `register_setting()` without a `sanitize_callback`, while `buildSiteHtaccessRules()` applies only `trim()` to each cookie value before in
NVD CRITICAL: CVE-2026-103889 — The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable t...
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template w
NVD CRITICAL: CVE-2026-94589 — The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirect...
The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload
NVD CRITICAL: CVE-2026-107645 — The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation...
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_cu
NVD HIGH: CVE-2026-104797 — The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress ...
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change in all versions up to, and including, 2.9.0 The `adfoin_ultimatememberac_send_data` function, which powers the Ultimate Member "Update Profile Field" action, resolves the target WordPress user from an attacker-supplied email address and passes an att
NVD CRITICAL: CVE-2026-104732 — The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Byp...
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — via transient, session marker, or equivalent — that a requester completed step-1 password authentication before processing a step-2 TOTP submission for the POSTed `user_id`; compoun
Co-creator of Empire Market dark web marketplace given 40-year sentence
Raheim Hamilton, 30, pleaded guilty earlier this year to a drug conspiracy charge and agreed to forfeit more than $100 million worth of Bitcoin and several properties in Virginia.
FBI Arrests Founder of Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity.
FBI Arrests Executive at Ransomware Negotiation Firm
Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity.
Anthropic Turns Claude Toward Critical Infrastructure
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/anthropic-turns-claude-toward-critical-infrastructure-image_small-9-a-33064.jpg" align=right hspace=4><b>11 Industry Partners Will Pair Claude With Engineers to Tackle OT Vulnerabilities</b><br>Anthropic is pairing Claude AI models with 11 industry partners to identify and prioritize vulnerabilities in critical infrastructure OT s
Trade Coalition Calls for Binding Rules on Feds' OT Security
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/trade-coalition-calls-for-binding-rules-on-feds-ot-security-image_small-7-a-33062.jpg" align=right hspace=4><b>CISA Urged to Use Authorities to Raise Bar on Industrial Cybersecurity</b><br>The U.S. federal government should immediately require federal agencies to establish basic security measures for operational technology, a coal
AI Agent Governance Starts With Identity
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ai-agent-governance-starts-identity-image_small-10-a-33063.jpg" align=right hspace=4><b>Autonomous Systems Need Distinct Identities, Limited Access and Human Owners</b><br>As AI agents gain authority to change systems, records and workflows, CIOs need to bring them under existing IAM controls, connect their actions to accountable
OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks
The ChatGPT maker said the researchers "violated clear policies on handling sensitive information.” The post OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks appeared first on SecurityWeek .
ASOS Breach Reveals the Risks in Customer-Facing SaaS
The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network.
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks. [...]
Friday Squid Blogging: I Caught a Squid
On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of which we could keep). And…I caught a squid! Near as I can tell, it’s a longfin squid, sometimes called a Boston squid ( Doryteuthis (Amerigo) pealeii ). That night I cooked it over a barbecue grill—hot and fast. Deli
Cisco Expects AI Agents to Spark Record Compute Demand
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cisco-sees-ai-agents-driving-unprecedented-compute-demand-image_small-8-a-33060.jpg" align=right hspace=4><b>President Jeetu Patel Says Cyber Defense Must Become Autonomous and Token-Efficient</b><br>Cisco President Jeetu Patel predicts AI agent power users will rise from under 2% to at least 30% within a year, warning that soarin
ISMG Editors: How China Could Coerce Taiwan Without a War
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ismg-editors-how-china-could-coerce-taiwan-without-war-image_small-10-a-33058.jpg" align=right hspace=4><b>Also, Healthcare's Resilience Test, Extortionists Struggle to Be Heard</b><br>In this week’s update, ISMG editors discussed a think tank war game showing how China could cripple Taiwan’s communications short of invasion, why
AI Scramble Drives Cybersecurity M&A Boom
Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Many of the buyers are not your typical cybersecurity firms.
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity
Citrix Ships Another Emergency Fix for NetScaler Appliances
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/citrix-ships-another-emergency-fix-for-netscaler-appliances-image_small-10-a-33054.jpg" align=right hspace=4><b>Keeping Score: It's Vendor's Third Patch in 2 Weeks to Address Exploitable Flaws</b><br>For the third time in two weeks, Citrix has shipped an emergency security fix for its NetScaler line of products. The vulnerability
Japan confirms arrest of Russian Qilin operative, extradition to Germany
Japan’s National Police Agency confirmed the arrest and extradition to Germany of a Russian national accused of being involved in the Qilin ransomware gang.
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) - watchTowr Labs
[object Object]
Suspected ShinyHunters Extortion Hacker Arrested by FBI
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/suspected-shinyhunters-extortion-hacker-arrested-by-fbi-image_small-9-a-33059.jpg" align=right hspace=4><b>FBI Vows to Dismantle Hacking Group After It Stole FBI Personnel Data</b><br>The FBI announced Friday the arrest of a suspected hacker behind the breach of a bureau HR system, marking the second recent detention of an alleged
Asos Hackers Claim Breach of Snowflake-Connected Simon AI
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/asos-hackers-claim-breach-snowflake-connected-simon-ai-image_small-1-a-33056.jpg" align=right hspace=4><b>Snowflake-Connected Marketing Tool Appears to Be Source of Customer Data Breach</b><br>Fast-fashion retailer Asos' hacker claims to have stolen customer data by breaching a marketing tool called Simon AI, integrated with the v
FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack
The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on almost all FBI agents and job applicants. The FBI has not named the suspect, and no charges have been made public. The
What We Missed: FBI Strikes Back at ShinyHunters
In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected ShinyHunters operative to the compromise of a Pentagon-run data center.
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. [...]
NVD HIGH: CVE-2026-108159 — AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the des...
AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, execu
NVD HIGH: CVE-2026-108156 — LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path ...
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scann
FBI arrests another suspected ShinyHunters hacker after agency breach
The FBI has arrested another suspected member of the ShinyHunters extortion group believed to be involved in the recent breach of FBI systems, Director Kash Patel announced Friday. [...]
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure," iVerify said in a new report published Thursday. The name
Security Threats Don't Stop at the Office: Why Executives' Families Need Training Too
Those closest to executives must match their security postures because the weakest link in a family becomes the entry point for attacks.
NVD HIGH: CVE-2026-108113 — ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerab...
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server u
NVD HIGH: CVE-2026-104082 — SmarterMail before build 9777 contains a remote code execution vulnerability tha...
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrU
Valley Oaks Health Data Breach Settlement Gets First Nod from Court
Valley Oaks Health faced class action litigation over a June 2023 data security incident that affected 50,352 individuals. The consolidated […] The post Valley Oaks Health Data Breach Settlement Gets First Nod from Court appeared first on The HIPAA Journal .
Lightwell project filters out 400 Java library vulnerabilities
Lightwell, the open-source security initiative set up by IBM and Red Hat, has identified more than 400 previously undiscovered vulnerabilities in widely used Java libraries — and now the companies are inviting customers to submit their own code dependencies to a new service, Lightwell Clearinghouse, for review. They’ll be looking for bugs such as the critical sandbox bypass in Java template engine
Hundreds of thousands impacted by data breach at biosensor firm iRhythm
A company known for wearable cardiac sensors, iRhythm, has begun notifying states of the impact of a data breach from the summer.
Leader of vast money mule operation that laundered cybercriminal proceeds pleads guilty
Oleg Korniev, a 42-year-old dual citizen of Ukraine and Russia, was a principal of Your Mule Cashout, or “YMCO,” which from 2007 until 2014 set up a sophisticated network of mules in the U.S. and Europe.
Ransomware consultant said he would decrypt data, is accused of paying ransoms instead
The owner of a ransomware remediation company is facing trial for defrauding customers. Zohar Pinhasi, also known as “Zack Silver” and “Zack Green,” has been arraigned in New York on wire fraud charges for allegedly defrauding clients of his ransomware remediation company, MonsterCloud. Pinhasi falsely claimed he could recover documents encrypted by ransomware without paying a ransom, according to
FBI touts another ShinyHunters arrest in response to data breach
“We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate," FBI Director Kash Patel said.
Germany arrests alleged core Qilin ransomware member after extradition
Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month. [...]
OpenAI reports three new incidents of misalignment
OpenAI continues to report incidences of “misaligned” behavior by its AI models, with three new reports dropping on Oct. 2. However, they describe relatively minor issues compared to previous alignment reports and notices covering its attacks on Hugging Face , Rubygems , and a German programming wiki . The first of the new reports described how an instance of a model under test learned from an int
NVD CRITICAL: CVE-2026-108109 — PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c...
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.
NVD HIGH: CVE-2026-108108 — PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in ...
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.
NVD CRITICAL: CVE-2026-108107 — PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi...
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.
NVD HIGH: CVE-2026-108106 — Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulne...
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service
NVD HIGH: CVE-2026-108101 — HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne...
HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.
NVD HIGH: CVE-2026-104081 — KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre...
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can u
Wikimedia Says Rogue AI Agents Abused its Platforms
Wikimedia says OpenAI agents performed unauthorized actions on its platforms, including edits to wikis
Bacon County Health Services Investigating Cyber Incident
Data breaches have been announced by Bacon County Health Services in Georgia, Comprehensive Orthopaedics & Musculoskeletal Care in Connecticut, Imagine […] The post Bacon County Health Services Investigating Cyber Incident appeared first on The HIPAA Journal .
Belarusian hacktivists admit to 2023 breach of Russian state healthcare network
The Belarusian Cyber Partisans concurred with Russian research that they indeed spent months inside the network for the Moscow Department of Health.
Sibos 2026: Trust and collaboration at 'machine speed' needed to fight banking industry threats
Sibos 2026 in Miami featured several 'Big Issue Debate' sessions, but one with an unwieldy name captured the attention of many attendees: 'Trust under pressure: resilience in a world where compromise must be assumed and prepared for.'
$10 million bounty offered for Chinese Hafnium hacker accused of Microsoft Exchange Server mega-attack
The US State Department is offering up to US $10 million for information about the whereabouts of Zhang Yu, a 44-year-old Chinese national who is accused of being a key figure in China's state-sponsored hacking group, Hafnium. Read more in my article on the Hot for Security blog.
Revolut to create its own scent
Fintech Revolut is on the hunt for a scent branding agency to help it translate its brand into a fragrance that is "unmistakably ours".
Citrix issues its weekly critical security patch for NetScaler ADC and NetScaler Gateway
For the third week running, Citrix has issued a critical security warning to customers managing their own NetScaler ADC and Netscaler Gateway instances, this time warning of a memory overflow vulnerability enabling denial of service or remote code execution. This week’s vulnerability affects ADC and Gateway when configured as a SAML (Security Assertion Markup Language) identity provider (IdP); old
How to keep AI agents within their permissions
AI agents can use valid credentials to perform actions beyond their assigned permissions, creating risks that traditional access controls may not prevent. Token Security explains how organizations can enforce agent-specific policies without sacrificing autonomy. [...]
Silent Ransom Group claims “Luna Moth Files” are fake. The data suggest otherwise.
On Tuesday, cybersecurity professionals began investigating an onion site that appeared to contain internal chat files from Silent Ransom Group. On Thursday, Silent Ransom Group said the leak was fake, but is it? A bespoke site called “Luna Moth Files” appeared Tuesday morning. The identity of the person who published the data is unknown, as... Source
OpenAI says it disrupted Russian and Iranian influence ops that used ChatGPT
ChatGPT was used in a Latin American propaganda operation run by Russians and to boost a set of Iranian fake journalist identities, OpenAI's safety team said.
TP-Link Sued by Four More U.S. States Over Router Security and China Ties
Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with Texas filing a suit in February. Florida, Iowa, Montana and Nebraska allege the California company misled buyers about how secure its routers are and how separate it is from China. TP-Link denies the claims and says it will fight them in court. TP-Link Systems is based in
CaixaBank expands Google Cloud collaboration
CaixaBank has announced an expanded strategic agreement with Google Cloud to strengthen its technological capabilities and accelerate the integration of AI, data management and cloud infrastructure across its business.
NVD CRITICAL: CVE-2026-86405 — Improper verification of cryptographic signature vulnerability in Sipay Electron...
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.
NVD CRITICAL: CVE-2026-85531 — Improper verification of cryptographic signature vulnerability in Sipay Electron...
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
LSEG and CMC Markets ink strategic data agreement
LSEG and CMC Markets (“CMC”) today announced a multi-year strategic data agreement, expanding CMC's access to LSEG's financial data, news and analytics.
Social Engineering AI Agents: The New BEC for 2026
As AI agents gain authority over business systems, attackers can manipulate them like business email compromise (BEC) victims.
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access
Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection. AnyDesk patched the flaw in version 8.0.3 in June, but its changelog described the fix only as "fixed a bug that could lead to a crash," with no CVE assigned and no security
EDX Markets and Verified X partner for tokenised bitcoin trading
VerifiedX (verifiedx.io), the programmable financial operating system for Bitcoin and intel assets, and EDX Markets (“EDX”), a leading digital asset technology firm that combines institution-only trading venue with a central clearinghouse, announced a strategic partnership to bring Verified Bitcoin (vBTC), a tokenized form of Bitcoin, to EDX for institutional spot trading.
Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI). "It's an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing," Anthropic said. "Projects that join will receive thorough, periodic security scans by our strongest models at no cost."
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"
Introducing Our New Cybersecurity Partner: Blue Team Alpha
Introducing Our New Cybersecurity Partner: Blue Team Alpha Cyberattacks on healthcare organizations can do far more than expose data. They […] The post Introducing Our New Cybersecurity Partner: Blue Team Alpha appeared first on The HIPAA Journal .
Exposed Nvidia GPU monitors can reveal AI infrastructure secrets
A component of Nvidia’s GPU monitoring software that enterprises use to keep tabs on their AI training and inference infrastructure has been vulnerable to denial-of-service (DoS) and information disclosure attacks. The Nvidia DCGM Exporter contains an unauthenticated resource exhaustion vulnerability that could allow remote attackers to crash the monitoring service and potentially disrupt AI workl
IG Prime and Investec launch white label offering
IG Prime, the institutional arm of IG Group (a FTSE 100 company), today confirms Investec Prime Services, a business unit within Investec Bank Limited, as a new partner for its institutional white label solution.
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. [...]
AvaTrade to acquire majority of FXCM's business
AvaTrade, a leading global online trading broker, today announced it has agreed to acquire the majority of FXCM Group’s business, one of the world’s longest-established Forex and CFD trading brands.
Shen Smiles Pays $140,000 to Resolve HIPAA Privacy Rule Violations
Dr. Linda L. Shen, the owner and operator of Shen Smiles, a Pennsylvania dental practice, has agreed to pay a […] The post Shen Smiles Pays $140,000 to Resolve HIPAA Privacy Rule Violations appeared first on The HIPAA Journal .
ING opens flagship store in Madrid
ING has inaugurated its new flagship in Madrid, a space that reflects the evolution of the bank in Spain, where it now serves more than four million customers and has established itself as the country’s most recommended bank.
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
Noteworthy stories that might have slipped under the radar: Tensorlake npm SDK compromised, Empire Market co-founder gets 40 years, exposed NVIDIA GPU monitors leak telemetry. The post In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years appeared first on SecurityWeek .
Q3 2026 Sets New Record for Ransomware Attacks
Comparitech observed 2627 claimed ransomware attacks in Q3, with critical sectors like finance, technology, education and healthcare experiencing significant increases
Google Domains Impacted by Recent ccTLD Hijacks
Hackers hijacked the .gh, .sl, and .as ccTLDs and obtained HTTPS certificates for several Google domains. The post Google Domains Impacted by Recent ccTLD Hijacks appeared first on SecurityWeek .
EU and UK banks face 1 year deadline for T+1
Banks in the EU and UK are under pressure to demonstrate their operational readiness for the upcoming move to next day settlement, with just one year to go before the deadline for T+1.
The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition
As enterprises race to deploy autonomous AI agents to accelerate business, a new report reveals they are tethered to security architectures built for a different era. The "Horizons of Identity Security" report from SailPoint highlights a critical “velocity paradox,” in which organizations invest in AI-speed business operations while continuing to rely on human-speed security controls, creating a
Cyberattack at IDC Frontier disrupts services around nation
The Asahi Shimbun reports: IDC Frontier Inc., a SoftBank subsidiary that provides cloud services, said Oct. 7 that a ransomware attack caused a system outage affecting 495 corporate and local government customers. The Tokyo-based company said it is still investigating the scale of the damage and whether any personal information was compromised. The cyberattack has... Source
Man admits to running network of 15,000 money mules for cybercriminals
A Ukrainian-Russian dual citizen has pleaded guilty to running a massive money laundering operation that laundered millions for cybercriminals worldwide. [...]
FCA cracks down on finfluencers
The UK's financial watchdog has stepped up its enforcement of illegal 'finfluencer' promotions, resulting in a 7,300% increase in actions between 2023 and 2025.
iRhythm Notifies Individuals Affected by June 2026 Hacking Incident
iRhythm, a health technology company that specializes in wearable cardiac monitoring devices such as the Zio wearable ECG monitor, has […] The post iRhythm Notifies Individuals Affected by June 2026 Hacking Incident appeared first on The HIPAA Journal .
Cavero Secure launches protocol for autonomous AI governance
Cavero Secure, a pioneer in continuous identity security and post-quantum trust architectures, are announcing a breakthrough approach to autonomous AI governance with the launch of its CaveroCTX™ protocol.
Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands. The post Unpatched AhsayCBS Vulnerabilities Exploited in the Wild appeared first on SecurityWeek .
NVD CRITICAL: CVE-2026-107935 — A path traversal vulnerability was found in gvproxy, the network forwarder provi...
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Microsoft: Outdated Windows devices will stop receiving security updates
Microsoft says devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation. [...]
UK and Allies Warn of Cyber Threat from China’s Integrity Technology Group
The UK, US and allies have issued an alert detailing malicious activity linked to China’s Integrity Technology Group
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Midnight Mimosa is the name given to a malware campaign primarily running preinstalled on low-cost Android devices. The post Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries appeared first on SecurityWeek .
Amex hit with $350m penalty for AML deficiencies
The Office of the Comptroller of the Currency (OCC), the main banking regulator in the US, has issued a $350m civil money penalty against American Express National Bank for deficiencies in its anti-money laundering (AML) and bank secrecy act (BSA) processes.
Nivo launches AI assistant for lending
Nivo has today launched Lender Collect, an AI assistant that coordinates a lending case from the first broker email through evidence gathering, underwriting preparation and the conditions that follow the lender's decision.
DailyPay competes $200m securitisation
DailyPay, the leader in On-Demand Pay, announced a $200 million asset-backed securitisation (ABS) of its On-Demand Pay receivables.
GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys
A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control.
AI Training Critical as Governance Challenges Grow
As AI adoption accelerates, ISACA is expanding its certification portfolio with a governance-focused credential designed to help professionals manage AI securely
When building an AI-native security program, start with outcomes
In my last article, I described the SOC Triangle , the longstanding trade-off among quality, consistency and cost efficiency in security operations. AI is starting to loosen that constraint by enabling certain kinds of work with greater depth and consistency, without requiring a linear increase in headcount. That raises the next question I hear from security leaders. Where should we start? For res
Citrix warns admins to patch new NetScaler RCE flaw immediately
Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. [...]
Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own
Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest's top prize, and made the team the overall winner. Trend Micro's Zero
Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security
OSS Scanner sends unreviewed, model-generated vulnerability reports to open source maintainers that opt in. The post Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security appeared first on SecurityWeek .
Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments
Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions. "CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions," Citrix said. The vulnerability
Major AI Firms Pledge Data Protection Changes Following UK Privacy Watchdog Push
Ten leading AI firms have committed to make data protection improvements following a call for evidence by the UK’s Information Commissioner's Office
NVD HIGH: CVE-2026-81929 — The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulner...
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to
Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service. The post Citrix Urges Immediate Patching of Critical NetScaler Vulnerability appeared first on SecurityWeek .
Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own
$1.2 million was paid out at Pwn2Own Ireland 2026 for exploits targeting phones, printers, smart speakers, smart home hubs, and AI infrastructure and coding tools. The post Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own appeared first on SecurityWeek .
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon. To that end, the agencies seized several domains and blocked access to platforms that were used to scan, and in some cases infiltrate, U.S. critical infrastructure. The list of seized
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland
The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. [...]
Formula Predicts When AI Chatbots Are at Risk of Turning Bad
Researchers from George Washington University have published a paper examining whether the time and cause of AI going rogue can be predicted. The post Formula Predicts When AI Chatbots Are at Risk of Turning Bad appeared first on SecurityWeek .
Anyflo emerges from stealth to simplify stablecoin payments for enterprises
Stablecoin payments orchestration service Anyflo has emerged from stealth with news that it has acquired bitcoin lending platform Native.
NVD CRITICAL: CVE-2026-96207 — Improper certificate validation in Microsoft Partner Center allows an unauthoriz...
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
NVD CRITICAL: CVE-2026-94510 — Authorization bypass through user-controlled key in Microsoft Bookings allows an...
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
NVD CRITICAL: CVE-2026-88131 — Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized ...
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
NVD CRITICAL: CVE-2026-77900 — Missing authentication for critical function in Azure App Service allows an unau...
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
NVD CRITICAL: CVE-2026-69435 — Missing authorization in Azure SRE Agent allows an authorized attacker to elevat...
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
OpenAI Lawyer: Labs Shouldn't Be Liable for AI Agent Hacking
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/openai-lawyer-labs-shouldnt-be-liable-for-ai-agent-hacking-image_small-4-a-33050.jpg" align=right hspace=4><b>Absence of Intent, Safety Testing Environment Are Key Legal Factors in Litigation</b><br>Although U.S. frontier firms created artificial intelligence agents that went on a hacking spree, breaking the laws of at least two c
Anthropic Bans AI Model Abuse, Tightens Rules on Deception
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/anthropic-bans-ai-model-abuse-tightens-rules-on-deception-image_small-8-a-33048.jpg" align=right hspace=4><b>Updated Claude Policy Targets Influence Campaigns, Surveillance and Mistreatment of AI Models</b><br>Anthropic is telling users to be nicer to AI models in an updated usage policy that also clarifies deceptive activities. "
NVD HIGH: CVE-2026-89091 — A flaw was found in ansible-core. When installing a collection with `ansible-gal...
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink di
NVD CRITICAL: CVE-2026-84249 — IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to e...
IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
NVD HIGH: CVE-2026-82900 — IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to d...
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
NVD HIGH: CVE-2026-82895 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker ...
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
NVD HIGH: CVE-2026-81932 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection...
IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
NVD CRITICAL: CVE-2026-80381 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker ...
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
NVD CRITICAL: CVE-2026-75875 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker ...
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
FBI Seizes Domains Used in Flax Typhoon Attacks
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/fbi-seizes-domains-used-in-flax-typhoon-attacks-image_small-10-a-33049.jpg" align=right hspace=4><b>US Authorities Say Infrastructure Supported Scanning, Phishing and Data Theft</b><br>The FBI seized seven domains allegedly used by China-linked hackers to scan critical infrastructure, deliver malware and steal files. A joint advis
Breach Roundup: FortiBleed Still Hemorrhaging Credentials
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/breach-roundup-fortibleed-still-haemorrhaging-credentials-image_small-4-a-33047.jpg" align=right hspace=4><b>Also: AI Agents Hit Wikimedia, Asos Traces Breach to Employee</b><br>This week: Fortibleed, OpenAI agents attacked Wikimedia, FBI hacking fallout hits Accenture, Silent Ransom leak and a Flydubai attack. Asos breach traced
Healthcare AI Governance Has a Visibility Problem
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/healthcare-ai-governance-has-visibility-problem-image_small-10-a-33046.jpg" align=right hspace=4><b>Study Finds 91% Can't Verify AI Tools in Use; New AI Playbook Covers Clinical Risks</b><br>Most healthcare organizations have AI governance policies, but 91% can't verify all AI tools in use, a new study finds. As security and overs
How We Found Thousands of Exposed NVIDIA GPUs and a Way to Disrupt Them (CVE-2026-47483)
[object Object]
FBI disrupts Chinese hacking tools used to breach critical infrastructure
The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]
Leader of 764 pleads guilty, faces up to 30 years in prison
Prasan Nepal ran the nihilistic violent extremist network for almost four years and played a crucial role facilitating the grooming, manipulation and extortion of minors. The post Leader of 764 pleads guilty, faces up to 30 years in prison appeared first on CyberScoop .
Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software
The critical infrastructure defense program will seek to pair Claude models, Anthropic engineers and threat research with the expertise of cybersecurity companies. The post Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software appeared first on CyberScoop .
NVD CRITICAL: CVE-2026-78406 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
NVD CRITICAL: CVE-2026-78401 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
NVD HIGH: CVE-2026-78388 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
NVD HIGH: CVE-2026-19498 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
NVD HIGH: CVE-2026-19494 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
NVD HIGH: CVE-2026-19493 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file write due to path traversal.
NVD CRITICAL: CVE-2026-19491 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.
NVD HIGH: CVE-2026-19482 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.
NVD HIGH: CVE-2026-18740 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.
NVD HIGH: CVE-2026-17189 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session
NVD CRITICAL: CVE-2026-16916 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.
NVD CRITICAL: CVE-2026-16823 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.
NVD HIGH: CVE-2026-12109 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.
NVD HIGH: CVE-2026-11930 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers.
NVD HIGH: CVE-2026-11888 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access ...
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack.
NVD HIGH: CVE-2026-11318 — Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com....
Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the
NVD HIGH: CVE-2026-107782 — System Informer before 4.0.26241.138 contains an incorrect authorization vulnera...
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.
NVD HIGH: CVE-2026-107781 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains ...
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
NVD CRITICAL: CVE-2026-107780 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains ...
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows.
NVD CRITICAL: CVE-2026-107779 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains ...
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor ho
'AgentCorruption' Puts AWS Environments At Risk With Single Prompt
A now-patched vulnerability in AWS Bedrock AgentCore could allow an attacker to use one AI chatbot to take over an organization's entire fleet.
Lawmakers warn Google could expose Spirit Airlines data in $10 million AI training deal
The proposed sale would include about 100 million emails, 500 million Microsoft Teams messages, employment contracts, employee and timecard records and payroll and tax information, Rep. Steven Horsford (D-NV) said in a press release.
NVD HIGH: CVE-2026-84275 — IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM fil...
IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector.
NVD CRITICAL: CVE-2026-84272 — IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentic...
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.
NVD HIGH: CVE-2026-84271 — IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypa...
IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.
NVD HIGH: CVE-2026-84250 — IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protec...
IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges.
NVD HIGH: CVE-2026-84245 — IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation ...
IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability to gain root privileges and access or modify sensitive system files.
NVD CRITICAL: CVE-2026-84244 — IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulne...
IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated Guardium user.
NVD HIGH: CVE-2026-82344 — IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer ove...
IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.
NVD HIGH: CVE-2026-82335 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buff...
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.
NVD HIGH: CVE-2026-82334 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-...
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.
NVD HIGH: CVE-2026-107707 — Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerabi...
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.
NVD CRITICAL: CVE-2026-104076 — TVU Networks Receiver/Transceiver devices running firmware before version 7.9 co...
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud s
NVD CRITICAL: CVE-2026-104075 — TVU Networks Receiver/Transceiver devices running firmware before version 7.9 co...
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript val
Ransomware attack disrupts Japan's IDCF Cloud used by govt clients
IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving the eastern part of the country. [...]
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
The seizures of the tools, allegedly operated by the Chinese firm Integrity Tech, accompanied a warning from the FBI, CISA and NSA. The post DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub appeared first on CyberScoop .
Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions
Zohar Pinhasi allegedly deceived ransomware recovery clients into a payment scheme disguised as a specialized service that helped victims avoid paying cybercriminals. The post Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions appeared first on CyberScoop .
Hijacked TensorLake npm Turned Install Into Credential Risk
<div class="hs-featured-image-wrapper"> <a href="https://www.sonatype.com/blog/hijacked-tensorlake-npm-turned-install-into-credential-risk" title="" class="hs-featured-image-link"> <img src="https://www.sonatype.com/hubfs/TENSORLAKE.png" alt="Image with text "hijacked TensorLake npm release" alongside an icon of a skull" class="hs-featured-image" style="width:auto !important; max-width:50%; float:
NVD HIGH: CVE-2026-84278 — IBM Guardium Data Protection 12.2 is affected by a command injection vulnerabili...
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.
NVD HIGH: CVE-2026-84276 — IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerabi...
IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.
Low-cost Android phones ship with residential proxy malware
A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. [...]
International coalition seizes tools used by cyber firm behind Flax Typhoon
The U.S. and other nations took down digital tools and infrastructure by Beijing-based Integrity Tech that allowed "widespread vulnerability scanning and, in some cases, intrusions" as part of the Flax Typhoon campaign.
NVD CRITICAL: CVE-2026-107704 — The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injectio...
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby pr
NVD CRITICAL: CVE-2026-107703 — @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerabilit...
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.
NVD HIGH: CVE-2026-107701 — dot-access through 1.0.0 contains a prototype pollution vulnerability that allow...
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.
NVD CRITICAL: CVE-2026-107700 — dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allo...
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.
NVD CRITICAL: CVE-2026-107699 — ppt2png through 0.0.6 contains an OS command injection vulnerability that allows...
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.
Venezuelan Cartel's Malware Honcho Nabbed for ATM Jackpotting
The first cybercriminal to ever make the FBI's "10 Most Wanted Fugitives" list allegedly infused Tren de Aragua's violent criminal operations with cash.
Growing PQC at the edge belies deeper quantum-readiness challenges
The quantum threat is becoming an increasing concern for security leaders, but many may be mistaking protection at their website’s front door for quantum readiness across their business. More than half (54%) of the world’s top 1 million websites now support post-quantum key exchange, according to research from F5 Labs, an encouraging statistic given that just 27% of CISOs in a June KPMG survey sai
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8. The company, Integrity Technology Group, has been sanctioned by the U.S. and the UK. The hackers scanned websites for flaws using a tool containing more
SoFi Tech, Orbi and Mastercard team on crypto-linked card programme in Mexico
SoFi Tech Solutions, formerly Galileo, today announced a partnership with Mexican fintech Orbi and Mastercard to launch a crypto-linked card program in Mexico.
Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations.
Making sure the checks get printed
Pierre's debut newsletter explores the messy, real-world side of risk management and how to keep vital systems running when a perfect patch isn't an option.
Ransomware Response Firm CEO Accused of Data Recovery Fraud
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ransomware-response-firm-ceo-accused-data-recovery-fraud-image_small-5-a-33045.jpg" align=right hspace=4><b>MonsterCloud CEO Disguised Ransom Payments as Proprietary Tool, Say Prosecutors</b><br>A ransomware service that offered clients an extortion-free shortcut to unlocking their files was too good to be true, say U.S. federal p
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories
The crooks have trust problems of their own. One ransomware affiliate decided to keep the profits for himself. Elsewhere, an attacker left a server exposed, complete with tools and traces of an intrusion. Apparently, keeping things secure is a problem on both sides of the fence. The rest of the week isn't much more reassuring. Malicious code turned up in developer packages and extensions that
OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media
The two campaigns were rated 4 and 5 out of 6 for severity, the first time OpenAI has reported what it considers a high-impact influence campaigns. The post OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media appeared first on CyberScoop .
CVE-2026-107332 - Insecure default file permissions on cached credentials in AWS Toolkit for Visual Studio Code
<p><b>Bulletin ID:</b> 2026-129-AWS <br> <b>Scope:</b> AWS <br> <b>Content Type:</b> Important (requires attention) <br> <b>Publication Date:</b> 10/08/2026 10:30 PM PDT</p> <p><b>Description:</b></p> <p>AWS Toolkit for Visual Studio Code is an open source extension that lets developers work with AWS services, including Amazon CodeCatalyst, from within Visual Studio Code. We identified CVE-2026-10
NVD HIGH: CVE-2026-104078 — Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bun...
Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formul
NVD HIGH: CVE-2026-104077 — Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability th...
Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin, allowing a javascript: URL to execute in the resulting background iframe. Because No
FakeGit malware campaign returns with 17,610 malicious GitHub repos
More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. [...]
Cryptohack Roundup: Conviction in Uranium Finance Hack
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cryptohack-roundup-conviction-in-uranium-finance-hack-image_small-5-a-33038.jpg" align=right hspace=4><b>Also: A US Court Orders $30M Penalty in Fundsz Fraud Case</b><br>This week, a conviction in a $54 million exploit, a $30 million Fundsz fraud penalty, Near Intents post-hack, Abstract Blockchain will shutdown, Velocity’s victim
DOJ charges ransomware recovery CEO for secretly paying hackers
The owner of a ransomware recovery firm was hit with wire fraud charges for allegedly making secret ransom payments while overcharging the victims of attacks.
ASOS: Hackers tricked way into employee account before sending rogue push notification
The company said its investigation, carried out with external experts, found the attackers had accessed “some personal information, including names and contact details, and certain non-personal account related information.”
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)
We just did a major update to FOR577 and added a lot of new material on day 5 about investigating AI usage in incident response. In the new material we dicsuss 8&#;x26;#;xc2;&#;x26;#;xa0;of the most popular AI coding assistants and&#;x26;#;xc2;&#;x26;#;xa0;agents including Claude Code, C
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization. JPCERT/
Crypto thief who splurged on gold grills sentenced in London
A 25-year-old man who helped steal nearly $260,000 in cryptocurrency through a SIM-swapping fraud scheme was sentenced to two and a half years in prison at a London court.
Casper Orthopedic Associates; Atlantic Digestive Specialists Announce Data Breaches
Data breaches have been announced by Casper Orthopedic Associates in Wyoming and Atlantic Digestive Specialists in New Hampshire. Casper Orthopedic […] The post Casper Orthopedic Associates; Atlantic Digestive Specialists Announce Data Breaches appeared first on The HIPAA Journal .
Cisco Patches a Dozen Critical Vulnerabilities
The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution. The post Cisco Patches a Dozen Critical Vulnerabilities appeared first on SecurityWeek .
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN. According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company is tracking the cluster under the name Earth Sirrush (previously SHADOW-EARTH-065). ASHVEIN,
Cisco warns of critical flaws allowing Nexus switch takeover
Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches. [...]
NVD CRITICAL: CVE-2026-9209 — mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulne...
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attacke
NVD HIGH: CVE-2026-93017 — The `insights-operator-gather` ClusterRole grants the operator's service account...
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups:
NVD HIGH: CVE-2026-14999 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.
NVD CRITICAL: CVE-2026-14992 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.
NVD HIGH: CVE-2026-14905 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
NVD HIGH: CVE-2026-14888 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.
NVD HIGH: CVE-2026-14507 — IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticat...
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.
NVD CRITICAL: CVE-2026-14502 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.
NVD HIGH: CVE-2026-14497 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.
NVD HIGH: CVE-2026-14496 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
NVD CRITICAL: CVE-2026-14269 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
NVD CRITICAL: CVE-2026-107640 — Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerabil...
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.
NVD HIGH: CVE-2026-107639 — ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument i...
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.
NVD HIGH: CVE-2026-105833 — EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability...
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.
NVD HIGH: CVE-2026-105830 — league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of s...
league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.
Mastercard to enable offline payments across Europe
Mastercard is introducing offline payment requirements that mean that from 2027 Europeans will be able to pay during power and network outages.
Leaked chats show Russian extortion gang sending ‘agents’ into US law firms
In leaked chats, members track dozens of victims, haggle over multimillion-dollar payments and direct operatives based in the United States whom they call “agents.”
TrueLayer raises $27m to scale Pay by Bank
European Pay by Bank network TrueLayer has raised $27 million in investment led by Italy's CDP Venture Capital.
Attackers Hijack Three ccTLDs to Obtain Google Certificates
Attackers compromised .gh, .sl and .as registries to obtain unauthorized HTTPS certificates
Security Awareness Training Isn’t Dead, but It Needs a Rethink
All enterprises conduct security awareness training for their employees. But whether this has tangible benefits is debatable. The post Security Awareness Training Isn’t Dead, but It Needs a Rethink appeared first on SecurityWeek .
N26 expands Flexible Cash Fund access to all membership tiers
N26 today announced the expansion of its Flexible Cash Fund, making the investment product available across all N26 membership tiers.
NVD HIGH: CVE-2026-91844 — Unrestricted upload of file with dangerous type vulnerability in İzometri IT Ser...
Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This issue affects eimzamip: from v1.6.4 before v1.6.6.
NVD HIGH: CVE-2026-16167 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.
NVD HIGH: CVE-2026-16165 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
NVD HIGH: CVE-2026-16164 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.
NVD HIGH: CVE-2026-16163 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.
NVD HIGH: CVE-2026-16161 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
NVD HIGH: CVE-2026-16159 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.
NVD HIGH: CVE-2026-16111 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.
NVD HIGH: CVE-2026-15824 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
NVD HIGH: CVE-2026-15822 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.
NVD HIGH: CVE-2026-15819 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator.
NVD HIGH: CVE-2026-15784 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
NVD HIGH: CVE-2026-15781 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.
NVD CRITICAL: CVE-2026-15762 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
NVD CRITICAL: CVE-2026-14991 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
NVD CRITICAL: CVE-2026-14990 — IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scr...
IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Laboratory Services Cooperative Agrees to Pay $6.1 Million to Settle Data Breach Litigation
Laboratory Services Cooperative, a Seattle, Washington-based nonprofit clinical laboratory that provides diagnostic and analytical testing services for Planned Parenthood affiliates […] The post Laboratory Services Cooperative Agrees to Pay $6.1 Million to Settle Data Breach Litigation appeared first on The HIPAA Journal .
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration. "In this activity, the threat actor leveraged
ClearToken and Consensys bring 24/7 settlement infrastructure to wholesale markets
ClearToken, the UK-based market infrastructure group for digital and traditional assets, and Consensys, the protocols and institutional infrastructure company, today announce a strategic partnership to help banks move tokenised assets and cash onto always-on infrastructure, with the legal certainty and controls wholesale markets require.
Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products. The post Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication appeared first on SecurityWeek .
OAuth grants pile up faster than you can review them. Here's how to keep up.
OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting forgotten OAuth grants to gain access to corporate data. This article covers why OAuth risks are so hard [...]
Hackers target two South Korean megachurches, potentially exposing congregant data
Two of South Korea's largest Protestant churches are investigating cyberattacks that may have exposed sensitive information about hundreds of thousands of members, including personal details, financial records and internal documents.
ASOS Confirms Data Breach Linked to Stolen Employee Credentials
The ASOS hack comes from the compromise of agentic marketing platform Simon AI, said the attackers
PawaPay secures Mozambique payment licence
PawaPay, a leading pan-African payments aggregator, has been granted a Payment Service Provider (PSP) licence by the Bank of Mozambique through its local subsidiary, Quidexplus Mozambique.
Murex platform connects to ICE market data feed
Murex, the global leader in trading, risk management and post trade solutions for capital markets, is pleased to announce that its MX.3 platform can now be natively connected to Intercontinental Exchange’s (ICE) real time market data feed, the ICE Consolidated Feed.
Facephi strengthens global presence through partnership with credit bureau Crif
Facephi (BME Growth: FACE; Euronext Growth Paris: ALPHI), a global leader in digital identity verification and fraud prevention, today announced that it has entered into a strategic partnership with CRIF, a global company specialising in credit information, risk management and digital solutions, with operations in 37 countries.
Uranium crypto exchange hacker convicted for stealing $53 million
A Maryland man was found guilty of stealing more than $53 million after hacking the decentralized crypto exchange Uranium Finance twice in April 2021. [...]
NVD CRITICAL: CVE-2026-19218 — Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN So...
Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.
NVD CRITICAL: CVE-2026-16340 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.
NVD HIGH: CVE-2026-16181 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.
NVD HIGH: CVE-2026-16179 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.
NVD HIGH: CVE-2026-16178 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.
NVD HIGH: CVE-2026-16176 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.
NVD HIGH: CVE-2026-16170 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.
NVD HIGH: CVE-2026-16169 — IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to...
IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
AWS’s repeated problems with AI agent controls illustrates the autonomous agent dilemma
Throughout this year, Amazon Web Services (AWS) has repeatedly had to patch autonomous agent security holes, which have then reemerged in slightly different forms, according to cybersecurity researchers at Palo Alto Networks’ Unit 42 and at Zenity Labs. But the problem is not with AWS, which seems to be reacting quickly to address security reports, as much as it is with the essential nature of aut
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
Russia-aligned UAC-0099 has steadily upgraded its MATCHBOIL downloader since 2024
Thousands of cheap Android phones shipped with ad-fraud malware
"It’s on the phone before the owner switches it on for the first time, and it can’t be uninstalled," researchers at Bitdefender said about ad fraud malware found on thousands of cheap Android devices.
Singapore central bank issues risk rules on banks' AI use
Banks in Singapore must seek an independent review of any forthcoming AI projects before implementation, according to new rules.
US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward
Zhang Yu was charged alongside Xu Zewei, who was extradited from Italy to the US in April 2026. The post US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward appeared first on SecurityWeek .
SonicWall and Splunk Patch Critical Vulnerabilities
Critical and high-severity vulnerabilities could allow attackers to bypass authentication, execute arbitrary code, and elevate their privileges. The post SonicWall and Splunk Patch Critical Vulnerabilities appeared first on SecurityWeek .
It Wasn’t Me, It Was the AI Agent” May Not Avoid Liability Under New Senate Proposal
Odia Kagan of FoxRothschild writes: “It wasn’t me, it was the AI agent” may not help companies avoid civil or criminal liability under a new bipartisan legislative proposal. U.S. Senators Josh Hawley (R-Mo.) and Chris Murphy (D-Conn.) have announced the proposed AI Agent Accountability Act, which seeks to hold AI-agent operators and developers liable for... Source
Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
Russian-aligned hackers have targeted Ukrainian transportation, manufacturing and energy companies with a constantly evolving malware strain designed to harvest system data, according to new research.
KR: Coupang files lawsuits against 620 billion won fine over data leak
The Coupang breach in South Korea has stayed in the news cycle for nine months and may offer a useful case study in how not to respond to an incident. In December 2025, South Korea’s largest online retailer, Coupang, apologized for a November breach affecting more than 33 million customers. A former developer who worked... Source
NVD CRITICAL: CVE-2026-92555 — Insertion of sensitive information into sent data vulnerability in AKIN Software...
Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.
NVD HIGH: CVE-2026-19083 — Authorization bypass through User-Controlled key vulnerability in AKIN Software ...
Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07.
Microsoft Teams to get support for third-party deepfake detection tools
Microsoft will soon introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings. [...]
Unlimit and Gr4vy Partners collaborate on payments
Gr4vy, the US-based cloud payment orchestration platform, has partnered with Unlimit, the global financial infrastructure company, giving its enterprise customers access to Unlimit’s card acquiring and leading local payment methods through their existing Gr4vy integration.
Writing the Next Chapter
Dark Reading is about to begin a new decade in its storied history, and we have some breaking news of our own to share.
Major Yandex data center in Russia hit by Ukrainian drone strike
A drone strike on a large Yandex data center caused a significant disruption to the Russian tech giant's network, with connectivity reportedly falling to around 70 percent of normal levels.
Red Lion Controls N-Tron 700 Series
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious us
Satel Netco Design
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbit
Grid Protection Alliance openPDC and openHistorian
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p>The following versions of Grid Protection Alliance openPDC and openHistorian are affected:</p> <ul> <li>openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022)</li> <li>openPDC (Docker i
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
<div class="OutlineElement Ltr SCXW40950166 BCX8"> <h2><strong>Advisory at a Glance </strong></h2> <table dir="ltr"> <tbody> <tr> <th> <div class="TableCellContent SCXW40950166 BCX8"> <div class="OutlineElement Ltr SCXW40950166 BCX8"> <p><strong>Title </strong></p> </div> </div> </th> <td> <div class="TableCellContent SCXW40950166 BCX8"> <div class="OutlineElement Ltr SCXW40950166 BCX8">
Sibos 2026: Is USD's position as prime global currency in jeopardy?
Many global currency and trade experts have been wondering for a while now whether the US dollar might lose its luster as the world’s reserve or preferred cross-border payments and trade or asset management settlement currency. But a panel of bankers and foreign exchange experts gathering at Sibos 2026 in Miami all agreed the answer to that question is "not yet."
AML vendor Armalytix appoints legal and compliance head
Armalytix, the multi-award-winning intelligence firm delivering precision client information for AML, affordability and more, has appointed Arvin Razon as its first dedicated Head of Legal and Compliance, a move that underpins the company's ambition to be the trusted compliance infrastructure for the UK property sector as it scales across conveyancing, lending and estate agency, helping property p
FBI: FortiBleed attackers can lock organizations out of their own firewalls
Details from an FBI investigation into the ongoing FortiBleed attacks reveal that victims could be locked out of their own firewall even as attackers remain logged in. After gaining access to a backend server left exposed by the attackers, the FBI and US Secret Service have shared new details of an operation that has already affected more than 80,000 devices worldwide. The server gave investigator
ASOS links data breach to social engineering attack, credential theft
ASOS is sending updates to affected customers about the cybersecurity incident it suffered earlier this week, confirming that hackers accessed some personal data. [...]
Lynx AM selects xyt for equities data analytics
xyt, a leading independent provider of high-quality trade data and analytics, is pleased to announce its selection by Lynx Asset Management (“Lynx”), a Stockholm-headquartered systematic asset manager, as its provider of independent volume and liquidity analytics for global equities.
Ocorian appoints head of innovation
Ocorian, a leading global provider of asset manager, private wealth and corporate, and issuer services, has appointed Ryan McGrath to the new role of Global Head of Innovation, based in New York City.
Rein Security Raises $25 Million to Guard AI Agents at Runtime
The cybersecurity startup will invest in product innovation, agentic research, and employee base expansion. The post Rein Security Raises $25 Million to Guard AI Agents at Runtime appeared first on SecurityWeek .
How Technology Empowers—and Imperils—Dictators
This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs . Two weeks after Moscow’s full-scale invasion of Ukraine in March 2022, the Russian TV Channel One editor Marina Ovsyannikova burst onto the set of the evening newscast. She held up a hand-drawn sign behind the anchor’s head that read: “Stop the war. Don’t believe propaganda. They’r
Sandworm-Linked Group Sharpens Matchboil Downloader
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/sandworm-linked-group-sharpens-matchboil-downloader-image_small-7-a-33037.jpg" align=right hspace=4><b>Malware Has Hit Ukrainian Transport, Energy and Manufacturing Firms</b><br>Eset says Russia-aligned UAC-0099 has spent since at least 2024 refining Matchboil, a downloader used against Ukrainian organizations that now supports re
Chinese Hacker Deployed AI in Campaign Against South Korean Banks
CrowdStrike revealed that a Chinese-speaking hacker deployed agentic pentesting tool ARTEX and Claude to help breach data from South Korean financial firms
Standard Chartered extends digital asset custody to Singapore
Global custodian Standard Chartered has announced an expansion of its digital assets custody service
Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. ANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe
Owner of Empire cybercrime market gets 40 years in prison
The co-creator of Empire Market, one of the largest dark web marketplaces before its shutdown, has been sentenced to 40 years in prison for facilitating $430 million in illegal transactions from 2018 to 2020. [...]
TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws
SEC Consult has published technical details on vulnerabilities mentioned in a complaint filed by several US states. The post TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws appeared first on SecurityWeek .
AWS takes aim at runaway AI agent behavior with Strands Box
Amazon Web Services (AWS) has introduced an open-source sandbox for AI agents that allows developers to restrict their actions based on previous behavior, seeking to address security risks as enterprises give autonomous systems greater access to applications and data. The tool, called Strands Box, combines operating system-level isolation with policies that govern what agents can do. Released in d
Critical Flaw in Multiple Atlassian Products Exploited in the Wild
A critical vulnerability affecting eight Atlassian products, including Jira and Confluence, is being exploited in the wild, said VulnCheck
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions.
Wise to pay clients' tax bills after software error
Money transfer app Wise is reportedly negotiating a settlement with the UK's tax authorities over technical errors that led thousands of clients to pay the wrong amount of tax on their investments.
Wise to pay clients' tax bills after third-party software error
Money transfer app Wise has contacted the UK's tax authorities over technical errors that led thousands of clients to pay the wrong amount of tax on their investments.
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
“AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis.
Q3 2026 Open Source Malware Index: When Compromise Compounds
<div class="hs-featured-image-wrapper"> <a href="https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds" title="" class="hs-featured-image-link"> <img src="https://www.sonatype.com/hubfs/Rolling%20Malware%20Index%20Data%20-%20Q3%20-%202026_Malware%20Index%20-%20Q2-2026%20-%201200x627.png" alt="Image with the text "Sonatype Open Source Malware Index Q3 2026"" clas
Quantum computers could break today’s encryption. Washington needs to prepare now.
As advances lower the barrier to breaking current encryption, Washington must move with equal urgency on post-quantum defenses. The post Quantum computers could break today’s encryption. Washington needs to prepare now. appeared first on CyberScoop .
Citi appoints head of research
Citi appoints Michael Zezas as Head of Research.
Coinbase and Samsung Wallet partner for USDC
Last July, Coinbase added Samsung Pay as a payment option, making it easier for users to buy crypto in the Coinbase app.
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys. "The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to
SocialCoach launches reputation management tool for lenders
SocialCoach released Reputation Manager, bringing loan officer reviews to the same platform that seven of the top 20 U.S. lenders already use for social media, video and compliance.
Europol and US GAO Sound the Alarm Over Quantum Threats
Europol and US Government Accountability Office urge faster transition to post-quantum cryptography
Europol and US Spending Watchdog Sound the Alarm Over Quantum Threats
Europol and US Government Accountability Office urge faster transition to post-quantum cryptography
Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme
Zohar Pinhasi was paying ransoms to obtain decryption keys and then charging victims substantially more for remediation. The post Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme appeared first on SecurityWeek .
Swift appoints supervisory board members
Swift today announced the members of its new Supervisory Board, having evolved its governance model to shape the cooperative’s next generation strategy to meet the global financial community’s priorities and further strengthen resilience and trust in the cross-border ecosystem.
We are fighting phishing at the wrong layer
I timed an attacker once. From registering a domain to having it delegated, certificated and serving a live credential-harvesting page took under 24 minutes, and 12 of those were spent waiting on nameservers. I keep coming back to that number, because it quietly indicts most of what we do about phishing. We block domains. We feed them to our gateways and our DNS filters and our threat intel platfo
Backbase puts agentic AI in customers' hands
Backbase today announced the general availability of Conversational Banking, bringing agentic AI into banks’ customer and employee experiences.
MATCHBOIL: New tricks, same old evil intentions
ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026
FBI and Secret Service Warn of FortiBleed Lockout Threat
The FBI and Secret Service are warning Fortigate admins that their systems are still being targeted
Oracle Health Data Breach Tally Climbs to Nearly 20 Million
The figure is far higher than the counts that surfaced in earlier filings and patient notifications. The post Oracle Health Data Breach Tally Climbs to Nearly 20 Million appeared first on SecurityWeek .
FortiBleed Attackers Locking Victims Out of Fortinet Devices
Attackers are creating new accounts and deleting existing ones and passwords to prevent legitimate access. The post FortiBleed Attackers Locking Victims Out of Fortinet Devices appeared first on SecurityWeek .
U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The reward is for information leading to his identification or location, the news outlet NTD reported this week, citing a notice
MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data
The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data. Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire fraud and one count of wire
NVD CRITICAL: CVE-2026-85097 — The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary ...
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a
Almost 20 Million Individuals Affected by 2025 Data Breach at Oracle Health/Cerner
The scale of a 2025 data breach involving electronic protected health information stored on Oracle Health’s legacy Cerner servers is […] The post Almost 20 Million Individuals Affected by 2025 Data Breach at Oracle Health/Cerner appeared first on The HIPAA Journal .
Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland
On the second day of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities. [...]
NVD CRITICAL: CVE-2026-107459 — The SecuShare Pro developed by Openfind has an OS Command Injection vulnerabilit...
The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code," Socket said
NVD CRITICAL: CVE-2026-17609 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to...
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the t
NVD HIGH: CVE-2026-17196 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to...
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. Thi
SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
SonicWall has disclosed yet another critical flaw in one of its core products. CVE-2026-102255 , rated 10 in severity, the highest possible on the Common Vulnerability Scoring System (CVSS), is a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. An unintended access path could allow attackers to order the appliance to issue requests
NVD HIGH: CVE-2026-82627 — The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builde...
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plu
Nasdaq Ventures invests in One Trading
Nasdaq Ventures has made a strategic investment in European derivatives and digital assets exchange One Trading.
Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding Clients
Here’s another case where the folks who were supposed to be the good guys helping you may be harming you. Zohar Pinhasi, 50, also known as “Zack Silver” and “Zack Green,” a U.S. and Israeli national, was arraigned today in the Eastern District of New York on wire fraud charges relating to Pinhasi’s false representations... Source
US Bank rolls out identity, privacy and credit monitoring service
US Bank has introduced a service to help customers monitor and take action when credit, identity and privacy risks are found on the dark web.
CISA KEV: ISC BIND — ISC BIND Data Processing Errors Vulnerability
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
CISA KEV: Apache Struts — Apache Struts Command Injection Vulnerability
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
CISA KEV: Strapi Strapi — Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
CISA KEV: ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
CISA KEV: ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Ransomware recovery CEO charged over secret ransom payments
The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data. [...]
Making the Case to the Board for Post-Quantum Readiness
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/making-case-to-board-for-post-quantum-readiness-image_small-1-a-33036.jpg" align=right hspace=4><b>Frame Quantum Risk Around Business Exposure, Timelines and Staged Investment</b><br>CIOs seeking board support for post-quantum readiness should skip the physics lesson. The stronger case connects vulnerable cryptography to critical
Anthropic Expands Access to Frontier Cyber AI Models
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/anthropic-expands-access-to-frontier-cyber-ai-models-image_small-10-a-33035.jpg" align=right hspace=4><b>3 Access Tiers Cover Defense, Red Teaming and Critical Systems</b><br>Anthropic opened its advanced cyber AI program to applications from any organization, offering tiered access for defense, red teaming and critical infrastruc
China Could Coerce Taiwan by Hacking Comms, Think Tank Warns
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/war-game-tests-taiwans-telecom-backups-against-china-image_small-3-a-33034.jpg" align=right hspace=4><b>War Game Pits Taiwan's Telecom Sector Against China</b><br>A concerted Chinese attempt to take over neighboring Taiwan is more likely to involve "cyber-enabled economic warfare" rather than outright invasion, warns a Washington,
Oracle Health's Cerner EHR Breach Figure Soars to 20 Million
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/oracle-healths-cerner-ehr-server-hack-soars-to-20m-affected-image_small-10-a-33033.jpg" align=right hspace=4><b>Vendor Has Updated Breach Reports to Several States Including Texas</b><br>The number of patients affected in a 2025 hacking incident involving health data managed by electronic health record vendor Cerner has soared to
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments The post Evolution of Web3 in Cloud Supply Chain Attacks appeared first on Unit 42 .
Can you really make more than $200M in six months without encrypting victims? It seems Silent Ransom Group can.
DataBreaches has reported extensively on Silent Ransom Group in 2026, often including material provided exclusively to this site by the group. Now, what appears to be a leak of their internal chats may shed additional light on their success. DataBreaches has reported on Silent Ransom Group (SRG) since 2022, with particular interest in their numerous... Source
Can you really make more than $200M in six months without encrypting victims? It seems Silent Ransom Group can. (1)
UPDATED 2:42 pm October 8: Plot twist! Silent Ransom Group agreed to be interviewed about the Luna Moth Files but denies that the group has been breached or leaked. More to follow later. DataBreaches has reported extensively on Silent Ransom Group in 2026, often including material provided exclusively to this site by the group. Now,... Source
Australian Gov't Weighs Mandatory AI Incident Reporting
In the wake of an agentic attack against its own Medicare systems, Australia's government is feeling out what regulations might look like for frontier AI companies.
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
The FBI is warning that FortiBleed attacks are still ongoing, targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways and locking out legitimate administrators. [...]
Citizen Lab Slams Trump Administration, 'Techno-Fascist' Executives
The Citizen Lab's Ron Deibert warns the US government is pushing for pervasive surveillance and says certain technology executives are all too happy to help.
NVD CRITICAL: CVE-2026-76268 — In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user w...
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration op
NVD HIGH: CVE-2026-76266 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux...
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installat
Anthropic Gives Vetted Defenders Fewer Claude Guardrails
Anthropic has merged Project Glasswing into a tiered access program for its advanced cyber LLMs, including Opus, Sonnet, and Mythos.
Hackers hijack Google domains after breaching ccTLD registries
Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa, and Sierra Leone after compromising third-party operators and modifying authoritative DNS records. [...]
NVD HIGH: CVE-2026-107161 — A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge(...
A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-
US posts $10 million reward for accused Chinese ‘Hafnium’ hacker
U.S. officials say Zhang Yu was a prominent figure in the Hafnium campaign, which saw hackers breach thousands of computers and steal troves of documents.
Major rules for federal contractors handling sensitive data are nearing the finish line
The regulations on “controlled unclassified information” include security rules and requirements for reporting when they’re breached, including by cyberattacks. The post Major rules for federal contractors handling sensitive data are nearing the finish line appeared first on CyberScoop .
OpenAI Agent Escape Causes Wikimedia Service Outage
Autonomous agents also tried to abuse other websites and services hosted by the foundation, using them as proxies for unauthorized activities.
Four Compliance Frameworks, One Security Team. How Universities Can Stop Drowning in Regulatory Risk
Most industries manage one major compliance framework. Universities might manage four simultaneously, each bringing with it unique requirements, enforcement mechanisms, and consequences for failure. Here's what that actually looks like in practice. In Part 1 of this series, we laid out the scale of the threat facing higher education: 4,388 cyberattacks per organization per week, a 24% year-over-ye
Four compliance frameworks, one security team: Why fragmented university security raises regulatory risk
In Part 1 of this series, we looked at the security challenges created by fragmented, campus-by-campus environments. Higher education also faces a second pressure that makes that fragmentation harder to sustain: overlapping compliance obligations across FERPA, GLBA, HIPAA, and CMMC. Each framework brings different requirements, reporting timelines, and consequences for failure. Managing them acros
Microsoft, Adobe, Apple, and Foxit vulnerabilities
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s third-party vulnerability disclosure policy .  For Snort coverage that can detect
Mistral Touts 'Le Chonk' as Capable European Sovereign Model
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/mistral-touts-le-chonk-as-capable-european-sovereign-model-image_small-8-a-33032.jpg" align=right hspace=4><b>French Hope for Native European AI Stresses New Model's Cybersecurity Ability</b><br>Mistral, the French company widely seen as Europe's only potential artificial intelligence champion, unveiled a new model that boasts str
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6. Google's own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the real site over an encrypted
$11 million plan for psychological support at Cyber Command gets fresh boost from lawmakers
Lawmakers who oversee military cyber policy as well as the Fort Meade, Maryland, hub for those agencies say an $11 million mental health program should be locked in to defense spending legislation.
Arizona courts say hackers stole info on more than 1.3 million people
The investigation into the incident revealed cybercriminals were able to breach the Fines/Fees and Restitution Enforcement (FARE) Program, a statewide program that helps the court collect outstanding debts tied to traffic and criminal violations.
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have
NVD CRITICAL: CVE-2026-76501 — A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administratio...
A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM and SR
NVD CRITICAL: CVE-2026-76500 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76500 are related to
NVD CRITICAL: CVE-2026-76499 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to imprope
NVD CRITICAL: CVE-2026-76498 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76498 are related to imprope
NVD CRITICAL: CVE-2026-76486 — A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) fe...
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker c
NVD CRITICAL: CVE-2026-76485 — A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) fe...
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker c
NVD CRITICAL: CVE-2026-76483 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by
NVD CRITICAL: CVE-2026-76482 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-202
NVD CRITICAL: CVE-2026-76480 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-202
NVD HIGH: CVE-2026-76472 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-76472 are related to issues with improper neutralization of special elemen
NVD CRITICAL: CVE-2026-76471 — A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an una...
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP r
NVD HIGH: CVE-2026-76470 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76470 are related to incorrect calculation issues that are grouped
NVD HIGH: CVE-2026-76469 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76469 are related to insufficient control flow management issues th
NVD HIGH: CVE-2026-76468 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76468 are related to improper input validation that are grouped un
NVD HIGH: CVE-2026-76467 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76467 are related to issues concerning improper control of a resou
NVD CRITICAL: CVE-2026-76465 — A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) fea...
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validati
NVD CRITICAL: CVE-2026-76464 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by this CVE-2026-76464 are related to buffer management issues that are groupe
NVD HIGH: CVE-2026-76463 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76463 are related to improper access control issues that are group
NVD HIGH: CVE-2026-76459 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76459 are related to out-of-bounds write issues that are grouped under
NVD HIGH: CVE-2026-76458 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76458 are related to improper handling of exceptional conditions issues
NVD HIGH: CVE-2026-76457 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76457 are related to out-of-bounds read issues that are grouped under t
NVD HIGH: CVE-2026-76456 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76456 are related to improper input validation of special elements used
NVD CRITICAL: CVE-2026-76455 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76455 are related to improper access control issues that are grouped un
NVD CRITICAL: CVE-2026-76454 — A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Pre...
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This vulnerability is due to improper input validation and a lack of authentication in the management API. An att
NVD HIGH: CVE-2026-76453 — As part of Cisco's ongoing commitment to proactive security and product quality,...
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76453 are related to improper neutralization issues that are grouped un
NVD HIGH: CVE-2026-20362 — A vulnerability in the web-based management interface of Cisco Finesse could all...
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successfu
NVD CRITICAL: CVE-2026-20328 — A vulnerability in the web-based management interface of Cisco License On-Prem, ...
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application. This vulnerability is due to improper checks during the password reset process. An attacker could exploit this vulnerability by sending a malicious requ
FBI, French authorities seize deepfake CSAM-for-sale websites
Some of the material appeared to be recorded or stolen video of girls through interactions on social media sites like Snapchat, TikTok, Instagram and Facebook. The post FBI, French authorities seize deepfake CSAM-for-sale websites appeared first on CyberScoop .
Sibos 2026: TradFi vs DeFi, which wins and why
The first of several 'Big Issue Debates' taking place at Sibos 2026 in Miami tackled the topic 'Can TradFi fix the experience before DeFi wins the race?'
NVD HIGH: CVE-2026-107207 — LMCache through 0.5.5 contains a server-side request forgery vulnerability in it...
LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach internal hosts, read responses, and tamper with nodes or stop the heartbeat.
NVD CRITICAL: CVE-2026-107206 — LMCache through 0.5.5 contains a missing authentication vulnerability in the mul...
LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' c
NVD CRITICAL: CVE-2026-107204 — LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerab...
LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network and applications. The most serious could allow an attacker without a login to send requests through the appliance and reach internal functions. SonicWall rates it 10.0 on the CVSS scale and says it has no evidence that any of the four flaws is being
South Korea Suspects AI Tool Helped Steal Bank Customer Data
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/south-korea-suspects-ai-tool-helped-steal-bank-customer-data-image_small-9-a-33031.jpg" align=right hspace=4><b>Attack Servers Show Signs Open-Source Penetration Testing Tool Artex Employed</b><br>Police in South Korea probing data breaches at multiple banks have found signs on attack servers that the threat actor used a free, ope
Attackers Hijack Asos App to Say Store is Hacked
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/hacker-controlled-breach-message-pending-asos-confirmation-image_small-4-a-33029.jpg" align=right hspace=4><b>Asos Lost Control of its Story to 'Advanced Persistent Teenagers'</b><br>Fanciers of fast-fashion online retailer Asos received an unusual notification from the store app Tuesday, apparently sent by the hackers who hacked
AI systems most at risk of cybersecurity attacks, PwC report shows
Amongst the existing cybersecurity threats, attacks against AI systems are the ones leaders feel least prepared for, according to a new PwC report.
Microsoft Outlook to block MSIX attachments starting November
Microsoft announced that it will add .msix and .msixbundle attachments to the list of blocked attachments in Outlook Web and the new Outlook Windows client starting next month. [...]
Jefferson-Blount-St. Clair Mental Health Authority Pays $700K to Settle Data Breach Lawsuit
Jefferson-Blount-St. Clair Mental Health Authority has agreed to settle a consolidated class action lawsuit stemming from a 2025 security incident […] The post Jefferson-Blount-St. Clair Mental Health Authority Pays $700K to Settle Data Breach Lawsuit appeared first on The HIPAA Journal .
Robinhood taps Duffel to power travel platform
Duffel, the travel-tech platform, has partnered with Robinhood to power the flight, hotel and car rental experiences at the heart of Robinhood Travel.
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. The flaw is in LMCache's multiprocess mode, where the cache runs as a standalone server that LLM workers reach over the ZeroMQ messaging library. A single network
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miners and further expand the scale of the botnet. The financially motivated campaign, dubbed Canto Incognito, has been found to install cryptocurrency miners, including
NVD HIGH: CVE-2026-77214 — libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in...
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching t
Iridium Credit raises $3m
Iridium Credit, the verification infrastructure for invoice finance, today announced a $3 million round co-led by Field Ventures and MGV.
PoeLLM malware infects exposed AI servers in cryptomining attacks
A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads. [...]
Oklahoma judge’s Flock ruling shows the power of Supreme Court’s digital evidence decision
How a recent Supreme Court decision on geofencing influenced a federal judge to toss a sheriff's Flock camera evidence in a drug trafficking case.
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
More than 3,400 servers have been compromised by malware that hides its infrastructure coordinates in a poem. The post PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem appeared first on CyberScoop .
Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)
On October 5th, Atlassian published patches&#;x26;#;xc2;&#;x26;#;xa0;for multiple products to fix an "Arbitrary File Access" vulnerability &#;x26;#;x5b;CVE-2026-21589&#;x26;#;x5d;. An attacker can read arbitrary files in the web application&#;x26;#;39;s direct
HSBC to make 'deep, wide and brutal' UK wealth management job cuts in AI push
HSBC is planning to axe up to 70% of its UK financial advisors as part of swingeing cuts to its wealth management business driven by riding use of AI, according to the Financial Times.
NVD HIGH: CVE-2026-46569 — In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail()...
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.
NVD HIGH: CVE-2026-42616 — In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c ...
In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary by crafting a malicious NTFS image. The overflow is triggered by reading a file.
Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts
Southern Company is notifying customers that their utility account information was accessed by hackers. The post Georgia Power, Alabama Power Data Breach Hits 400,000 Accounts appeared first on SecurityWeek .
OT Coalition Urges CISA to Mandate Federal OT Security
OTCC urged CISA to mandate baseline security requirements for federal operational technology
Cyber experts call on CISA to create mandatory federal OT rules
The Operational Technology Cybersecurity Coalition released a white paper urging the CISA to create a new directive centered around operational technology, which is used to monitor and control critical infrastructure.
Ransomware has a new target. Is your backup ready?
Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that attackers cannot easily reach. [...]
Coast Guard Boardings of Hacked Vessels: New Details
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/coast-guard-boardings-hacked-vessels-new-details-image_small-7-a-33027.jpg" align=right hspace=4><b>US-Bound Supertankers Hacked Using Known Vulnerabilities, Says Official</b><br>Two cyberattacks on U.S.-bound supertankers in August, which led to them being boarded by Coast Guard and FBI cyber specialists, exploited known, unpatch
Hadrian Expands Offensive Security Platform With $40M Raise
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/hadrian-expands-offensive-security-platform-40m-raise-image_small-6-a-33026.jpg" align=right hspace=4><b>Platform Expansion Will Move Beyond External Scanning Into Internal Network Defense</b><br>Dutch startup Hadrian closed a $40 million Series B funding round to expand its offensive security platform into internal attack-path te
Denmark Braces for Wave of Phishing Attacks
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/denmark-braces-for-wave-phishing-attacks-image_small-10-a-33025.jpg" align=right hspace=4><b>Attackers Stole Data of Nearly 9M Danes from the Central Register of Persons</b><br>Denmark's residents have been hit by a data breach affecting the country's Central Register of Persons, exposing names, addresses, CPR numbers and other de
Google Pauses Open-Source Bug Bounty Program Amid AI Slop
<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/google-pauses-open-source-bug-bounty-program-amid-ai-slop-image_small-2-a-33024.jpg" align=right hspace=4><b>Tech Giant Cites 'Significant Rise in Automated Submissions' Lacking Validity</b><br>Google has indefinitely paused a bug bounty program designed to reward researchers who find flaws in the open-source software it maintains
Senate passes healthcare cybersecurity bill after 190 million impacted by Change Healthcare breach
The Health Care Cybersecurity and Resiliency Act of 2026 was passed by unanimous consent last week, potentially expanding federal cyber requirements for healthcare organizations.
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle "Rey," was detained as ShinyHunters was in the process of extorting a business unit recently divested by the gl
Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
The individual was detained in May and has been extradited to Germany to face hacking charges. The post Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany appeared first on SecurityWeek .
Russian cyberattacks against UK are 'Putin Tax' costing $3.3 billion, says lawmaker
A report by a Labour MP and an academic argues that if the British public cannot see what Russian activity costs, it cannot weigh that burden against the cost of defending against it.
TS Imagine adds regulatory intelligence to AI platform for capital markets
TS Imagine, a global provider of trading, portfolio, risk management and prime brokerage solutions, today announced the availability of Gentek.ai’s Model Context Protocol (MCP) with TSIQ, its AI platform for capital markets.
PayDo Selects Convera to expand Swift receivables and onward cross-border payments
The collaboration brings expanded Swift receive capabilities into PayDo’s existing platform, helping customers manage incoming and onward international payments through a more connected experience.
Canton Foundation targets Korea with LG CNS partnership
Canton Foundation and LG CNS today announced a strategic partnership to advance institutional adoption of the Canton Network in Korea and support the development of the technical ecosystem required for institutions to build and deploy on Canton Network.
Sumsub launches reusable KYC gateway
Sumsub, the AI-powered trust infrastructure for compliance operations at scale, today launched Reusable KYC Gateway at Token2049 Singapore. MiniPay, one of the fastest growing stablecoin wallets, is the first live integrator, giving its users a shared verification experience across MiniPay's partner network.
Valu and Alshaya Group team on flexible payments for retail brands in Egypt
Valu, the leading universal financial technology powerhouse in the Middle East and North Africa (MENA), announced a strategic partnership with Alshaya Group, one of the world’s leading franchise operators, to expand access to flexible payment solutions across participating Alshaya retail brands in Egypt.
TransUnion UK makes executive appointments
TransUnion UK & Europe has announced several senior appointments as the business continues driving innovation across the region.
CVE-2026-102489 Deep-Dive: Zammad Session Leak to RCE
[object Object]
Hadrian Raises $40 Million to Expand Autonomous Offensive Security Platform
Hadrian offers an agentic offensive security platform that allows defenders to operate at the same speed as attackers. The post Hadrian Raises $40 Million to Expand Autonomous Offensive Security Platform appeared first on SecurityWeek .
Attackers Hide AI Prompt Injections Inside Phishing Emails
Barracuda finds phishing emails designed to manipulate both human users and AI assistants
Liberty France goes live with Lendscape platform
Liberty Finance, a leading alternative finance provider, has completed its digital transformation journey by implementing Lendscape's cutting-edge, AI-enabling asset finance platform.
Anthropic widens access to AI cyber capabilities for vetted security teams
Anthropic is expanding its Cyber Verification Program to give more security teams access to advanced cyber capabilities with reduced safeguards on its most advanced AI models. The expanded program has three access tiers based on the type of cybersecurity work an organization is authorized to perform. The tiers cover defensive security work, authorized red teaming, and testing of systems that could
Integral selected for digital asset trading in Turkey
Integral, a leading provider of currency technology, today announced that Yapı Kredi Kripto has selected Integral's digital asset trading technology, enabling the group to provide cryptocurrency services through its soon-to-launch regulated digital asset business.
FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
Users of two types of Fortinet hardware should take steps to limit their exposure to a now-global credential stealing campaign, U.S. federal law enforcement says.
Hackers exploit critical Atlassian flaw after public PoC release
A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. [...]
Wealthtech PlannerPal raises $6m
Funding follows rapid enterprise growth, with the PlannerPal client base including 20% of the UKs top 20 wealth managers and further expansion into the mortgage market.
Devexperts names Rainer Fuchsluger as global group CEO
Devexperts today announced the appointment of Rainer Fuchsluger as Global Group Chief Executive Officer (CEO), effective immediately.
Advantest Discloses Data Breach Months After Ransomware Attack
The Japanese chip testing giant said hackers stole personal information from its servers in the February 2026 cyberattack. The post Advantest Discloses Data Breach Months After Ransomware Attack appeared first on SecurityWeek .
Denmark’s national ID system breach exposes personal data of 8.8M
Denmark is reviewing security controls around its national citizen registry after unauthorized parties exploited a company’s access credentials to harvest records on approximately 8.8 million people over a 10-day period. The breach covers people living in Denmark as well as individuals who have died or moved abroad, while people with protected names and addresses were not affected. The unauthorize
Many Medical Devices Incapable of Supporting Transition to Post-Quantum Cryptography
An analysis of medical devices indicates that healthcare organizations face a significant risk of future quantum-enabled attacks, as only a […] The post Many Medical Devices Incapable of Supporting Transition to Post-Quantum Cryptography appeared first on The HIPAA Journal .
NVD HIGH: CVE-2026-106059 — GitAhead through 2.7.1 on macOS contains a command injection vulnerability that ...
GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do shell script payload, which runs as the victim user when Show in Finder is chosen.
NVD HIGH: CVE-2026-106058 — GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git...
GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $(command) selected via .gitattributes so checkout or staging runs the command through bash -c as the victim.
De Kalb County, Indiana fell prey to vendor impersonation billing
The Star reports that the DeKalb County government fell victim to a cybersecurity incident for the second time in little more than a year. This time, it paid an invoice sent by threat actors impersonating a vendor: “On Thursday, October 1, 2026, DeKalb County Government became aware of a Financial Fraud Cyber Incident that had... Source
CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products
Overview On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589 , a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian assigned the vulnerability a CVSSv4 score of 9.3 . An
Noah raises $38m for stablecoin payments platform
Stablecoin payments infrastructure provider Noah has closed its seeding round after pulling in $38 in funding.
The Sixth Voice of the CISO Data Shows Cyber Risk Has Moved Inside the Workflow
The 2026 findings are not just a year-over-year shift. They mark the latest point in a five-year arc where resilience, AI governance, human risk, and board scrutiny are converging inside the systems where work actually happens. For years, the enterprise cybersecurity story has been told as a straight line of escalation: more attacks, more data loss, more pressure, and more urgency. That
Telegram Account Behind ASOS Rogue Notification Tied to Gaming Trading
A Group-IB researcher has found the Telegram account linked to the unauthorized ASOS customer notification previously engaged in gaming-item trading
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
The U.S. Federal Bureau of Investigation (FBI) and Secret Service (USSS) on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways. "The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software
Encrypted instructions trick Copilot CLI into spilling developer secrets
GitHub Copilot CLI can be made to read sensitive files from a developer’s machine and send their contents to an attacker from a single web page. Security researchers at Adversa AI said the new attack technique, dubbed Cryptographic Context Injection (CCI), hides malicious instructions inside encrypted content. These instructions are treated as trusted context when Copilot CLI decrypts the content
What Is Agentic Pentesting? What It Proves, and Where It Stops.
If you’re evaluating an agentic pentesting solution right now, you’ve probably heard the same pitch more than once: point it at a target, and it discovers, validates, and exploits attack paths autonomously, the way a real attacker would. That promise is worth taking seriously. It’s also worth pressure testing, and three questions do the heavy lifting. What can the assessment actually
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances. [...]
Apple’s Verified Photography System
Apple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photographer or institution to vouch for an image using their own credentials. We are conce
Goldman Sachs appoints bankiong tech co-head
Wall Street bank Goldman Sachs has named senior tech bank executive Jane Dunlevie as its new co-head of the technology, media and telecommunications investment banking group.
Goldman Sachs appoints banking tech co-head
Wall Street bank Goldman Sachs has named senior tech bank executive Jane Dunlevie as its new co-head of the technology, media and telecommunications investment banking group.
Chrome 155 Update Patches 247 Vulnerabilities
Four critical-severity use-after-free defects were fixed in Chromecast, Browser, Navigation, and Track. The post Chrome 155 Update Patches 247 Vulnerabilities appeared first on SecurityWeek .
The ASOS incident: When attackers use the channels customers trust
ASOS customers opened their phones to find a hostile push notification delivered through the retailer’s own app. The message claimed the company’s Snowflake environment had been compromised and directed ASOS to engage with the sender through Telegram. ASOS later confirmed to Sky News that an unauthorized customer notification had been sent and said it was investigating activity involving third-par
Musician sent to prison for $10 million streaming fraud using AI bots
A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme. [...]
Advantest confirms personal information stolen in ransomware attack
Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data. [...]
Capitolis raises $220m for eSecLending acquisition
Capitolis, a US-based fintech in the portfolio optimisation market, has pulled in $220, following a series E equity financing round.
Half of Cybersecurity Pros Still Rely on Passwords Despite Security Concerns
A Yubico survey identified a significant gap between awareness and adoption of secure methods of authentication in enterprises
Anthropic Introduces 3-Tier Cyber Verification Program for AI Access
Anthropic is integrating the CVP and Project Glasswing into a single offering, with three levels of access to its most capable AI models. The post Anthropic Introduces 3-Tier Cyber Verification Program for AI Access appeared first on SecurityWeek .
One breach, please, and make no mistakes
The cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure. How you prepare for agentic threats is what makes the difference during real incidents.
ASOS Confirms Cyberattack, Data Breach
Hackers compromised a third-party communication platform and sent rogue notifications to ASOS users. The post ASOS Confirms Cyberattack, Data Breach appeared first on SecurityWeek .
Pwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One
Ethical hackers have already found 32 zero days in various products at Pwn2Own Ireland
Edmond de Rothschild and Caceis extend asset servicing agreement
CACEIS and Edmond de Rothschild announce a strategic Asset Servicing partnership that deepens their cooperation in Luxembourg.
BDO Unibank selects Finastra for payments
Finastra, a global leader in financial services software, today announced that BDO Unibank, Inc. (BDO) has enhanced its payments infrastructure with Finastra’s modern Global PAYplus (GPP), reinforcing the bank’s ability to support growing transaction volumes, strengthen operational resilience, and advance interoperability across the payments ecosystem.
Your enterprise doesn’t need six BOM programs. It needs one evidence graph
In infrastructure and security programs, I have watched visibility projects follow a familiar path. The first dashboard feels like progress. Then the data grows, ownership blurs and the team discovers that visibility without identity and action has become another estate to operate. Bill-of-materials programs are reaching that point now. Most CIOs know the Software Bill of Materials, or SBOM. It he
Inside a brand deal scam targeting YouTube creators
A plausible-sounding sponsorship offer could mask an attempt to compromise your Google account
AI is turning offensive security into a continuous necessity
The rise of AI has CISOs facing even more vulnerabilities than ever, resulting in increasingly difficult decisions around what fixes to prioritize. “When I was a CIO, the hardest part of my job was deciding what not to do,” Snehal Antani, CEO of pentesting platform Horizon3.ai, tells CSO. “And if I chose not to fix a vulnerability because I didn’t have the resources or I didn’t think it was import
Danish CPR Breach Highlights Challenge of Supply Chain Risk
A breach of 8.8 million citizens on the Danish Central Register of Persons (CPR) occurred via third-party access
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
Anthropic on Tuesday said it's expanding a program that allows vetted cybersecurity professionals to test its advanced artificial intelligence (AI) models with reduced safeguards and blocking classifiers, as the company claimed its Project Glasswing initiative uncovered at least 129,000 verified software vulnerabilities between April and July 2026. The company said it also found an additional
Wikimedia Says Rogue OpenAI Agents Tried to Turn Its Tools Into Proxies
Wikimedia looked into whether its own websites had seen activity like that disclosed by other organizations The post Wikimedia Says Rogue OpenAI Agents Tried to Turn Its Tools Into Proxies appeared first on SecurityWeek .
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer). The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the
Android’s October 2026 Updates Patch 25 Vulnerabilities
The patches resolve a critical vulnerability in Android’s System component that could lead to privilege escalation. The post Android’s October 2026 Updates Patch 25 Vulnerabilities appeared first on SecurityWeek .
Atlassian Patches Critical Vulnerability Affecting 8 Products
Unauthenticated attackers could exploit the flaw to access specific files in the web application root directory. The post Atlassian Patches Critical Vulnerability Affecting 8 Products appeared first on SecurityWeek .
Frontier models found the vulnerabilities. Only the attacker found the chains.
Static analysis found the flaws, but only live attack testing proved how they could be chained into breaches. A comparison of Evo COS, Claude Security, and Claude Code Security.
NVD HIGH: CVE-2026-106471 — A flaw was found in Candlepin. The central authorization filter incorrectly gran...
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this c
Atlassian’s critical flaw turns eight enterprise products into one big security problem
A newly-disclosed critical flaw in Atlassian’s data center software has a remarkably wide reach, affecting eight core products across the company’s enterprise portfolio. CVE-2026-21589 , rated 9.3 (critical) in severity, is an arbitrary file access vulnerability that could allow an attacker with no login access to read files in web app root directories that they should not otherwise see, and poten
Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System
The Arizona Supreme Court said the information was copied for people dating back as far as 30 years. The post Personal Information for Over 1 Million People Stolen in a Cyberattack on Arizona’s Court System appeared first on SecurityWeek .
You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
[object Object]
NVD HIGH: CVE-2026-97680 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.
NVD HIGH: CVE-2026-97679 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.
NVD HIGH: CVE-2026-97678 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
NVD HIGH: CVE-2026-97674 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.
NVD HIGH: CVE-2026-97673 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
NVD HIGH: CVE-2026-97655 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.
NVD HIGH: CVE-2026-93678 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
NVD HIGH: CVE-2026-93677 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.
NVD HIGH: CVE-2026-93675 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
NVD CRITICAL: CVE-2026-93674 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
NVD HIGH: CVE-2026-93449 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
NVD HIGH: CVE-2026-93447 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.
NVD HIGH: CVE-2026-93445 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
NVD HIGH: CVE-2026-93443 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.
NVD HIGH: CVE-2026-88962 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
NVD CRITICAL: CVE-2026-104334 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
NVD HIGH: CVE-2026-103360 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
NVD HIGH: CVE-2026-101331 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
NVD HIGH: CVE-2026-104335 — IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke...
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.
JPMorgan Chase extends lead as world's most AI-advanced bank
JPMorgan Chase has extended its lead as the world's most artificial intelligence-advanced bank, once again topping the Evident AI Index.
M&A intelligence platform Comparables.ai raises $6m
Finnish mergers and acquisitions intelligence platform Comparables.ai has raised $6 million in seed funding.
Autonomous Attacks Are Already Here. The Defense Has to Match Their Speed.
Autonomous attackers are shrinking the window for defense. Learn how continuous discovery, remediation, validation, and prevention can help security teams keep pace.
Engineer sentenced for locking over 3,000 devices on employer’s network
Sergiu Gatlan has an update on a case previously noted on this site. A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer’s network in a ransomware-style attack. 57-year-old Daniel Rhyne from Kansas City, Missouri, pleaded guilty... Source
NVD HIGH: CVE-2026-106509 — Backstage is an open framework for building developer portals. Prior to 1.14.6, ...
Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build documentation locally or in a container, a user with write access to a registered repository can include configuration values in mkdocs.yml that cause arbitrary
NVD HIGH: CVE-2026-106505 — Backstage is an open framework for building developer portals. Prior to 1.14.6 a...
Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can circumvent the MkDocs configuration file sanitizer introduced in response to CVE-2026-25153 and execute arbi
NVD HIGH: CVE-2026-106062 — A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader...
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL (CWE-787), following integer overflow in size calculations (CWE-190). This may allow heap cor
NVD HIGH: CVE-2026-101258 — A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript o...
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that deleg
Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks
The FBI and Secret Service warned Fortinet users that FortiBleed, uncovered this summer, is a continuing threat. The post Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks appeared first on CyberScoop .
Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]
American Bankers Association invests in BankTech Ventures fund
The American Bankers Association today announced an investment in BankTech Ventures Fund II, a community-bank-backed venture fund focused on identifying and supporting innovative technology companies that help banks operate more efficiently, better serve customers and compete more effectively in a rapidly evolving marketplace.
CVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRF
<p><b>Bulletin ID:</b> 2026-127-AWS <br> <b>Scope:</b> AWS <br> <b>Content Type:</b> Important (requires attention) <br> <b>Publication Date:</b> 10/06/2026 13:30 PM PDT</p> <p><b>Description:</b></p> <p>bedrock-agentcore-starter-toolkit is an AWS-maintained open-source Python package, distributed via GitHub and PyPI, that provides a command-line interface for importing Amazon Bedrock Agents into
Plaid launches credit, fraud and payment risk AI models
Open finance fintech Plaid has unveiled AI models designed to help financial firms make better lending decisions, catch more fraud, and reduce payment risk.
ClickFix Attacks Evolve to Better Hide Malicious Payloads
Threat actors are now hiding payloads by using DNS TXT records and browser cache pre-fetching, making it tougher to spot early attack stages.
Critical Healthcare Systems Aren't Quantum-Ready
A study of 2.5 million devices across 50 healthcare organization suggests the sector has a long way to go in getting ready for the post-quantum cryptography era.
NVD HIGH: CVE-2026-104048 — A flaw was found in SSSD. In trust-enabled identity management environments, SSS...
A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.
Wiretapping change sparks big privacy fight in the Golden State
An update to a state wiretapping law will end private lawsuits over some internet tracking and surveillance, pitting businesses against privacy groups and unions.’ The post Wiretapping change sparks big privacy fight in the Golden State appeared first on CyberScoop .
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]
NVD HIGH: CVE-2026-96890 — A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Ente...
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committ
NVD HIGH: CVE-2026-83550 — A flaw was found in postgres-exporter. Due to the blank import of `net/http/ppro...
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from
NVD CRITICAL: CVE-2026-106237 — Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed ...
Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
NVD HIGH: CVE-2026-106221 — Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39...
Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
NVD HIGH: CVE-2026-106199 — Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8...
Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
NVD HIGH: CVE-2026-106198 — Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allo...
Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
NVD HIGH: CVE-2026-106196 — Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.80...
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
NVD CRITICAL: CVE-2026-106195 — Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0....
Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
NVD HIGH: CVE-2026-106188 — Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 ...
Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
NVD HIGH: CVE-2026-106122 — The RabbitMQ Java client library allows Java and JVM-based applications to conne...
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message with a malformed echoed property can cause reply
NVD HIGH: CVE-2026-106121 — The RabbitMQ Java client library allows Java and JVM-based applications to conne...
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies
NVD HIGH: CVE-2026-104073 — NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vuln...
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API to
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. The products, which claim to offer campaign optimization, spend audits, and business-account connections, are designed with one goal in
FBI removes contractor working with its PeopleSoft system after data breach, says report
The US Federal Bureau of Investigation has removed an Accenture contractor working on its PeopleSoft installation over their role in a data breach that exposed personal details of FBI employees, Reuters reported Monday. This is the first time that anyone other than the hacker group Shinyhunters that claimed responsibility for the breach has linked it to PeopleSoft. “To date, our review has determi
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the name of a real binary, it may
Circle, Ripple and Standard Chartered invest in OKX
Crypto exchange OKX has secured strategic investment from Circle, QRT, Ripple and SC Ventures at a $25 billion valuation.
Google's PageBreak AI Agent Finds 500 Flaws in Its Web Apps
The situation illustrates a trend toward using AI and deterministic validation to identify flaws and exploitability, and provide a risk assessment.
Former NSA chief Nakasone says agency overhaul is ‘probably needed’
Paul Nakasone said the reported reorganization is likely necessary to meet faster-moving cyberthreats and competition in AI, but warned its success will rest on execution and a workforce facing mounting retirement pressure. The post Former NSA chief Nakasone says agency overhaul is ‘probably needed’ appeared first on CyberScoop .
AlphaSense unveils SuperAnalyst AI agent
AlphaSense, the AI platform redefining market intelligence for the business and financial world, today announced its always-on AI agent, SuperAnalyst, is evolving decision-grade AI from answering questions to continuously executing complex workflows using real-time data on behalf of users.
Atlassian warns of critical file-access flaw in Jira, Confluence
Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]
NVD HIGH: CVE-2026-106219 — In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs a...
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
NVD CRITICAL: CVE-2026-106218 — In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leadin...
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
NVD CRITICAL: CVE-2026-104070 — The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulner...
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a m
IANS' Kakolowski: How AI Is Reshaping CISO Budgets & Security Teams
In this video interview, Nick Kakolowski, senior director for CISO research at IANS, talks AI: budgets, ROI, and changes inside security teams.
You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) - watchTowr Labs
[object Object]
'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
Not quite an EDR-killer, but the proof-of-concept cyber technique creates a silent virus detection gap while service runs normally, no exploit required.
ASOS confirms data breach after “HACKED” in-app notifications
UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. [...]
Wells Fargo brings debit card personalisation to mobile app
Wells Fargo today announced an enhanced digital banking experience with Mobile Card Design Studio®1, giving customers the ability to personalize eligible debit cards directly within the Wells Fargo Mobile®2 app.
Alleged ATM malware creator appears in Nebraska court after arrest
Aguirre was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March, becoming the first cybercriminal added to the list.
South Korean officials believe AI agents were used to hack several banks
The personal data of at least 68,000 people was reportedly exposed in breaches of at least seven financial institutions, with officials saying they believe a Chinese cybersecurity tool was used to hack the banks’ systems.
Call Federal Credit Union goes live with Mahalo platform
Call Federal Credit Union (‘Call Federal’) has gone live with Mahalo Banking’s Thoughtful Banking platform. This launch expands the credit union’s digital banking capabilities with new self-service functionality, enhanced security and accessibility features, and a more user-friendly experience for members.
Lumin Digital launches behavioural intelligence tool
Lumin Digital, the Compounding Growth Platform for banks and credit unions, today announced the commercial launch of Lumin Signal, a new capability that gives financial institutions greater visibility into how retail and business users navigate the digital banking experience and the tools to act on those insights directly within the Lumin platform.
FBI Blames Contractor’s Missed Patch for ShinyHunters Breach
Eduard Kovacs reports: The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees, Reuters reported on Tuesday, citing two people familiar with the matter. The FBI has not publicly named the contractor or the organization involved. However, a senior bureau official told Reuters that its... Source
Experian launches Cashflow Data Bureau
Experian, a global leader in data and technology, today announced Experian Cashflow Data Bureau, Inc.
Ripple expands partnership with Brevan Howard to include prime brokerage services
Ripple, a leading provider of blockchain solutions across traditional and digital finance, and Brevan Howard, a leading global alternative investment manager specializing in global macro and digital assets, today announced that they are deepening their relationship.
NVD HIGH: CVE-2026-54472 — Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of H...
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8
Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. [...]
ClickFix Attack Hides VBScript Payload in Browser Cache
ClickFix sites stage a VBScript payload in the browser cache to bypass the Run dialog's length limit
UK picks banks as lead managers for digital gilt pilot
The UK government has selected six banks as joint lead managers for the Digital Gilt Instrument (Digit) pilot issuance.
BMO and MoneyPrep bring financial literacy education to elementary students
BMO today announced an exclusive strategic partnership with MoneyPrep to bring financial literacy education to more elementary students across Canada.
Mollie strengthens Pay by Bank
Mollie has launched a renewed version of Pay by Bank, built on the technology of GoCardless, which Mollie acquired earlier this year. Pay by Bank lets consumers pay directly from their bank account, through a faster, more efficient checkout designed to boost conversion.
Osaka Metropolitan University cancels classes after suspected ransomware attack
Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems unavailable.
NVD HIGH: CVE-2026-85523 — Improper neutralization of special elements used in an OS command ('OS command i...
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1.
NVD HIGH: CVE-2026-106040 — Mooncake Store master through 0.3.13.post1 contains a missing authorization vuln...
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can evict DISK replicas across all tenants, deleting objects whose only remaining replica is on disk.
NVD HIGH: CVE-2026-106038 — Mooncake Store master through 0.3.13.post1 contains a missing authentication vul...
Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and reques
NVD CRITICAL: CVE-2026-106037 — Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in...
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments.
NVD HIGH: CVE-2026-105920 — A vulnerability was determined in Kusalkasilva Learning-Management-System up to ...
A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product use
NVD HIGH: CVE-2026-105841 — lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz re...
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
NVD HIGH: CVE-2026-105840 — lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive u...
lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the r
NVD HIGH: CVE-2026-105837 — libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load()...
libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.
FBI Blames Contractor’s Missed Patch for ShinyHunters Breach
The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees. The post FBI Blames Contractor’s Missed Patch for ShinyHunters Breach appeared first on SecurityWeek .
Securing Agent-to-Agent Communication: The Next Identity Frontier
As organizations deploy autonomous AI agents, security teams face a significant shift as non-human non-human entities making decisions, invoking tools, and delegating tasks to other agents without human intervention. Security architectures built around human users, static APIs, and distinct endpoints break down when AI agents dynamically collaborate across an environment. As these interactions bec
YouLend and Verifone team up on merchant financing
Verifone, a global leader in payments and commerce technologies, today announced strategic product enhancements at the NACS Show to drive growth, customer satisfaction and revenue for its convenience and fuel retail partners.
ExpenseIn partners Stripe on automated reimbursements for business expenses
ExpenseIn, the expense management platform, extends its partnership with Stripe, the programmable financial services company, to introduce automated reimbursement for its users.
Gatehouse Bank backs youth homeless charity via new saver account
Gatehouse Bank has today launched a one-year fixed term Community Saver Account in support of the Bank’s charity partner, Depaul UK, a youth homelessness charity.
How to secure RMM software: 8 controls MSPs should test
RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation. [...]
Nikkei Discloses Two Employee Cloud Account Compromises
Nikkei says two employee cloud accounts were accessed, with one used to send 9,000 phishing emails
Getnet simplifies European expansion for merchants
Expanding across Europe just became simpler for merchants. Getnet, Santander's global merchant payments platform, now enables multinational merchants, marketplaces and e-commerce companies to access payment services in over 30 countries across Europe through a single integration.
Tribe Payments names Alex Lim head of sales and solutions, Asia-Pacific
Tribe Payments, a global payments fintech specialising in issuer and acquirer processing, has appointed Alex Lim as Head of Sales and Solutions, Asia-Pacific.
OMS and Step One Finance extend integration with bespoke loan origination platform
One Mortgage System (OMS) has strengthened its partnership with Step One Finance through the integration of a bespoke loan origination system, further cementing OMS’s growing role in the second charge lending space.
ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
CERT-UA found fake Cloudflare verification pages that led visitors into a now-familiar ClickFix trap. This time the goal was to infect machines with an infostealer.
NVD HIGH: CVE-2026-82531 — Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability...
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution
NVD HIGH: CVE-2026-105919 — A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb8...
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be
NVD HIGH: CVE-2026-105835 — PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST...
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one succeeds, obtaining a full access token.
Red Hat’s Lightwell Project Remediates 400 Open-Source Vulnerabilities
The IBM subsidiary has also announced its Lightwell Clearinghouse is now available to all customers
FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026. The post FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware appeared first on SecurityWeek .
Revolut eyes Philippines bank licence
Digital bank Revolut is considering the Philippines as the next market in its global expansion plans
Critical Medical Devices Unable to Support PQC Transition
Forescout found that just 6% of Internet of Medical Things (IoMT) and 16% of medical OT are capable of supporting post quantum cryptography
NVD HIGH: CVE-2026-105918 — A vulnerability has been found in Kusalkasilva Learning-Management-System up to ...
A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious
Self-described “cybersecurity engineer” arrested after computer case reopened
Natalie Dreier reports: A Florida man who calls himself a “cybersecurity engineer” on TikTok and Twitch was arrested after police reopened an investigation closed earlier this year. Mark Asea was held in the St. Lucie County Jail in Port St. Lucie, Florida, last week on a count of an offense against computer users, WPEC reported.... Source
Personio acquires spend management platform Circula
German unicorn Personio has purchased fellow German fintech Circula, one of Europe's largest spend management platforms.
Japan hands over ‘Qilin’ hacker group member to Germany
JiJi reports: Japanese police have captured a Russian national believed to be a key member of the “Qilin” international hacker group and extradited him to Germany, investigative sources said Tuesday. Qilin is believed to have carried out ransomware attacks against companies worldwide, causing major damage through data encryption. In 2025, the group claimed responsibility online... Source
Denmark Central Person Register (CPR) Breach: Cyberattack Exposes Data of 8.8 Million
Rescana’s new report on a breach affecting the Denmark Central Person Register (CPR) summarizes the situation: On October 5, 2026, Danish authorities publicly disclosed a significant data breach affecting the Central Person Register (CPR), Denmark’s national population database. Attackers exploited a legitimate company account to access the names, addresses, and CPR numbers of approximately
ASOS customers receive ‘hack’ notification threatening leak
Sarah Butler reports: ASOS is investigating after users of its mobile app received a notification claiming hackers had “fully compromised” the online fashion retailer’s data. The value of Asos’s shares on the London Stock Exchange dived almost 12% after thousands of customers received a notification titled “Asos hacked” with a link that sent them to... Source
Savannah lwIP SMTP client
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-279-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution.</strong></p> <p>The following versions of Savannah lwIP SMTP client are affected:</p> <u
Hitachi Energy REB500
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-279-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. Please ref
Hitachi Energy Asset Suite
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-279-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality, integrity and ava
Johnson Controls EasyIO FG
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-279-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device.</strong></p> <p>The following versions of Johnson Controls EasyIO FG are affected:</p> <ul> <li>EasyIO FG firmwar
Hitachi Energy SOI
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-279-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confident
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro. The attack works only when the program's Java support is enabled. So far, it has only been shown as a proof of concept, and there are no reports of its use in
New Linux malware turns vulnerable IoT devices into proxy nodes
A new Linux backdoor is turning vulnerable internet-facing devices into remotely controlled proxy nodes, while using the public Session Traversal Utilities for NAT (STUN) infrastructure to blend into normal VoIP and WebRTC traffic. Fortinet’s FortiGuard Labs said it has been tracking the malware, dubbed ClingSTUN, across multiple attacks exploiting known vulnerabilities in routers, IoT devices, DV
Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks
Citing growing risks posed by more capable and autonomous AI agents, Apple will introduce additional controls. The post Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks appeared first on SecurityWeek .
ASOS Customers Receive Bizarre “Hacked” Message Amid Suspected Snowflake Compromise
ASOS customers have received a seemingly legitimate push notifications claiming the retailer’s IT systems have been breached through a Snowflake breach
Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits
The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have been partially responsible for a May outage. [...]
Here’s how experts think CISA should tell agencies to protect OT
Government auditors say federal agencies haven’t met mandated security steps for operational technology, which hackers targeted in water sector attacks this summer. The post Here’s how experts think CISA should tell agencies to protect OT appeared first on CyberScoop .
Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies
The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia pages. "The unauthorized bot activities included edits to our wikis, some unsuccessful attempts to exploit a public note-taking tool we host, and heavy traffic,
DNB to lay off 400 and expand use of AI agents
Norway's biggest bank, DNB, is set to lay off 400 staff in its technology teams while it increases its investment in AI agents.
Possible Vulnerability in Apple’s Automatic Reboot
404Media is reporting (alternate link ) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn’t been used for 72 hours. The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey,
Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers
In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around it fell short. Earlier this year, our team at OX Security, traced critical vulnerabilities in Anthropic's MCP
Cybersecurity M&A Roundup: 39 Deals Announced in September 2026
Significant cybersecurity M&A deals announced by Dragos, IBM, Palo Alto Networks, Kiteworks, and Upwind. The post Cybersecurity M&A Roundup: 39 Deals Announced in September 2026 appeared first on SecurityWeek .
Pacing the AI frontier won’t solve agentic cybersecurity’s most urgent problems
When Anthropic CEO Dario Amodei urged other leading AI labs to “pace the frontier” last week, his calls for caution were echoed by other prominent voices in tech. Both Sam Altman and Elon Musk agreed with Amodei’s assessment that pausing AI development was essential to prevent the extinction of the human race. Amodei listed several potential disasters that could arise from unchecked AI development
BNP Paribas SS implements Proxymity's Vote Connect
BNP Paribas’ Securities Services business, a leading global custodian with USD 17.5 trillion in assets under custody1, today announces the implementation of Proxymity’s Vote Connect Global solution as part of its general meetings services for global custody clients across EMEA and Asia Pacific, directly connecting issuers, intermediaries and investors through a near real-time, transparent and effi
HSBC and Ant International expand treasury management services in Middle East
Ant International today announced an expanded collaboration with HSBC to enhance real-time treasury management services in the Middle East.
Waypoint Trading launches market data product
Today marks the launch of Waypoint Wayfinder, a platform for financial institutions to manage the growing volume of notifications from exchanges.
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign. The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek .
Citrix Patches Third Actively Exploited NetScaler Zero Day
Citrix has released another patch for a zero day vulnerability under active exploitation, just a few days after patches were […] The post Citrix Patches Third Actively Exploited NetScaler Zero Day appeared first on The HIPAA Journal .
Google’s bug bounty pause highlights growing AI vulnerability triage challenge
AI is accelerating the discovery of software vulnerabilities, but it is also creating a new bottleneck for defenders: deciding which machine-generated findings warrant investigation. Google has decided to temporarily stop accepting certain bug bounty submissions after a surge of largely invalid automated reports highlights a growing challenge for security teams as AI-driven vulnerability discovery
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure. The post Blinder Tunnel Campaign Targets Iraqi Infrastructure appeared first on Unit 42 .
What Are the New Rules for Secure Open Source Consumption?
<div class="hs-featured-image-wrapper"> <a href="https://www.sonatype.com/blog/what-are-the-new-rules-for-secure-open-source-consumption" title="" class="hs-featured-image-link"> <img src="https://www.sonatype.com/hubfs/Secure%20Open%20Source%20Consumption.png" alt="Image with concentric hexagons at the center containing a lock icon" class="hs-featured-image" style="width:auto !important; max-widt
The AI app builder your team trusts has a root-level backdoor
The fastest-growing category of enterprise software right now is also the least scrutinized from a security standpoint. AI application platforms — tools that let teams build, connect and automate AI-powered workflows without writing much code — are landing in production environments faster than security teams can assess them. They connect to your APIs, your databases, your cloud credentials and yo
French regulator targets crowdfunding platforms
France's financial watchdog, the Autorité des Marchés Financiers (AMF), has called on crowdfunding platforms to strengthen their practices in order to better protect investors.
8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
Hackers abused a company’s lawful access to the CPR system to steal the personal information of registered citizens. The post 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register appeared first on SecurityWeek .
More RMM Tools In the Wild, (Tue, Oct 6th)
It seems that a trend started&#xe2;&#x80;&#xa6; I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.
Qupital launches onchain e-commerce lending protocol
Qupital, Asia's leading AI-driven fintech platform specializing in cross-border e-commerce trade finance, today announced the official launch of the world's first AI-driven on-chain e-commerce lending protocol.
Nikkei discloses breaches of employees’ Microsoft, Google email accounts
Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails. [...]
FXPro launches 'real pro trader' campaign
FxPro, the world's #1 broker, has unveiled its latest global brand campaign, taking a playful swipe at the stereotypes of the trading world.
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted, and reports filed before October 1 are
Police Urge Passkey Use After Surge in Cybercrime Profits
Report Fraud says cybercrime revenue stemming from account takeover increased 417% annually
Rothera goes live on Smartstream's Air to automate high-volume derivatives reconciliations
Smartstream, the trusted data solutions provider for leading global financial institutions and enterprises, today announced that Rothera, the U.S.-based CFTC-regulated event contract market, has gone live on Smartstream’s Air.
What exactly is ISOC? And what does it mean for you?
Gartner recently released a new category of security tools: the Integrated Security Operations Center (ISOC) . This new category acknowledges the need to expand beyond traditional SIEM tools in the creation of a security portfolio, though, as they note in the introductory report, Security Information and Event Management (SIEM) isn’t going anywhere. Gartner’s evolution away from SIEM as an all-enc
The quest for simplicity: Why SMBs want advanced protection without the complexity
The cybersecurity market is often making it tougher for SMBs to keep threats at bay
Social Engineering Detection Moves Into the Live Conversation
Companies are pouring time and dollars into security awareness training, but little evidence shows it actually works against social engineering. The post Social Engineering Detection Moves Into the Live Conversation appeared first on SecurityWeek .
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
An affiliate of The Gentlemen RaaS group ran a parallel leak site during extortion of two dozen victims
AI accelerates n-day attacks, as flaw disclosures and exploits double
Attackers are increasingly weaponizing already-disclosed flaws rather than new zero-days, and AI tools may be accelerating how quickly they do it. According to a report from Google’s Threat Intelligence Group (GTIG), attackers have exploited more vulnerabilities in the wild thus far this year than they did all of last year. With the number of flaws disclosed each month sharply rising, AI tools are
Engineer sentenced for locking over 3,000 devices on employer network
A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack. [...]
NVD CRITICAL: CVE-2026-94293 — An unauthenticated remote attacker can modify Asset Administration Shell submode...
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
NVD CRITICAL: CVE-2026-105778 — A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this...
A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
NVD HIGH: CVE-2026-105701 — The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution i...
The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on t
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees. That's according to a report from Reuters, citing two sources familiar with the matter. "To date, our review has determined that the incident occurred as the result of a security failure
NVD HIGH: CVE-2026-75962 — The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs,...
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in Denmark's national population register, the country's digitalization ministry said on October 5. They used a private Danish company's lawful right to look up records in the Central Person Register (CPR). The ministry has told people never to
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X.
NVD HIGH: CVE-2026-105704 — A vulnerability was identified in SourceCodester Drug Recommendation System 1.0....
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user_id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and might be used.
Shares in British clothing company ASOS dive after hackers apparently send push notification
Several mysteries surround what appeared to be an unauthorized push notification sent to customers of London-based clothing company ASOS.
NVD HIGH: CVE-2026-105571 — A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is ...
A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early throu
NVD HIGH: CVE-2026-105486 — A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the functio...
A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d9
NVD CRITICAL: CVE-2026-105484 — A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230...
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.
Dell patches 18 critical flaws that could hand attackers the keys to storage and Kubernetes
Dell’s security team has had a busy week. The company has announced a slew of Common Vulnerabilities and Exposures (CVEs) impacting its Dell Container Storage Modules (CSM) and Dell System Update (DSU). Disclosed by Dell in two security notices, these critical vulnerabilities could allow unauthenticated attackers to “completely bypass” authentication controls, gain root access, manipulate storage
ShinyHunters’ exploitation of a new PeopleSoft zero-day hole threatens to change enterprise risk dynamics
A recent compromise of PeopleSoft by hacking group ShinyHunters is causing new concerns for enterprise users of the Oracle product, with analysts recommending extreme measures in response. Law enforcement has made some progress in its pursuit of the cyber criminals involved. On Saturday, Reuters reported that a suspected member of ShinyHunters had been arrested by the FBI and has been cooperating
Despite ShinyHunters arrests after FBI jobs data breach, enterprises still have no answers about PeopleSoft risks
The theft of FBI employee data by hacking group ShinyHunters, and the subsequent shutdown of the FBI’s Peoplesoft-based jobs portal , is causing concern for enterprise users of the Oracle product, with analysts recommending extreme measures in response. Law enforcement has made some progress in its pursuit of the cyber criminals involved, but there has still been no official word from either the F
NVD HIGH: CVE-2026-105471 — A security flaw has been discovered in girishsaraf Online-Appointment-Booking-Sy...
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks
ANZ completes cross-border tokenised deposit payment with Swift ledger
Australia's ANZ has carried out a live corporate treasury transactions using tokenised deposits and Swift’s blockchain ledger.
Anchorage Digital expands global services with Standard Chartered
Digital asset custody services provider Anchorage Digital has formed a partnership with Standard Chartered through which it will offer USD accounts and access to Swift wires, including transfers to and from third parties, to eligible non-US institutional clients.
NVD HIGH: CVE-2026-105470 — A vulnerability was identified in girishsaraf Online-Appointment-Booking-System ...
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be
NVD HIGH: CVE-2026-105469 — A vulnerability was determined in girishsaraf Online-Appointment-Booking-System ...
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file get_town.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidval can lead to sql injection. The attack may be launched remotely. The exploit has been publicly discl
Citrix discloses third actively exploited NetScaler zero-day in less than a week
The vendor was much quicker and consistent in its response to the latest defect, and researchers consider the impact relatively low compared to the previous pair of zero-days. The post Citrix discloses third actively exploited NetScaler zero-day in less than a week appeared first on CyberScoop .
CISA to keep cyber pay incentives, but less staff will qualify
Justin Doubleday reports: The Cybersecurity and Infrastructure Security Agency is continuing to offer cyber pay incentives to retain skilled technical staff, but less employees will qualify for the program under revised criteria that ties eligibility to job series and performance ratings. The revised policy has sparked some concern that CISA could lose more staff after... Source
OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU
OpenAI is preparing to add invisible watermarks to text generated by ChatGPT and Codex in the European Union. [...]
NVD HIGH: CVE-2026-105750 — Docling simplifies document processing by parsing diverse formats and providing ...
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed H
NVD HIGH: CVE-2026-105745 — Docling simplifies document processing by parsing diverse formats and providing ...
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external
NVD HIGH: CVE-2026-105744 — Docling simplifies document processing by parsing diverse formats and providing ...
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Cra
NVD HIGH: CVE-2026-105468 — A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to...
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This pro
Wikimedia Foundation: OpenAI agents tried to edit pages and compromise notes tool
Beyond the potential misuses of its services, Wikimedia said activity by AI agents can be a drain on web platforms that are already operating with limited resources.
ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes
The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications.
NVD HIGH: CVE-2026-77226 — Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability ...
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured administrators. An unauthenticated remote attacker can exploit this logic flaw to call the setup user-c
Rejetto HFS servers now actively scanned for critical RCE flaw
Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). [...]
NVD HIGH: CVE-2026-105392 — A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The imp...
A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The proj
NVD HIGH: CVE-2026-105387 — A security flaw has been discovered in girishsaraf Online-Appointment-Booking-Sy...
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may
NVD HIGH: CVE-2026-105386 — A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to...
A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this issue is the function get of the file print.php. The manipulation of the argument transaction_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling releas
NVD HIGH: CVE-2026-104714 — Concurrent execution using shared resource with improper synchronization ('race ...
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the r
Alleged ShinyHunters member reportedly detained in Jordan, assisting law enforcement
Saif al-Din Khader is cooperating with the FBI, reports said, as the bureau responds to a massive breach that exposed employee data.
Morgan Stanley sets up digital asset lab
Morgan Stanley has built a digital asset lab where it can test things like stablecoins, tokenisation and decentralised finance applications.
NVD HIGH: CVE-2026-105385 — A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to...
A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transaction_details.php. Executing a manipulation of the argument transaction_id can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utiliz
NVD HIGH: CVE-2026-101919 — A flaw was found in the HyperShift operator. The operator copies user-provided K...
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When dow
Aapryl forms data relationship with Nasdaq eVestment
Aapryl, an institutional analytics platform for investment manager evaluation, today announced a data relationship with Nasdaq eVestment.
Versana digital loan voting platform goes live
Versana today announced the launch of Versana Loan Voting, a new digital technology solution designed to automate and streamline the amendment voting process across the broadly syndicated loan (BSL) and private credit markets.
US, Australia warn of latest Citrix vulnerability after NetScaler advisory
Citrix confirmed late on Friday that it was “tracking a newly observed issue” related to some customer-managed NetScaler deployments but claimed the problem was not connected to vulnerabilities reported last week that also caused alarm among cybersecurity experts.
IQVIA fined $7.8 million for failing to properly anonymize health data
Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7.8M) over poor data-processing practices that the agency says could have put roughly one million patients at risk of data exposure and de-anonymization. [...]
NVD HIGH: CVE-2026-105383 — A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to...
A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling relea
Ukraine grocery chain ATB confirms cyberattack as hackers threaten to leak data
Ukraine’s largest grocery store chain, ATB, confirmed that it was hit by a cyberattack after hackers posted an extortion demand on its website.
WindRose Health Network Discloses Data Breach Affecting 33K Individuals
Data breaches have been announced by WindRose Health Network and Advantage Home Health Care in Indiana, Camden-on-Gauley Medical Center in […] The post WindRose Health Network Discloses Data Breach Affecting 33K Individuals appeared first on The HIPAA Journal .
Secure Your Mission-Critical Application Estate: Qualys TotalAppSec is Now FedRAMP High Authorized (FedRAMP Certified Class D)
Key Takeaways Qualys TotalAppSec is now FedRAMP High Authorized on the Qualys Government Platform (FedRAMP Certified Class D, package FR2231052341). Federal AI use cases more than doubled in a year (3,611 use cases across 56 agencies), and most AI interactions are delivered through APIs; expanding an estate traditional IP-based inventory was never designed to measure. […]
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. "Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a
Chinese Hackers Impersonate US Officials for AI Cyber Espionage
An emerging threat group known as TA419 established seemingly legitimate professional relationships with AI policy experts working for US think tanks, universities, and legal organizations.
University of Illinois Chicago affected by ransomware attack on medical school
A ransomware attack that affected the University of Illinois Chicago (UIC) College of Medicine resulted in the theft of some information from its servers.
South Korean president orders investigation after spate of bank data breaches
South Korea's president, Lee Jae Myung, has ordered an investigation into a series of data breaches at banks in the country.
Denmark population registry data breach affects 8.8 million people
Denmark's Central Population Register (CPR) is warning of a data breach that exposed the personal information of approximately 8.8 million registered individuals. [...]
Website Tracking Privacy Risks: Do You Know What Your Websites Are Sharing?
Website tracking privacy risks can remain hidden across a health system’s digital estate until a patient, regulator, or plaintiff discovers […] The post Website Tracking Privacy Risks: Do You Know What Your Websites Are Sharing? appeared first on The HIPAA Journal .
Website Privacy: Your Privacy Policy Makes Promises But Does Your Website Keep Them?
Your privacy policy makes promises but does your website keep them? Privacy and compliance teams may not know every tool that is operating, what information it collects, or where that information is sent. The post Website Privacy: Your Privacy Policy Makes Promises But Does Your Website Keep Them? appeared first on The HIPAA Journal .
NatWest Accelerator takes female-founder initiative She Scales nationwide
NatWest Accelerator is expanding its She Scales initiative across the UK after a pilot delivered 68 events and more than 1,800 attendances, with every surveyed participant saying they felt more confident or better equipped to build their business.
Bloomberg Electronic Markets brings automation to JGB Market-on-Close functionality
Bloomberg announced the first successful fully automated Japanese Government Bond (JGB) Market-on-Close trade, following the introduction of a new workflow. Aligned to BB3P (Hikene Trading), the Market-on-Close reference rate for JGBs, the automated workflow helps minimize tracking error and provides certainty of execution at a specific close time.
New Dell System Update flaw lets hackers gain root privileges
Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. [...]
Nueva EPS, Colombia’s largest regional healthcare promoting entity has allegedly been hacked
Colombia’s largest health-promoting entity, Nueva EPS, has allegedly been hacked by an individual demanding $15 million not to leak the data. Colombia’s healthcare system includes Entidad Promotora de Salud (EPS), regional health-promoting entities responsible for implementing objectives set by the Ministry of Health, developing guidelines and protocols, and overseeing healthcare deliv
Nueva EPS, Colombia’s largest regional healthcare promoting entity has allegedly been hacked (1)
Colombia’s largest health-promoting entity, Nueva EPS, has allegedly been hacked by an individual demanding $15 million not to leak the data. Colombia’s healthcare system includes Entidad Promotora de Salud (EPS), regional health-promoting entities responsible for implementing objectives set by the Ministry of Health, developing guidelines and protocols, and overseeing healthcare deliv
Basware buys payment fraud prevention platform Trustpair
Invoice lifecycle management firm Basware has acquired payment fraud prevention platform Trustpair. Financial terms were not disclosed.
ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
ClingSTUN exploits known IoT flaws and abuses public STUN servers to keep proxy access to devices
Trulioo strengthens identity verification for Fiserv clients
Trulioo, a global risk intelligence platform, today announced a collaboration with Fiserv, a leading global provider of payments and financial technology solutions. Trulioo will bring its person and business verification capabilities to Fiserv, helping its clients streamline onboarding and underwriting across global markets.
Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports
Google has temporarily stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP). The post Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports appeared first on SecurityWeek .
South Korea probes bank breaches amid suspected AI-powered attacks
South Korea's Financial Services Commission (FSC) held an emergency meeting following a series of cyberattacks targeting financial institutions in the country. [...]
⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
A blank field. A public repo. One reply to an email. A box left exposed. None of this sounds dramatic, which is partly the problem. This week’s threats keep finding leverage in small things that were easy to overlook. There are actively exploited bugs in the mix, cleaner intrusion paths, smarter automation, and a long patch list waiting behind them. Some attacks are getting more capable. Others
Senate Unanimously Passes the Health Care Cybersecurity and Resiliency Act
A bipartisan bill that seeks to improve healthcare cybersecurity and resilience has been unanimously passed by the U.S. Senate. The […] The post Senate Unanimously Passes the Health Care Cybersecurity and Resiliency Act appeared first on The HIPAA Journal .
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
Rapid7 has uncovered new BPFDoor, BPF Rekoobe and AVERAT malware variants targeting telecom and network-edge appliances in South Korea and Taiwan
EBAday 2027 moves to Rome: Early bird registration now open
The annual two-day summit for payments and transaction banking professionals hosted by the Euro Banking Association (EBA) and Finextra, returns for its 22nd edition in Rome, Italy on 15-16 June 2027.
Belarusian hacktivists spent two years inside Russian healthcare network, researchers say
Russian cybersecurity researchers attributed a quiet two-year espionage campaign to the Belarusian Cyber Partisans, a group better known for public attacks against governments and infrastructure.
CISA Sends CIRCIA Final Rule for White House Review
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has penned a final rule under the Cyber Incident Reporting for Critical […] The post CISA Sends CIRCIA Final Rule for White House Review appeared first on The HIPAA Journal .
tenfold CE: Our free Identity Governance tool just got 2 new features
tenfold has added shared content governance and real-time event auditing to its free Community Edition for organizations with under 150 users. The new features help teams manage Microsoft 365 sharing and investigate suspicious identity activity. [...]
Citrix NetScaler Targeted Via New Zero Day
The memory buffer vulnerability can result in denial of service to customers, with CISA warning it poses “significant risks” to the federal government
TrueLayer and SumUp partner to simplify account top-ups
TrueLayer, the Pay by Bank network used by more than 30 million people across Europe - today announced that its Pay by Bank technology powers instant account top-ups in the SumUp App, the personal account offering for consumers from global financial technology company SumUp.
HSBC expands data partnerships to back Hong Kong SMEs expanding overseas
HSBC today announced it is expanding its network of trade, cargo and corporate data providers through the Hong Kong Monetary Authority’s (HKMA) Commercial Data Interchange (CDI), supporting its ambition to make banking more responsive to Hong Kong small and medium-sized enterprises (SMEs) as they expand across markets.
Iress sourcing data integrated into Access FS Elev8 platform
Financial technology company Iress has expanded the distribution of its mortgage and protection sourcing data through a new integration with Elev8, the CRM platform developed by Evolve Tech Solutions for Access FS.
Japanese media group Nikkei discloses cyberattack targeting journalistic sources
The Japanese media giant Nikkei disclosed a cyber incident involving an employee email account that may have compromised journalistic sources.
Japanese media group Nikkei discloses intrusions targeting employees and users
The Japanese media giant Nikkei disclosed a cyber incident involving an employee email account that may have compromised journalistic sources.
Moorwand to issue new multi-currency Tap card
Tap Global Group plc (AIM: TAP, OTCID: TAPIF), the regulated digital finance platform, announces that it has appointed Moorwand Ltd ("Moorwand") as issuer and Bank Identification Number ("BIN") sponsor for a new Tap Mastercard programme.
Alleged dev of Ploutus ATM malware appears in US court after arrest
The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States. [...]
Need for Speed: AI-Driven Attacks Are Changing Security Strategies
AI-powered attacks are fast, relentless, and automated. How security teams can keep up is top of mind, according to the latest Dark Reading reader poll.
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
ClingSTUN operates as a back-connect proxy backdoor, sets up persistence, and contains exploits for self-propagation. The post Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws appeared first on SecurityWeek .
Mynt valued at $7bn for upcoming IPO
Philippines unicorn Mynt could achieve a valuation of more than $7bn following an IPO that is set to be the country's biggest ever listing
250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms
Hackers stole patient information from Clover Health Investments and AngMar Management Services in July. The post 250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms appeared first on SecurityWeek .
Hackers Breached Propulsion System of U.S.-Bound Oil Tanker
Seen on Homeland Security Today: FBI and US Coast Guard investigators have found evidence that hackers accessed the propulsion system of an oil supertanker as it was approaching the Texas coast this summer, according to US officials familiar with the matter, an extraordinary breach that highlights the growing physical risks from cyberattacks. The cyberattack resulted... Source
Daiwa Securities says info on 110,000 clients may have been leaked in vendor incident
Takashi Nakamichi and Ryo Horiuchi report that Daiwa Securities, Japan’s second-largest brokerage and investment banking firm, is responding to a breach at one of its vendors. Daiwa Securities Group said information on as many as 110,000 clients may have been stolen after the servers of an external vendor were hacked. Japan’s second-largest brokerage received a... Source
Ransomware group threatens to leak customer data from top insurance companies in South Africa
Luis Monzon reports: Ransomware-as-a-service group The Gentlemen threatened to leak data belonging to insurance companies LegalWise and Samwumed, with more South African companies likely to follow. The Gentlemen is one of the most active cybercriminal organisations in the world, and accounted for 17% of all ransomware attacks globally in July, according to Check Point Software.... Source
Citrix warns of actively exploited NetScaler flaw days after zero-day patch rush
Citrix has warned customers about another high-severity vulnerability in its NetScaler ADC and NetScaler Gateway products, just days after the company urged them to fix a separate batch of flaws that included two actively exploited zero-days . The new vulnerability, tracked as CVE-2026-88779 , is a memory-overflow issue that can cause a denial-of-service (DoS) condition on affected appliances. Cit
Data breach at Denmark’s national population register exposes 8.8 million people
Denmark is investigating a data breach affecting approximately 8.8 million people after unauthorized users gained access to its national population register.
The Credential Layer Is Expanding Faster Than Security Teams Can See It
Every modern enterprise depends on credentials. This is how humans, systems, and now AI, all connect to data, services, and each other securely. GitGuardian helps secure that credential layer through three connected capabilities: Detect, Remediate, and Prevent. The journey starts with detection, because organizations first need to understand what credentials exist, where they live, and what they
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel," Nozomi Networks said in a report
SEC publishes new crypto custody rules
The US Securities and Exchange Commission has proposed new rules designed to establish a dedicated legal framework for crypto custody within the wealth management and advisory market
Kord launches dedicated sort-code for legal transactions
UK fintech Kord is launching the UK’s first dedicated legal sort code: 04-10-26.
Curvestone AI selected for Barclays scaleup scheme
Curvestone AI, the AI compliance platform for regulated financial services, has announced its selection as one of only 25 companies chosen for the Barclays Eagle Labs Scaleup Programme.
NVD HIGH: CVE-2026-105290 — A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an...
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The pr
Another Historic Cipher Falls to AI
This one is from 1809, written by Napoleon’s nephew.
Exploitation Hits Rejetto HFS Vulnerability Discovered by AI
CVE-2026-61500 allows attackers to recover the session-cookie signing key and gain administrative access and RCE. The post Exploitation Hits Rejetto HFS Vulnerability Discovered by AI appeared first on SecurityWeek .
APAC consumers show appetite for stablecoin
Almost half of consumers in Asia Pacific would be willing to use stablecoins in the next five years, according to recently published research from Visa
Senate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity
More than 730 cyber breaches affected over 270 million Americans last year, costing an average of $10 million per breach. The post Senate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity appeared first on SecurityWeek .
Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access
Apple has announced that it's taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed by artificial intelligence (AI) agents. "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history – without users' full knowledge
Google Suspends Open-Source Bug Bounty Due to AI Vulnerability Reports
Google has paused its Open Source Vulnerability Rewards Program due to a flood of AI submissions
OpenAI will show visual ads in ChatGPT while you generate images
OpenAI is expanding ads in ChatGPT, and one of the first new formats will show visual ads while you're generating images. [...]
CaixaBank establishes new AI and data division
Spanish financial services firm CaixaBank has created its first AI and data division in a move designed to accelerate the bank's digital transformation efforts.
NVD CRITICAL: CVE-2026-105285 — A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1...
A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
The US needs a real plan to defend its water systems
Here’s what it would take: stronger defenses for large utilities, hands-on help for smaller systems and federal support to make both happen. The post The US needs a real plan to defend its water systems appeared first on CyberScoop .
Sky Links Capital appoints managing director
Sky Links Capital Group announced the appointment of Hormoz Faryar as Managing Director. Faryar brings over 25 years of institutional e-FX trading and sales expertise to lead the firm's institutional business development and expansion across global markets.
Microsoft: Windows KB5124010 update crashes some games and apps
Microsoft confirmed over the weekend that some games and applications using AC-3 (Dolby Digital) audio decoding will crash after installing the September 2026 KB5124010 Windows 11 preview update. [...]
More UK Schools Are Recovering Faster from Cyber Incidents
Ofqual study finds growing number of UK schools are bouncing back “immediately” from cyber-attacks
Constructor launches agentic payment platform
Constructor, the product discovery platform for the agentic era, today announced Agentic Checkout, which integrates Stripe, to enable shoppers to both find and buy products within a single agent conversation and interface.
NVD CRITICAL: CVE-2026-105284 — A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The imp...
A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
ELW Consulting launches cloud finance platform
ELW Consulting are proud to announce the launch of Elevations, a cloud-native platform covering the full development finance loan lifecycle, from origination to redemption.
Frontline Education Breach Impacts K-12 School District Staff
A breach at school software provider Frontline Education has exposed employee data
Google halts open-source bug bounty program amid AI spam surge
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. [...]
Should the CISO role be split in two?
In its roughly 30-year history, the CISO role has been reshaped by waves of new technology and rising cyber threats. In many organizations, CISOs now own risk reporting, information risk management, threat monitoring, cyber risk accountability and governance, and security strategy. And as AI and digital dependence grow, the CISO’s remit is growing beyond security controls. The latest IANS State of
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and
Alleged ShinyHunters Leader Arrested in Jordan
Known as Rey, the suspect is reportedly helping the FBI identify and locate other members of the extortion group. The post Alleged ShinyHunters Leader Arrested in Jordan appeared first on SecurityWeek .
Community finance and open banking technology can support ‘credit invisibles’ – Salad Finance
People with low credit, whether due to a missed payment or a period of financial insecurity, are often disproportionately punished by the financial system by not being given loans, credit cards, and other forms of consumer credit.
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0. "CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to
NVD HIGH: CVE-2026-105232 — A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895...
A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the argument username/email/location causes sql injection. The attack can be initiated remotely. The exploit has
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier
Citrix has confirmed that a new zero-day vulnerability, CVE-2026-88779, emerged just days after two other exploited flaws were patched. The post Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier appeared first on SecurityWeek .
NVD HIGH: CVE-2026-105182 — A security flaw has been discovered in SourceCodester Online Reviewer Management...
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=update. The manipulation of the argument Title results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
NVD HIGH: CVE-2026-105294 — Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability tha...
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.
NVD HIGH: CVE-2026-105170 — A weakness has been identified in kishor-23 food-waste-management-system 411989e...
A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected is an unknown function of the file admin/signup.php of the component Admin Signup. This manipulation of the argument sign causes missing authentication. The attack can be initiated remotely. The exploit has been made available to the p
TTY Logs and the Data it Captures, (Sun, Oct 4th)
For an experiment, I created a script [1] that parses and send the TTY logs collected from actors or bots activity that run various commands after they successfully login the DShield sensor. Those TTY logs are sent daily at the end of each day to the DShield SIEM [2] to be correlated with all the data. 
NVD HIGH: CVE-2026-105221 — The gist RubyGem before 6.1.0 contains an improper certificate validation vulner...
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.
NVD HIGH: CVE-2026-105166 — A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb8...
A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is the function insert of the file fooddonateform.php of the component Food Donation Form. Performing a manipulation of the argument image-choice results in sql injection. The attack is possible to be carried out remotely. The e
Citrix patches NetScaler SAML zero-day exploited in attacks
Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...]
South Korea’s President Lee Jae Myung orders thorough probe into data breaches at local banks
Lee Hyo-jin reports: President Lee Jae Myung on Sunday ordered a thorough investigation into a string of recent data breaches at financial institutions, as artificial intelligence (AI)-powered cyberattacks increasingly target them. According to Cheong Wa Dae, Lee was briefed on recent data breaches at financial and public institutions and their responses to the incidents. “The... Source
Slate Valley Unified School District voted not to pay ransom demand; Kairos likely to leak data
The Slate Valley Unified School District in Fair Haven, Vermont, has been responding to a security incident since September 3. On October 2, Kairos threat actors contacted DataBreaches to alert us to the incident and their response to the district’s claim that they believed student data had not been compromised. They were also angry that... Source
NVD HIGH: CVE-2026-105216 — go-micro before 6.0.0 contains an improper certificate validation vulnerability ...
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certificate to intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic, including authentication tokens an
NVD HIGH: CVE-2026-105089 — WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability ...
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.
NVD CRITICAL: CVE-2026-105215 — ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in...
ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged IDPConfigID and ExternalUserID values to pre-create an account bound to a victim's external IdP identity, w
NVD HIGH: CVE-2026-105212 — ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypas...
ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim's login name can register an attacker-controlled authenticator and log in as that user, bypassing exist
NVD HIGH: CVE-2026-105211 — ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V...
ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with OTP-Email and OTP-SMS enrolled can read both codes from server-action responses to gain MFA-authenticated sessions, including administrator takeover.
NVD HIGH: CVE-2026-105210 — ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authenticatio...
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enroll attacker-controlled TOTP, OTP-SMS, OTP-Email, or U2F factors, overwrite the verified phone number, a
NVD CRITICAL: CVE-2026-105209 — ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorizati...
ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and r
NVD HIGH: CVE-2026-105208 — ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with...
ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An attacker who predicts a victim's in-flight intent identifier and wins a timing race can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens
NVD CRITICAL: CVE-2026-105207 — ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user ...
ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account
NVD HIGH: CVE-2026-105158 — A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted elem...
A vulnerability was detected in RainyGao DocSys up to 2.02.85. The impacted element is the function BaseController.createDBForMysql of the file BaseController.java of the component Database Management. The manipulation of the argument url results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through a
Trump Names National Intelligence Director Jay Clayton to Lead a New Federal AI Task Force
The announcement comes after Trump hosted top executives of AI companies at the White House last week. The post Trump Names National Intelligence Director Jay Clayton to Lead a New Federal AI Task Force appeared first on SecurityWeek .
NVD HIGH: CVE-2026-105149 — A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects...
A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in
NVD HIGH: CVE-2026-105148 — A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability ...
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generation_config.api_base leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was c
NVD HIGH: CVE-2026-105147 — A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unk...
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but di
Weekly Update 524: Live From Copenhagen
I'm in Denmark! Well, just, I'm now at Copenhagen airport ready to begin the long trek home, with the final event at GOTO now done and going just perfectly. This week, there are two ShinyHunters arrests in the news: Pepijn in the Netherlands and then Saif
Anthropic asks Claude users to share voice data for AI model training
Anthropic has started asking Claude users to voluntarily share their voice conversations to help train and improve its AI models. [...]
User Agent Strings Curiosities, (Sun, Oct 4th)
Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name is Saif al-Din Khader, is said to have been brought into custody on September 29, 2026, cooperating with the U.S. Federal Bureau of Investigation (FBI) and
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations. The campaigns have impersonated prominent economists and AI policymakers, as well as a prominent Anthropic employee, to single out an AI policy expert at a
NVD CRITICAL: CVE-2026-105135 — A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects ...
A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure
NVD CRITICAL: CVE-2026-105134 — A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects...
A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve
NVD HIGH: CVE-2026-105133 — A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the fu...
A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 10.3.4 is able to mitigate thi
NVD HIGH: CVE-2026-88779 — Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: b...
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
NVD HIGH: CVE-2026-105126 — LaraDashboard before 1.4.8 contains an improper privilege management vulnerabili...
LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution.
NVD HIGH: CVE-2026-105123 — W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnera...
W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path
CISA KEV: Citrix NetScaler — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Google Gemini could soon get full access to your Mac’s files, apps and the web
Google's Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time. [...]
The Italian Italy’s Data Protection Authority fines IQVIA €7 million over data protection breach
The following is a machine translation of a press release by Italy’s privacy guarantor: Healthcare data: The Privacy Guarantor fines IQVIA 7 million euros. The data of one million patients of 800 family doctors are not anonymous. The Italian Data Protection Authority has fined IQVIA Solutions Italy Srl €7 million. The company, part of a... Source
Italy’s Data Protection Authority fines IQVIA €7 million over data protection breach
The following is a machine translation of a press release by Italy’s privacy guarantor: Healthcare data: The Privacy Guarantor fines IQVIA 7 million euros. The data of one million patients of 800 family doctors are not anonymous. The Italian Data Protection Authority has fined IQVIA Solutions Italy Srl €7 million. The company, part of a... Source
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
A suspected ShinyHunters hacking group member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. [...]
ShinyHunters hacker “Rey,” allegedly involved in FBI data theft, detained in Jordan
Jana Winter, Raphael Satter, and A.J. Vicens report: A key member of the ShinyHunters hacking group, which claims to have stolen data on every FBI employee, was detained this week in Jordan, three people familiar with the matter told Reuters. Two of the sources said he was cooperating with the FBI to identify his fellow... Source
YARA-X 1.21.0 Release, (Sat, Oct 3rd)
YARA-X&#;x26;#;39;s 1.21.0 release brings 5 improvements and 4 bugfixes.
MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics
The U.K.'s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering efforts on behalf of Beijing's state security service. In a "Security Service Espionage Alert" issued on September 30, 2026, MI5 said the "primary purpose of the China General Technology Research Institute (CGTRI) 中国通用技术研究院 is to fund research that
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. "In the
Danish university DTU breach exposes data of up to 200,000 people
The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. [...]
DHS readies major cyber contract
Justin Doubleday reports: The Department of Homeland Security is preparing this year to award a major cloud, cybersecurity and network services contract aimed at further centralizing the management of IT services across DHS. In a notice posted to Sam.gov last month, DHS laid out the notional timeline for award of the Network, Cloud and Cybersecurity... Source
NVD HIGH: CVE-2026-105115 — OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation v...
OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadge
OpenAI faces California DOJ subpoena amid growing cybersecurity incident notices
IAPP reports: Regulator inquiries into major AI companies’ cybersecurity practices are ramping up. A day after reports surfaced about the likely escalation of a U.S. Federal Trade Commission probe into OpenAI and other developers, California Attorney General Rob Bonta advanced his office’s ongoing OpenAI investigation. Bonta announced the company was served an investigative subpoena to
Fed employee repeatedly removed sensitive files, watchdog finds
Matt Bracken reports: A Federal Reserve Board staffer mishandled sensitive classified files and triggered hundreds of data loss prevention alerts leading up to their retirement, the agency’s inspector general revealed in a new report. The security issues with the employee were uncovered by the watchdog during its audit of the Fed’s offboarding process, which began... Source
Senate passes bipartisan bill to bolster hospital cybersecurity
Naomi Diaz reports: The Senate passed the bipartisan Health Care Cybersecurity and Resilience Act by unanimous consent. The legislation aims to help healthcare providers strengthen their cybersecurity defenses and protect patient information, according to an Oct. 1 news release from the Senate Committee on Health, Education, Labor and Pensions. Sens. Bill Cassidy, MD, R-La., Maggie... Source
Medical records giant Epic pauses product development to fix security bugs that risk patients’ data
Zack Whittaker reports: Epic, the software technology giant that makes the widely used MyChart software for accessing patients’ medical data, has paused most of its product development as the company works to protect its software and systems from cyberattacks. Judy Faulkner, the founder and chief executive of Epic, told Modern Healthcare last month that the... Source
doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures
doxx.net’s new ADN platform prevents agentic misadventure while the agent is operating under the user’s authority. The post doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures appeared first on SecurityWeek .
Fortra Patches Critical Vulnerabilities in BoKS
The bugs could lead to authentication bypass, shell command execution, and memory corruption. The post Fortra Patches Critical Vulnerabilities in BoKS appeared first on SecurityWeek .
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations
Featuring: Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infrastructure, security is shifting toward continuous visibility, control, and the ability to respond to risk at scale. This report examines how core areas of
N0n ransomware: what you need to know
N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow. Read more in my article on the Fortra blog.
NVD CRITICAL: CVE-2026-92084 — The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W...
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcode
NVD CRITICAL: CVE-2026-87115 — The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable...
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as
NVD HIGH: CVE-2026-104478 — Formwork before 2.3.13 contains a path traversal vulnerability in BackupControll...
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.
NVD HIGH: CVE-2026-104433 — Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerabil...
Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can connect to the handshake port listening on all interfaces and send an eight-byte frame to terminate the hosting process, such as an SGLang inference serve
NVD HIGH: CVE-2026-82044 — UTMStack before 11.2.16 contains a server-side request forgery vulnerability tha...
UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() method exposed via GET /api/generate-pdf-report. Attackers can leverage this to force the web-pdf microservice to fetch internal backend endpoints, the OpenS
NVD CRITICAL: CVE-2026-82042 — UTMStack before 11.2.16 contains an authentication bypass vulnerability that all...
UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint without path restriction, constant-time comparison, rate limiting, or audit logging. Attackers who obtai
NVD CRITICAL: CVE-2026-82041 — UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMInc...
UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, res
Friday Squid Blogging: EU is Trying to Fight Unregulated Squid Fishing
The EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic. I’m not optimistic. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus
The plaintiffs, who all worked for the independent and Salvadoran news outlet El Faro, failed to convince the court that their case had jurisdiction in California, according to the judge’s order.
RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail
The offensive cyber operations startup looks to evolve red teaming beyond traditional methods to simulate attackers' increasingly advanced capabilities.
NVD HIGH: CVE-2026-82039 — UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupS...
UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.format(). Attackers can exploit the GET /api/utm-asset-groups/searchGroupsByFilter endpoint to execute arb
NVD HIGH: CVE-2026-104991 — Phproject before 1.8.7 contains a missing object-level authorization vulnerabili...
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents a
NVD HIGH: CVE-2026-104988 — A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plug...
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST subsystem's agent certificate, which causes downstream authorization checks to treat the request as agent-privileged. An authenticated EST use
Bipartisan backlash to ALPRs grows as two high-profile bills are introduced
Republican Sen. Josh Hawley has new legislation on limiting automated license plate readers (ALPRs), while Democratic Sens. Bernie Sanders and Jeff Merkley, with Rep. Alexandria Ocasio-Cortez, have teed up a broader bill.
NVD CRITICAL: CVE-2023-54405 — H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud plat...
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter without restricting path traversal or file type. Attackers can exploit the path traversal in the token pa
NVD HIGH: CVE-2014-125130 — CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress t...
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files
Frontline Education breach exposes school district employee data
Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. [...]
Warlock ransomware breach SharePoint in water, telecom operator attacks
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]
The legal questions raised by agentic AI hacks
Experts and policymakers want AI companies to face consequences for agentic hacks. There may not be a clear-cut answer under existing laws and regulations. The post The legal questions raised by agentic AI hacks appeared first on CyberScoop .
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab said in an advisory. The gateway is the service that connects a GitLab instance to AI models, and only organizations that host their own gateway need to act. The flaw is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1. The flaw
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor codenamed Antino. Cisco Talos is tracking the cluster
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors to take over susceptible systems. The vulnerabilities are listed below - CVE-2026-63688 (CVSS score: 10.0) - A missing authentication for critical function vulnerability in the csm-authorization-storage gRPC server that an
Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response
One company told customers to power down its data-protection platform during a nine-hour window, while the other remained mum on reported attacks prior to releasing a patch for its product.
Bypassing Secure Boot via Unbounded RLE8 Splash Images in U-Boot (CVE-2026-71972)
[object Object]
CVE-2026-103505 - Mount Option Injection in Amazon EFS CSI Driver
<p><b>Bulletin ID:</b> 2026-120-AWS <br> <b>Scope:</b> AWS <br> <b>Content Type:</b> Important (requires attention) <br> <b>Publication Date:</b> 10/01/2026 08:30 AM PDT</p> <p><b>Description:</b></p> <p>The Amazon EFS CSI Driver is a Container Storage Interface driver that allows Kubernetes clusters to use Amazon Elastic File System. We identified CVE-2026-103505, where an actor with PersistentVo
SWIFT Banking & Government Middleware Enables RCE
Patch middleware vulnerabilities now to avoid hardware-based MFA exploits in ultra-sensitive environments.
GitLab warns of critical RCE vulnerability in AI Gateway service
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...]
Is Your Organization Ready for 2027's AI Accountability Era?
Organizations may face an artificial intelligence (AI) reckoning over the next year. Omdia and Gartner weigh in on how to tackle the governance, security, and value challenges ahead.
Is It Fair to Blame 'Rogue' AI for Security Failures?
"Rogue AI" terminology anthropomorphizes LLMs and shifts risk responsibility from vendors. Defenders should treat agents as untrusted, nondeterministic software systems, not sentient beings with malicious intent.
US sanctions Tren de Aragua gang members in ATM hacks crackdown
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. [...]
NVD HIGH: CVE-2026-104637 — A weakness has been identified in onetwothreeneth HospitalManagementSystem up to...
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_subaccount/edit_physician/edit_patient of the file php/controller.php. Executing a manipulation of the argument img can lead to unrestricted upload. The attack may be launched remo
YouTuber raises $15m for Brazil's 'Cash App'
NG.Cash, the "Brazilian Cash App" founded by a former YouTuber, has raised $15 million to back its efforts to bring credit and crypto services to the country's young, unbanked population.
Unidentified Flock Cameras in Florida
St. Lucie County in Florida discovered ( alt link ) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted. I am reminded of the decade-old story of StingRay cell phone surveillance devices in Washington, DC, whose operators were also unknown. My guess is that in the StingRay case, the devices were operated by foreign actors. This Flock case
In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats
Noteworthy stories that might have slipped under the radar: Kiteworks patches over 100 vulnerabilities, Microsoft publishes 2026 Digital Defense Report, AI finds 24 Android app flaws. The post In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats appeared first on SecurityWeek .
BMO taps Mastercard for embedded commercial virtual card payments
BMO and Mastercard today announced the availability of a new embedded Commercial payments capability that enables eligible Corporate Card clients to initiate and manage BMO Commercial virtual card payments directly within the software platforms they use to run their operations.
NVD HIGH: CVE-2026-93875 — The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scrip...
The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload
NVD HIGH: CVE-2026-85215 — Improper neutralization of special elements used in an SQL command ('SQL injecti...
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue affects Paperwork: through 2026-09-09.
NVD CRITICAL: CVE-2026-19652 — The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation i...
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter, with no validation or whitelist of allowe
Microsoft: AI Cuts Post-Compromise Attack Time to Minutes
Microsoft has warned that threat actors have gained the advantage over defenders by using AI to enhance the speed and scale of attacks
Mississippi mayor says ransomware incident led city to shut down systems
Government services were temporarily disrupted by ransomware in Vicksburg, Mississippi. Mayor Willis Thompson said the FBI and other authorities are investigating.
'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
The group is exploiting a variety of vulnerabilities impacting Microsoft SharePoint, according to a new report from Symantec Threat Hunter Team.
The EDR blind spot: 3 ways browser attacks evade endpoint telemetry
Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. [...]
Vulnerability Backlogs Are an Ownership Problem
Organizations don't need better vulnerability scanners; they need to know who owns their assets and has the authority and capacity to actually fix them.
InDebted names Chris McNamara CEO
InDebted, the global AI-native collections infrastructure company, today announced the appointment of Chris McNamara as Chief Executive Officer and Brendan Lee as Chief Financial Officer, both effective 1 October 2026.
Coinpayments appoints founder Alex Alexandrov as group CEO
Coinpayments , the global digital assets payments infrastructure provider, has announced the appointment of founder Alex Alexandrov as Group CEO. Alexandrov founded the company in 2013 and has served as Chairman for much of its growth.
NVD CRITICAL: CVE-2026-104611 — A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown fu...
A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.
NVD CRITICAL: CVE-2026-104610 — A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_...
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor
The dropper “carries a complete universal Mach-O inside itself, roughly 756 KB in the development build, and extracts it at runtime. The post macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor appeared first on SecurityWeek .
City of Vicksburg, Mississippi, shuts down computers after cyberattack
Joseph Topping reports: The City of Vicksburg, Mississippi, has shut down its computer systems after a ransomware attack, potentially delaying in-person utility payments while emergency response and utility service continue. Mayor Willis Thompson told The Vicksburg Post that the city had disconnected its internet operations. “We had to bring our internet operations down, just for... Source
Malicious Linux Implants Mimic Asian Mail Security Products
A trio of newly discovered backdoors walk and quack like legitimate edge solutions, so it's hard to tell they're not.
SMTP is the key: BPFDoor and AVERAT hitting the network edge
Overview Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT , deployed against Taiwanese appliances. Additionally, we provide source code details of the
Dell asks admins to patch max severity CSM flaws as soon as possible
Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. [...]
OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling
OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street Journal reported. "We have parted ways with three individuals for violating our policies on accessing and handling sensitive company information," a spokesperson for the company was quoted as saying. "Our investigation confirmed that these
NVD HIGH: CVE-2026-104609 — A weakness has been identified in onetwothreeneth HospitalManagementSystem up to...
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file edit_accounts.php. This manipulation of the argument user_id/patient_id/physician_id/discounts_id/services_id causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and co
NVD HIGH: CVE-2026-104457 — YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filter...
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them in
NVD HIGH: CVE-2026-104445 — YesWiki before 4.6.7 contains an authentication bypass vulnerability in the Acti...
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
NVD HIGH: CVE-2026-104437 — Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transpare...
Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.
NVD HIGH: CVE-2026-104416 — Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability...
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
WealthAi launches AI agents to oversee client onboarding and KYC process
WealthAi, the AI operating system OS for wealth managers and advisers, has launched a new suite of AI agents designed to oversee the client onboarding and KYC process end-to-end.
Crypto Scammers Hijack Microsoft’s Official X Account
Hackers used the account, which has 13 million followers, to amplify a Clippy-themed cryptocurrency account. The post Crypto Scammers Hijack Microsoft’s Official X Account appeared first on SecurityWeek .
Why CISOs Struggle to Answer the Board's Three Hardest Questions, and How to Fix the Report
The quarterly board meeting is two weeks out. The security team is pulling exports from the identity provider, the cloud posture tool, the vulnerability scanner, the SIEM and the EDR console. Someone is building a spreadsheet to reconcile them. Someone else is turning that spreadsheet into slides. Then a board member asks three questions: How secure is the organization, overall? What is
In Rare Move, Alleged Iranian State Hacker Extradited to US
Amir Barati, an alleged member of the Mabna Institute, was indicted for targeting universities, private organizations, and government entities in the US and abroad. The post In Rare Move, Alleged Iranian State Hacker Extradited to US appeared first on SecurityWeek .
Lloyds survey reveals 71% of UK FIs believe tokenisation will reshape financial services
Lloyds' 10th annual Financial Institutions Sentiment Survey, conducted between April and May 2026, showed that 71% of the 100 senior leaders surveyed across UK banks, insurers, financial sponsors and asset and wealth managers, expect tokenisation to transform how money and assets move through the financial system.
How American Political Campaigns Are Using AI—and What They’re Spending on the Tools
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian . New campaign finance disclosure data shines a light on which US political campaigns are using AI tools and how much they are spending on them. Candidates’, parties’ and committees’ spending reveals that AI is fast becoming an essential tool of politics. The candidates themselves are quiet abo
Fairchild Medical Center & Boone Health Settle Pixel Lawsuits
Fairchild Medical Center and Boone Health have agreed to settlements to resolve complaints alleging they impermissibly disclosed patient data to […] The post Fairchild Medical Center & Boone Health Settle Pixel Lawsuits appeared first on The HIPAA Journal .
SequenceHash: multihashing for the rest of us
<p>Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a <a href="https://blog.trailofbits.com/2024/08/21/yolo-is-not-a-valid-hash-construction/#yolomultihash">common stumbling point</a> when cryptographers try to use hashes.</p> <p>As part of our goal to “fix software, not bugs,” Trail of Bits is introducing <a hre
NVD CRITICAL: CVE-2026-94541 — The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerabl...
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the p
Texas Hospice Management Company Data Breach Affects 35,000 Texas Residents
AngMar Management Services, a Mansfield, Texas-based home health and hospice management company, has identified unauthorized access to its information technology […] The post Texas Hospice Management Company Data Breach Affects 35,000 Texas Residents appeared first on The HIPAA Journal .
BMO and Mastercard enable corporate card clients to manage virtual card payments
BMO and Mastercard today announced the availability of a new embedded Commercial payments capability that enables eligible Corporate Card clients to initiate and manage BMO Commercial virtual card payments directly within the software platforms they use to run their operations. Through this expansion, BMO becomes the first Mastercard issuer in Canada to offer an integrated embedded finance and pay
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
The China-based hacking group has been exploiting SharePoint vulnerabilities since July 2025. The post Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks appeared first on SecurityWeek .
Microsoft’s X account hacked in crypto pump-and-dump scheme
On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. [...]
Police Target KillSec Ransomware Group with Arrests and Seizures
Investigators have disrupted the operations of ransomware group KillSec and arrested several key suspects
Rolling the cyber dice with open-source and open-weight AI models
With typical cybersecurity exposure, I can conduct pen testing with deterministic tools. I am able to predict how a piece of software is going to respond. I even stand a decent chance of finding vulnerabilities before they can be exploited against me. What we are dealing with now is a new kind of exposure. For LLMs and AI models, there are invisible risks that are unscannable and virtually undetec
Mosaic Processing asks software platforms to examine payment costs
Mosaic Processing invites software platforms to review how payment acceptance fits into their products, customer relationships and business economics. The invitation includes booking, membership, billing, ERP and practice-management software companies that serve businesses accepting credit and debit cards.
AI Agents Aimed SQL Injection at US and Canadian Government Sites
The attacks targeted the US Department of Education and Library and Archives Canada, and researchers linked some agents to OpenAI. The post AI Agents Aimed SQL Injection at US and Canadian Government Sites appeared first on SecurityWeek .
EU Cyber Resilience Act ‘completely kills’ manual vulnerability triage
Independent security experts see the EU Cyber Resilience Act (CRA) reshaping international technology markets to emphasize cyber resilience from the ground up, thereby testing the operational capacities of technology vendors whose wares compete in those markets. The EU CRA introduces mandatory reporting within 24 hours for any actively exploited vulnerabilities or severe incidents affecting produc