ARTICLES 2026 OCTOBER January(387) February(431) March(447) April(451) May(495) June(499) July(647) August(1282) September(893) October(617) November(0) December(0)
DATE |
NAME |
Info |
CATEG. |
WEB |
|
18.10.26 |
Microsoft fixes VPN issues caused by September Windows updates | Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. | OS | BleepingComputer |
|
18.10.26 |
The Blind Spots of Agentic Pentesting and How to Close Them | AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. | AI | BleepingComputer |
|
18.10.26 |
Global takedown hits network behind 1 billion phishing messages | A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. | Phishing | BleepingComputer |
|
18.10.26 |
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st. | ICS | BleepingComputer |
|
18.10.26 |
Hirudo Android malware replaces banking apps to evade security checks | A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. | Virus | BleepingComputer |
|
18.10.26 |
Microsoft: Recent Windows updates may trigger Remote Desktop failures | Microsoft has confirmed that non-admin users may be unable to connect to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled. | OS | BleepingComputer |
|
18.10.26 |
OpenAI engineer arrested for allegedly planting spy device in office | A Saudi OpenAI engineer has been arrested for allegedly planting a hidden recording device in an executive conference room at the company's San Francisco offices to secretly record sensitive conversations. | AI | BleepingComputer |
|
18.10.26 |
Ghostscript flaw lets hackers hijack servers via PDF uploads | A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files. | Hack | BleepingComputer |
|
18.10.26 |
Anthropic warns self-replicating AI could spread to your smart devices | Anthropic is warning that small AI models could soon be able to self-replicate across consumer IoT devices, from Android TV boxes to smart ovens, creating distributed botnets capable of running AI workloads without relying on data centers. | AI | BleepingComputer |
|
18.10.26 |
Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days | Today is Microsoft's October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. | OS | BleepingComputer |
|
18.10.26 |
Microsoft releases Windows 10 KB5126657 extended security update | Microsoft released the Windows 10 KB5126657 extended security update, which includes this month's record-breaking October 2026 Patch Tuesday fixes and a few bug fixes and changes. | OS | BleepingComputer |
|
18.10.26 |
Microsoft: Windows 11 24H2 Home and Pro reached end of support | Microsoft announced today that devices running Windows 11 24H2 Home and Pro editions have reached the end of support and will no longer receive monthly security and non-security preview updates. | OS | BleepingComputer |
|
18.10.26 |
UK Housing Ombudsman Service investigates 'security incident' | The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday. | Incindent | BleepingComputer |
|
18.10.26 |
Windows 11 KB5127648 & KB5126653 cumulative updates released | Microsoft has released the Patch Tuesday Windows 11 KB5127648 and KB5126653 cumulative updates for versions 26H2/25H2/24H2 and 23H2 to fix security vulnerabilities and bugs, and add new features. | OS | BleepingComputer |
|
17.10.26 |
TFG London cyberattack disrupts systems at Hobbs and Whistles retailers | TFG London detected a cybersecurity incident that impacted IT systems used by the Phase Eight, Hobbs, and Whistles premium fashion brands. | Incindent | BleepingComputer |
|
17.10.26 |
Ivanti warns of Connect Secure zero-day exploited in attacks | Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. | Exploit | BleepingComputer |
|
17.10.26 |
Docker Hub flaw let attackers impersonate users, tamper with images | Docker has disclosed a critical vulnerability (CVE-2026-105445) in Docker Hub that let attackers access another user's container repositories using a personal access token (PAT). | Vulnerebility | BleepingComputer |
|
17.10.26 |
The MFA Gaps Attackers are Still Exploiting | Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn't enough and how organizations can close these authentication gaps. | Exploit | BleepingComputer |
|
17.10.26 |
SAP warns of maximum severity OAuth2 SSRF security flaw | SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. | Vulnerebility | BleepingComputer |
|
17.10.26 |
Norway fines Microsoft ad firm $9.6 million over Grindr data sharing | Norway's Data Protection Authority (Datatilsynet) has fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive data belonging to Grindr users in the country. | Incindent | BleepingComputer |
|
17.10.26 |
Yandex confirms service outage as users lose access to cloud files | Russian cloud services provider Yandex announced that drone attacks damaged three of its data centers, forcing it to shut down two facilities and partially disable a third. | BigBrothers | BleepingComputer |
|
17.10.26 |
Anthropic takes risky AI tests offline after models breach govt sites | Anthropic announced that its internal AI models undergoing "high-risk and cybersecurity evaluations" no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels. | AI | BleepingComputer |
|
17.10.26 |
Ledger confirms spy chip implant behind wallet crypto thefts | Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. | Cryptocurrency | BleepingComputer |
|
17.10.26 |
Cyberattack shuts down refrigerators at French supermarkets | Attackers remotely defrosted refrigerators at multiple French supermarket chains overnight in a cyberattack that reportedly targeted Danfoss refrigeration controllers. | Incindent | BleepingComputer |
|
17.10.26 |
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption | A new Windows malware loader called AvisLoader uses encrypted peer-to-peer communications to make command-and-control infrastructure harder to disrupt. Varonis researchers explain how the malware uses ClickFix delivery, shortcut-based persistence, and remote command execution capabilities. | Virus | BleepingComputer |
|
17.10.26 |
Retail giant Ahold Delhaize takes systems offline after cyberattack | Retail giant Ahold Delhaize, one of the world's largest food retail chains, confirmed today that it had to take some systems offline in response to a "cybersecurity incident" affecting its network. | Incindent | BleepingComputer |
|
17.10.26 |
GitLab warns of max severity code execution vulnerability | GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. | Vulnerebility | BleepingComputer |
|
17.10.26 |
Microsoft: Windows 11 23H2 reaches end of support in 30 days | Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. | OS | BleepingComputer |
|
17.10.26 |
Nippon Columbia malware incident exposes 8.6 million karaoke fan records | Daiichi Kosho, a major Japanese entertainment system maker, disclosed that a malware infection at its contractor, Nippon Columbia, exposed more than 8.7 million customer and employee records. | Incindent | BleepingComputer |
|
17.10.26 |
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants | Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised | Hack | The Hacker News |
|
17.10.26 |
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug | A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate | Vulnerebility | The Hacker News |
|
17.10.26 |
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor | Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at | Virus | The Hacker News |
|
17.10.26 |
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing | Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted | APT | The Hacker News |
|
17.10.26 |
OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract | OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case | AI | The Hacker News |
|
17.10.26 |
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers | The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in | APT | The Hacker News |
|
17.10.26 |
CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing | AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and | AI | The Hacker News |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: AI agents running inside restricted evaluation environments had found ways around their network isolation, compromised internal infrastructure, and eventually breached systems at Hugging Face. | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
XWorm Reborn: From infostealer to surveillance platform | In September 2024, Netskope Threat Labs first reported on XWorm and its infection chain. The following year, in July 2025, we reported version 6.0 and its more advanced features. As we continued tracking the malware over the past year, we identified four distinct XWorm versions operating concurrently in the wild. | Malware blog | Netskope Threat Labs |
|
17.10.26 |
Leaking the Keys to the Kingdom: How a Single Slip Handed Over a Darknet Empire | A flaw in GoBalance, a load-balancing tool used by many darknet sites, allows anyone to recover a site's master signing scalar from its publicly available data. With that key, an attacker can take over the site and redirect its visitors. | Cyber blog | SEARCHLIGHT |
|
17.10.26 |
A JPEG, a Race, and a Ghost: Breaking Discourse's Image Pipeline | During a security audit of Discourse, a popular open-source forum platform powering over 22,000 communities including OpenAI, Atlassian, and Cloudflare, we discovered two vulnerabilities affecting default configurations. | Security blog | SEARCHLIGHT |
|
17.10.26 |
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE | It has been a little while since we last looked at Adobe Experience Manager (AEM). We had some excellent findings last time but were just shy of full remote code execution. This time we were able to achieve full unauthenticated remote code execution on AEM Cloud. | Vulnerebility blog | SEARCHLIGHT |
|
17.10.26 |
Session Cookie Authentication Bypass: Predictable Signing Secret Enableds Account Impersonations | During a security review of a yard management system (YMS) used to optimize supply chain operations, Resecurity identified an authentication bypass caused by two independent weaknesses in the application's session-cookie design. | Security blog | Resecurity |
|
17.10.26 |
Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem | Resecurity identified and mapped the infrastructure supporting a commercial phishing-kit-as-a-service (PhaaS) operation marketed under the name “Iron Man System.” The kit is sold to criminal buyers as a self-hosted package that deploys pre-built lure pages impersonating postal and courier services, toll and traffic-fine authorities, tax agencies, banks, telecoms and loyalty programmes, then captures the data victims submit. | Phishing blog | Resecurity |
|
17.10.26 |
October 2026 Patch Tuesday Analysi | Today’s Patch Tuesday Alert addresses Microsoft’s October 2026 Security Updates. The FIRE team is actively working on coverage for these vulnerabilities and expect to ship that coverage as soon as it is completed. | OS Blog | Fortra |
|
17.10.26 |
Best KnowBe4 Alternatives & Competitors | Adaptive Security is backed by OpenAI as its first and only cybersecurity investment, and is used by companies including Figma, Ramp, Lennar, and Plaid. | Security blog | Adaptive Security |
|
17.10.26 |
Email Security Statistics 2026: Phishing, BEC & AI | Email security statistics consistently show the human layer rather than the technical stack as the decisive variable in most confirmed breaches, which is why human-layer defense deserves proportionate investment. | Spam blog | Adaptive Security |
|
17.10.26 |
DNS as C2 in Noir, An AI-Developed Crypto Wallet Drainer | We found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages. The loader races three public DNS-over-HTTPS (DoH) services and uses the first valid answer. | Cyber blog | Adaptive Security |
|
17.10.26 |
Inside Help TDS: Hotejka and Cloudflare Abuse | Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. | Security blog | Adaptive Security |
|
17.10.26 |
Run multi-container agent evals on Tensorlake with Harbor | Harbor 0.23.0 can run Docker Compose tasks on Tensorlake. Each task boots as one MicroVM with a Docker daemon inside, so an agent’s MCP server, database, browser, or game server runs next to it as its own container. | BotNet blog | Tensorlake |
|
17.10.26 |
GhostAction Returns: 772 Repos Hit, 30k More in Oct | The GhostAction supply chain campaign hit 772 public GitHub repositories between Aug. 31 and Sept. 30, 2026, targeting 2,577 secrets. Between Oct 8-9 a new burst hit 30k more, and this time the workflows ran. | Hacking blog | GITGUARDEN |
|
17.10.26 |
AI Agent Security: Six Controls From Nine Real Incidents | An AI agent runs with your credentials and acts before you can stop it. Nine incidents show what that costs. Six controls limit the damage: sandbox the agent, scope its credentials, lock its configuration, log every call, scan the workspace first, and deny by default. | AI blog | GITGUARDEN |
|
17.10.26 |
FlowerStorm detection and 70+ YARA rules: September 2026 | The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape. | Malware blog | VMRAY |
|
17.10.26 |
6 Malware Analysis Tasks You Can Automate with AI Agents | A reverse engineer’s week can quickly fill up with work that has already been solved once, whether that means decrypting a familiar string routine or peeling back another dropper stage. Once the underlying scheme is understood, much of this work no longer requires much judgment. | AI blog | VMRAY |
|
17.10.26 |
ontinue.com/1h2026threatintelligencereport/ | 1H 2026 findings reveal growing abuse of trusted identities, AI-assisted tooling, SaaS platforms, and business workflows as attackers achieve greater impact with less effort. | Cyber blog | ONTINUE |
|
17.10.26 |
2026_10_1h2026-TI-Report-Executive-Summary-en.pdf | The first half of 2026 reinforced a significant shift in the threat landscape: the most effective attacks increasingly do not look like attacks at all. They look like a Microsoft Teams message from someone claiming to be in IT, a login prompt from a trusted brand, a software package from a familiar repository, or a routine request that appears legitimate on the surface | Cyber blog | ONTINUE |
|
17.10.26 |
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) | Before we begin, yes - it's confusing. There are more vulnerabilities with watchTowr IDs in this blog post than there are CVE IDs (assigned by PaperCut), due to PaperCut bundling vulnerabilities and then patch bypasses for those same vulnerabilities into singular CVE IDs. | Vulnerebility blog | labs.watchtow |
|
17.10.26 |
Q3 2026 DDoS, bad bots, and BGP incidents: statistics and overview | As we predicted, botnet sizes returned to growth after a sharp decline in the previous quarter. The largest botnet observed in Q3 2026 comprised 3.56 million devices, up from 2.09 million in Q2. | Cyber blog | QRATORLABS |
|
17.10.26 |
Behind Closed Doors: How Physical Penetration Testing | Protecting confidential conversations takes more than closing a conference room door. Physical penetration testing reveals whether unauthorized people can reach sensitive spaces, interfere with equipment, or leave a device unnoticed. Define the test around the spaces and information you need to protect, then use the results to improve access checks, reporting, and response. | Security blog | Bishop Fox |
|
17.10.26 |
Submit and Execute: Weaponizing Reflected XSS in Siemens | Siemens Teamcenter is one of the most widely deployed product lifecycle management (PLM) platforms in the world, the system of record for the engineering designs, bills of materials, and approval workflows behind aircraft, vehicles, and industrial hardware. We found that a crafted link could execute JavaScript in the browser of a logged-in Teamcenter user. During an authorized assessment, we used it to silently grant one account the ability to act on behalf of another. | Vulnerebility blog | Bishop Fox |
|
17.10.26 |
AI Security Scoping: Define What To Test In Yo | Integrating artificial intelligence into enterprise workflows demands a system view: models are only one component in a chain that includes APIs, orchestration layers, data pipelines, identity, storage, and observability. | AI blog | Bishop Fox |
|
17.10.26 |
The October 2026 Security Update Review | Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). | OS Blog | Zero Day Initiative |
|
17.10.26 |
cikabika-bot-inside-a-discord-rat | Darktrace researchers investigate CikaBika Bot, a Rust-based remote access trojan delivered through a document-themed lure. The malware uses a Nim loader, PowerShell UAC bypass and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity. | BotNet blog | darktrace.com |
|
17.10.26 |
Underground AI-as-a-Service: How Cybercriminals are Buying and Selling AI | In under six months, the criminal supply of and demand for AI-powered tools grew into a sophisticated underground economy on hacker forums and platforms, maturing and scaling faster than any market these forums have seen. | AI blog | HALCYON |
|
17.10.26 |
ASOS App Hack: Attackers Used Push Notifications to Send a Ransom Note - Real-time Open Source Software Supply Chain Security | On October 6, 2026, people with the ASOS app got a push notification that said the company had been hacked. Attackers sent it. They had gotten into the third-party tools ASOS uses to message its customers, and they used that access to send an extortion note straight to people’s phones. ASOS has confirmed that names and contact details may have been accessed. The bigger claim, that the attackers “fully compromised” ASOS’s Snowflake data warehouse, is still unproven, and Snowflake says its platform was not breached. | Ransom blog | SAFEDEP |
|
17.10.26 |
tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud - Real-time Open Source Software Supply Chain Security | We found a credential-stealing worm in tensorlake@0.5.144. It runs on install, and npm was serving it as latest for a package with about 106,000 monthly downloads. | Hacking blog | SAFEDEP |
|
17.10.26 |
MALFEX Moves Its npm Loader into a Native Windows DLL - Real-time Open Source Software Supply Chain Security | The npm package imgdecode hides a malicious loader in a compiled Node.js addon. Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub. It decrypts the response and injects the result into a new dllhost.exe process. This code does not need an install script. On 2026-10-13, the package was still available on npm. | Malware blog | SAFEDEP |
|
17.10.26 |
TLD Launch Milestones 2026-2027: What Brand Protection Teams Need to Know | New top-level domain (TLD) launches follow public schedules, giving brand protection teams time to prepare defensive registrations, monitoring, and response plans before new namespaces become broadly available. | Vulnerebility blog | NETCRAFT |
|
17.10.26 |
TRM Labs Supports Microsoft's Disruption of YAM Store, CoGUI, and Iron Man, Three Services Behind Global Scam Operations | | On October 14, 2026, Microsoft's Digital Crimes Unit and Health-ISAC announced that they are dismantling three components of a Chinese-language cybercrime marketplace: YAM Store, CoGUI, and Iron Man. | Cyber blog | TRM Labs |
|
17.10.26 |
MALFEX npm Malware Campaign: Three Payloads And An Adversary That Signs Their Work - | The MALFEX campaign is a long-running npm supply-chain attack that delivers Remote Access Trojans (RAT), information stealers, or open Node.js processes as payloads. Learn about how the attack works, how to find out if you’re impacted, and what response actions to take. | Malware blog | Checkmarx |
|
17.10.26 |
Malware vs malware: a ClickFix kit at war for your screen | Two ClickFix kits fought over the same screen on hacked WordPress sites. One wrote the fight into its code, in Russian, down to the moment the browser broke. | Malware blog | ADAMNET |
|
17.10.26 |
OFAC Sanctions Tren de Aragua Crypto-Laundering Network | OFAC designated 10 targets in a Tren de Aragua ATM jackpotting scheme that stole at least $40.73 million from U.S. financial institutions. The network used cryptocurrency to launder the proceeds. | Cryptocurrency blog | CHAINALYSIS |
|
17.10.26 |
How Chainalysis Used AI to Trace the $387M Bitget Theft | Since $387 million was stolen from Bitget on September 24, Chainalysis investigators have been working with the exchange and law enforcement partners to trace the stolen funds across multiple blockchains and protocols. | AI blog | CHAINALYSIS |
|
17.10.26 |
Hacking OpenAI | On July 25, 2026, we chained two critical vulnerabilities to compromise multiple OpenAI employees’ ChatGPT accounts. With these accounts, we could then access internal OpenAI repositories, and potentially many other connectors. | AI blog | Hacktron AI |
|
17.10.26 |
Shadow AI Detection for MSPs | Employees have always found and used technology outside the approved IT stack, from unauthorized endpoint applications and browser extensions to personal cloud services. It left a trail: an install, a device on the network, something a scan or an agent could eventually catch. From there, an analyst had to investigate the finding and assess the risk before deciding how to respond. | AI blog | WatchGuard Blog |
|
17.10.26 |
GhostAction Is Now Phishing Open Source Maintainers | GhostAction operators used a targeted GitHub phishing proxy to steal developer credentials and one-time codes using a sophisticated GitHub phishing kit | Hacking blog | OpenSourceMalware |
|
17.10.26 |
GhostAction Attack Escalates By Targeting GitHub Users OpenSourceMalware | OSM has identified a new evolution of the GhostAction attack, which targets GitHub users via malicious CI workflow files and worm-like behaviour | Hacking blog | OpenSourceMalware |
|
17.10.26 |
Threat intel blog | GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farms | Cyber blog | OpenSourceMalware |
|
17.10.26 |
YuanKong RAT: the Android remote-control service that stamps its operators' names into every build | Most Android RATs try hard to hide their server. This one barely hides anything and that turns out to be the interesting part. The dropper leaves the key under the mat: a vault-config.json sitting in assets/ right next to the ciphertext it unlocks, holding the key and IV in cleartext. | Malware blog | STAR Labs |
|
17.10.26 |
Qilin Ransomware: Inside a Rust Encryptor and Its Affiliate Ecosystem | Qilin ransomware combines file encryption with an affiliate operation that manages victims, ransom negotiations, and stolen-data publication. Different intrusion teams deploy its payloads, so identifying Qilin does not automatically identify the attacker or the method used to enter a network. | Ransom blog | Darkatlas |
|
17.10.26 |
Rokarolla Android Banking Trojan: Analysis & Detection | The Rokarolla Android banking trojan combines fake login screens, message collection, and remote device interaction. With the required permissions, it can steal credentials and manipulate legitimate app interfaces. | Malware blog | DARKATLAS |
|
17.10.26 |
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) | BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on October 13 in APSB26-153 but requires a manual patch, while new installs remain vulnerable. | Vulnerebility blog | Sansec |
|
17.10.26 |
Spike in attacks targeting digital video recorders in Ukraine | GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. | BigBrother blog | GRAYNOISE |
|
17.10.26 |
skynox7: Proxyjacking Edge Devices Into Residential Proxies | Adversaries have a wide range of mechanisms they can use to obfuscate their public internet protocol (IP) addresses to avoid attribution and reduce their detectable signature. Adversaries have used various types of nodes and services to proxy their traffic including commercial virtual private networks (VPN), virtual private servers (VPS), co-opted victim infrastructure, and more. | Hacking blog | GRAYNOISE |
|
17.10.26 |
Variola: From ClickFix to a Modular Implant | Blackpoint’s Adversary Pursuit Group (APG) traced a ClickFix intrusion to a previously unclassified modular Windows implant, which APG is tracking as Variola. | Security blog | Blackpoint Cyber |
|
17.10.26 |
Pay Day Piracy: How Attackers Talk Their Way Into Your Payroll System | Using behavioral AI to chain anomalies from the help desk to HR payroll systems. | AI blog | Abnormal AI |
|
17.10.26 |
Detecting AI Attackers in the Cloud: 4 Signals That Work | AI-driven cloud attacks pass posture checks and detection rules because every step looks legitimate, and four signals still catch them when they're read together instead of one at a time. | AI blog | Abnormal AI |
|
17.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
17.10.26 |
Next.js Security Update for Upstream Vulnerabilities | Last week we announced an upcoming out-of-band security update for Next.js, including two fixes postponed from the September security release due to upstream dependency delays. | Vulnerebility blog | Next.js |
|
17.10.26 |
Patch Tuesday: October 2026 (Expel’s version) | Microsoft’s October release is the largest in its history: 1,414 CVEs, 78 rated critical and 1329 rated important. | OS Blog | Expel |
|
17.10.26 |
QuartzLine: A working PDF viewer with a backdoor inside | QuartzLine is a working PDF viewer with a backdoor hidden inside. In public analysis so far, the attacker never sent a command in any traffic researchers could decrypt. | Malware blog | Expel |
|
17.10.26 |
Emsisoft Anti-Malware for macOS stable release | After months of testing, feedback, and refinement, Emsisoft Anti-Malware for macOS is now officially available in a stable release. This release brings several performance improvements and tweaks. | Malware blog | Expel |
|
17.10.26 |
LG webOS sync-demo Preauth RCE - | First, the attacker replays the LG-signed manifest embedded in com.webos.app.sync-demo. SSG trusts the signature and follows the STB_INTERNAL_CONNECTION prompt-skip path, issuing a SECURE-tier client-key without a PIN prompt. Then cmp-client navigates to an attacker-controlled interactiveUrl. The loaded page keeps the app instance bridge and calls Luna services as cmp-client. | Vulnerebility blog | SSD Secure Disclosure |
|
17.10.26 |
Mobile Device Management Alone Cannot Address Every Mobile Security Threat | In an article published by HackRead, the limitations of Mobile Device Management (MDM) are examined as organizations face increasingly sophisticated threats targeting employee smartphones and corporate data. While MDM helps enforce device policies and manage access, it does not eliminate risks from mobile phishing, malicious applications, and compromised devices. | Security blog | ZIMPERIUM |
|
17.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Cryptocurrency blog | ZIMPERIUM |
|
17.10.26 |
Banking Scams Now Primarily Target Mobile Devices | A recent report reveals that 90% of banking scam attempts now occur on mobile devices, highlighting the growing role of smartphones in financial fraud. Researchers found that scammers are increasingly exploiting mobile banking interactions through social engineering, impersonation, and deceptive communications to manipulate victims into authorizing fraudulent transactions. | Spam blog | ZIMPERIUM |
|
17.10.26 |
GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories - | On October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. | Cyber blog | StepSecurity |
|
17.10.26 |
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD | Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. | Exploit blog | Calif |
|
17.10.26 |
Akamai Named a Leader in IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment | Akamai has been named a Leader in the IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment. This is the second time that Akamai has been recognized as a Leader in this assessment. | Security blog | Akamai |
|
17.10.26 |
Comply with PCI 6.4.3 & 11.6.1 Through Client-Side Security Tools | As the payment landscape evolves, compliance with PCI DSS v4 (v4.0.1 is the latest) is now a reality, with the deadline to adopt the future-dated requirements behind us. It is a critical defense against growing web skimming attacks (also known as e-skimming and digital skimming) and data leakage risks. | Security blog | Akamai |
|
17.10.26 |
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain | A WhatsApp-delivered financial document lure carried Statement.exe into a multistage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process. | Social blog | Morphisec Blog |
|
17.10.26 |
Why is Preemptive Cyber Defense Important in 2026 | Preemptive cyber defense is a prevention-first security strategy that stops threats before they execute, rather than detecting and responding to them after they have already run. Instead of recognizing an attack in progress, it removes the conditions an attack needs to succeed, blocking malicious code deterministically at the moment of execution. | Security blog | Morphisec Blog |
|
17.10.26 |
2026 Financial Sector Cyberattack Chain Analysis & Defense | Between September 30 and October 3, 2026, consecutive customer data leaks were confirmed at several major commercial banks in Korea. In particular, most of the leaks were found to have exploited APIs by targeting authentication and authorization flaws, and there are even concerns about potential automated attacks using AI agents. | BigBrother blog | Enki White Hat |
|
17.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The campaign uses PhantomPolia, a JavaScript loader that retrieves an encrypted configuration from an Ethereum Sepolia smart contract through public Remote Procedure Call (RPC) endpoints. The loader then decrypts the configuration locally using PBKDF2 and AES-GCM, revealing the next-stage command-and-control (C2) domain without exposing it directly on the compromised site. | Cryptocurrency blog | LEVELBLUE |
|
17.10.26 |
Now Detecting: CVE-2026-85706 - Unauthenticated Arbitrary File Read in GitLab | A maximum severity flaw in GitLab's repository commits API allows anonymous attackers to read arbitrary files from self-managed servers. We are already detecting it. | Vulnerebility blog | Ethiack |
|
17.10.26 |
Mythos AI Security Implications: The Complete Guide (2026) | Claude Mythos did not create the AI-security asymmetry between attackers and defenders. Mythos made it undeniable. Anthropic's own Frontier Red Team used the model to autonomously discover thousands of high- and critical-severity zero-day vulnerabilities across every major operating system and every major web browser, and it did so at costs that break the historical economics of vulnerability research. | AI blog | Ethiack |
|
17.10.26 |
Front Lines Podcast: What Founders Get Wrong When Pitching CISOs | On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust. | Cyber blog | Socket |
|
17.10.26 |
Socket for Origin Now Available | Socket for Origin scans dependency changes in pull requests and flags security risks based on your team’s policies. Now available in Cursor’s App Marketplace. | Cyber blog | Socket |
|
17.10.26 |
Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings | Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes. | AI blog | Socket |
|
17.10.26 |
Suspected Chinese spies hit BeyondTrust via zero-day | A suspected Chinese espionage crew broke into BeyondTrust Remote Support appliances through a flaw nobody knew about, weeks before the vendor disclosed it. Google Threat Intelligence Group (GTIG) and Mandiant say the actor they now call ARMORY CASTLE, previously tracked as UNC5221, exploited CVE-2026-102764 as a zero-day in late August 2026, then used the hijacked appliances to steal credentials and reach the machines those appliances are trusted to manage. | Vulnerebility blog | IntelFusions |
|
17.10.26 |
Deploy with Void | VoidZero's tools such as Vite, Vitest, Oxc, and Rolldown — bundled in one toolchain as Vite+ — have made frontend development faster, but building full-stack applications requires more than just a tooling stack. These applications need server routes, databases, local development environments, and a fast and easy way to deploy ideas to production. | Cyber blog | Cloudflare Blog |
|
17.10.26 |
Cloudflare and OpenAI: making AI discovery better for everyone | Optimizing your site for AI is of little use if AI can't find it. The answer to someone's question may already be on your website: the installation guide you spent a week writing, or a first-hand account of using a product, with the details that make the difference for whether they buy it. As more people turn to AI for help, you want those systems to find your work, represent it accurately, and send interested people your way. You also want control over how they access your site. | AI blog | Cloudflare Blog |
|
17.10.26 |
Yandex outage: data shows that instead of going dark, malicious bots went on the move | Following reported strikes on Yandex data centers, claims circulated on the Internet that Russian bot farms and influence operations had been knocked offline. HTTP traffic charts showed steep drops, fueling speculation that the infrastructure damage had stopped these malicious actors. However, aggregate traffic metrics can easily mislead. There are two autonomous system numbers (ASNs) associated with Yandex: AS13238 is used by Yandex’s search engine, while AS200350 runs its cloud services. | BigBrother blog | Cloudflare Blog |
|
17.10.26 |
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug | Hyperdrive support for MySQL is now generally available (GA). Hyperdrive, Cloudflare’s database connection pooler for Workers, initially only supported Postgres. Since we announced the beta for MySQL protocol support last year, we have been working on making our MySQL handling as reliable as our Postgres support. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
A fully programmable secure web gateway | Every secure web gateway on the market works the same way: traffic matches a condition. A terminal action fires. Allow, Block, Isolate, Log. This model has been the foundation of network security for nearly 30 years, and it handles the common case well. But it has a ceiling, and customers with complex environments hit that ceiling regularly. | Vulnerebility blog | Cloudflare Blog |
|
17.10.26 |
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) | On August 18, 2026, Vercel announced a $1 million challenge inviting researchers to break the isolation boundary of its Sandbox product (total prize pool). The announcement came just weeks after OpenAI had disclosed a remarkable security incident: | Vulnerebility blog | PWN.AI Security Research |
|
17.10.26 |
Acronis Cyberthreats Update, October 2026 | The Acronis Cyberthreats Update covers current cyberthreat activity and trends, as observed by Acronis Threat Research Unit (TRU) and Acronis sensors. Figures presented here were gathered in September 2026 and reflect threats that Acronis detected, as well as news stories from the industry. This report represents a global outlook and is based on more than one million unique endpoints distributed around the world. | Cyber blog | ACRONIS |
|
17.10.26 |
Acronis AI Copilot: Adoption is high and growing among MSPs | Acronis Cyber Platform has a built-in AI assistant. Type a plain-language question into the console, and it generates an answer or completes a supporting task within the console. | AI blog | ACRONIS |
|
17.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
17.10.26 |
AI and the Shared Responsibility Model: What Changes | Whether you are deploying large language models (LLMs), training custom machine learning models, building agentic workflows or embedding AI into existing applications, the major cloud service providers (CSP) have rolled out dedicated platforms to make it easier than ever to get started. | AI blog | GIUDEPOINT |
|
17.10.26 |
Hiring in the Age of Deepfakes: Synthetic Applicants | It’s tough enough to hire the right person in today’s competitive talent market. Candidates ghost interviewers, skill sets don’t match job descriptions and the race for top technical talent is relentless. | Hacking blog | GIUDEPOINT |
|
17.10.26 |
Silent Ransom Group Leaked Chats: Key Findings by GRIT | The chats appear to be from Silent Ransom Group (SRG) and show an attempt at a deliberate rebrand (to Sleepless Threat) to evade law enforcement. The tradecraft analysis matches the FBI’s May 2025 notice on SRG. We assess with moderate-to-high confidence that the people in this chat operate under or alongside, the SRG name. | Ransom blog | GIUDEPOINT |
|
17.10.26 |
러시아 전쟁의 이면에서 우크라이나를 겨냥한 김수키의 Operation GitPower | Kimsuky’s Operation GitPower Targeting Ukraine Behind the Front Lines of Russia’s War | APT blog | GENIANS |
|
17.10.26 |
금융분야 침해사고 이슈 분석 | 본 보고서는 2026년 9월 말부터 10월 초까지 국내 금융권에서 연쇄적으로 발생한 개인정보 침해사고를 대상으로, Genians Security Center(GSC)가 공개 보도, 금융당국 발표, 보안업계 분석을 종합하여 사고 경과, 공격 기법, AI 활용 정황 및 국내외 위협 동향을 정리한 것입니다. | APT blog | GENIANS |
|
17.10.26 |
The zod Near-Miss: Publish-Time Scanning at the npm Registry Boundary — | zod is the kind of dependency you add without thinking about it. The schema validation library sits in millions of TypeScript projects; commenters in GitHub’s incident thread put its weekly downloads above 280 million. On Sunday, September 21, 2026, a commit landed in the public colinhacks/zod repository with the message Fix bugs and improve performance. | Hacking blog | Yeeth Security |
|
17.10.26 |
CVE-2026-89111: Critical SAP Cloud SDK SSRF | SAP has disclosed CVE-2026-89111, a maximum-severity server-side request forgery (SSRF) vulnerability in SAP Cloud SDK for Python that can expose OAuth2 client credentials. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
Top RCE Vulnerabilities: 10 Critical CVEs and Exploits | A remote code execution (RCE) vulnerability is a software flaw that lets an attacker run their own code on a target system from a remote location. Exploiting vulnerabilities like this is now the most common way attackers get in: it was the initial access vector in 31% of breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), up from 20% the year before, and the median time to fully patch rose from 32 to 43 days. | Vulnerebility blog | SOCRADAR |
|
17.10.26 |
October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days | Microsoft’s October 2026 Patch Tuesday, released on October 13, 2026, fixes 1,413 vulnerabilities across Windows, Office, Exchange Server, SharePoint, .NET, Azure services, and developer tools. The total surpasses September’s Patch Tuesday (974 flaws) and sets a new monthly record for the second month in a row, a rise Microsoft has tied to AI-assisted vulnerability discovery. | OS Blog | SOCRADAR |
|
17.10.26 |
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks | Ivanti released fixes on October 13, 2026, for CVE-2026-104935, an Ivanti Connect Secure zero-day that attackers exploited before a patch existed. Volexity, which uncovered the activity during an incident investigation, tracks the attacker as UTA0576. According to the published analysis, the actor chained three vulnerabilities to move from an unauthenticated web request to root-level code execution on an ICS VPN appliance running version 22.8R2.4, which was fully patched at the time. | Exploit blog | SOCRADAR |
|
17.10.26 |
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site | A month after its first leak site postings, the n0n extortion group has turned its attention to global shipping. On October 12, 2026, the group added 38 organizations to its Dark Web leak site in one batch: container terminals in Brazil, Spain, Morocco, India and Vietnam, shipping lines in Singapore, China and Taiwan, port IT providers in Kuwait, Indonesia and Germany, and a dense cluster of South Korean operators. | APT blog | SOCRADAR |
|
17.10.26 |
French Supermarket Cyberattack: Exposed OT Behind France’s Food Supply | Supermarkets across France opened on Monday, October 12, to warm freezers and spoiled stock. Overnight, attackers had taken control of refrigeration controllers in hundreds of stores and forced them into defrost, heating equipment to as high as 50°C. Prosecutors confirmed fires, retailers estimated losses in the tens of millions of euros, and Coopérative U’s chief executive called the attack unprecedented. | BigBrother blog | SOCRADAR |
|
17.10.26 |
Iran War Cyber Threat Outlook: Conflict Phases and What Comes Next | Since the Iran War began on February 28, 2026, the conflict has moved through phases that most threat frameworks were not built to track. In cyberspace, SOCRadar tracked 1,357 incidents prominent in the first month that spanned 25+ countries, 15+ sectors, and 40+ distinct attack groups. That data does more than record what happened. It reveals a pattern | BigBrother blog | SOCRADAR |
|
17.10.26 |
Behind the scenes of a vishing operation | Okta Threat Intelligence recently obtained material from a sensitive source that provides an inside view of Work Panel, an operator console used by threat actors running vishing campaigns that target customers of multiple identity providers, including Okta. | Phishing blog | Okta Threat Intelligence |
|
17.10.26 |
October 2026 Microsoft Patch Tuesday | Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild. | Vulnerebility blog | Tenable® |
|
17.10.26 |
Xorbits Xoscar: Unauthenticated RCE via Cloudpickle Deserialization in the Actor Pool | VulnCheck is disclosing CVE-2026-49950, a deserialization vulnerability in Xorbits Xoscar that allows for unauthenticated remote code execution. The bug is not in an application endpoint; it is in the transport layer of the actor framework itself. An actor pool is Xoscar's unit of concurrency: a process that hosts actors and exchanges messages with other pools over TCP. | Vulnerebility blog | VulnCheck |
|
17.10.26 |
Expanding Visibility Into Chinese Government-linked Cyber Threat Actors | Some of the joint advisory's IOCs are still live and repurposed. Three IPs were hitting VulnCheck Canaries as recently as May 2026, years after their advisory last-seen dates, but against entirely different vulnerabilities than the advisory lists. | APT blog | VulnCheck |
|
17.10.26 |
SPIP odt2spip Plugin: Authenticated Command Injection via Uploaded Document Filename | VulnCheck is disclosing CVE-2026-104085, an OS command injection in odt2spip, a document-import plugin for the SPIP CMS. The plugin lets an author import an office document (.odt, .doc, .docx, .html) into an article. It moves the uploaded file to a path built from the raw client-supplied filename, then hands that path to LibreOffice through a shell command. | Hacking blog | VulnCheck |
|
17.10.26 |
5 Key Takeaways From Censys’ State of the Internet Report | New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about where Internet infrastructure lives, how it changes, and what’s exposed. | Cyber blog | Censys |
|
17.10.26 |
The Ultimate Guide to Brand Protection with Censys - Censys Brand Protection & Fraud Takedowns: A Censys Guide | On August 23, 2026, a PowerShell dropper reached out to hxxp://binance-idexchange[.]com/333.mp4 for its next stage. Binance, the world’s largest cryptocurrency exchange with hundreds of millions of users, had nothing to do with it — duh! | Cryptocurrency blog | Censys |
|
17.10.26 |
Frostbitten in France: A Danfoss StoreView Internet Exposure Report | Attackers targeted refrigeration units at hundreds of supermarkets across France over the weekend of October 10, resulting in spoiled food and, in some cases, fires. | Incident blog | Censys |
|
17.10.26 |
Navigating the Waves of AI-Powered Identity Attacks | It’s one of the most famous lines in movie history. Chief Brody, chumming the water off the back of the Orca, a battle-hardened fishing boat, gets his first full look at the nemesis in Jaws. He backs slowly into the cabin in shock and says… | Incident blog | Flare |
|
17.10.26 |
Analysis After the Refrigeration System Attack in France | Overnight between October 11-12, 2026, refrigeration systems at several hundred grocery stores in France were driven into forced defrost. Temperatures in some cases reached 50 degrees Celsius, stock was destroyed, and equipment overheated. | Incident blog | Flare |
|
17.10.26 |
September 2026 Threat Trend Report on APT Groups | APT cases disclosed in September 2026 demonstrate that attacks have evolved to exploit the developer ecosystem, cloud services, and network management infrastructure as trust layers. Legitimate software installers, GitHub repositories, Microsoft 365, OneDrive, Telegram, Nostr, routers, and authentication servers were all included in the attack chain. | APT blog | ASEC |
|
17.10.26 |
Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat | Since the original ARTEX GitHub repository disappeared, there has been an increase in independent distributions and customized instances based on the existing ARTEX codebase. These distributions are being redistributed with the product name, UI, filesystem structure, agent settings, and language modified, while retaining traces of ARTEX. | Cyber blog | ASEC |
|
17.10.26 |
ARTokens 5.1.2: Microsoft 365 Device Code Phishing | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | Phishing blog | ZeroBEC |
|
17.10.26 |
ARTEX Attacks on South Korean Financial Institutions | From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions were attacked one after another. | Attack blog | THREATBOOK |
|
17.10.26 |
RedAgents.Ai: The World's First Multi-Agent AI Pentest Platform | Recent news of multiple South Korean banks having their networks breached has once again deepened the industry's alarm over AI attacks. Even when attackers are not technically skilled, they can use AI agents to cause a major security impact. | Malware blog | THREATBOOK |
|
17.10.26 |
MSSP Growth: How to Scale Investigations Without Adding More Work | But growth also brings more alerts, suspicious files and URLs, investigations, escalations, reports, and SLA commitments. And if too much of that work still depends on manual analyst effort, those 10 new clients can put pressure on the SOC faster than expected. | Security blog | ANYRUN BLOG |
|
17.10.26 |
Fake AI Tools Target US Companies: Claude, ChatGPT & Copilot | ANY.RUN researchers tracked fake AI tool campaigns that impersonate Claude, ChatGPT, GitHub Copilot, Gemini, and other AI brands to plant infostealers, take over browser sessions, and phish business accounts. Between April 15 and October 5, 2026, 1,258 public sandbox analyses were tied to these campaigns, and the USA was the second-largest source of submissions after India. | AI blog | ANYRUN BLOG |
|
17.10.26 |
What Can ANY.RUN Reveal About Your Threat Landscape? | Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with ANY.RUN. Beyond individual investigations, this activity generates valuable data on emerging threats, industry trends, and SOC operational performance. | Security blog | ANYRUN BLOG |
|
17.10.26 |
DORA TLPT Requirements: Where Threat Intelligence Fits | The DORA TLPT requirements push selected EU financial entities beyond standard penetration testing. TLPT must be based on realistic threat scenarios, relevant threat actors, and current intelligence about how attacks are actually carried out. | Security blog | ANYRUN BLOG |
|
17.10.26 |
Russia Is Tightening Internet Controls, Leading to Operational Risks | Since mid-2025, the Kremlin has intensified restrictions on digital communications and infrastructure, very likely to suppress the organization of domestic political dissent and conduct digital surveillance within Russia. | BigBrother blog | RECORDEDFUTURE |
|
17.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | Disclosure note: Before publishing, we shared the new infrastructure identified in this research with the relevant national CERTs. This research did not recover victim data. | Cryptocurrency blog | HUNT.IO |
|
17.10.26 |
Inside a PaperCut Attacker’s AI Toolkit: Agent Instructions, Exploit Code, a Second RCE, and Victims Across 45+ Countries | Disclosure note: Before publishing this research, we shared our findings and the victim data we recovered with the national CERTs of the affected countries. The CERTs are handling notification of the affected organizations in their jurisdictions. | AI blog | HUNT.IO |
|
17.10.26 |
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon. | Exploit blog | Proofpoint US |
|
17.10.26 |
Threat Actors Abuse AI Pentesting Framework | Zscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic penetration testing framework developed in China that uses large language models (LLMs) to automate reconnaissance and exploitation tasks. | AI blog | ThreatLabz |
|
17.10.26 |
The patch tsunami: Microsoft addresses 1,415 CVEs in Patch Tuesday | For nearly 25 years, Patch Tuesday gave IT teams a predictable stream of patches to manage. In 2026, AI turned that stream into a tidal wave that threatens to overwhelm the organizations that can’t adapt. | OS Blog | ThreatDown |
|
17.10.26 |
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize | Group-IB researchers analyze KGB RAT, a Windows Remote Access Trojan advertised on underground forums as being fully undetectable, featuring a built-in crypter, HVNC, credential theft, ransomware, and an unusual set of psychological harassment capabilities. | Malware blog | Group-IB Blog |
|
17.10.26 |
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. Analysis of threat actor-controlled open directories uncovered Claude Code session histories, ARTEX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling. | AI blog | CrowdStrike |
|
17.10.26 |
How Attackers Can Bypass LLM Safety Classifiers | The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. | AI blog | CrowdStrike |
|
17.10.26 |
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage | CrowdStrike joins Anthropic’s Critical Infrastructure Defense Program, bringing deep cybersecurity expertise in protecting IT and OT environments to help advance AI-powered defense for critical infrastructure. | AI blog | CrowdStrike |
|
17.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). Successful exploitation can cause a denial of service (DoS) condition, potentially disrupting authentication services and remote access functionality. | Vulnerebility blog | SOPHOS |
|
17.10.26 |
Intent-Based Access Control: AI, Risk and the Limits of Inference | In Minority Report, the Department of Precrime promised certainty. Three precognitives saw the future, the system picked the consensus, and police arrested people for murders they hadn't yet committed. The whole machine depended on one buried secret: sometimes the precogs disagreed, and the dissenting vision, the minority report, was quietly deleted. The system held together as long as the precogs agreed, but broke when it removed its own doubt. | AI blog | SOPHOS |
|
17.10.26 |
Vulnerability Discovery and Exploitation Trends in the AI Era | Google Threat Intelligence Group (GTIG) examines vulnerability disclosure and exploitation statistics to evaluate the impact of artificial intelligence (AI) on the vulnerability threat landscape. We found that AI is measurably changing not just the pace of vulnerability discovery and exploitation, but also the types and typical risk profiles of vulnerabilities that are being discovered. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
ARMORY CASTLE Exploits BeyondTrust | On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar) appliances. BeyondTrust Remote Support is an enterprise secure remote access solution that enables IT teams to securely access and troubleshoot remote endpoints. The successful exploitation of this vulnerability results in the arbitrary upload of files. | Exploit blog | Google Cloud Blog |
|
17.10.26 |
AI/ML-Driven Malware Analysis Platforms: Key Features | Malware is becoming increasingly sophisticated, making it difficult for organizations to detect emerging threats using traditional signature-based security tools alone. Attackers use techniques such as code obfuscation, polymorphism, and sandbox evasion to bypass conventional security measures. | AI blog | SEQRITE |
|
17.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | SEQRITE |
|
17.10.26 |
WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack | WP2Shell is a critical WordPress Core exploit chain disclosed in July 2026 that can enables pre-authentication remote code execution (RCE) on vulnerable WordPress installations. The chain is particularly significant from a threat-intelligence perspective because it removes the requirement for an attacker to first obtain valid credentials or authenticate to the target application. | Exploit blog | SEQRITE |
|
17.10.26 |
Weekly Vulnerability Report: Langflow, N8n, And 54 ICS Flaws | This Cyble Research & Intelligence Labs (CRIL) weekly vulnerability report covers two views of risk: what attackers tried against Cyble’s global honeypot sensors, and what the Cybersecurity and Infrastructure Security Agency (CISA) disclosed for industrial control systems (ICS). | Cyber blog | CYBLE |
|
17.10.26 |
Don’t Get Played: TOKEN2049 Security Event Faces Scam Claims | A crypto security event that promised to teach attendees how to avoid scams is now the subject of scam allegations. The gathering, branded “Don’t Get Played,” was held as a side event during TOKEN2049 week in Singapore and co-hosted by groups operating under the names “Apex Accelerator” and “Stone Venture.” | Spam blog | CYBLE |
|
17.10.26 |
The GhostX Ecosystem: Forged In Transit, Licensed To Deceive | Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. | Malware blog | CYBLE |
|
17.10.26 |
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | Malware blog | Gen Blogs |
|
17.10.26 |
Aoki: Infostealer Targets AI Coding Assistant Credentials | Newer versions of a little-documented infostealer steal API keys and tokens from ever-growing number of AI coding assistants, including Claude, Codex, Cursor and Gemini. | Malware blog | SECURITY.COM |
|
17.10.26 |
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime | Over the past year, Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators, developers, and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide. | Phishing blog | Microsoft Security Blog |
|
17.10.26 |
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant | Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance. | APT blog | Palo Alto |
|
17.10.26 |
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk | When unusual activity was detected on a European bank’s central IT system, its internal security team quickly recognized that the incident warranted immediate response. They discovered unauthorized VPN-based access attempts that spanned several months. They then engaged Unit 42 to determine the full scope of the intrusion, identify any persistent footholds and secure the environment. | Hacking blog | Palo Alto |
|
17.10.26 |
AI-Powered Espionage Campaign Targets Government Linux Infrastructure | Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. | AI blog | Palo Alto |
|
17.10.26 |
When LLM Gateways Go Wrong: Findings from LiteLLM - Check Point Research | Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as of LiteLLM version 1.83.9. | AI blog | Check Point Research |
|
17.10.26 |
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation | I've been following a lot of (sometimes heated) threads and discussions lately about the current vulnerability landscape. I learned new words/phrases such as Summer of Hell (although I'm writing this with 1°C/34°F outside), Vulnpocalypse, Bugmageddon, Bugpocalypse, Breachpocalypse... | Vulnerebility blog | Check Point Research |
|
17.10.26 |
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. | APT blog | CISCO TALOS |
|
17.10.26 |
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware | “AI-analysis evasion” encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. | AI blog | CISCO TALOS |
|
17.10.26 |
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities | Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical." | OS Blog | CISCO TALOS |
|
17.10.26 |
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations | Cisco Talos identified UAT-6275 (TAG-193 by Recorded Future) activity targeting government organizations across the Commonwealth of Independent States (CIS). Recovered artifacts show additional interest in water resources and energy. This focus is consistent with intelligence collection and may reflect the regional effects of the Russia–Ukraine war. | APT blog | CISCO TALOS |
|
17.10.26 |
Inbox flooded with sign-up messages? How to handle email bombing | If you’re suddenly being overwhelmed with sign-up emails, it could very well be a sign of something more serious | Spam blog | Eset |
|
17.10.26 |
Medicare Open Enrollment season is here, and so are the scams | Open Enrollment is peak season for Medicare fraud – here’s how to tell real outreach from fakes and keep your details safe | Spam blog | Eset |
|
17.10.26 |
What to do when a data breach notice tells you almost nothing | Data breach notifications are telling victims less than ever. What the company leaves out can still shape what you do next. | Security blog | Eset |
|
17.10.26 |
The Unseen Credential Surface: How AI Agents Expose Secrets | There is a quiet assumption behind every AI agent: that when it "just runs a command for you," it handles your credentials as carefully as a good engineer would. It does not. This is not due to malicious intent. It is architectural. | AI blog | TRELLIX |
|
16.10.26 |
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions | A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory- | Vulnerebility | The Hacker News |
|
16.10.26 |
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory | A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A | Vulnerebility | The Hacker News |
|
16.10.26 |
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads | Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that | Virus | The Hacker News |
|
16.10.26 |
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks | The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of | Vulnerebility | The Hacker News |
|
15.10.26 |
Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams | A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka , which appears to be a | Spam | The Hacker News |
|
15.10.26 |
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks | NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There | Vulnerebility | The Hacker News |
|
15.10.26 |
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing | Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along | Vulnerebility | The Hacker News |
|
15.10.26 |
Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules | Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October | Vulnerebility | The Hacker News |
|
15.10.26 |
Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early | Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN | AI | The Hacker News |
|
15.10.26 |
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation | Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. | Vulnerebility | The Hacker News |
|
15.10.26 |
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 | The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with | Mobil | The Hacker News |
|
15.10.26 |
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories | The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and | Hack | The Hacker News |
|
15.10.26 |
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts | Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows | Exploit | The Hacker News |
|
15.10.26 |
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches | Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to | Exploit | The Hacker News |
|
15.10.26 |
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation | Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. | Exploit | The Hacker News |
|
15.10.26 |
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability | Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, | Exploit | The Hacker News |
|
15.10.26 |
Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App | Attackers exploited a flaw in an optional Nextcloud app, Collabora Online - Built-in CODE Server , to plant web shells on Nextcloud servers. Three | Vulnerebility | The Hacker News |
|
15.10.26 |
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages | Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the | Phishing | The Hacker News |
|
15.10.26 |
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud | The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme . | BigBrothers | The Hacker News |
|
14.10.26 |
CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their | Exploit | The Hacker News |
|
14.10.26 |
curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution | A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who | Vulnerebility | The Hacker News |
|
14.10.26 |
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days | A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the | AI | The Hacker News |
|
14.10.26 |
Hirudo Android Trojan Uses Patched Banking Apps to Bypass Their Built-In Security Checks | Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking | Virus | The Hacker News |
|
14.10.26 |
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host | A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel | AI | The Hacker News |
|
14.10.26 |
Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave | Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the | Vulnerebility | The Hacker News |
|
14.10.26 |
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug | Microsoft on Tuesday shattered its own Patch Tuesday record by shipping patches for a whopping 1,413 vulnerabilities , including one that it said has | OS | The Hacker News |
|
14.10.26 |
OpenAI Employee Arrested for Allegedly Planting Hidden Recorder in Executive Conference Room | A Saudi National and employee of OpenAI has been arrested for allegedly planting a hidden recording device in an executive conference room at the | AI | The Hacker News |
|
14.10.26 |
Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets | Small artificial intelligence (AI) models may be months away from developing capabilities to self-replicate on IoT devices like smart ovens | IoT | The Hacker News |
|
14.10.26 |
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another | A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. | Vulnerebility | The Hacker News |
|
14.10.26 |
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far | An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm | Vulnerebility | The Hacker News |
|
14.10.26 |
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft | A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security | Vulnerebility | The Hacker News |
|
13.10.26 |
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking | GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was | Hack | The Hacker News |
|
13.10.26 |
Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation | The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying Grindr users' sensitive data to advertisers. The | Social | The Hacker News |
|
13.10.26 |
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network | Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or | Vulnerebility | The Hacker News |
|
13.10.26 |
SOCRadar and Torq: Automate Threat Intelligence Response | Your Dark Web monitoring just flagged a set of employee credentials for sale. The alarm is accurate, it is timely, and it is now sitting in a queue. Someone has to read it, confirm the accounts are real, check whether the sessions are active, open a ticket and chase the identity team to rotate the password. | Security blog | SOCRADAR |
|
13.10.26 |
CVE-2026-102255: Critical SonicWall SMA1000 SSRF | SonicWall has patched CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting the WorkPlace interface of SMA1000 appliances. | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
Inside ICMacOS: From an Infostealer to a Persistent RAT | Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly one in three software developers works on macOS. | Malware blog | SOCRADAR |
|
13.10.26 |
Angi, Tour Guy, Healthcare, KPN and CafeMom Leaks | SOCRadar Dark Web Team identified several new underground posts, including an alleged Angi customer database sale, an alleged The Tour Guy breach exposing 3.8 million records, and an alleged healthcare leads database covering Australia, South Korea, Japan, and China. | CyberCrime blog | SOCRADAR |
|
13.10.26 |
CVE-2026-85097: Bricksforge Flaw Exploited for Unauthenticated RCE | Threat actors are actively exploiting CVE-2026-85097, a maximum-severity (CVSS 10.0) vulnerability in the Bricksforge plugin for WordPress. The flaw lets unauthenticated attackers upload and execute arbitrary PHP code on vulnerable sites, resulting in remote code execution (RCE). | Vulnerebility blog | SOCRADAR |
|
13.10.26 |
ARTEX Attacks on South Korean Financial Institutions | From September 27 to early October 2026, the internet-facing (peripheral) business systems of multiple South Korean financial institutions were attacked one after another. | Attack blog | THREATBOOK |
|
13.10.26 |
Auditing the auditor: Unmasking Apex Accelerator | REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery. | Security blog | Elastic Security Labs |
|
13.10.26 |
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers | Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing | Incindent | The Hacker News |
|
13.10.26 |
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control | Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges | Vulnerebility | The Hacker News |
|
13.10.26 |
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code | GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software | Vulnerebility | The Hacker News |
|
13.10.26 |
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies | Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly | Virus | The Hacker News |
|
12.10.26 |
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch | Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances | Vulnerebility | The Hacker News |
|
12.10.26 |
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE | A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to | Vulnerebility | The Hacker News |
|
12.10.26 |
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records | Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting | AI | The Hacker News |
|
12.10.26 |
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands | Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword . "Compared | Exploit | The Hacker News |
|
12.10.26 |
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws | Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its | AI | The Hacker News |
|
11.10.26 |
Cyber exec arrested in case allegedly tied to ShinyHunters hackers | Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. | CyberCrime | BleepingComputer |
|
11.10.26 |
ARTEX AI, Claude agents used in cyberattacks on South Korean banks | The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. | AI | BleepingComputer |
|
11.10.26 |
Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management | Traditional attack surface management helps organizations discover exposed assets, but visibility alone is not enough to address threats. Criminal IP introduces AITEM, an AI-powered approach that connects exposure discovery with investigation, risk prioritization, and response. | AI | BleepingComputer |
|
11.10.26 |
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks | Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks | CyberCrime | BleepingComputer |
|
11.10.26 |
Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto | Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. | Cryptocurrency | BleepingComputer |
|
11.10.26 |
FBI arrests another suspected ShinyHunters hacker after agency breach | The FBI has arrested another suspected member of the ShinyHunters extortion group believed to be involved in the recent breach of FBI systems, Director Kash Patel announced Friday. | BigBrothers | BleepingComputer |
|
11.10.26 |
Germany arrests alleged core Qilin ransomware member after extradition | Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan earlier this month. | Ransom | BleepingComputer |
|
11.10.26 |
Max severity SonicWall SMA1000 flaw now exploited in attacks | Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. | Exploit | BleepingComputer |
|
11.10.26 |
Man admits to running network of 15,000 money mules for cybercriminals | A Ukrainian-Russian dual citizen has pleaded guilty to running a massive money laundering operation that laundered millions for cybercriminals worldwide. | CyberCrime | BleepingComputer |
|
11.10.26 |
Microsoft: Outdated Windows devices will stop receiving security updates | Microsoft says devices running unsupported versions of Windows will stop receiving security updates after next year's Windows Update certificate rotation. | Security | BleepingComputer |
|
11.10.26 |
Citrix warns admins to patch new NetScaler RCE flaw immediately | Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway secure remote access solutions. | Vulnerebility | BleepingComputer |
|
11.10.26 |
Hackers get $1,262,000 for 98 zero-days at Pwn2Own Ireland | The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. | Congress | BleepingComputer |
|
11.10.26 |
FBI disrupts Chinese hacking tools used to breach critical infrastructure | The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. | BigBrothers | BleepingComputer |
|
11.10.26 |
Ransomware attack disrupts Japan's IDCF Cloud used by govt clients | IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving the eastern part of the country. | Ransom | BleepingComputer |
|
11.10.26 |
Low-cost Android phones ship with residential proxy malware | A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. | OS | BleepingComputer |
|
11.10.26 |
FakeGit malware campaign returns with 17,610 malicious GitHub repos | More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. | Hack | BleepingComputer |
|
11.10.26 |
Cisco warns of critical flaws allowing Nexus switch takeover | Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches | Vulnerebility | BleepingComputer |
|
11.10.26 |
Uranium crypto exchange hacker convicted for stealing $53 million | A Maryland man was found guilty of stealing more than $53 million after hacking the decentralized crypto exchange Uranium Finance twice in April 2021. | Cryptocurrency | BleepingComputer |
|
11.10.26 |
Microsoft Teams to get support for third-party deepfake detection tools | Microsoft will soon introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings. | OS | BleepingComputer |
|
11.10.26 |
ASOS links data breach to social engineering attack, credential theft | ASOS is sending updates to affected customers about the cybersecurity incident it suffered earlier this week, confirming that hackers accessed some personal data. | Incindent | BleepingComputer |
|
11.10.26 |
Owner of Empire cybercrime market gets 40 years in prison | The co-creator of Empire Market, one of the largest dark web marketplaces before its shutdown, has been sentenced to 40 years in prison for facilitating $430 million in illegal transactions from 2018 to 2020. | CyberCrime | BleepingComputer |
|
11.10.26 |
Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland | On the second day of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities. | Congress | BleepingComputer |
|
11.10.26 |
Ransomware recovery CEO charged over secret ransom payments | The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data. | Ransom | BleepingComputer |
|
11.10.26 |
FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins | The FBI is warning that FortiBleed attacks are still ongoing, targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways and locking out legitimate administrators. | Hack | BleepingComputer |
|
11.10.26 |
Hackers hijack Google domains after breaching ccTLD registries | Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa, and Sierra Leone after compromising third-party operators and modifying authoritative DNS records. | Hack | BleepingComputer |
|
11.10.26 |
Microsoft Outlook to block MSIX attachments starting November | Microsoft announced that it will add .msix and .msixbundle attachments to the list of blocked attachments in Outlook Web and the new Outlook Windows client starting next month. | OS | BleepingComputer |
|
11.10.26 |
PoeLLM malware infects exposed AI servers in cryptomining attacks | A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads. | Virus | BleepingComputer |
|
11.10.26 |
Ransomware has a new target. Is your backup ready? | Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that attackers cannot easily reach. | Ransom | BleepingComputer |
|
11.10.26 |
Hackers exploit critical Atlassian flaw after public PoC release | A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being exploited in attacks that do not require authentication. | Exploit | BleepingComputer |
|
11.10.26 |
SonicWall warns of max severity SSRF flaw in SMA1000 gateways | SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances. | Vulnerebility | BleepingComputer |
|
10.10.26 |
Musician sent to prison for $10 million streaming fraud using AI bots | A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme. | CyberCrime | BleepingComputer |
|
10.10.26 |
Advantest confirms personal information stolen in ransomware attack | Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data. | Ransom | BleepingComputer |
|
10.10.26 |
Ninja Forms plugin flaw exploited to hack WordPress sites | Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. | Exploit | BleepingComputer |
|
10.10.26 |
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland | On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. | Exploit | BleepingComputer |
|
10.10.26 |
Atlassian warns of critical file-access flaw in Jira, Confluence | Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. | Vulnerebility | BleepingComputer |
|
10.10.26 |
ASOS confirms data breach after “HACKED” in-app notifications | UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. | Incindent | BleepingComputer |
|
10.10.26 |
Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes | A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. | AI | BleepingComputer |
|
10.10.26 |
How to secure RMM software: 8 controls MSPs should test | RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged access to recovery and tenant isolation. | Security | BleepingComputer |
|
10.10.26 |
Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits | The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have been partially responsible for a May outage. | AI | BleepingComputer |
|
10.10.26 |
Nikkei discloses breaches of employees’ Microsoft, Google email accounts | Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails. | Incindent | BleepingComputer |
|
10.10.26 |
Engineer sentenced for locking over 3,000 devices on employer network | A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack. | Incindent | BleepingComputer |
|
10.10.26 |
OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU | OpenAI is preparing to add invisible watermarks to text generated by ChatGPT and Codex in the European Union. | AI | BleepingComputer |
|
10.10.26 |
Rejetto HFS servers now actively scanned for critical RCE flaw | Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE). | Vulnerebility | BleepingComputer |
|
10.10.26 |
IQVIA fined $7.8 million for failing to properly anonymize health data | Italy's Data Protection Authority (GPDP) has fined IQVIA €7 million ($7.8M) over poor data-processing practices that the agency says could have put roughly one million patients at risk of data exposure and de-anonymization. | Incindent | BleepingComputer |
|
10.10.26 |
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories | Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source | Hack | The Hacker News |
|
10.10.26 |
FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack | The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X . ShinyHunters is | BigBrothers | The Hacker News |
|
10.10.26 |
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands | Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword . "Compared | Exploit | The Hacker News |
|
10.10.26 |
TP-Link Sued by Four More U.S. States Over Router Security and China Ties | Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with Texas filing a suit in February . Florida, Iowa, | BigBrothers | The Hacker News |
|
10.10.26 |
Dire Wolf Ransomware Attacks: How to Test and Strengthen Your Defenses | Dire Wolf Ransomware is a double-extortion ransomware first observed in April 2025. By August 2026, it had claimed 100 victims across 32 countries, including the United States and Brazil, mainly in professional services, manufacturing, healthcare, technology, and financial services. | Ransom blog | PICUSSECURITY |
|
10.10.26 |
CISA AA26-281A: How Chinese Government-Linked Actors Steal Sensitive Data | CISA published a joint cybersecurity advisory on October 8, 2026, which describes how Chinese government-linked threat actors combine automated reconnaissance with hands-on intrusion to steal sensitive data. | BigBrother blog | PICUSSECURITY |
|
10.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Malicious Crypto Shell Packages Target RubyGems | A threat actor calling themselves "Ghost Dev" published 42 malicious typo squat packages to the RubyGems registry targeting crypto and web3 packages | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
How to Investigate a GitHub Repo's Real History | Learn to reconstruct what actually happened to a compromised repo using timestamps and logs that the person doing the manipulation doesn't control. | Malware blog | OpenSource Malware Blog |
|
10.10.26 |
Novinarya: An Android stealer that hides its live C2 in a shop bio | Scan this sample for a command server and you find nothing: no URL, no IP, nothing to block. That is the whole idea. Behind a fake “Smart System Security” app, this Iranian banking and crypto stealer keeps its server out of the binary and reads it at run time from the bio of a seller’s profile on a legitimate marketplace, rotating it with a single edit no new sample needed. | Malware blog | STAR Labs |
|
10.10.26 |
Runtime AI Defense in a shared responsibility model | This last February, by their own account, an employee at Meta connected an open source agent to their inbox and told it to suggest which emails to archive or delete, and to confirm with them before acting. Despite the guardrails of the prompt, the agent started deleting. Their stop commands didn't work and they had to manually kill the process. | AI blog | Sysdig |
|
10.10.26 |
Spike in attacks targeting digital video recorders in Ukraine | GreyNoise identified an increase in scanning and exploitation attempts targeting Digital Video Recorders (DVR) in Ukraine between 21 September and 1 October 2026. The activity coincides with an escalation in Russian strikes across the country. | BigBrother blog | GREYNOISE |
|
10.10.26 |
Why API Security Belongs in ECB Cyber Action Plans | An undocumented partner endpoint or an outdated mobile-banking API can expose customer information even after newer services receive stronger protections. As AI accelerates vulnerability discovery and exploitation, banks need a clearer view of these gaps and a practical way to reduce them. | Vulnerebility blog | Akamai |
|
10.10.26 |
CVE-2026-21589: Critical Arbitrary File Read Vulnerability in Atlassian Products | On October 5, 2026, Atlassian released a security advisory to address a critical arbitrary file read vulnerability across multiple Atlassian Data Center products, including Bitbucket, Confluence, Jira Software, and Bamboo. | Vulnerebility blog | Akamai |
|
10.10.26 |
How Akamai ExAR Contained a LATAM Supply Chain Attack | Akamai Guardicore Segmentation’s Exposure Analysis and Response (ExAR) detected and investigated a multistage intrusion affecting supply chain infrastructure in Latin America (LATAM). The complex intrusion was targeting Linux, OpenShift, and Windows DMZ workloads before significant operational disruption occurred. | Hacking blog | Akamai |
|
10.10.26 |
Open Enrollment Is Where Digital Strategy Gets Tested. Are You Ready? | Most retail purchases come with a return policy. If the sweater doesn't fit, you send it back. But health plan selections work differently. Once a member chooses a plan during open enrollment, they generally keep that plan for the year unless they qualify for a Special Enrollment Period or get coverage another way. | Cyber blog | Akamai |
|
10.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | In recent years, organizations have made real progress here. SBOMs (Software Bill of Materials) are now a standard deliverable. Software Composition Analysis (SCA) tools run in CI/CD. Vendor security questionnaires are longer and more rigorous than ever. | Security blog | JSCRAMBLE |
|
10.10.26 |
From WhatsApp to SYSTEM: Inside the VulcanRAT207.A Intrusion Chain | A financial-document lure, reported to have arrived over WhatsApp, carried Statement.exe into a multi-stage Windows intrusion. After unpacking, the loader screened the host, attempted elevation, and injected a downloader into the LocalSystem Task Scheduler process. | Social blog | Morphisec Blog |
|
10.10.26 |
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign | The LevelBlue Operational Cyber Threat Intelligence (OpsCTI) Team recently observed a ClickFix campaign delivering Remus Stealer through compromised websites. | Malware blog | LEVELBLUE |
|
10.10.26 |
16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials | Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces. | Cryptocurrency blog | Socket |
|
10.10.26 |
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack | Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware. | Malware blog | Socket |
|
10.10.26 |
Building an evidence-grounded agentic security operations harness on Cloudflare | Security alerts rarely arrive one at a time. A single alert can cause a spike across the environment, requiring a human analyst to decide which alerts are related and what they mean. When multiple arrive at the same time, it can quickly overwhelm even a seasoned security analyst. Enter the alert paradox. Now, our built-in, multi-AI-agent security operations harness can handle more of this work at Cloudflare scale. | AI blog | Cloudflare Blog |
|
10.10.26 |
Bridging technical depth and usability: The story behind Radar’s redesign | Radar provides a real-time view into global Internet trends, powered by Cloudflare’s global network. We support Cloudflare’s mission to help build a better Internet by making web data visible, clear, and actionable for everyone. Since launching in 2020, Radar has found a natural audience amongst expert users with technical backgrounds, such as network operators and academic researchers who rely on Radar data to observe industry trends and global events. | Security blog | Cloudflare Blog |
|
10.10.26 |
Meet AI Detection Engineer, the Newest Member of Your SOC | AI Detection Engineer investigates, builds, tests, and deploys a tuned detection for confirmed misjudgments your team reports, then shows the verifiable impact. | AI blog | Abnormal AI |
|
10.10.26 |
Four ways back in: the WordPress XSS campaign that hides its own admin account | Two unrelated WordPress plugins, two separate stored Cross-Site Scripting vulnerabilities, one payload. Over the past several days our telemetry has recorded exploitation attempts against both, and every attempt pulls the same JavaScript from imgcdn1.com. Two is what we have confirmed, not what we expect the final count to be. | Vulnerebility blog | Patchstack |
|
10.10.26 |
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin | This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge(opens in new tab)↗ plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least version 3.1.8.10. | Vulnerebility blog | Patchstack |
|
10.10.26 |
Inferno Drainer Is Burning Out | Inferno Drainer and its many derivatives constitute arguably the most notorious cryptodrainer-as-a-service ecosystem ever developed. After months spent reverse-engineering its newest payloads and monitoring the ecosystem in real time, one thing seems clear: the operation is in serious decline, and has been for quite some time. | Cryptocurrency blog | Ransom-ISAC |
|
10.10.26 |
Upcoming Next.js Security Update for Upstream Vulnerabilities | Next Wednesday, October 14, 2026, we plan to publish an out-of-band Next.js security update. It will address three vulnerabilities in upstream dependencies: two Critical and one High. Two of these fixes were postponed from the September security release due to upstream coordination. | Vulnerebility blog | Next.js |
|
10.10.26 |
Oh Noes! is updated and free for Cybersecurity Awareness Month | October means Cybersecurity Awareness Month, which for a lot of security teams means the same routine: send a fake phishing email, see who clicks, remind everyone not to click links from strangers. Again. | Cyber blog | Expel |
|
10.10.26 |
Earth Sirrush: A Russia-Aligned Intrusion Set With 4 Years of Evolving Espionage Tooling | Earth Sirrush has repeatedly changed its tools and delivery methods, but TrendAI™ Research reveals how shared code, reused artifacts, and infrastructure patterns continue to expose the links between its campaigns. | APT blog | TrendAI (US) |
|
10.10.26 |
AI and the Evolving Threat Landscape: What Public Sector CISOs Need to Know Now | Public sector CISOs need to grapple with challenges brought about by AI threats: up to 3,600 AI CVEs in 2026, autonomous ransomware, and critical infrastructure risk. | AI blog | TrendAI (US) |
|
10.10.26 |
Crypters and the Mobile Malware Blind Spot: What a New Australian Government Advisory Means for Mobile Security | A joint advisory from the Australian Signals Directorate (ASD), Australian Federal Police (AFP), New Zealand Police, Google, and the UK's National Crime Agency (NCA) warns that "crypters," commercial obfuscation-as-a-service tools priced from as little as $25 a file, let attackers scramble malware so it evades antivirus and endpoint detection. | Malware blog | TrendAI (US) |
|
10.10.26 |
Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It | tensorlake@0.5.144 on npm steals credentials when you install it, then tries to spread to other packages and repos. It also sets a trap. If you revoke the GitHub token it stole, a background job on your machine deletes your home directory. | Malware blog | StepSecurity |
|
10.10.26 |
StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines | AI agent skills live in two places. Developers install them on their own machines, and teams commit them to repositories so everyone who works in the codebase gets them. A skill often travels between the two: a developer installs it, finds it useful, and commits it; everyone who clones the repository then has it. | AI blog | StepSecurity |
|
10.10.26 |
Hijacked TensorLake npm Turned Install Into Credential Risk | The affected npm release included a preinstall hook that starts an obfuscated JavaScript payload through Bun. The package can download Bun 1.3.13 if it is not already available. | Hacking blog | SONATYPE |
|
10.10.26 |
NEBULA - Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL | CloudSEK uncovered NEBULA, a malicious npm supply-chain campaign involving seven fake AI SDK packages distributed through four attacker-controlled accounts. Disguised as legitimate developer tools, these packages deploy a modified KNTRAT Windows trojan capable of stealthy remote access, camera and microphone surveillance, and persistence. The investigation reveals advanced syscall-based evasion techniques, active threats, and actionable indicators for security teams. | Malware blog | CloudSEK |
|
10.10.26 |
aws-auth ConfigMap Deprecated: What EKS Teams Need Now | If you’ve been running Amazon Web Services (AWS) Elastic Kubernetes Service (EKS) clusters for any length of time, you’ve probably had that moment. Staring at an aws-auth ConfigMap YAML file at 2 AM, trying to figure out why a new team member can’t access the cluster. | Hacking blog | GUIDESECURITY |
|
10.10.26 |
GRIT Q3 2026 Ransomware Report: Top Takeaways | GuidePoint’s Research and Intelligence Team (GRIT) just unveiled the Q3 GRIT Ransomware and Cyber Threat Insights Report. This quarter, they look at the so-called “vulnpocalypse,” shine a spotlight on the Education industry and ShinyHunters group, analyze the Clop syndicate’s latest activity and assess payment trends in the ransomware space. | Ransom blog | GUIDESECURITY |
|
10.10.26 |
AgentCorruption: One Role to Rule Them Al | Exploring what the agent's default execution role and stolen credentials can actually do, and how they became an entry point to the entire region - discovering and invoking other agents, reading, deleting and hijacking private conversations through chat history tampering, and more. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Credential Theft from AWS's Secrets Manager and More | Up to now, we showed how far we could get once we had the over-privileged role in hand: we were able to pull container images, talk to other agents that we were never allowed to, read private conversations, plant short- and long-term memories to control agents’ behavior and delete user data. All of this stays within the AWS region boundary. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Weaponizing Agent Memory for Persistent Hijacking | How access to AgentCore Memory let us plant instructions that survived beyond the initial compromise, turning an agent's remembered context into a channel for persistent command and control. | Hacking blog | Zenity Labs |
|
10.10.26 |
AgentCorruption: Initial IMDS Access | How a single prompt to a public-facing AgentCore agent exposed the instance metadata endpoint, the agent's cloud identity, and its container image: the foothold for everything that follows in this series. | Hacking blog | Zenity Labs |
|
10.10.26 |
DarkSword/Coruna Open Directory Finding Report | Open directories on five hosts exposed the full DarkSword/Coruna iOS exploit-and-harvest platform, from the C2 delivery server to the per-wallet theft modules. The infrastructure was still in use at triage time. | Exploit blog | Censys |
|
10.10.26 |
New on the Map — September 2026: 22 Protocol and Endpoint Scanners | Most organizations do not have a complete picture of what is reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. Attackers scan for these services systematically, every day. | Security blog | Censys |
|
10.10.26 |
Harbor SSRF Vulnerability Exposes Cloud Credentials | OX Research disclosed an SSRF vulnerability in Harbor, the CNCF open-source container registry. Any registered user who can create a project can point a webhook at the cloud metadata endpoint and walk away with the server’s IAM credentials. | Hacking blog | OX SECURITY |
|
10.10.26 |
Leaked AI & MCP Credentials: What They Expose | One record in the corpus carries the argument before we even start counting. It’s a project configuration file for an AI coding assistant that wires several named tool servers behind a single agent. | AI blog | FLARE.IO |
|
10.10.26 |
Healthcare: Cybercrime's Highest-Value Target | Various healthcare and public health reports like the one of IC3 (2025) report that healthcare organizations are among the most targeted critical infrastructure sectors for cyber incidents, with hundreds of reports of ransomware attacks and data breaches reported in a single year. | CyberCrime blog | FLARE.IO |
|
10.10.26 |
Email Security That Reasons About the Request and the Response | ARTokens (also reported as ARToken) is a Microsoft 365 device code phishing kit previously documented by Cisco Talos. It has re-emerged in recent campaigns with notable changes to its implementation and deployment options. | Phishing blog | ZEROBEC BLOG |
|
10.10.26 |
DDoS Readiness: Is Your Protection Actually On? | Most security controls tell you when they’re broken. A bad firewall rule lets traffic through that shouldn’t be there. An expired certificate generates alerts. A misconfigured WAF starts blocking legitimate users and someone notices pretty quickly. | Attack blog | Imperva |
|
10.10.26 |
From Threat Intelligence to SOC Action | So, what actually makes threat intelligence useful in daily SOC work? During our discussion, we narrowed it to three things: | Security blog | ANY.RUN & Elastic |
|
10.10.26 |
Critical N-able N-central Vulnerability and Active Exploitation | UPDATE 9/6/26: N-able issued [Hotfix 4 (2026.3 HF4)] to address CVE-2026-86218, an actively exploited pre-auth RCE zero-day with a 10.0 CVSS score that supersedes all prior hotfixes. On-premises N-central users must apply HF4 immediately, as systems running HF3 remain vulnerable to this newly disclosed flaw. Hosted (NCOD) instances have already been patched by N-able. | Exploit blog | Huntress |
|
10.10.26 |
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | On October 4, 2026, NVD disclosed two CVEs impacting the AhsayCBS backup utility: CVE-2026-105133 and CVE-2026-105134. Starting October 7 (23:20:15 UTC), Huntress began seeing threat actors exploiting the flaws to perform remote code execution on impacted hosts. | Vulnerebility blog | Huntress |
|
10.10.26 |
Japan Adopts Proactive Cyber Defense Strategy | Japan’s Active Cyber Defense (ACD) framework shifts the country from voluntary information sharing and post-incident investigation to mandatory reporting, preventive communications analysis, and limited disruption of attack infrastructure. | BigBrother blog | RECORDEDFUTURE |
|
10.10.26 |
AI SOC automation: Inbox zero for your alert queue | AlertZero brings AI SOC automation to Elastic Security with four agents, one job each, so the queue stops setting your priorities. Nothing changes in your environment without your approval. | AI blog | Elastic Security Labs |
|
10.10.26 |
Semantic Privilege Escalation: The AI Security Threat Your Access Controls Can't See | In 1988, Norm Hardy published a short paper about an incident at Tymshare roughly eleven years earlier. A Fortran compiler lived in a system directory called SYSX, and so it could record usage statistics there, administrators had granted it a "home files license" that let it write any file in that directory. | AI blog | Proofpoint US |
|
10.10.26 |
Trojanized Terraform Provider Campaign | In July 2026, Zscaler ThreatLabz uncovered a campaign linked to TraderTraitor (also tracked as Jade Sleet, UNC4899, Pressure Chollima, and Slow Pisces), an advanced persistent threat actor backed by the North Korean government that has targeted the cryptocurrency industry for years. | Malware blog | ThreatLabz |
|
10.10.26 |
Criminal AI, powered by OpenRouter | Kriminal, DadGPT, and WormGPT are three of the most recognizable tools in the criminal AI marketplace today. Kriminal and DadGPT sell themselves as unrestricted AI: no filters, no refusals, built specifically to say “yes” where a mainstream model would say “no.” | AI blog | THREATDOWN |
|
10.10.26 |
How Attackers Can Bypass LLM Safety Classifiers | The CrowdStrike Cyber Superintelligence Lab evaluated the most advanced publicly deployed content safety classifier and found that it can be systematically circumvented. | AI blog | CROWDSTRIKE |
|
10.10.26 |
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage | CrowdStrike joins Anthropic’s Critical Infrastructure Defense Program, bringing deep cybersecurity expertise in protecting IT and OT environments to help advance AI-powered defense for critical infrastructure. | AI blog | CROWDSTRIKE |
|
10.10.26 |
Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | CrowdStrike Intelligence identified infrastructure associated with a targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October 2026. | AI blog | CROWDSTRIKE |
|
10.10.26 |
Citrix NetScaler vulnerability (CVE-2026-88779) in active exploitation | On October 4, 2026, Citrix disclosed a high-severity (CVSS score of 8.7) memory overflow vulnerability (CVE-2026-88779) affecting Citrix NetScaler ADC and Citrix NetScaler Gateway deployments that are configured as either a SAML Service Provider (SP) or SAML Identity Provider (IdP). | Vulnerebility blog | SOPHOS |
|
10.10.26 |
CVE-2026-3854: How Git Push Options Became an Internal Metadata Injection Primitive | CVE-2026-3854 exposed a critical trust-boundary failure in the GitHub Enterprise Server (GHES) push pipeline. A value supplied through a standard Git push option could be copied into internal, semicolon-delimited metadata and later interpreted as trusted configuration. | Vulnerebility blog | Seqrite |
|
10.10.26 |
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data | Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in our user base. | Malware blog | GENDIGITAL |
|
10.10.26 |
CVE-2025-7544: Attackers Weaponize Tenda AC1206 Router Vulnerability to Deploy Mirai-Related Malware | MLflow is one of the most widely deployed open-source platforms for managing the machine learning lifecycle, from experiment tracking and model versioning to deployment and registry management. | Vulnerebility blog | SonicWall |
|
10.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Adobe Commerce and Magento StyleSmuggler RCE - CVE-2026-75650 | SonicWall Capture Labs threat research team became aware of the threat CVE-2026-75650, assessed its impact, and developed mitigation measures. The flaw, also known as StyleSmuggler, is a critical vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. | Vulnerebility blog | SonicWall |
|
10.10.26 |
Blinder Tunnel Campaign Targets Iraqi Infrastructure | We discovered that an Iranian state-aligned threat actor has been masquerading as the Dubai Airports IT department to deliver trojanized coding challenges to high-value targets. Unit 42 tracks the activity as CL-STA-1178. This activity includes a campaign we call “Blinder Tunnel,” that targeted Iraqi critical infrastructure in March 2026, following infrastructure staging that was observed as early as November 2025. | Cyber blog | Palo Alto |
|
10.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. | Vulnerebility blog | Palo Alto |
|
10.10.26 |
Evolution of Web3 in Cloud Supply Chain Attacks | Threat actors have systematically upgraded their command-and-control (C2) infrastructure to use Web3, also known as Web 3.0 or decentralized blockchain web architectures. | Hacking blog | Palo Alto |
|
10.10.26 |
Making sure the checks get printed | My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve been working in the cybersecurity industry in many roles over the past 20+ years, first focusing on endpoint security, policies, and firewalls, then moving to risk management and compliance, disaster recovery, and investigations. | Cyber blog | CISCO TALOS |
|
10.10.26 |
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware | Just as attackers are adding new capabilities into their toolkits with AI, they are consciously trying to evade the novel AI capabilities levied on them by defenders. In Cisco Talos' findings with CAIRN, we classify this archetype of malware as “A3: AI-Analysis Evasion” — that is, malware that embeds natural-language instructions to influence automated analysis. | AI blog | CISCO TALOS |
|
10.10.26 |
One breach, please, and make no mistakes | For some time now, the cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure (to name a few, Hugging Face, DSEWiki, and RubyGems). | Incident blog | CISCO TALOS |
|
10.10.26 |
Microsoft, Adobe, Apple, and Foxit vulnerabilities | Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. | Vulnerebility blog | CISCO TALOS |
|
10.10.26 |
Give yourself room to be human | Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. | Cyber blog | CISCO TALOS |
|
10.10.26 |
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing | Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. | APT blog | CISCO TALOS |
|
10.10.26 |
MATCHBOIL: New tricks, same old evil intentions | ESET Research catalogs the changes of UAC-0099’s MATCHBOIL downloader from 2024 to 2026 | Malware blog | Eset |
|
10.10.26 |
Inside a brand deal scam targeting YouTube creators | A plausible-sounding sponsorship offer could mask an attempt to compromise your Google account | Phishing blog | Eset |
|
10.10.26 |
The quest for simplicity: Why SMBs want advanced protection without the complexity | The cybersecurity market is often making it tougher for SMBs to keep threats at bay | Cyber blog | Eset |
|
10.10.26 |
Windows Exploitation Techniques: Dangling COM Object Registrations | This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. | Vulnerebility blog | PROJECT ZERO |
|
9.10.26 |
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access | Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives | Exploit | The Hacker News |
|
9.10.26 |
Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects | Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial | AI | The Hacker News |
|
9.10.26 |
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge | Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and | Exploit | The Hacker News |
|
9.10.26 |
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities | Exploit | The Hacker News |
|
9.10.26 |
GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys | A bug in GoBalance , a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address | Hack | The Hacker News |
|
9.10.26 |
Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own | Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every | Congress | The Hacker News |
|
9.10.26 |
Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments | Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code | Vulnerebility | The Hacker News |
|
9.10.26 |
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions | The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China- | BigBrothers | The Hacker News |
|
9.10.26 |
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails | Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, | APT | The Hacker News |
|
8.10.26 |
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks | Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The | Hack | The Hacker News |
|
8.10.26 |
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML | The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan | Virus | The Hacker News |
|
8.10.26 |
ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms | Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial | AI | The Hacker News |
|
8.10.26 |
LINUX DAYS 2026 | Linuxdays 2026. LinuxDays is a Czech Linux conference, which takes place every year on the first weekend of October in Prague. The event was created in 2012 ... | CONGRESS | CONGRESS |
|
8.10.26 |
Q3 2026 Open Source Malware Index: When Compromise Compounds | In the third quarter of 2026, Sonatype identified 149,329 malicious open source packages across ecosystems, bringing the total logged since tracking began in 2017 to 1,960,846. | Malware blog | SONETYPE |
|
8.10.26 |
CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD | NOTE: This is an analysis of the artifacts and samples found during the hunt of SLAPSHOT, WHIPSHOT which is a Python tunneler used to proxy traffic into internal networks. The analysis is done using various AI Models and if you find any irrelevancy, please do report directly. This article is intended for Network Defenders, Threat Analysts, SOC and IT Administrators. | Exploit blog | THE RAVEN FILE |
|
8.10.26 |
AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage | An AI tool that produces only text carries roughly the risk of a badly worded email. A tool that can reach into systems and change things carries the risk of whatever those systems hold. The security question is not how clever the model is. It is which systems and data the model is authorized to access. | AI blog | ACRONIS |
|
8.10.26 |
Caught in 4K: The Gentlemen Files | A Russian-speaking Gentlemen ransomware affiliate called Azazel robbed two dozen victims across six countries, then double-crossed his own gang by publishing the loot on a private leak site and pocketing every dollar. | APT blog | CloudSEK |
|
8.10.26 |
How AI Is Changing the Roles Required in the Security Operations Center | As AI takes on more of the enrichment, correlation, and initial assessment inside the SOC, roles, skills, and KPIs still require deliberate redesign. Security leaders need to decide where automation is dependable, where human judgment should remain decisive, and how teams should be measured when alert handling is no longer the center of the operating model | AI blog | RAPID7 |
|
8.10.26 |
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR | The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface. | Security blog | RAPID7 |
|
8.10.26 |
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment | The surge in emerging threat actors directly correlates with the rapid escalation of victim counts and stolen financial resources. Simultaneously, this growth has spurred the proliferation of specialized supply storefronts across social media platforms, dark web channels, and various smaller niche marketplaces. | CyberCrime blog | RAPID7 |
|
8.10.26 |
SMTP is the key: BPFDoor and AVERAT hitting the network edge | Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese appliances. | Malware blog | RAPID7 |
|
8.10.26 |
Access Governance: Reducing Attacker Reach in the Age of AI-Accelerated Threats | AI is accelerating vulnerabilities and threats. Learn how to strengthen your organization's data security and access governance to reduce risks effectively with insights from Varonis and PwC. | AI blog | VARONIS |
|
8.10.26 |
Least Privilege for AI Agents: A Practical Guide for Security Leaders | Learn what it means to enforce least privilege for AI agents, and get practical with a six-step implementation plan. | AI blog | VARONIS |
|
8.10.26 |
Rogue AI Agents Abuse urlquery to extract Russian government data | We found additional activity and sandbox circumvention techniques used by rogue AI agent swarms. These include attempting to extract Russian government data, hijacking remote browser services and running Javascript in attempts to extend their capabilities, circumvent networking and sandbox restrictions, and complete their tasks. | AI blog | Zenity Labs |
|
8.10.26 |
How AI Agents Turned One Exposed Endpoint into a Server Takeover Threat Spotlight | ReliaQuest investigated an incident in which, for the first time, we identified an open-source AI agent orchestration platform running on the same IP address that launched the attack. We assess with high confidence that AI agents driven by large language models (LLMs) carried out substantial portions of it. | AI blog | RELIAQUEST |
|
8.10.26 |
5 SOC Pain Points Putting US Security Teams Under Pressure | US SOC teams are under pressure to detect and contain threats faster, but the real challenge is often not a lack of security solutions. It’s the growing amount of alerts, fragmented investigation data, evasive attack techniques, and the time analysts spend connecting the dots. | Security blog | ANYRUN BLOG |
|
8.10.26 |
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs | In September, Huntress observed a phishing campaign where threat actors abused legitimate Power BI domains to make their attack more convincing and evade security controls that trust the service. | Phishing blog | Huntress |
|
8.10.26 |
Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure Beyond the Published IOCs | On 31 August 2026 Group-IB described BraZetsu, a Python framework for Windows compiled with Nuitka, and attributed it with high confidence to the Brazilian actor Exilware. The same paper ties the binary to the Infected Marketplace (Banco de Infects), a shop that inventories compromised Windows hosts and sells the access after a deposit of about $5.80 (BRL 30), settled through NowPayments. | Malware blog | HUNT.IO |
|
8.10.26 |
Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia | Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself. | Phishing | The Hacker News |
|
8.10.26 |
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases | Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency | Cryptocurrency | The Hacker News |
|
8.10.26 |
U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks | The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft | BigBrothers | The Hacker News |
|
8.10.26 |
MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data | The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors | Ransom | The Hacker News |
|
8.10.26 |
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm | The npm package known as " tensorlake ," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud | Virus | The Hacker News |
|
8.10.26 |
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains | Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, | Hack | The Hacker News |
|
8.10.26 |
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer | Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and | Virus | The Hacker News |
|
8.10.26 |
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances | SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network | Vulnerebility | The Hacker News |
|
8.10.26 |
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely | A critical vulnerability in LMCache , open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run | AI | The Hacker News |
|
8.10.26 |
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet | Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and | AI | The Hacker News |
|
7.10.26 |
Denmark population registry data breach affects 8.8 million people | Denmark's Central Population Register (CPR) is warning of a data breach that exposed the personal information of approximately 8.8 million registered individuals. | Incindent | BleepingComputer |
|
7.10.26 |
New Dell System Update flaw lets hackers gain root privileges | Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. | Vulnerebility | BleepingComputer |
|
7.10.26 |
New Dell System Update flaw lets hackers gain root privileges | Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. | Vulnerebility | BleepingComputer |
|
7.10.26 |
South Korea probes bank breaches amid suspected AI-powered attacks | South Korea's Financial Services Commission (FSC) held an emergency meeting following a series of cyberattacks targeting financial institutions in the country. | AI | BleepingComputer |
|
7.10.26 |
tenfold CE: Our free Identity Governance tool just got 2 new features | tenfold has added shared content governance and real-time event auditing to its free Community Edition for organizations with under 150 users. The new features help teams manage Microsoft 365 sharing and investigate suspicious identity activity. | Security | BleepingComputer |
|
7.10.26 |
Alleged dev of Ploutus ATM malware appears in US court after arrest | The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States. | Virus | BleepingComputer |
|
7.10.26 |
OpenAI will show visual ads in ChatGPT while you generate images | OpenAI is expanding ads in ChatGPT, and one of the first new formats will show visual ads while you're generating images. | AI | BleepingComputer |
|
7.10.26 |
Microsoft: Windows KB5124010 update crashes some games and apps | Microsoft confirmed over the weekend that some games and applications using AC-3 (Dolby Digital) audio decoding will crash after installing the September 2026 KB5124010 Windows 11 preview update. | OS | BleepingComputer |
|
7.10.26 |
Google halts open-source bug bounty program amid AI spam surge | Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. | AI | BleepingComputer |
|
7.10.26 |
Citrix patches NetScaler SAML zero-day exploited in attacks | Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. | Vulnerebility | BleepingComputer |
|
7.10.26 |
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials | The U.S. Federal Bureau of Investigation (FBI) and Secret Service (USSS) on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways. | Vulnerebility | The Hacker News |
|
7.10.26 |
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details | Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to | Exploit | The Hacker News |
|
7.10.26 |
Identity-aware AI data agents with AWS Lake Formation and Trusted Identity Propagation | You’re building a data agent that lets business users ask questions about lakehouse data in natural language. You’ve already built governance policies that control who can access which datasets. The challenge is making the agent respect those rules without rebuilding them in your application code. | AI blog | AWS Security Blog |
|
7.10.26 |
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure | SOCRadar’s Threat Research Unit (STRU) has documented CyberXero, a Russian-speaking, financially motivated Initial Access Broker that pairs commodity offensive tooling with an AI orchestration layer running on its own infrastructure. | AI blog | SOCRADAR |
|
7.10.26 |
Investigate Threats Faster | Your SOC runs on Elastic. Detections, logs, cases and dashboards all live in Kibana, and your analysts have built their muscle memory around it. Then an impersonating domain, a leaked credential or a newly exposed asset shows up in a different console, and the investigation starts with a copy-paste. | Hacking blog | SOCRADAR |
|
7.10.26 |
How to mitigate shadow AI risks from employee citizen coders | AI tools let non-technical employees build workplace apps in minutes with natural language prompts. While these AI-generated apps boost productivity, they can create severe security and data risks. As Cybersecurity Awareness Month kicks off, we’re sharing how Tenable adopted a structured governance framework that allows our “citizen coders” to build secure and compliant apps with AI. | AI blog | Tenable® |
|
7.10.26 |
Claude Mythos: When Zero-Day Vulnerabilities Outpace Defenses | Advances in AI are reshaping the cybersecurity landscape in a fundamental way. Modern AI systems are no longer limited to detecting known threats. They are increasingly capable of uncovering previously unknown vulnerabilities buried deep within complex software and systems, including Zero Day vulnerabilities that can be found at lightning speed. | AI blog | FORESCOUT |
|
7.10.26 |
CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery | ClickFix campaigns have become one of the most effective ways to turn a browser session into code execution. The technique is simple: show the victim a fake verification page, place a command on the clipboard, and convince them to paste it into the Windows Run dialog. | Malware blog | Flare |
|
7.10.26 |
IronChain Ransomware Raises Business Data Loss Risk | During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of how a cyber incident can become a business continuity issue. IronChain shows why. It puts business-critical data at risk of permanent loss and can bring operations to a halt. | Ransom blog | ANYRUN BLOG |
|
7.10.26 |
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | In September, the Huntress agent was deployed on an organization that had been hit by an Akira ransomware attack. The post-compromise agent deployment limited Huntress visibility into critical pieces of evidence. | Ransom blog | Huntress |
|
7.10.26 |
Super Intelligence: The Rise of Super-Intelligent Threats | On September 29, 2026, the White House signed an executive order replacing the term "Artificial Intelligence" with "Super Intelligence" across the U.S. executive branch. The stated reasoning is that "Super Intelligence" better conveys "the true capabilities of the technologies being developed today", not merely imitating or automating human intelligence, but empowering citizens “to achieve what was previously impossible.” | AI blog | SEKOIA |
|
7.10.26 |
CVE-2026-88771: Citrix NetScaler Zero-Day Attack Clusters | As early as the beginning of September 2026, eSentire's Threat Response Unit (TRU) observed multiple threat actor clusters exploiting CVE-2026-88771, a zero-day vulnerability later disclosed in Citrix's September 27, 2026 security bulletin CTX697096. | Vulnerebility blog | eSentire |
|
7.10.26 |
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws | Anthropic on Tuesday said it's expanding a program that allows vetted cybersecurity professionals to test its advanced artificial intelligence (AI) models with reduced safeguards and blocking classifiers, as the company claimed its Project Glasswing initiative uncovered at least 129,000 verified software vulnerabilities between April and July 2026. | AI | The Hacker News |
|
7.10.26 |
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer | The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected | Virus | The Hacker News |
|
7.10.26 |
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes | Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial | AI | The Hacker News |
|
7.10.26 |
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan | Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and | Virus | The Hacker News |
|
7.10.26 |
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings | A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before | Vulnerebility | The Hacker News |
|
7.10.26 |
Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies | The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including | AI | The Hacker News |
|
7.10.26 |
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports | Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect | Vulnerebility | The Hacker News |
|
6.10.26 |
47-Day TLS Certificates: 5 Steps to Prepare | Somewhere in your organization is a spreadsheet of certificate expiry dates, and someone who owns it. That is not a caricature. DigiCert’s 2026 research with Omdia surveyed more than 400 senior IT leaders and found that 47% still rely on manual tracking methods such as spreadsheets, and only 34% have a complete, current view of what they hold. | Security blog | Imperva |
|
6.10.26 |
Harvest Now, Decrypt Later: End-to-End PQC TLS | Somewhere, an attacker is recording your encrypted traffic. Not breaking it. Recording it. The bet is patient and simple: store ciphertext today, wait for quantum computers to mature, decrypt at leisure. The industry calls it harvest now, decrypt later (HNDL), and it is the rare security threat with a believable deadline attached: data with a ten-year shelf life, encrypted with algorithms on a countdown. | Security blog | Imperva |
|
6.10.26 |
New Remote DoS Attacks Against GraphQL Java | Imperva Threat Research identified a series of remote denial‑of‑service vulnerabilities in GraphQL Java, one of the most widely used libraries for GraphQL in the Java ecosystem. | Attack blog | Imperva |
|
6.10.26 |
The Hidden DoS Vector in SQL Parsers | SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. | Attack blog | Imperva |
|
6.10.26 |
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage | This article explains how Elastic SIEM uses a monthly automated telemetry pipeline to score prebuilt detection rules across noise, performance, threat, and profile dimensions, helping security teams decide which rules to enable first. | Spam blog | Elastic Security Labs |
|
6.10.26 |
Machine-speed attacks require machine-speed prevention and detection | Artificial intelligence (AI) is transforming the way cyberattacks are handled. Reconnaissance has become faster, phishing is more convincing, and vulnerabilities are identified and exploited sooner, and after initial access, automation can accelerate privilege escalation, lateral movement, and data theft. | Hacking blog | Threatlocker |
|
6.10.26 |
IQUALIF Leak, IUT Breach, SMTP Dump and Struts Exploit | SOCRadar Dark Web Team identified several new underground posts, including an alleged IQUALIF-based French residential data leak, an alleged breach affecting IUT Paris Seine, and an alleged initial access auction for a U.S. manufacturing company. Other posts advertised an alleged 19 million SMTP credential dump and access to servers reportedly compromised through CVE-2017-5638. | Exploit blog | SOCRADAR |
|
6.10.26 |
FortiMail Zero-Day Under Active Exploitation | Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live. | Exploit blog | SOCRADAR |
|
6.10.26 |
CVE-2026-90970: GitLab AI Gateway RCE | GitLab has patched CVE-2026-90970, a critical vulnerability in the Self-Hosted AI Gateway that can allow an authenticated user with Duo Agent Platform access to execute arbitrary commands on the gateway. | Vulnerebility blog | SOCRADAR |
|
6.10.26 |
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure | How ClingSTUN combines vulnerability exploitation, persistence, and STUN-assisted connectivity on Linux devices | Malware blog | FortiGuard Labs |
|
6.10.26 |
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products | A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files | Vulnerebility | The Hacker News |
|
6.10.26 |
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach | The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the | BigBrothers | The Hacker News |
|
6.10.26 |
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account | Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and | Incindent | The Hacker News |
|
6.10.26 |
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits | A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. | Hack | The Hacker News |
|
6.10.26 |
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes | Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as | Vulnerebility | The Hacker News |
|
5.10.26 |
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2 | Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling . " | Exploit | The Hacker News |
|
5.10.26 |
Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access | Apple has announced that it's taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed | OS | The Hacker News |
|
5.10.26 |
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE | A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The | Vulnerebility | The Hacker News |
|
5.10.26 |
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline | Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as | Exploit | The Hacker News |
|
5.10.26 |
Anthropic asks Claude users to share voice data for AI model training | Anthropic has started asking Claude users to voluntarily share their voice conversations to help train and improve its AI models. | AI | BleepingComputer |
|
5.10.26 |
Google Gemini could soon get full access to your Mac’s files, apps and the web | Google's Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time. | AI | BleepingComputer |
|
5.10.26 |
ShinyHunters hacker reportedly detained in Jordan, aiding FBI | A suspected ShinyHunters hacking group member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. | CyberCrime | BleepingComputer |
|
5.10.26 |
Danish university DTU breach exposes data of up to 200,000 people | The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. | Incindent | BleepingComputer |
|
5.10.26 |
Frontline Education breach exposes school district employee data | Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. | Incindent | BleepingComputer |
|
5.10.26 |
Warlock ransomware breach SharePoint in water, telecom operator attacks | The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. | Ransom | BleepingComputer |
|
5.10.26 |
GitLab warns of critical RCE vulnerability in AI Gateway service | GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. | Vulnerebility | BleepingComputer |
|
5.10.26 |
US sanctions Tren de Aragua gang members in ATM hacks crackdown | The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. | CyberCrime | BleepingComputer |
|
5.10.26 |
The EDR blind spot: 3 ways browser attacks evade endpoint telemetry | Browser-based attacks can steal sessions, abuse extensions, or manipulate users without creating the endpoint artifacts EDR is designed to detect. NordLayer explains three ways attacks can evade endpoint telemetry and why browser-level controls can help close the gap. | Security | BleepingComputer |
|
5.10.26 |
Dell asks admins to patch max severity CSM flaws as soon as possible | Dell has patched two maximum severity vulnerabilities in the Container Storage Modules (CSM) that connect Dell enterprise storage arrays to Kubernetes environments. | Vulnerebility | BleepingComputer |
|
5.10.26 |
Microsoft’s X account hacked in crypto pump-and-dump scheme | On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. | Social | BleepingComputer |
|
4.10.26 |
Fortinet warns of critical FortiMail flaw exploited in zero-day attacks | Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. | Exploit | BleepingComputer |
|
4.10.26 |
Autonomous AI agents tried to hack US, Canadian government websites | Autonomous AI agents using aggressive strategies attempted to hack U.S. and Canadian government websites to find school and divorce statistics. | AI | BleepingComputer |
|
4.10.26 |
Microsoft says threat actors are ahead in the early AI race | Microsoft says cyberattackers are currently benefiting from artificial intelligence faster than defenders, allowing threat actors to speed up vulnerability discovery, malware development, and post-compromise activity while security teams struggle to keep pace. | AI | BleepingComputer |
|
4.10.26 |
Police dismantle KillSec ransomware gang allegedly led by 16-year-old | An international law enforcement operation dubbed "Operation KillSwitch" seized the KillSec ransomware gang's data leak site and servers, led to three arrests, and identified a 16-year-old as the group's alleged administrator. | Ransom | BleepingComputer |
|
4.10.26 |
The Day-One Hole in Zero Trust Architecture | Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued. | Security | BleepingComputer |
|
4.10.26 |
Kiteworks patches max severity code injection vulnerability | Secure file-sharing software company Kiteworks has released security updates to address 126 vulnerabilities, including a max-severity flaw affecting its Email Protection Gateway (EPG) security solution. | Vulnerebility | BleepingComputer |
|
4.10.26 |
Microsoft enables Windows settings backup by default for orgs | Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2. | OS | BleepingComputer |
|
4.10.26 |
Hackers stole Pentagon personnel records of over 3 million people | The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. | Incindent | BleepingComputer |
|
4.10.26 |
Metamask discloses security incident affecting its infrastructure | On Thursday, cryptocurrency wallet provider MetaMask has disclosed an ongoing infrastructure security incident affecting some of its infrastructure. | Cryptocurrency | BleepingComputer |
|
4.10.26 |
Russian state hackers use new RedFlick technique to push malware | The Russian state actor Star Blizzard has been using a new malware installation tactic dubbed "RedFlick" to deploy its signature CosmicPulse backdoor. | APT | BleepingComputer |
|
4.10.26 |
DIVD says Zammad zero-days enabled AI-driven network breach | The Dutch Institute for Vulnerability Disclosure (DIVD) says that the breach of its network was possible by exploiting a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system. | AI | BleepingComputer |
|
4.10.26 |
Over 543,000 valid credentials exposed in public GitHub repositories | More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platform's security measures to prevent accidental leaks of sensitive data. | Incindent | BleepingComputer |
|
4.10.26 |
CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition. | Vulnerebility | BleepingComputer |
|
4.10.26 |
Cisco warns of new SD-WAN zero-day exploited in attacks | Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. | Exploit | BleepingComputer |
|
4.10.26 |
AI's Third Wave: Coworkers Break the Security Model That Worked for Agents | Persistent AI coworkers may operate continuously with standing access, creating identity risks that existing security models were not designed to handle. Token Security explains why these agents need their own identities, owners, scoped permissions, and lifecycle controls. | AI | BleepingComputer |
|
4.10.26 |
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members | A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported , citing three people familiar with the matter. | CyberCrime | The Hacker News |
|
4.10.26 |
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing | A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial | APT | The Hacker News |
|
4.10.26 |
Microsoft to block Entra ID script injection attacks starting October | Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. | Hack | BleepingComputer |
|
4.10.26 |
TeamViewer urges users to patch severe flaws “as soon as possible” | Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software. | Vulnerebility | BleepingComputer |
|
4.10.26 |
Bitget hacked via zero-day in third-party security products | Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products. | Exploit | BleepingComputer |
|
4.10.26 |
Microsoft is rolling out Linux container support to WSL | Microsoft is taking Windows Subsystem for Linux beyond just running Linux distributions, as WSL Containers is now generally available. | OS | BleepingComputer |
|
4.10.26 |
Signal adds encypted local backup support to iOS, desktop apps | Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows). | Social | BleepingComputer |
|
4.10.26 |
Custom ChatGPTs push ClickFix attacks to deploy RAT malware | Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. | AI | BleepingComputer |
|
4.10.26 |
FBI tells ShinyHunters members to turn themselves in after recent arrest | The FBI is warning members of the ShinyHunters extortion group to turn themselves in after Dutch police arrested a man the bureau described as one of the group's alleged leaders. | BigBrothers | BleepingComputer |
|
4.10.26 |
Hackers exploit Citrix NetScaler zero-day to deploy web shells | Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. | Exploit | BleepingComputer |
|
4.10.26 |
Former US Air Force members sent to prison over BEC attacks | Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. | Spam | BleepingComputer |
|
4.10.26 |
Windows 11 2026 Update released, here's everything you need to know | Microsoft has started rolling out Windows 11 26H2 to everyone, and while it's this year's big annual feature update, you probably won't notice a massive difference after installing it. | OS | BleepingComputer |
|
4.10.26 |
New Spectre v2 attack variant leaks Linux root password hash in minutes | A new Branch Target Reuse (BTR) attack has been devised that can recover root password hashes on Intel computers running Linux in 3-5 minutes on average. | Attack | BleepingComputer |
|
4.10.26 |
Automated AI agent used to breach cybersecurity nonprofit DIVD | The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as "loud and very, very messy." | AI | BleepingComputer |
|
4.10.26 |
Catch threats before they escalate with real-time Identity Telemetry | Identity governance helps control who should have access, but periodic reviews alone may not reveal attacks as they happen. tenfold Software explains how real-time identity telemetry can help security teams investigate suspicious activity before it escalates. | Security | BleepingComputer |
|
4.10.26 |
Vietnamese man charged in $16 million 'pig butchering' crypto scam | A Vietnamese national was charged with money laundering for his role in a massive "pig butchering" scam, which defrauded a victim out of $16 million worth of cryptocurrency. | Cryptocurrency | BleepingComputer |
|
4.10.26 |
Kiteworks patches critical flaw, brings customer systems online | American tech company Kiteworks has lifted a precautionary advisory asking customers to shut down systems after patching a critical vulnerability. | Vulnerebility | BleepingComputer |
|
3.10.26 |
MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics | The U.K.'s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering | BigBrothers | The Hacker News |
|
3.10.26 |
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware | The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both | Ransom | The Hacker News |
|
3.10.26 |
Apple patches CoreGraphics zero-day flaw exploited in attacks | Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. | Vulnerebility | BleepingComputer |
|
3.10.26 |
Japan's Keio confirms ransomware attack disrupted business systems | Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. | Incindent | BleepingComputer |
|
3.10.26 |
Times Car confirms data breach affecting 6.6 million user accounts | Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. | Incindent | BleepingComputer |
|
3.10.26 |
Dutch police confirm arrest in ShinyHunters hacking investigation | Dutch police have confirmed that a 24-year-old Amsterdam man arrested earlier this month was detained as part of an investigation into the ShinyHunters hacking group. | CyberCrime | BleepingComputer |
|
3.10.26 |
Over 16,000 Supabase databases expose PII, passwords, auth tokens | Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens. | Hack | BleepingComputer |
|
3.10.26 |
JadePuffer agentic AI attacks target Azure, destroy cloud resources | The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. | AI | BleepingComputer |
|
3.10.26 |
80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking | Infostealer logs exposed AI account credentials and sessions tied to more than 80,000 corporate domains, creating risks ranging from stolen conversations to LLMjacking. SOCRadar examines the growing market for stolen AI logins and how organizations can identify their exposure. | AI | BleepingComputer |
|
3.10.26 |
Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist | Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals suspended after suspected North Korean hackers breached its systems last week and stole over $350 million. | Cryptocurrency | BleepingComputer |
|
3.10.26 |
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers | A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain | Vulnerebility | The Hacker News |
|
3.10.26 |
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign | Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The | APT | The Hacker News |
|
3.10.26 |
AI-Enabled Cyber Attacks: What They Are and How to Defend Against Them | AI-enabled cyber attacks are malicious operations in which adversaries use AI, most often large language models (LLMs), to plan, carry out, or scale any part of an attack. That includes writing phishing lures and deepfake pretexts, developing and debugging malware, discovering and exploiting vulnerabilities, and running intrusions end to end. | AI blog | PICUSSECURITY |
|
3.10.26 |
CrowdSec Bot Detection Uncovers a 75,000-IP Bot Network | On the 31st of August, we released CrowdSec 1.8.0 that included the bot detection feature. Despite the fact that the feature was (is) still tagged as alpha, some mad lads promptly slapped it on their production infrastructure. Thanks for the trust! | BotNet blog | CROWDSEC |
|
3.10.26 |
AI-Agentic attacks Optimized Operations | AI is changing cyberattacks from isolated activities into connected operations that require a new level of speed, context, and understanding. | AI blog | WatchGuard Blog |
|
3.10.26 |
PolinRider is A/B Testing its Way Past Your Detections | We've seen fa-solid-400.woff2 become 500 and 900, change from .woff2 to .llf files, move folders, and drop its whitespace padding. | Malware blog | OpenSource Malware Blog |
|
3.10.26 |
Prompt Forcing: The Scarier Sibling of Prompt Injection | Breaking down a newly discovered prompt attack technique that isn't prompt injection. | AI blog | Forever Security |
|
3.10.26 |
Introducing the SysQL Skill: Ask your security graph anything | Dashboards answer the questions someone already decided to build a screen for. Every other question — the one a new CVE just made urgent, or the one no vendor anticipated — waits until someone writes a report or files a ticket. | Vulnerebility blog | Sysdig |
|
3.10.26 |
Swarming Against Citrix 0-Day Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | Exploit blog | GREYNOISE |
|
3.10.26 |
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF | GreyNoise observes adversary activity through our Global Observation Grid (GOG), a network of sensors that draws attacker scanning and exploitation onto infrastructure we control. This lets us study adversary infrastructure, tooling, and tradecraft directly, without waiting for a victim investigation. | AI blog | GREYNOISE |
|
3.10.26 |
Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets | GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. These forged automated scanners have been observed requesting files often exposed on misconfigured web servers and by other commonly leaked secret and credential methods. | AI blog | GREYNOISE |
|
3.10.26 |
Separating Signal from Slop: Triaging CVEs in the Age of… | Tools that can read a codebase, identify a vulnerability, and generate a working proof-of-concept have lowered the skill floor for vulnerability research. They also produce a wave of bugs that look terrifying on paper (remote code execution, popular software, no authentication,) yet they often depend on a configuration rarely enabled in real deployments. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
One Port to Root: Weaponizing Check Point Management… | The Check Point management server is the brain of a Check Point firewall estate: it holds the policy every gateway enforces, the administrator credentials, and the certificate authority the whole deployment trusts. A flaw already used in real attacks lets anyone who can reach that server take it over completely without logging in. | Vulnerebility blog | Bishop Fox |
|
3.10.26 |
AI-Assisted Attacks Still Leave a Behavioral Trace | AI is increasingly being used to accelerate cyber-attacks, but attackers still leave detectable behavioral traces. This blog explores how Darktrace identified suspicious file delivery, command-and-control communications, beaconing activity, and other anomalies linked to AI-assisted campaigns through behavioral analysis. | AI blog | DARKTRACE |
|
3.10.26 |
DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm - Real-time Open Source Software Supply Chain Security | Nine npm packages hide a self-spreading Linux worm. The npm account dirtyblanket published all nine on September 29, 2026, in 33 minutes. Eight of them copy the popular Express framework. One copies React. | Malware blog | SAFEDEP.IO |
|
3.10.26 |
PolinRider Switches to Ethereum C2 in 30+ Repositories - Real-time Open Source Software Supply Chain Security | The PolinRider loader family has a new way to find its command and control (C2) servers. It reads Ethereum mainnet and looks for small transactions from an operator wallet. The recipient address of each transaction holds the IP address of a C2 server. SafeDep found two operator wallets that use this method. One wallet has sent a transaction about every 51 minutes since 2026-06-23. | Cryptocurrency blog | NETCRAFT |
|
3.10.26 |
'Super Intelligence' Executive Order Fuels Nearly Hundredfold Increase in .si Domain Registrations | We previously reported that registrations of Slovenian .si domains overtook .ai in the 25 hours after President Trump told the UN General Assembly on September 22 that the U.S. would call AI “super intelligence” (SI). | AI blog | NETCRAFT |
|
3.10.26 |
FinCEN Moves to Cut the A7 Network's Sub-Agents Off From the US Financial System | FinCEN issued a finding and NPRM today identifying transactions involving any non-US company controlled by the A7 Network, which the agency calls "Sub-Agents," as a class of transactions of primary money laundering concern. The proposed rule would prohibit every covered US financial institution from sending or receiving funds or crypto involving a Sub-Agent. | AI blog | TRM Labs |
|
3.10.26 |
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail | In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. | OS Blog | IDNSEC |
|
3.10.26 |
CVE-2026-86950: The Great Glyph Grift | Apple recently released iOS 26.7.1 to fix a bug in CoreGraphics (CVE-2026-86950). The security advisory stated that the vulnerability was reported by Meta Product Security and "may have been exploited in an extremely sophisticated attack against specific targeted individuals." For those who are unfamiliar with Apple’s English dialect, it means that the bug was actually exploited in the wild. | Vulnerebility blog | Calif |
|
3.10.26 |
Crypto Scam Extensions Masquerade as High-Profile Investors | LayerX security researchers (now part of Akamai) uncovered a campaign of nearly 30 malicious browser extensions designed to scam cryptocurrency investors by masquerading as legitimate, high-profile financial and/or cryptocurrency investors such as Warren Buffett, Andy Kreiger, Thomas Bulkowski, and others. | Spam blog | Akamai |
|
3.10.26 |
When Productivity Extensions Become Attack Platforms | LayerX Research (now part of Akamai) discovered a coordinated campaign of 32 malicious browser extensions across the Chrome Web Store and Microsoft Edge Add-ons Store, affecting more than 6,150 users. | Security blog | Akamai |
|
3.10.26 |
Beyond Vendor Assessments: Managing Third-Party Risk | Software supply chain security has a well-defined starting line. It has no finish line, even though most programs are built as if it does. | Cyber blog | JSCRAMBLE |
|
3.10.26 |
Aligning AI Speed with AI Trust: AI Agent Security Insights for CISOs and Security Leaders | AI agent security is the practice of governing two separate things: what an autonomous AI system is allowed to reach, and what it is allowed to do. Most enterprises have built a program for the first one. Almost nobody has built one for the second, and that's where the losses are starting to show up. | AI blog | Morphisec Blog |
|
3.10.26 |
From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHat | RATHat's Android malware remained largely static from late 2025 to September 2026, while its Command-and-Control (C2) panel was replaced entirely and went through three generations in six months, rebranded from BlackCat to Panda Workshop. | Malware blog | Cleafy |
|
3.10.26 |
TIKTOUK: Tracing a WordPress Credential Collection Toolkit | TIKTOUK brings together WordPress probing, collection of exposed configuration data, recovery of encrypted email credentials, and JavaScript secret scanning. Its two Python components and Go-based Linux crawler turn website responses into structured results for a central hub: an HTTP service that distributes target tasks and receives collected data and status reports. | Hacking blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators | CVE-2026-88771 is a critical pre-authentication command-injection vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. Citrix and security researchers have already documented the vulnerability and its underlying exploitation mechanism. This analysis focuses instead on exploitation activity identified by LevelBlue's Threat Hunt Operations & Research (THOR) team while hunting across multiple customer environments. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Citrix NetScaler Zero-Day Exploited Globally | On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the Known Exploited Vulnerabilities (KEV) list. | Vulnerebility blog | LEVELBLUE |
|
3.10.26 |
Hackers exploit FortiMail zero-day before a patch exists | Fortinet says attackers are already exploiting a critical flaw in FortiMail, its email security gateway, and the fixed software has not shipped yet. The bug, tracked as CVE-2026-104286 and rated 9.8 on CVSS v3, lets an attacker with no login write arbitrary files to the appliance using crafted HTTP or HTTPS requests. Fortinet rates its impact as executing unauthorized code or commands. | Vulnerebility blog | IntelFusions |
|
3.10.26 |
Introducing Cloudflare Basin: an open, serverless data platform, now generally available | During Birthday Week 2025, we announced the Cloudflare Data Platform, a suite of products that ingest, store, and query your analytical data. Today, we’re announcing that the platform is generally available, and we’re giving it a new name: Cloudflare Basin. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Introducing Clef: our open-source decision models, and new RL fine-tuning platform | Over the last few weeks, there has been lots of buzz around decision models such as Typesafe AI’s Jev System One model. While classifier models have been around for some time, Jev introduces a new decision model concept into the world of AI — a model that produces bounded structured outputs cheaply, quickly and consistently that can be added into a workflow when a decision is required. | AI blog | CLOUDFLARE |
|
3.10.26 |
One year later: Sovereign AI and the fight for choice | It's Birthday Week, when we traditionally ship presents to the Internet. This year, two of them come from Europe: EuroLLM, which covers all 24 official EU languages, and Apertus, Switzerland's fully open model, trained on more than 1,500 languages. Both were built by public universities and research institutions. Both are coming to Workers AI, and you can request access today. | AI blog | CLOUDFLARE |
|
3.10.26 |
Introducing Workers KV Instant — powered by Quicksilver | Today, we’re introducing Workers KV Instant, a new mode for Workers KV that pushes your changes globally for instant availability without cold read penalties. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cloudflare OS: your company’s agent workspace, managed for you | Cloudflare OS gives everyone in your organization an agent workspace that knows how your company works and connects to its data and systems. Today, we're opening the waitlist for fully managed Cloudflare OS deployments. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Announcing Cloudflare K2: serverless event streams | With traditional Remote Procedure Call (RPC) architectures, there exists a core challenge: producers and consumers must align in scale and in time. If your producers send too much data for your consumers to handle or if your consumers or downstream services become unavailable, events are dropped. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
We want you to build the next Git platform on Cloudflare | GitHub was built for a world where humans write code, organize it into repositories, and collaborate through branches, commits, issues, and pull requests. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
AI Search is now generally available | Cloudflare’s AI Search combines Workers AI, Vectorize, R2, and Browser Run into a fully managed index and retrieval pipeline. Since we launched AI Search over a year ago, we’ve seen developers use it to power a wide range of search use cases, from searching internal documentation to powering search for their websites. We use AI Search ourselves to power search on our own blog and developer docs. | AI blog | CLOUDFLARE |
|
3.10.26 |
Support for modern cryptographic algorithms in Workers | Today, Cloudflare Workers is adding support for post-quantum-resistant algorithms within Web Crypto. These are defined in Modern Algorithms in the Web Cryptography API draft community group report, and include: | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cloudflare Impact reaches $100 million in donations | This week, Cloudflare's Impact programs will reach $100 million in donated services. It's a significant milestone, and one that we are proud of because it means that thousands of organizations, like journalism outlets, civil society, state and local governments, election management bodies, and public schools are being protected from cyberattacks. | Cyber blog | CLOUDFLARE |
|
3.10.26 |
Cut your AI spend with AI Gateway's Auto Router | From our conversations with companies at every stage of their AI adoption journey, we've seen some common patterns. First, there is an exploration period as you bring on every new tool, dole out API keys freely, and let the tokens flow. Then, you converge on the canonical tools for your organization for agentic coding, for non-technical workflows, for running and deploying agents. | AI blog | CLOUDFLARE |
|
3.10.26 |
Detect and send production issues straight to your agent | As agents help us build more complex applications, both humans and agents need a better way to stay on top of what goes wrong in production. Coding agents can already query observability data, navigate a repository, change code, write tests, and open a pull request. | AI blog | CLOUDFLARE |
|
3.10.26 |
Simplifying domains for people and agents | You just thought of your next great idea, and buying the right domain feels like the easiest way to make that first bit of progress. Naturally, you open a new tab in your browser, only to find yourself face-to-face with an experience that feels like a budget airline peppering you with add-ons at checkout: Want security? How about a website? Do you want email? You’re just a few minutes into building your next idea, and it doesn’t feel fun anymore. | AI blog | CLOUDFLARE |
|
3.10.26 |
Monetization Gateway beta: charge AI agents for consumption with HTTP 402 | Today, we’re making the Cloudflare Monetization Gateway available as part of a closed beta, and showcasing four customer use cases that are in production today. Since we announced the plan three months ago, we have been working closely with our customers to make the Gateway fast, flexible, and easy to use. | AI blog | CLOUDFLARE |
|
3.10.26 |
Pay Per Use: when AI uses your work, you should get paid | AI answer engines read a publisher’s page and hand the reader a summary, so the visit, and the revenue that would come with it, never happens. Most publishers will never sign a licensing deal with the companies that use their work in AI products, and no company can negotiate with millions of sites. The web needs a way to say “yes, if you pay.” Pay Per Use is one way to say it, and it's now in beta. | AI blog | CLOUDFLARE |
|
3.10.26 |
Spetsvuzavtomatika Leak Exposes an SVR Cyber Development Ecosystem | The Spetsvuzavtomatika leak found on the darknet exposes a broad Russian cyber research and development program, with seven named projects defining its work. Two of the projects, Felix-23 and HAD, focus on target discovery, scanning, enrichment, and active testing. Another project, Putnik, supports internal-network access and credential theft. | CyberCrime blog | DomainTools Investigations |
|
3.10.26 |
AI Security Strategy: 6 Steps for CISOs | Security teams are used to vetting technology before it arrives. With AI, it was already everywhere before anyone asked them. | AI blog | Abnormal AI |
|
3.10.26 |
Signatures Are the Floor, Not the Ceiling | See why signature-based detection struggles against AI-generated attacks and how behavioral AI uses embeddings to detect novel threats without relying on known indicators. | AI blog | Abnormal AI |
|
3.10.26 |
How Behavioral AI Detects Threats That Look Normal | Attackers are no longer breaking in but blending in, mimicking normal behavior to breach organizations. A founding Abnormal AI engineer explains why we bet on behavioral AI to stop attackers walking through the front door. | AI blog | Abnormal AI |
|
3.10.26 |
XCTDH Adopts Hash Hiding | A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically encoded in Ethereum transaction destination addresses. | Cryptocurrency blog | Ransom-ISAC |
|
3.10.26 |
September 2026 Security Release | An attacker-controlled, allow-listed remote URL can lead to Server-Side Request Forgery (for example to private IP ranges) during Image Optimization. If no images.remotePatterns are configured, your application is not affected. | Security blog | Next.js |
|
3.10.26 |
Beyond Model Alignment: Securing Every Layer of the AI Agent | Alignment makes a model well-intentioned, but it can’t secure the harness, tools, and data an agent touches in production. Real agent security means governing every layer with enforcement the agent itself can’t switch off. | AI blog | Trend Micro |
|
3.10.26 |
ShinyHunters Returns to PeopleSoft With a One-Character WAF Bypass | ShinyHunters is once again exploiting a previously patched vulnerability in PeopleSoft, which we analyzed in June 2026. | Incident blog | Trend Micro |
|
3.10.26 |
Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes | Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise. | Malware blog | StepSecurity |
|
3.10.26 |
Managing Agentic AI: Why the Control Plane Problem Is an AI Problem | On one hand, it’s somewhat befuddling how often people may need that reminder. In reality, it is not that they don’t know that happy mantra, it’s that they struggle to gain the requisite visibility into … everything in their IT and OT environments. | AI blog | GUIDESECURITY |
|
3.10.26 |
Cloud Security Assessments: Set the Right Cadence | While cloud practitioners are accustomed to their fast-moving environments, it’s still common practice to move on to the next priority after the cloud assessment report is delivered and the major findings get remediated. | Cyber blog | GUIDESECURITY |
|
3.10.26 |
New Report from Rapid7 Labs: Why Q2 2026 signals the end of traditional patch cycles | The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs. | Cyber blog | RAPID7 |
|
3.10.26 |
Why One-Time Approval Fails for AI Agent Skills | A review answers one question, once: is this skill, MCP server or plugin allowed in? It never asks again, whether it took six weeks in a ticket queue or six minutes in a governance tool. | AI blog | Manifold |
|
3.10.26 |
Spanish Carding Tutorial: How Fraudsters Think | A 2,200-word tutorial titled “Complete Guide to Carding in Spain (2026)” appeared on the Carder Market forum in April 2026. It is exactly what it sounds like: a beginner’s playbook for credit card fraud targeting the Spanish market, complete with entry fees, expected returns, and step-by-step operational workflows (we are holding back specific names and techniques to execute attacks to prevent these from falling into those with malicious intentions). | CyberCrime blog | FLARE.IO |
|
3.10.26 |
Revenge of the SD-WAN: Exploring and Exploiting Yet Another Critical Cisco SD-WAN Vulnerability (CVE-2026-76504) | On Wednesday, September 30, Cisco dropped an out-of-band security advisory highlighting CVE-2026-76504, a brand new critical authentication bypass in the SD-WAN vManage line of products that was disclosed as an exploited zero-day vulnerability. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
JCTables for Joomla: When "Already Escaped" Means Injectable | Today VulnCheck is disclosing CVE-2026-76570, an unauthenticated arbitrary SQL read and write in JCTables, the Joomla data-table component published by JoomCode, that chains to remote code execution as the web user. It is being disclosed in accordance with VulnCheck's coordinated vulnerability disclosure policy. | Vulnerebility blog | VULNCHECK |
|
3.10.26 |
CVE-2026-86950: Apple CoreGraphics Zero-Day | Apple has issued an urgent security patch for CVE-2026-86950, a critical zero-day out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution via malicious files. Exploited in targeted, highly sophisticated attacks against specific individuals, this flaw presents an immediate threat across affected Apple platforms. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
CVE-2026-76504: Cisco SD-WAN Flaw Exploited | Cisco has disclosed CVE-2026-76504, a critical authentication bypass vulnerability in Catalyst SD-WAN Manager, formerly known as vManage. The flaw allows an unauthenticated remote attacker to access the management API with administrator privileges. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
TeamViewer Fixes Five Remote Access Flaws | TeamViewer has patched five high-severity vulnerabilities in its Full Client and Host applications for Windows, Linux, and macOS. The flaws include local privilege escalation, potential code execution, and remote session access control bypass. The company strongly recommends that all users update to the latest available version as soon as possible. | Vulnerebility blog | SOCRADAR |
|
3.10.26 |
Gotta Breach 'Em All! The Journey Of ShinyHunters | ShinyHunters has outlasted forum takedowns, multiple arrests, and its own founders' convictions. This report traces six years of activity and tactical evolution. From stolen S3 buckets to zero-day exploits, we attempted to explain why the brand keeps surviving what should have ended it. | Cyber blog | SEKOIA |
|
3.10.26 |
The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers | TL;DR: Frontier AI has collapsed the vulnerability exploit window from weeks to mere hours. Attackers now use advanced AI models to reverse-engineer published fixes and generate working exploits faster than human security teams can deploy updates. In the AI era, publishing a patch creates a blueprint for attackers. Surviving this threat requires vendors to tier sensitive disclosures and customers to treat patch application speed as a critical security metric. | AI blog | JFROG |
|
3.10.26 |
ANY.RUN's Threat Coverage Digest: September 2026 | September saw an expansion of detection coverage across network, file, and behavioral activity, providing analysts with additional visibility into suspicious activity. ANY.RUN added 76 behavior signatures, 16 YARA detections, and 1,098 Suricata rules, strengthening coverage across malware activity, suspicious files, and network communications. | Cyber blog | ANYRUN BLOG |
|
3.10.26 |
Copilot has the largest AI attack surface of any tool we tracked | Microsoft Copilot accounts for a disproportionate share of the AI footprint we track, and it’s barely being used. It’s a massive attack surface featuring a minuscule rate of activity. | AI blog | ThreatDown |
|
3.10.26 |
Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy | Milk Dragon, also known as NaiLong is an Adversary-in-the-Middle (AiTM) phishing kit active since October 2025. Unlike conventional phishing tactics that rely on fear and urgency, Milk Dragon lures victims with big discounts on consumer goods distributed via Facebook and TikTok marketplace advertisements. | Phishing blog | GROUP-IB |
|
3.10.26 |
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino | Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace clandestino único, mejorado con IA, para comercializar objetivos comprometidos en Iberoamérica y Latinoamérica. | Malware blog | GROUP-IB |
|
3.10.26 |
Your State’s Scam Reality: What New Research Reveals Across All 50 States | A package notification arrives, and we stop to check whether we actually ordered something. A recruiter reaches out about a job, but before replying, we research the person and the company. A bank alert appears, and instead of tapping the link, we open the banking app ourselves. | Spam blog | McAfee Blog |
|
3.10.26 |
ClickFix Attacks: How They Work and How CrowdStrike Stops Them | Consider this hypothetical scenario: An employee tries to join what looks like a routine video meeting. The page loads, but instead of the meeting, they see an error message along with a helpful fix: Copy the provided command, open the Windows Run dialog, paste it, and press Enter. | Hacking blog | CROWDSTRIKE |
|
3.10.26 |
CrowdStrike Expands Federal SOC Modernization via CISA-Funded SIEMaaS | Falcon Next-Gen SIEM is now part of CISA’s SIEMaaS technology stack, which gives eligible agencies a funded path to modernize security through the CDM DEFEND F shared service. | Cyber blog | CROWDSTRIKE |
|
3.10.26 |
CrowdStrike and NVIDIA Extend Security Across the AI Stack | CrowdStrike and NVIDIA are collaborating on the NVIDIA Open Agent Safety Platform, an open reference design to extend security deeper into the agentic stack and establish stronger boundaries for autonomous AI. | AI blog | CROWDSTRIKE |
|
3.10.26 |
Citrix NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772) in active exploitation | On September 27, 2026, Citrix disclosed eight vulnerabilities affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. Two of these vulnerabilities are critical (CVSS score of 9.5) and can allow an unauthenticated remote attacker to execute code: | Vulnerebility blog | SOPHOS |
|
3.10.26 |
TerminalFix and Lorem Ipsum Loader enable covert tunneling | The activity is linked to a broader campaign that previously used a different delivery mechanism | CyberCrime blog | SOPHOS |
|
3.10.26 |
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI | Since the release of our May 2026 report detailing adversarial misuse of artificial intelligence (AI), Google Threat Intelligence Group (GTIG) has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond. | AI blog | Google Cloud Blog |
|
3.10.26 |
NVIDIA and Eclypsium Partner for Trusted AI Infrastructure | AI agents are moving from answering questions to taking action. They can read sensitive data, call APIs, write and execute code, use external tools, and coordinate with other agents. In some environments, their decisions may affect physical systems. | AI blog | Trend Micro |
|
3.10.26 |
Inside DragonForce: How a Ransomware Cartel's Payload Actually Runs | DragonForce is a Ransomware-as-a-Service (RaaS) operation that first surfaced in mid-to-late 2023. It initially presented itself as a hacktivist collective before shifting to a profit-driven model. Early payloads were built on leaked LockBit 3.0 source code and later supplemented with code derived from the leaked Conti builder. | Ransom blog | Seqrite |
|
3.10.26 |
Telecom Attack Surface: SS7, BGP & Nation-State Intrusions | SS7 and BGP were built on trust. Here's how nation-state actors exploit that trust, and telecom routers, to stay inside carrier networks for years. | Hacking blog | Cyble |
|
3.10.26 |
Attack Surface Management 2026: Why Point-in-Time Scans Fail | Quarterly scans leave cloud exposures hidden for months. Learn why CISA and FBI data now make continuous attack surface management essential in 2026. | Cyber blog | Cyble |
|
3.10.26 |
Your IP, Their Traffic | You install an app that offers a reward, a premium feature or perhaps a little money in exchange for sharing some of your unused internet bandwidth. It sounds harmless enough. Your connection is idle most of the time anyway. | Cyber blog | GENDIGITAL |
|
3.10.26 |
Warlock Ransomware Attackers Hit Water and Telecom Operators | China-nexus group behind Warlock is still exploiting SharePoint vulnerabilities, attacking organizations in Portuguese and Spanish-speaking countries, hitting critical infrastructure, government, and education organizations. | Ransom blog | SECURITY.COM |
|
3.10.26 |
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 | Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notification path. Exploitation can be triggered by a specially crafted email against internet-facing Zimbra servers when the optional zimbra-snmp package is installed and SNMP notifications are enabled, without requiring authentication or user interaction. | Vulnerebility blog | Microsoft blog |
|
3.10.26 |
Phishing Abuses RMM Tools for Persistent Access | In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. | Phishing blog | Microsoft blog |
|
3.10.26 |
Safely Securing AI Agents | Learn of the benefits of safely securing AI agents. | AI blog | Trend Micro |
|
3.10.26 |
IBM Langflow OSS Unauthenticated RCE - CVE-2026-9198 | The SonicWall Capture Labs threat research team became aware of an Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation in Langflow AI, assessed its impact and developed mitigation measures. Langflow AI is a Python-based web application that provides a visual interface to build AI-driven agents and workflows. | Vulnerebility blog | SonicWall |
|
3.10.26 |
SmokeLoader Malware: A Modular Threat with Advanced Evasion and Persistence | This week, the SonicWall Capture Labs Threat Research Team reviewed a sample of SmokeLoader malware. This is a modular program used by a variety of criminal and APT groups to gain a foothold on a system. It has vigorous anti-VM, anti-AV, and anti-analysis checks and capabilities. SmokeLoader can be used with RATs, ransomware, backdoors or botnets and uses both file and fileless methods of persistence. | Malware blog | SonicWall |
|
3.10.26 |
VioletRAT v6.5: From .NET Loader to In-Memory RAT — A Deep Dive into the Infection Chain | Recently, the SonicWall Capture Labs Threat Research Team discovered a sophisticated multi-stage .NET malware campaign that delivers VioletRAT v6.5 through a heavily obfuscated infection chain. The malware uses multiple .NET loader stages, an obfuscated batch script, in-memory assembly loading, and process injection into Msbuild.exe before executing the final VioletRAT payload. | Malware blog | SonicWall |
|
3.10.26 |
OperTraitors: How Kubernetes Operators Betray Your Security Posture | Kubernetes operators are coded to drastically reduce operational toil by acting as automated site reliability engineers. However, their reliance on highly privileged service accounts introduces a severe, often overlooked security weak spot. | Hacking blog | Palo Alto |
|
3.10.26 |
Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) | Unit 42 is aware of possible zero-day activity against NetScaler devices. In a Citrix report that details several CVEs, they noted that CVE-2026-88771 and CVE-2026-88772 have been exploited in the wild. The threat actors exploited these vulnerabilities to deliver web shells and establish their initial access and persistence into organizations. Analysis is ongoing to determine any post-compromise activity. | Vulnerebility blog | Palo Alto |
|
3.10.26 |
The Fine Art of Frustrating the Adversary | For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation. | Cyber blog | CISCO TALOS |
|
3.10.26 |
Give yourself room to be human | Fall is officially here in Maryland, and I can’t be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. | Cyber blog | CISCO TALOS |
|
3.10.26 |
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor | Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts. | APT blog | CISCO TALOS |
|
3.10.26 |
Securing the keys to the kingdom: Announcing Executive Threat Detection | Attackers are using greater sophistication to gain access to high-yield targets like executives, and company-wide security measures can easily miss these subtle, personal attacks. | Cyber blog | CISCO TALOS |
|
3.10.26 |
Trust and the enticing consultancy offer | In the cybersecurity industry, trust is the invisible currency. Every practitioner carries the implicit trust not to abuse privileged access or knowledge of vulnerabilities in each employment or engagement. This trust is valued by those who require our services, but also by threat actors. | Vulnerebility blog | CISCO TALOS |
|
3.10.26 |
The Closed Quorum: Inside the first reported autonomous AI C2 implant | CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025. | AI blog | CISCO TALOS |
|
3.10.26 |
This month in security with Tony Anscombe – September 2026 edition | Autonomous AI agents go on a hacking spree, and Microsoft ships what used to be a year's worth of security patches in one go – here's how to keep pace | Cyber blog | Eset |
|
3.10.26 |
Timeshare exit scams: From fake buyers to recovery scams | Con artists are targeting timeshare owners who want out – and some victims are hit twice | Spam blog | Eset |
|
3.10.26 |
The devil is still in the email – but wearing a new mask | When phishing can increasingly pass familiar checks, avoiding or limiting the damage depends on how quickly your company can detect and contain the attack | Spam blog | Eset |
|
3.10.26 |
Is that new (vibe coded) app safe? 5 questions to ask first | As AI lets anyone build software, here’s how to vet that shiny new app before it exposes your data | Cyber blog | Eset |
|
2.10.26 |
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes | Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by | Vulnerebility | The Hacker News |
|
2.10.26 |
OpenAI Parts Ways With Three Safety Researchers Over Sensitive Information Mishandling | OpenAI has parted ways with three members of its safety team after they leaked private information in violation of company policies, The Wall Street | AI | The Hacker News |
|
2.10.26 |
Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools | Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as | OS | The Hacker News |
|
2.10.26 |
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes | The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its | Exploit | The Hacker News |
|
2.10.26 |
Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers | Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data | CyberCrime | The Hacker News |
|
2.10.26 |
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory | Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure | Virus | The Hacker News |
|
1.10.26 |
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates | OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. | AI | The Hacker News |
|
1.10.26 |
CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV | The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a critical authentication bypass flaw impacting Cisco | Exploit | The Hacker News |
|
1.10.26 |
Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version | Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon , that it said is being rolled out to a set of trusted cyber defenders through its Fairwind Program. | AI | The Hacker News |
|
1.10.26 |
US soldier gets 70 months in prison for extorting 10 tech, telecom firms | A former U.S. Army soldier has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024. | CyberCrime | BleepingComputer |
|
1.10.26 |
CISA orders feds to patch exploited Citrix flaws by Wednesday | The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. | Exploit | BleepingComputer |
|
1.10.26 |
OpenAI is preparing “o,” an always-on ChatGPT assistant that could handle email | OpenAI is testing a new always-on assistant called "o", and references to the unannounced feature briefly showed up on the company's website. | AI | BleepingComputer |
|
1.10.26 |
Citrix confirms two NetScaler RCE zero-days exploited in attacks | Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. | Exploit | BleepingComputer |
|
1.10.26 |
Cloudflare fixes Containers cross-tenant flaw exposing customer data | Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host. | Vulnerebility | BleepingComputer |
|
1.10.26 |
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path | Security researchers have published the first public proof-of-concept for CVE-2026-86950 , an Apple CoreGraphics flaw Apple says may have been | Social | The Hacker News |
|
1.10.26 |
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft | Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party | Cryptocurrency | The Hacker News |
|
1.10.26 |
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators | MetaMask on Thursday said it's responding to what it described as an "ongoing security incident" impacting part of its infrastructure. "We are | Cryptocurrency | The Hacker News |
|
1.10.26 |
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs | Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. | Exploit | The Hacker News |
|
|
|
|
|