-
Trusted data resiliency anchors Oracle’s ransomware defense strategy
For enterprises, data resiliency ultimately comes down to an ability for useful work to continue. The definition sounds simple, yet making …
-
Google unveils Gemini 4 Argon, and cyber defenders get it first
Google has unveiled Gemini 4 Argon, the first new generation of its flagship AI model since Gemini 3 last November. A small group of …
-
MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data, and target …
-
16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows
A 16-year-old security researcher named Faav found an authentication flaw in Microsoft’s Titan analytics service that allowed him to gain …
-
OpenAI is sued over the rogue agents that hacked Hugging Face
OpenAI has been sued over the AI agents that hacked Hugging Face in July. The New York non-profit Legal Advocates for Safe Science and …
-
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under …
-
Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, …
-
iPhone Security Warning: Apple Says iOS 26 Flaw May Have Been Exploited
Apple patched an iPhone flaw that may have been exploited in targeted attacks. Here’s what iOS 26 users need to know and how to …
-
FTC opens probe into OpenAI, Anthropic and other AI labs
The US Federal Trade Commission is investigating OpenAI, Anthropic and other AI labs over the risks their technology poses to consumers. An …
-
Alex Stamos joins Cognition to make AI security affordable
Alex Stamos has joined Cognition, the maker of the Devin AI coding agent, as its chief information security officer. He announced the move …
-
InfoQ Online Cohorts Address AI Security and Coding Agent Verification
InfoQ is running two five-week online certification cohorts in October 2026. AI Security & Privacy Engineering, starting October 26, …
-
Global Group Ransomware Abuses WinMerge to Deploy Encryptor
A Ransomware-as-a-Service (RaaS) operation known as Global Group is targeting large enterprises with phishing emails that deliver a …
●●●
NVD
- CVE-2026-102794 – A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some …
- CVE-2026-96823 – Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 ...
- CVE-2026-103048 – URL redirection to untrusted site (‘open redirect’) vulnerability in The Wikimedia …
- CVE-2026-102793 – A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the …
- CVE-2026-103049 – Improper neutralization of input during web page generation (‘cross-site scripting’) …
EXPLOITS
- MikroTrick, 7.24, 7.24.2, 7.0.0, 7.23.4, 6.0.0, 6.49.21 – RCE
- CVE-2026-80428 Unauthenticated PHP Object Injection via Shibboleth – ILIAS < 9.22, 10.0 < 10.10, 11.0 < 11.3 - RCE
- Metabase 0.61.0 – Authenticated Remote Code Execution
- FreePBX 17.0.2 – Remote Code Execution (RCE)
- Ghost_CMS 6.19.0 – Remote Code Execution
SECURELIST
- MacSync under the microscope: new delivery methods and a new payload
- The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through com
- Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
- The Odyssey and trojans again: MovieReaper attacks users in multiple countries via comprom
- NightEagle targets Russian companies