Today's brief covers Swann Communications SWIFI-SE2KIC and Inductive Automation Ignition Software, along with key threat intelligence bulletins.
■
Swann Communications SWIFI-SE2KIC: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication. The following ve...CISA Advisory
■
Inductive Automation Ignition Software: View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level. T...CISA Advisory
■
CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure: CISA is aware of Ivanti’s disclosure of a newly exploited vulnerability, CVE-2026-104935, affecting Ivanti Connect Secure versions 25.1.1.1 and prior, 25.1.2...CISA Advisory
■
Microsoft Patches More Than 1,400 Security Flaws: Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch ...Krebs on Security
■
AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host: A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one vi...Source Advisory
Daily Brief: Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers
Today's brief covers Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers and Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control, along with key threat intelligence bulletins.
■
Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers: Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw ...Source Advisory
■
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control: Two of 31 newly disclosed flaws in Progress Software's MarkLogic Server database could let an account given only some management privileges take administrato...Source Advisory
■
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code: GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result ...Source Advisory
■
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies: Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ...Source Advisory
■
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More: Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not...Source Advisory
Today's brief covers Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE and CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records, along with key threat intelligence bulletins.
■
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE: A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The ...Source Advisory
■
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records: Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e...Source Advisory
■
ASOS Breach Reveals the Risks in Customer-Facing SaaS: The attack on the British retailer shows that compromising a single identity can lead to much deeper penetration of the corporate network.Dark Reading
■
AI Scramble Drives Cybersecurity M&A Boom: Welcome to another gangbuster year for strategic M&A activity in cyber, with 117 deals announced in the latest quarter. What's different: Many of the buyers ...Dark Reading
■
What We Missed: FBI Strikes Back at ShinyHunters: In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected ShinyHunters oper...Dark Reading
Daily Brief: The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
Today's brief covers The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't and TP-Link Sued by Four More U.S. States Over Router Security and China Ties, along with key threat intelligence bulletins.
■
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't: In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sig...Source Advisory
■
TP-Link Sued by Four More U.S. States Over Router Security and China Ties: Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with Texas filing a suit in February. Florida, Iowa, Montan...Source Advisory
■
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access: Security researchers have published a full working exploit for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root acc...Source Advisory
■
Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects: Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI). "I...Source Advisory
■
Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge: Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web s...Source Advisory
Daily Brief: FBI Arrests Founder of Ransomware Negotiation Firm
Today's brief covers FBI Arrests Founder of Ransomware Negotiation Firm and Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws, along with key threat intelligence bulletins.
■
FBI Arrests Founder of Ransomware Negotiation Firm: Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigatio...Krebs on Security
■
Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws: Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its artific...Source Advisory
■
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories: Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer account...Source Advisory
■
FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack: The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortio...Source Advisory
■
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands: Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the vari...Source Advisory
Today's brief covers Satel Netco Design and Grid Protection Alliance openPDC and openHistorian, along with key threat intelligence bulletins.
■
Satel Netco Design: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessiv...CISA Advisory
■
Grid Protection Alliance openPDC and openHistorian: View CSAF Summary The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-10462...CISA Advisory
■
Red Lion Controls N-Tron 700 Series: View CSAF Summary Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This acc...CISA Advisory
■
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data: Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data Original Public...CISA Advisory
■
GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys: A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion addres...Source Advisory
Today's brief covers Hitachi Energy RTU500 and ShinyHunters Extorted Boeing Spin-off Prior to Arrests, along with key threat intelligence bulletins.
■
Hitachi Energy RTU500: View CSAF Summary Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU5...CISA Advisory
■
ShinyHunters Extorted Boeing Spin-off Prior to Arrests: A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating w...Krebs on Security
■
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases: Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery ph...Source Advisory
■
U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks: The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in ...Source Advisory
■
MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data: The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victi...Source Advisory
Today's brief covers Hitachi Energy REB500 and Hitachi Energy Asset Suite, along with key threat intelligence bulletins.
■
Hitachi Energy REB500: View CSAF Summary Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerab...CISA Advisory
■
Hitachi Energy Asset Suite: View CSAF Summary Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document....CISA Advisory
■
Johnson Controls EasyIO FG: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device. The following vers...CISA Advisory
■
Hitachi Energy SOI: View CSAF Summary Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this do...CISA Advisory
■
Savannah lwIP SMTP client: View CSAF Summary Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code exec...CISA Advisory
Daily Brief: Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Today's brief covers Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports and Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products, along with key threat intelligence bulletins.
■
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports: Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1...Source Advisory
■
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products: A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each ...Source Advisory
■
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach: The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of p...Source Advisory
■
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account: Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in Denmark...Source Advisory
■
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits: A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of do...Source Advisory
Daily Brief: Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Today's brief covers Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE and New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline, along with key threat intelligence bulletins.
■
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE: A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in qu...Source Advisory
■
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline: Citrix has released security updates for a high-severity security flaw in NetScaler ADC and Citrix NetScaler Gateway that has been exploited as part of targe...Source Advisory
■
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers: A critical flaw in GitLab's AI Gateway could let a logged-in user with Duo Agent Platform access run commands on the gateway under certain conditions, GitLab...Source Advisory
■
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign: Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has ...Source Advisory
■
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes: Dell has released security updates to address multiple critical security flaws in Dell Container Storage Modules (CSM) that could be exploited by bad actors ...Source Advisory
Daily Brief: ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members
Today's brief covers ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members and China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing, along with key threat intelligence bulletins.
■
ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members: A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reu...Source Advisory
■
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing: A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) e...Source Advisory
■
MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics: The U.K.'s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering efforts on be...Source Advisory
■
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware: The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in a...Source Advisory
■
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations: Featuring: Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. ...Source Advisory
Daily Brief: Johnson Controls EasyIO Neo Series EC and CW Controllers
Today's brief covers Johnson Controls EasyIO Neo Series EC and CW Controllers and Meari IoT Cloud Platform OpenAPI Service, along with key threat intelligence bulletins.
■
Johnson Controls EasyIO Neo Series EC and CW Controllers: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials and...CISA Advisory
■
Meari IoT Cloud Platform OpenAPI Service: View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors,...CISA Advisory
■
Monta monta.app: View CSAF Summary Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable chargin...CISA Advisory
■
Armatura LLC Armatura One: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary cod...CISA Advisory
■
ABB Protection and Control IED Manager PCM600: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files. The following versions ...CISA Advisory
Daily Brief: Lantronix G520 Series Cellular Gateway
Today's brief covers Lantronix G520 Series Cellular Gateway and Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version, along with key threat intelligence bulletins.
■
Lantronix G520 Series Cellular Gateway: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitrary code with root privilege...CISA Advisory
■
Google Rolls Out Gemini 4 Argon to Trusted Cyber Defenders, Plans Guardrail-Free Version: Google on Wednesday announced its latest frontier artificial intelligence (AI) model, Gemini 4 Argon, that it said is being rolled out to a set of trusted cy...Source Advisory
■
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path: Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks...Source Advisory
■
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft: Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security pro...Source Advisory
■
MetaMask Security Incident Prompts Exit of Affected Ethereum Validators: MetaMask on Thursday said it's responding to what it described as an "ongoing security incident" impacting part of its infrastructure. "We are actively addre...Source Advisory
Today's brief covers Baicells Nova 430H and VIVOTEK Camera Firmware, along with key threat intelligence bulletins.
■
Baicells Nova 430H: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service co...CISA Advisory
■
VIVOTEK Camera Firmware: View CSAF Summary Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with...CISA Advisory
■
Anjvision YSSD-RTMP-H5: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-...CISA Advisory
■
Viidure Dashcam Android Application: View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system...CISA Advisory
■
Toptech TMS7 and TopHAT: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code. The following v...CISA Advisory
Today's brief covers Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation and Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation, along with key threat intelligence bulletins.
■
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation: Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacke...Krebs on Security
■
Dutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters Investigation: Dutch authorities have confirmed that they arrested a 24-year-old man from Amsterdam in connection with the ShinyHunters group. "It is true that this month a...Source Advisory
■
Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials: A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real se...Source Advisory
■
OpenAI Shelves GPT-6.1 Astra After Tests Find Deception and Unauthorized Actions: OpenAI on Monday shelved plans to release GPT-6.1 Astra, a next-generation artificial intelligence (AI) model that was planned for an October launch, after i...Source Advisory
■
OpenAI Pauses Tool Use After Agent Bypasses Internet Controls to Reach External Chatbot: OpenAI said it has made the decision to pause training of its most powerful models after one of its agents during reinforcement learning (RL) training contac...Source Advisory
Today's brief covers Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway and SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild, along with key threat intelligence bulletins.
■
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway: CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: CVE-2026-88771, CVE...CISA Advisory
■
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to i...Source Advisory
■
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack: Kiteworks (formerly Accellion) is urging customers to shut down their systems as a precautionary measure for nine hours over the weekend after it received th...Source Advisory
■
How the CISO CFO Relationship is a Key to Cybersecurity Success: Building a financial bridge: Organizations where CISOs and CFOs align on cybersecurity strategy to protect assets, manage risk and enable business growth are...Dark Reading
■
AI Sandbox Escapes: Why Forensic Readiness Matters More Than Containment: When autonomous AI agents "escape the sandbox," the real story isn't rogue machines — it's the same access-control failures we've seen for decades.Dark Reading
Daily Brief: Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation
Today's brief covers Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation and Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials, along with key threat intelligence bulletins.
■
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation: Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively explo...Source Advisory
■
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials: The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware...Source Advisory
■
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells: Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors global...Source Advisory
■
Zero Trust for AI Agents Starts With Fixing Zero Visibility: The way we talk about AI agents is shifting, and the way we implement them requires an even more fundamental shift. While earlier discourse focused on how qu...Source Advisory
■
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link: Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated atta...Source Advisory
Daily Brief: U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
Today's brief covers U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions and Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware, along with key threat intelligence bulletins.
■
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions: A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 mil...Krebs on Security
■
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware: Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised d...Source Advisory
■
PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence: Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption ch...Source Advisory
■
The SOC Doesn't Need to Start Over with Every Alert: Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a ...Source Advisory
■
Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise: Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September...Source Advisory
Today's brief covers Eufy Omni C20, Omni X10 Pro and Botslab G980H Dashcams, along with key threat intelligence bulletins.
■
Eufy Omni C20, Omni X10 Pro: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code. The follow...CISA Advisory
■
Botslab G980H Dashcams: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sen...CISA Advisory
■
lwIP TCP/IP Stack MQTT Client Application: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device. The following versions of ...CISA Advisory
■
Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data: A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the resea...Source Advisory
■
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV: The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magent...Source Advisory
Daily Brief: Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators
Today's brief covers Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators and Siemens Desigo CC family, along with key threat intelligence bulletins.
■
Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators: Introduction The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA)—hereafter referred to as the “authoring ag...CISA Advisory
■
Siemens Desigo CC family: View CSAF Summary A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary co...CISA Advisory
■
Siemens SIMOVE Fleetmanager and SIPLANT: View CSAF Summary SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside of intended sco...CISA Advisory
■
Siemens Siveillance Control: View CSAF Summary A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control P...CISA Advisory
■
OpenAI Agent Bypassed Australian Medicare Portal Controls to Access Non-Public Files: An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June, Prime Minister Antho...Source Advisory
Today's brief covers Siemens Industrial Edge Management and OpenPLC Runtime v3, along with key threat intelligence bulletins.
■
Siemens Industrial Edge Management: View CSAF Summary Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform f...CISA Advisory
■
OpenPLC Runtime v3: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an ope...CISA Advisory
■
lwIP (Lightweight IP): View CSAF Summary Successful exploitation of this vulnerability could result in a system crash, a DoS, or memory corruption, which could lead to code executi...CISA Advisory
■
Siemens WTV676 and WTV776: View CSAF Summary The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode ...CISA Advisory
■
Siemens SIPLUS and SIMATIC Products: View CSAF Summary Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products ...CISA Advisory
Daily Brief: SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
Today's brief covers SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing and One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor, along with key threat intelligence bulletins.
■
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing: The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus bey...Source Advisory
■
One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor: Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick ...Source Advisory
■
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session: A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened tha...Source Advisory
■
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Kn...Source Advisory
■
Fake LastPass Authenticator Installer Abuses Microsoft-Signed Driver to Kill Antivirus and EDR: A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a pass...Source Advisory
Daily Brief: ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Today's brief covers ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure and Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors, along with key threat intelligence bulletins.
■
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure: Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeare...Source Advisory
■
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors: The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information tech...Source Advisory
■
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulne...Source Advisory
■
Vectra AI Launches Ascent to Help Address New Era of AI-Driven Attacks: The new program expands Vectra AI's partner strategy as increasingly complex security environments and the growing use of AI create demand for broader AI exp...Dark Reading
■
Cisco Zero-Day Highlights API Endpoint Authentication Issues: The authentication bypass flaw CVE-2026-76460 impacts Cisco's Identity Services Engine (ISE) and received a maximum 10 out of 10 CVSS score.Dark Reading
Daily Brief: Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Today's brief covers Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws and Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar, along with key threat intelligence bulletins.
■
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws: Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of several Ope...Source Advisory
■
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar: A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still does not answer the question that matters: Can it actually be exploited...Source Advisory
■
Identity Visibility in 2026: The Foundation of Identity Security: Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial a...Source Advisory
■
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE: SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an una...Source Advisory
■
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories: An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on Septemb...Source Advisory
Today's brief covers ABB Ability Edgenius and Schneider Electric PowerChute Serial Shutdown, along with key threat intelligence bulletins.
■
ABB Ability Edgenius: View CSAF Summary ABB is aware of public reports of a vulnerability CVE‑2026‑31431 (Copy Fail) in the product versions listed as affected in the advisory. An...CISA Advisory
■
Schneider Electric PowerChute Serial Shutdown: View CSAF Summary Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS m...CISA Advisory
■
Data Broker Radaris Loses Domains in Privacy Fight: The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search ser...Krebs on Security
■
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild: A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-...Source Advisory
■
Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up: Google's Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a cybersecurity ...Source Advisory
Daily Brief: Mitsubishi Electric GX Works3 and Motion Control Settings
Today's brief covers Mitsubishi Electric GX Works3 and Motion Control Settings and Hitachi Energy FACTS Control Platform (FCP), along with key threat intelligence bulletins.
■
Mitsubishi Electric GX Works3 and Motion Control Settings: View CSAF Summary Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password...CISA Advisory
■
Hitachi Energy FACTS Control Platform (FCP): View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker ex...CISA Advisory
■
Bransys ELD: View CSAF Summary Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware. The following versions of ...CISA Advisory
■
Schneider Electric NetBotz 5 750/755: View CSAF Summary Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security a...CISA Advisory
■
Schneider Electric Modicon M340 Controller and Communication Modules: View CSAF Summary Schneider Electric is aware of a vulnerability in its Modicon M340 https://www.se.com/ww/en/product-range/1468-modicon-m340-pac/, BMXNOR020...CISA Advisory
Daily Brief: Using Cyber Decoys to Strengthen Detection and Response
Today's brief covers Using Cyber Decoys to Strengthen Detection and Response and Siemens Reyrolle 7SR5, along with key threat intelligence bulletins.
■
Using Cyber Decoys to Strengthen Detection and Response: CISA developed this guidance to help defensive teams at varying levels of cybersecurity maturity plan and implement cyber decoy strategies that strengthen th...CISA Advisory
■
Siemens Reyrolle 7SR5: View CSAF Summary Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 and recomm...CISA Advisory
■
CareCam CM2507: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access live video and sensitive device information, enable unau...CISA Advisory
■
Wärtsilä FOS-Onboard: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to deliver an unauthorized update, execute code, or extract creden...CISA Advisory
■
Siemens Mendix SAML: View CSAF Summary Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configur...CISA Advisory
Daily Brief: Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers
Today's brief covers Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers and Digital Watchdog VMAX DVR and NVR Product Lineups, along with key threat intelligence bulletins.
■
Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers: Developed by the National Institute of Standards and Technology (NIST) and CISA, this interagency report provides federal agencies and cloud service provider...CISA Advisory
■
Digital Watchdog VMAX DVR and NVR Product Lineups: View CSAF Summary Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live a...CISA Advisory
■
mySCADA myPRO Manager: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access privileged management functions or send arbitrary SMS me...CISA Advisory
■
Schneider Electric SCADAPack x70 Products: View CSAF Summary Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack ...CISA Advisory
■
Siemens Teamcenter: View CSAF Summary A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote ...CISA Advisory
Daily Brief: LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
Today's brief covers LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server and Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution, along with key threat intelligence bulletins.
■
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server: A critical vulnerability in LiteSpeed Web Server Enterprise could let a low-privilege website user gain root access on a shared-hosting server, cPanel warned...Source Advisory
■
Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution: Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. ...Source Advisory
■
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE: A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows ...Source Advisory
■
New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing: Researchers have disclosed a new hardware attack, called DDRop, that breaks the memory protection in Intel and AMD confidential computing by silently droppin...Source Advisory
■
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials: An attacker was operating inside the network of 3BB, one of Thailand's largest broadband providers, and maintained remote control of internal machines using ...Source Advisory
Today's brief covers Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users and Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data, along with key threat intelligence bulletins.
■
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users: A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercia...Source Advisory
■
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data: Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam m...Source Advisory
■
CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate: A new joint government advisory signals a regulatory shift, pressing organizations to adopt more transparent breach notification and incident response protoc...Dark Reading
■
Why AI Is So Good at Scamming Humans: Fred Heiding of Menlo Park Intelligence talks with the Dark Reading News Desk about his research on frontier models, and their ability to influence human beh...Dark Reading
■
AI Governance Can't Wait: Adversaries can manipulate AI defensive reasoning to silently compromise target networks.Dark Reading
Daily Brief: CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
Today's brief covers CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV and When the Whole Company Adopts AI: What It Does to Your SOC, along with key threat intelligence bulletins.
■
CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and Mi...Source Advisory
■
When the Whole Company Adopts AI: What It Does to Your SOC: Over the past year, we watched a new class of alert appear in enterprise security operations centers and grow faster than anything else in the stream: alerts...Source Advisory
■
Your Critical Vulnerabilities Might Not Be Your Biggest Risk: Security teams have become exceptionally talented at finding vulnerabilities. Now, it’s time to turn our attention to optimizing the process for determining ...Source Advisory
■
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor: A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a...Source Advisory
■
Threat Actor Generates 1M Personalized Fraud Emails in 3 Days: Cybercriminals behind malicious email campaigns no longer have to compromise volume for credibility, or vice versa, thanks to AI.Dark Reading
Daily Brief: OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
Today's brief covers OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers and GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure, along with key threat intelligence bulletins.
■
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers: The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers ...Source Advisory
■
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure: GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours...Source Advisory
■
Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks: Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including...Source Advisory
■
Claude Used to Automate Exploitation and Data Theft Across Multiple Victims: Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mas...Source Advisory
■
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection: Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted wor...Source Advisory
Today's brief covers Orthanc DICOM Server and AVEVA Pipeline Integrity Monitor, along with key threat intelligence bulletins.
■
Orthanc DICOM Server: View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated remote attacker to write past the end of a heap allocation when ...CISA Advisory
■
AVEVA Pipeline Integrity Monitor: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to disclose information, brute-force hashes, or run arbitrary code...CISA Advisory
■
ST Engineering iDirect iQ-Series Terminals (Update A): View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denia...CISA Advisory
■
NextGen Healthcare Mirth Connect: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to exfiltrate date or cause a denial-of-service condition. The fol...CISA Advisory
■
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors: Attackers have chained two flaws in JFrog Artifactory, the repository that software build pipelines pull from, to take administrator control of self-hosted s...Source Advisory
Daily Brief: Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key
Today's brief covers Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key and Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6, along with key threat intelligence bulletins.
■
Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key: Nearly one in ten of the internet-facing LiteLLM servers that Wiz Research scanned in February accepted sk-1234, the example admin key in LiteLLM's own setup...Source Advisory
■
Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6: Anthropic on Wednesday disclosed a fourth incident in which its artificial intelligence (AI) model broke into real third-party systems, marking the latest in...Source Advisory
■
U.S. Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8 Million in Crypto: The U.S. Department of Justice (DoJ) on Wednesday announced coordinated actions aimed at an illicit online marketplace called Xinbi Guarantee that offered sc...Source Advisory
■
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week: Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together mu...Source Advisory
■
Infostealer Logs Expose Replayable AI Tokens That Can Bypass MFA: Cybercriminals are hijacking artificial intelligence (AI) user accounts via information stealer logs to create "stolen keys" that grant illicit access to too...Source Advisory
Today's brief covers CareCam Pro IP Cameras and China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies, along with key threat intelligence bulletins.
■
CareCam Pro IP Cameras: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to take full control of the device. The following versions of CareCam...CISA Advisory
■
China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies: Executive summary China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of ...CISA Advisory
■
Microsoft Plugs Nearly 1,000 Security Holes: Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch...Krebs on Security
■
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox: Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-seve...Source Advisory
■
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root: cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related priv...Source Advisory
Daily Brief: Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Today's brief covers Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell and BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams, along with key threat intelligence bulletins.
■
Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell: Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active expl...Source Advisory
■
BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams: Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment...Source Advisory
■
Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing: Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users' personal informa...Source Advisory
■
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution: Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension ...Source Advisory
■
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks: Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that's targeting Microsoft 365 and other software-as-a-service ...Source Advisory
Daily Brief: N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
Today's brief covers N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw and JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies, along with key threat intelligence bulletins.
■
N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw: Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the...Source Advisory
■
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies: Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-in...Source Advisory
■
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code: Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitr...Source Advisory
■
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted: Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider S...Source Advisory
■
Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel: A group of AI safety researchers says a fleet of autonomous agents that identified themselves as OpenAI systems left about 18,000 posts on a dormant 25-year-...Source Advisory
Daily Brief: Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)
Today's brief covers Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A) and Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication, along with key threat intelligence bulletins.
■
Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A): View CSAF Summary Schneider Electric is aware of a vulnerability in the following products: The Easergy C5 is a scalable and interoperable bay controller, pr...CISA Advisory
■
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication: Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrat...Source Advisory
■
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner: Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on ...Source Advisory
■
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores: Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's serve...Source Advisory
■
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials: JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited...Source Advisory
Today's brief covers Pyramid Solutions NetStaX EtherNet/IP Stack and IXON VPN Client, along with key threat intelligence bulletins.
■
Pyramid Solutions NetStaX EtherNet/IP Stack: View CSAF Summary Successful exploitation of this vulnerability could result in memory corruption, a device crash, or a potential remote attack vector withou...CISA Advisory
■
IXON VPN Client: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to perform remote code execution on the computer running the client w...CISA Advisory
■
Preparing for the Post-Quantum Era: A Call to Action: CISA and the Group of Seven (G7) Cyber Security Working Group released Preparing for the Post-Quantum Era: A Call to Action highlighting the urgent need for ...CISA Advisory
■
Rockwell Automation ArmorStart LT: View CSAF Summary Successful exploitation of these vulnerabilities could result in a loss of webserver availability or allow an attacker to inject malicious ...CISA Advisory
■
Rockwell Automation ControlFLASH: View CSAF Summary Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker's choice on a ...CISA Advisory
Today's brief covers Rockwell Automation 1756-ENBT Module and Tycon Systems TPDIN-Monitor-WEB2 (Update A), along with key threat intelligence bulletins.
■
Rockwell Automation 1756-ENBT Module: View CSAF Summary Successful exploitation of this vulnerability could crash the module. The device requires a restart to recover. The following versions of R...CISA Advisory
■
Tycon Systems TPDIN-Monitor-WEB2 (Update A): View CSAF Summary Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastr...CISA Advisory
■
Inductive Automation Ignition: View CSAF Summary Successful exploitation of this vulnerability could allow any authenticated user to create projects. The following versions of Inductive Au...CISA Advisory
■
OPCFoundation OPC UA LocalDiscoveryServer (LDS): View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and ...CISA Advisory
■
Tycon Systems TPDIN-Monitor-WEB3: View CSAF Summary Successful exploitation of these vulnerabilities could allow for an attacker to perform a man-in-the-middle (MitM) attack, cause a factory ...CISA Advisory
Daily Brief: Communicating Under Pressure: Best Practices for Service Providers
Today's brief covers Communicating Under Pressure: Best Practices for Service Providers and CISA Adds Seven Known Exploited Vulnerabilities to Catalog, along with key threat intelligence bulletins.
■
Communicating Under Pressure: Best Practices for Service Providers: Developed by CISA, the Federal Bureau of Investigation, and international partners, this guidance describes how organizations can plan and execute clear, tim...CISA Advisory
■
CISA Adds Seven Known Exploited Vulnerabilities to Catalog: CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9586 Sangom...CISA Advisory
■
Rockwell Automation FactoryTalk Activation Manager: View CSAF Summary The following versions of Rockwell Automation FactoryTalk Activation Manager are affected: FactoryTalk Activation Manager V5.02_and_below (...CISA Advisory
■
FBI Probes Service Selling 153M+ Drivers Licenses: A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United ...Krebs on Security
■
Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone: The iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware, according to new findings from the Citiz...Source Advisory
Today's brief covers Rockwell Automation RSLinx Classic and Rockwell Automation Historian ME, along with key threat intelligence bulletins.
■
Rockwell Automation RSLinx Classic: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product. Th...CISA Advisory
■
Rockwell Automation Historian ME: View CSAF Summary Successful exploitation of these vulnerabilities could crash the device being accessed; an out-of-bounds write condition may allow remote c...CISA Advisory
■
Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix: View CSAF Summary The following versions of Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix are affected: C...CISA Advisory
■
Rockwell Automation Logix Platform: View CSAF Summary The following versions of Rockwell Automation Logix Platform are affected: ControlLogix 5580 <=V33, V34.011-V34.014, V35.011-V35.013, V3...CISA Advisory
■
Rockwell Automation Redundancy Module Configuration Tool: View CSAF Summary Successful exploitation of these vulnerabilities could allow for an attacker to escalate and execute processes with administrator privilege...CISA Advisory
Daily Brief: Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Today's brief covers Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis and Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity, along with key threat intelligence bulletins.
■
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis: Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that's been put to use by a Russia-aligned threat actor known as UAC-0099 agains...Source Advisory
■
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity: Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in questi...Source Advisory
■
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales: Threat actors with ties to the Democratic People's Republic of Korea (aka DPRK or North Korea) have been observed seeking job opportunities beyond the inform...Source Advisory
■
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More: The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected tra...Source Advisory
■
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions: The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malw...Source Advisory
Daily Brief: DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
Today's brief covers DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims and 19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code, along with key threat intelligence bulletins.
■
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims: The U.S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out...Source Advisory
■
19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code: Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and ha...Source Advisory
■
Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth: Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetoot...Source Advisory
■
Hundreds of OpenAI Agents Invaded Hugging Face Servers: The Hugging Face incident was bigger and worse than previously thought, with approximately 700 agents collaborating on a sophisticated, multistage attack.Dark Reading
■
Offensive Security Investments Surge as AI Threats Increase: Omdia's Theresa Lanowitz talks with the Dark Reading News Desk about the potential — and risks — of using agentic AI for penetration testing, red teaming, an...Dark Reading
Today's brief covers TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor and Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE, along with key threat intelligence bulletins.
■
TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor: Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal ...Source Advisory
■
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE: Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, ...Source Advisory
■
Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication: Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company releas...Source Advisory
■
Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers: Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard th...Source Advisory
■
ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnera...Source Advisory
Today's brief covers All-Line Equipment Company Fuel-Boss and Applied Systems Engineering ASE2000 V2 Communications Test Set, along with key threat intelligence bulletins.
■
All-Line Equipment Company Fuel-Boss: View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems. ...CISA Advisory
■
Applied Systems Engineering ASE2000 V2 Communications Test Set: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to i...CISA Advisory
■
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia: Authorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the ...Krebs on Security
■
Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network: Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative netw...Source Advisory
■
Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable: Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August...Source Advisory
Daily Brief: Rockwell Automation OTTO Fleet Manager
Today's brief covers Rockwell Automation OTTO Fleet Manager and Xiiaozet LK100W, along with key threat intelligence bulletins.
■
Rockwell Automation OTTO Fleet Manager: View CSAF Summary Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force a...CISA Advisory
■
Xiiaozet LK100W: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to take control over the device. The following versions of Xiiaoze...CISA Advisory
■
Mitsubishi Electric CNC Series (Update A): View CSAF Summary Successful exploitation of this vulnerability could allow a remote attacker to cause an out-of-bounds read, resulting in a denial-of-servic...CISA Advisory
■
Mitsubishi Electric Multiple FA Products (Update D): View CSAF Summary Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service (DoS) condition, a timeout error, ...CISA Advisory
■
Ebyte NA111-M: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device. The following versions of Ebyte NA...CISA Advisory
Today's brief covers CISA Vulnerability Review and CISA Adds Six Known Exploited Vulnerabilities to Catalog, along with key threat intelligence bulletins.
■
CISA Vulnerability Review: Most compromises do not rely on advanced techniques or cutting-edge tools. Cyber threat actors scan the internet looking for exposed, well-known software vul...CISA Advisory
■
CISA Adds Six Known Exploited Vulnerabilities to Catalog: CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2015-3246 Red Hat ...CISA Advisory
■
Siemens SIMATIC IoT2050 Advanced: View CSAF Summary SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-R...CISA Advisory
■
FURUNO FA-50 Class B AIS Transponder: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to alter device settings. The following versions of FURUNO FA-50 C...CISA Advisory
■
Bendix EC80 Brake ECU: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause the loss of ABS functions, steering assist, speedometer, ...CISA Advisory
Today's brief covers Ebyte NE2-D11 and A Tale of Two SOCs: Insights From Two Red Team Assessments, along with key threat intelligence bulletins.
■
Ebyte NE2-D11: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized administrative access, disclose sensitive inf...CISA Advisory
■
A Tale of Two SOCs: Insights From Two Red Team Assessments: Advisory at a Glance Title A Tale of Two SOCs: Insights From Two Red Team Assessments Original Publication August 25, 2026 Executive Summary The Cybersecurit...CISA Advisory
■
Rently Smart Home: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions. The fo...CISA Advisory
■
PayRange API: View CSAF Summary Successful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive informa...CISA Advisory
■
Zoneminder: View CSAF Summary Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user. The following versio...CISA Advisory
Daily Brief: Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Today's brief covers Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access and Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data, along with key threat intelligence bulletins.
■
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access: Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make i...Source Advisory
■
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle Web...Source Advisory
■
Shipping More AI Code Than You Can Secure? Watch How to Control Remediation Debt: If your developers are using AI coding tools, you are probably already seeing the upside: faster development, more code, and less time spent on routine work....Source Advisory
■
Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning: Cybersecurity researchers have found that several websites are still actively distributing a malware family known as Weedhack to gamers by masquerading as Mi...Source Advisory
■
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More: A package gets installed. A login prompt opens. A box sits exposed to the internet. Nothing looks unusual yet. That’s roughly the mood this week. Trusted too...Source Advisory
Daily Brief: UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Today's brief covers UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit and How an Emerging Industrial Protocol Family Could Put OT at Risk, along with key threat intelligence bulletins.
■
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit: Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globa...Source Advisory
■
How an Emerging Industrial Protocol Family Could Put OT at Risk: New research shows how attacks against some unprotected TSN protocols could allow attackers to disrupt or manipulate physical processesDark Reading
■
Hardware Makers Implement Post-Quantum Cryptography as Security Threats Near: The coming threat of super-powerful computers capable of cracking today’s algorithms requires upgrading encryption now. Tech companies have begun building de...Dark Reading
■
What We Missed: Delta Flight Disrupted With Wi-Fi Hack: In this video, Dark Reading editors discuss some of the news they didn't get a chance to cover, including some scary airplane security risks and the US gover...Dark Reading
■
N-able Bug Exposes Password Vault Master Keys: The popular "Passportal" password manager, favored by MSPs and SMBs, remains risky even after its patch, thanks to its cloud-based design. Should these produ...Dark Reading
Daily Brief: TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
Today's brief covers TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit and OWASP Flags Top AI Skill Risks in New Security Blueprint, along with key threat intelligence bulletins.
■
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit: The U.S. Department of Justice (DoJ) announced on Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit accusing the company of v...Source Advisory
■
OWASP Flags Top AI Skill Risks in New Security Blueprint: The Open Worldwide Application Security Project has a brand-new top 10 security list tailored for the modern era, and it debuts a Universal Skill Format to a...Dark Reading
■
Calling on Cyber Pros to Help Defend City Hall: Government agencies with smaller budgets need support — and here's how you can help.Dark Reading
■
OpenAI Adds Controls That Should've Been There Already: The new AI security controls follow the Hugging Face incident last month, though many of these additions perhaps should have been in place prior to the front...Dark Reading
■
New CUSTODY Framework Constrains AI Agents Inside the Network: Enterprise cybersecurity expert Jake Williams joins the Dark Reading News Desk to explain why he decided to release his new agentic AI framework in the wake ...Dark Reading
Daily Brief: 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Today's brief covers 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2 and Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot, along with key threat intelligence bulletins.
■
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2: Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to ste...Source Advisory
■
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot: Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kerne...Source Advisory
■
Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet: Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFu...Source Advisory
■
Wazuh and AI For Enhanced SOC Workflows: Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations...Source Advisory
■
Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0: Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal secu...Source Advisory
Daily Brief: Johnson Controls Simplex Incident Manager
Today's brief covers Johnson Controls Simplex Incident Manager and GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure, along with key threat intelligence bulletins.
■
Johnson Controls Simplex Incident Manager: View CSAF Summary Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and a...CISA Advisory
■
GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure: A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in q...Source Advisory
■
Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution: Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action i...Source Advisory
■
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads: The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases tha...Source Advisory
■
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts: Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals work...Source Advisory
Daily Brief: Defending Against an Active Threat to Siemens S7 Series PLCs
Today's brief covers Defending Against an Active Threat to Siemens S7 Series PLCs and Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code, along with key threat intelligence bulletins.
■
Defending Against an Active Threat to Siemens S7 Series PLCs: Executive summary Note: This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting ...CISA Advisory
■
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code: Cybersecurity researchers have disclosed details of a critical flaw in the Elementor Pro WordPress plugin that, if successfully exploited, could lead to remo...Source Advisory
■
Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second: Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JSON Web Token (JWT) from a co-located W...Source Advisory
■
OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior: OpenAI on Tuesday revealed that it paused reinforcement learning (RL) training for its latest artificial intelligence (AI) models for two weeks while it shor...Source Advisory
■
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs: A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes ...Source Advisory
Today's brief covers Siemens Simcenter Nastran and CISA Malcolm, along with key threat intelligence bulletins.
■
Siemens Simcenter Nastran: View CSAF Summary Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string a...CISA Advisory
■
CISA Malcolm: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code. ...CISA Advisory
■
CISA Adds Four Known Exploited Vulnerabilities to Catalog: CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-33824 Micros...CISA Advisory
■
Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure: Microsoft Defender Experts have linked more than 30 web domains to MacSync Stealer, a macOS-focused information stealer, after correlating recurring endpoint...Source Advisory
■
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data: A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically desig...Source Advisory
Daily Brief: SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers
Today's brief covers SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers and CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE, along with key threat intelligence bulletins.
■
SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers: SafePal has disclosed that an authorization flaw in an order-tracking plug-in exposed the names, email addresses, shipping addresses, phone numbers, and purc...Source Advisory
■
CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) c...Source Advisory
■
Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects: GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software that, unde...Source Advisory
■
Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection: Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-n...Source Advisory
■
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads: A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to a...Source Advisory
Daily Brief: Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Today's brief covers Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws and Mission-Driven Security: Inside a Global Bank's Defense, along with key threat intelligence bulletins.
■
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws: Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully ex...Source Advisory
■
Mission-Driven Security: Inside a Global Bank's Defense: In this video interview, Standard Chartered's group CISO shares insights on transitioning from technical roles to strategic leadership, the importance of bus...Dark Reading
■
Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to … AI: Driven by AI-augmented research and scanning, vulnerability volumes continue to surge, driving the National Institute of Standards and Technology to ask whet...Dark Reading
■
Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office: One Caledonian government agency reported a breach, thanks to a third party that may have serviced other agencies as well.Dark Reading
■
What Boards Need to Know About Tech Risk: Why do so many boards underestimate technology risk until it becomes a crisis?Dark Reading
Daily Brief: Who’s Tracking You? Use This New Service to Find Out
Today's brief covers Who’s Tracking You? Use This New Service to Find Out and Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor, along with key threat intelligence bulletins.
■
Who’s Tracking You? Use This New Service to Find Out: It can be daunting to determine who's responsible for showing ads on the websites we visit, or who's harvesting data from the mobile apps we use every day. T...Krebs on Security
■
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor: The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Wi...Source Advisory
■
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One: A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to ...Source Advisory
■
OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning: A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and ...Source Advisory
■
Enterprise Defenses Recovered at the Edge and Collapsed Inside: Enterprise defenses are tuned to catch the attacks that make noise. This year's data shows attackers winning by making none. According to Picus Labs' new Blu...Source Advisory
Today's brief covers Siemens Siveillance Video and Flow Neuroscience FL-100, along with key threat intelligence bulletins.
■
Siemens Siveillance Video: View CSAF Summary Siveillance Video Management Servers contains a vulnerability that could allow a Remote Code Execution attack. Siemens has released new ver...CISA Advisory
■
Flow Neuroscience FL-100: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and...CISA Advisory
■
Siemens LOGO! Soft Comfort: View CSAF Summary Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attac...CISA Advisory
■
ANDRITZ HIPASE-250 and 250 SCALA: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to read data from the device or gain access to affected workstatio...CISA Advisory
■
Siemens Solid Edge: View CSAF Summary Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files ...CISA Advisory
Today's brief covers Siemens Parasolid and Siemens License Server (SLS), along with key threat intelligence bulletins.
■
Siemens Parasolid: View CSAF Summary Parasolid is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This c...CISA Advisory
■
Siemens License Server (SLS): View CSAF Summary Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary f...CISA Advisory
■
Siemens Desigo DXR and PXC Controllers: View CSAF Summary A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by...CISA Advisory
■
Johnson Controls Inc. Airwall: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining...CISA Advisory
■
Johnson Controls Metasys: View CSAF Summary Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a c...CISA Advisory
Daily Brief: Johnson Controls C-CURE 9000 and Victor application server (Update A)
Today's brief covers Johnson Controls C-CURE 9000 and Victor application server (Update A) and Pulsetto Vagus Nerve Stimulator, along with key threat intelligence bulletins.
■
Johnson Controls C-CURE 9000 and Victor application server (Update A): View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The followin...CISA Advisory
■
Pulsetto Vagus Nerve Stimulator: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to use hidden commands to disable electrical safety mechanisms or mod...CISA Advisory
■
Mira Hormone Monitor, Mira Android App: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to...CISA Advisory
■
Microsoft Plugs Nearly 400 Security Holes: Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakn...Krebs on Security
■
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release: Threat actors have begun to exploit a newly disclosed Microsoft SharePoint vulnerability following the release of a proof-of-concept (PoC) code. The vulnerab...Source Advisory
Daily Brief: Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Today's brief covers Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access and Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations, along with key threat intelligence bulletins.
■
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access: Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The...Source Advisory
■
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations: Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubern...Source Advisory
■
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code: SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code executio...Source Advisory
■
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access: The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-of-concept (PoC) ...Source Advisory
■
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS: Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Softw...Source Advisory
Today's brief covers Thermo Fisher Applied Biosystems Genetic Analyzers and CISA Adds Three Known Exploited Vulnerabilities to Catalog, along with key threat intelligence bulletins.
■
Thermo Fisher Applied Biosystems Genetic Analyzers: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to modify .fsa/.hid output files, tampering with DNA data and resulti...CISA Advisory
■
CISA Adds Three Known Exploited Vulnerabilities to Catalog: CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-9198 IBM La...CISA Advisory
■
Acrisure KARR BT and DR-100: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations. The following ver...CISA Advisory
■
Canadian Man Pleads Guilty in Snowflake Extortions: A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspira...Krebs on Security
■
FBI Seizes NetNut Proxy Platform, Popa Botnet: The Federal Bureau of Investigation (FBI) said today it worked with industry partners to seize hundreds of domains associated with NetNut, a sprawling reside...Krebs on Security
Today's brief covers #StopRansomware: Gunra Ransomware and Scattered Spider Hackers Plead Guilty on Day 1 of Trial, along with key threat intelligence bulletins.
■
#StopRansomware: Gunra Ransomware: Advisory at a Glance Title #StopRansomware: Gunra Ransomware Original Publication August 10, 2026 Executive Summary Gunra is a ransomware-as-a-service (RaaS)...CISA Advisory
■
Scattered Spider Hackers Plead Guilty on Day 1 of Trial: Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the e...Krebs on Security
■
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm: For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertisin...Krebs on Security
■
Who Runs the Ransomware Group ‘The Gentlemen?’: A cybercrime group known as The Gentlemen has emerged as the second most active ransomware gang by victim count, rapidly attracting a talented pool of hacker...Krebs on Security
■
Shipping 10–50× More Code? Watch This Webinar on Securing AI-Speed Development: AI is helping development teams produce far more code, far faster. But security teams still have to review vulnerabilities, manage dependencies, prioritize f...Source Advisory
Daily Brief: CISA Adds One Known Exploited Vulnerability to Catalog
Today's brief covers CISA Adds One Known Exploited Vulnerability to Catalog and CPDLC over ATN-B1 Vulnerabilities, along with key threat intelligence bulletins.
■
CISA Adds One Known Exploited Vulnerability to Catalog: CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-8037 Progress L...CISA Advisory
■
CPDLC over ATN-B1 Vulnerabilities: View CSAF Summary ATN-B1 CPDLC relies on legacy clear text unauthenticated radio frequency links. Research demonstrates that these characteristics allow unau...CISA Advisory
■
ABB Ability Zenon: View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or ...CISA Advisory
■
Medixant RadiAnt DICOM: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file...CISA Advisory
■
Johnson Controls Inc. TL280: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. The following versions...CISA Advisory
Daily Brief: Read This Before You Buy That TV Streaming Stick
Today's brief covers Read This Before You Buy That TV Streaming Stick and LG to Ban Residential Proxies from Smart TV Apps, along with key threat intelligence bulletins.
■
Read This Before You Buy That TV Streaming Stick: Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee...Krebs on Security
■
LG to Ban Residential Proxies from Smart TV Apps: The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one's television into an always-on ...Krebs on Security
■
Microsoft Patches a Record 570 Security Flaws: Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the nu...Krebs on Security
■
Lessons Learned from CISA’s Recent GitHub Leak: The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA cr...Krebs on Security
■
Felons, Fraudsters Flog Offensive Cybersecurity Startup: A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspirac...Krebs on Security
Daily Brief: Toptech Systems RCU II+ and Multiload II+
Today's brief covers Toptech Systems RCU II+ / Multiload II+ and Watchfire Controller Software, along with 5 published security advisories.
■
Toptech Systems RCU II+ and Multiload II+: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain full system control and misuse it to access or manipulate con...CISA Advisory
■
Watchfire Controller Software: View CSAF Summary Successful exploitation of this vulnerability could allow a malicious user the ability to deliver malicious firmware that can update and ga...CISA Advisory
■
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs: CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems...CISA Advisory
■
Johnson Controls OpenBlue Employee: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files, execute stored cross-site scripting att...CISA Advisory
■
MZ Automation GmbH libiec61850: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the device. The followin...CISA Advisory
Daily Brief: NASA Core Flight System (cFS) Health & Safety (HS) Application
Coverage of NASA Core Flight System (cFS) Health & Safety and Mitsubishi Electric CC-Link IE TSN vulnerabilities.
■
NASA Core Flight System (cFS) Health & Safety (HS) Application: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. The following versions of NAS...CISA Advisory
■
Mitsubishi Electric CC-Link IE TSN Communication Protocol: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication ...CISA Advisory
■
Schneider Electric IGSS: View CSAF Summary Schneider Electric is aware of a vulnerability in its IGSS Definition module for the IGSS (Interactive Graphical SCADA System) product. The...CISA Advisory
■
Open Source Software: Security Principles and Practices: Open source software (OSS) is embedded in nearly every modern system, from business applications to critical infrastructure. Our new Open Source Software: Se...CISA Advisory
■
MikroTik RouterOS: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to extract the router's WireGuard private key in plaintext using only...CISA Advisory
Daily Brief: 2026 Minimum Elements for a Software Bill of Materials (SBOM)
Joint international guidance on 2026 Minimum Elements for a Software Bill of Materials (SBOM) and Siemens Mendix advisories.
■
2026 Minimum Elements for a Software Bill of Materials (SBOM): CISA, the National Security Agency, the Federal Bureau of Investigation, and international partners released joint guidance, 2026 Minimum Elements for a Soft...CISA Advisory
■
Siemens Mendix Runtime: View CSAF Summary Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers witho...CISA Advisory
■
CI Fortify – Advice for isolating vital systems: CI Fortify – Advice for isolating vital systemsCISA and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), in collaboration ...CISA Advisory
■
MikroTik RouterOS and Cloud Hosted Router: View CSAF Summary Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access. The fol...CISA Advisory
■
Siemens SIMATIC S7-PLCSIM Advanced: View CSAF Summary SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is prepari...CISA Advisory
Siemens Mendix Runtime: View CSAF Summary Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers witho...CISA Advisory
■
MikroTik RouterOS and Cloud Hosted Router: View CSAF Summary Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access. The fol...CISA Advisory
■
CI Fortify – Advice for isolating vital systems: CI Fortify – Advice for isolating vital systemsCISA and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), in collaboration ...CISA Advisory
■
Siemens SIMATIC S7-PLCSIM Advanced: View CSAF Summary SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is prepari...CISA Advisory
■
Siemens Desigo CC: View CSAF Summary OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or poten...CISA Advisory
CISA Adds Two Known Exploited Vulnerabilities to Catalog: CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-68686 Fortine...CISA Advisory
■
Weintek cMT3092X: View CSAF Summary Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other ...CISA Advisory
■
Rockwell Automation ThinManager: View CSAF Summary Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directori...CISA Advisory
■
Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite: Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite Executive summary A group of Russian state-suppo...CISA Advisory
■
Johnson Controls XAAP Android: View CSAF Summary Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device. The following...CISA Advisory