Archive
All articles, newest first. Page 4.
October 2026 Patch Tuesday: 1,413 CVEs and the 'Risk Cohort' Stress Test
Microsoft shipped its largest Patch Tuesday ever on October 13, 2026 — 1,413 CVEs. Three zero-days demand immediate attention, includi…
Meta Notifies 1,500 People After GitHub Breach Exposes Personal Data and Source Code
Meta is notifying roughly 1,500 individuals, mostly U.S. employees, after an unauthorized GitHub repository access via stolen employee…
Vercel Sandbox: AI Agents Bypass Network Restrictions via Manipulated Certificates
AIR researchers have demonstrated a vulnerability in the Vercel Sandbox that allows confined AI agents to exfiltrate sensitive data by…
Ivanti's Partial Patch Leaves Third Flaw Open in Zero-Day CVE-2026-104935
Ivanti released a partial fix on October 13, 2026 for the zero-day CVE-2026-104935 in Connect Secure, already exploited by threat acto…
Docker Hub IAM Bug Exposed 304,000 Pushes to Impersonation Risk for 26 Months
A critical vulnerability in Docker Hub, disclosed October 12, 2026, allowed attackers to impersonate legitimate users and manipulate t…
LiteLLM: RCE and Authentication Bypass for Authenticated Users
Multiple critical vulnerabilities in the open-source LiteLLM gateway allow any authenticated user to achieve remote code execution, ar…
LG webOS: Three-Flaw Chain Enables Pre-Auth Root Takeover from Local Network Without PIN
Three vulnerabilities in LG webOS chain together to grant an attacker on the same local network pre-authentication root access on cert…
Anthropic: Small AI Models Ready to Self-Replicate on IoT Devices
Anthropic's Frontier Red Team research demonstrates that models up to 30 billion parameters can run distributed inference on $55 TV bo…
Kimsuky Abuses GitHub and Zoom for Ukrainian Espionage: How It Works
North Korean APT group Kimsuky targeted Ukrainian experts using GitHub, GitLab, and Codeberg for payload delivery and data exfiltratio…
ADB-Enabled Exploit Unlocks Bootloader, Grants Persistent Root on Amazon Fire TV Cube 3
A public exploit package for the third-gen Amazon Fire TV Cube (codename gazelle) chains CVE-2026-43499 (Ghostlock) with a separate bo…
FortiMail Zero-Day CVE-2026-104286: CISA Sets Three-Day Deadline Before Patches Are Ready
Fortinet disclosed a CVSS 9.8 zero-day in FortiMail's IBE component that is under active exploitation. CISA added CVE-2026-104286 to t…
AI Completes OT Attack Chains in 16 Minutes: The Booz Allen Test
Two frontier AI models executed eight attack objectives against industrial systems in an isolated lab, moving from perimeter compromis…
Ransomware: Data Exfiltration Surges 275%, Terabytes Become the New Extortion Lever
The 2026 ThreatLabz report documents an explosion in data theft: 896.2 TB exfiltrated, a 275.8% increase. The terabyte replaces encryp…
Qilin Member Extradited to Germany: Gang Adds Over 450 Victims to Leak Site
A 28-year-old Russian national was extradited from Japan to Germany on October 2, 2026. Qilin did not pause: the group added more than…
Cybersecurity and AI Safety: The 24-Hour Playbook the GCRAI Wants to Replicate
A former Intel executive and GCRAI commissioner argues that AI safety must adopt three proven cybersecurity maturities—demonstrable co…
AI Agent Re-grades 10,000 Cloud Alerts: Three-Quarters Had the Wrong Severity
Sola Security study of 9,967 HIGH findings: 58.5% downgraded, 16.6% upgraded. Static CSPM vendor severities do not reflect real risk i…
Denmark Data Breach: '123456' Password Exposes 8.8 Million Identities
A two-person IT firm with legitimate access to Denmark's national CPR register became the entry point for a massive data extraction. U…
Phishing Now Strikes Twice: The Human and the AI Assistant
Barracuda Research has documented phishing campaigns that exploit HTML comments, invisible CSS, and zero-width characters to manipulat…
Genuine Check Passed: The Secure Element Was Genuine, But the Hardware Was Compromised
Ledger confirmed an unauthorized hardware implant in a Nano X sold by CryptoBilis. The chip captures display output and button presses…
Apex Accelerator: Fake Web3 Audits Deliver npm Malware
A threat group built a sham Web3 accelerator to distribute infostealer malware via malicious npm packages, weaponizing security audits…
French Supermarket Fridges Hacked: Outdated Danfoss Firmware, Temperatures Forced to 50°C
Hundreds of French stores hit in attack on Danfoss refrigeration controllers. Unpatched firmware, temperatures forced to 50°C, physica…
iRhythm Breach Hits 360,000 Patients; No Public Leak After Ransom Demand
iRhythm Technologies disclosed a data breach affecting over 360,000 patients via social engineering on third-party business applicatio…
AvisLoader: Windows Malware Loader Uses Encrypted P2P to Resist Disruption
AvisLoader is a Windows malware loader featuring encrypted peer-to-peer communications, shortcut-based persistence, and ClickFix deliv…
Luna Moth Leaks: The Criminal Enterprise Behind $207 Million in Extortion
Leaked files from Luna Moth expose a structured criminal organization operating like a business, complete with vishing scripts, role s…