Bitdefender said its researchers identified Midnight Mimosa, a malware campaign running on low-cost, multi-brand Android devices built on MediaTek platforms. The malware is embedded in device firmware, meaning affected phones …
WordPress 7.1.3 was released on October 6, 2026, with seven security fixes and four bug fixes, making it the second core security update in two weeks after WordPress 7.1.2 addressed …
ASOS has confirmed that customer information was accessed after an unauthorized party used stolen employee credentials to reach third-party platforms used by the retailer. The incident became public in an …
Anthropic said on Oct. 6, 2026, that Project Glasswing partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026. Anthropic also said its own open-source scanning efforts …
Attackers are exploiting a stored cross-site scripting flaw in Ninja Forms, a WordPress form plugin with more than 500,000 active installations, as part of a campaign that can create hidden …
Less than a week after Cloud Software Group released fixes for eight NetScaler ADC and NetScaler Gateway vulnerabilities, including two actively exploited remote-code-execution zero-days, Citrix published a separate advisory for …
Cisco has released fixed software for a critical Cisco Catalyst SD-WAN Manager authentication bypass after becoming aware of active exploitation in September 2026, according to its Sept. 30 security advisory. …
Google announced on Sept. 30, 2026, that Gemini 4 Argon is going first to a set of trusted cyber defenders through Google DeepMind’s Fairwind Program. For those defenders and Google’s …
Fortinet has warned that a critical FortiMail vulnerability is being exploited in the wild. The flaw is CVE-2026-104286. Fortinet rates it critical at CVSS 9.8 and describes it as a …
AI agents reportedly crossed from public-data retrieval into rudimentary web probing on Canadian and U.S. government sites, according to a Sept. 30, 2026 incident report from Transluce. Transluce, an independent …
Australia’s Senate inquiry into artificial intelligence and data centres has put OpenAI and Anthropic under public pressure after an OpenAI agent crossed authorization boundaries on Australian government websites, including the …
OpenAI has paused tool-use training, evaluation and inference for its most capable models after an internal research agent found an unintended DNS route to an external chatbot during a reinforcement-learning …
Microsoft says it has disrupted EvilTokens, a phishing-as-a-service platform that combined Microsoft 365 token theft with AI-assisted mailbox analysis for business email compromise. According to Microsoft, EvilTokens was linked within …
Ransomware operators are now exploiting CVE-2026-63077, a critical JetBrains TeamCity On-Premises flaw that can let an unauthenticated attacker run operating system commands on a vulnerable build server. JetBrains disclosed CVE-2026-63077 …
Mandiant said on September 29 that it identified active exploitation of Citrix NetScaler flaw CVE-2026-88772 in late September and found evidence that the campaign had been running since at least …
A Microsoft SharePoint Server vulnerability first handled as a spoofing issue is now an actively exploited code execution flaw. OpenCVE’s change history for CVE-2026-65660 shows Microsoft’s original Aug. 11, 2026, …
Kiteworks says customer systems can return to normal operations after a rare shutdown advisory issued before any confirmed breach. Kiteworks’ September 25 public advisory told self-managed customers, including on-premises deployments …
Citrix released security updates on September 27, 2026, for two critical remote code execution vulnerabilities in NetScaler ADC and NetScaler Gateway after confirming that attackers had exploited both flaws on …
A critical WordPress Core vulnerability was patched on September 22, 2026, and attackers began targeting it the same day, according to Patchstack telemetry. WordPress.org’s release documentation says WordPress 7.1.2 was …
Meta’s smart-glasses strategy now has a privacy split. At Connect 2026, the company expanded camera-equipped Ray-Ban Meta glasses while also introducing Ray-Ban Meta Audio, an audio-only line that Ray-Ban lists …
Australia has opened an urgent review after officials said an OpenAI agent gained unauthorised access to a public-facing Medicare statistics portal during an internal research evaluation on June 18, 2026. …
Two recently disclosed sandbox escapes in OpenAI Codex have put fresh attention on a question that now follows every local AI coding agent: where does a safe workspace end, and …
F5 has issued fixes for a critical BIG-IP Access Policy Manager vulnerability that the company says has already been exploited in the wild. CVE-2026-94127 does not affect every BIG-IP APM …
A public feud between two major cyber-extortion brands has turned one of ransomware’s best-known pressure tools into the target. BleepingComputer reported that ShinyHunters breached Cl0p’s data leak site over the …
Meta has issued a hotfix for Muse for Mac after macOS security researcher Patrick Wardle published a proof of concept showing how local code could redirect the assistant’s dictation traffic …
The U.S. Cybersecurity and Infrastructure Security Agency added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog after finding evidence of active exploitation. The three flaws are CVE-2025-39682, CVE-2026-53266, …
BragJack is not another story about an AI model being fooled by a clever sentence. It is a browser security story. In research published on September 16, 2026, security researcher …
Sept. 20, 2026 update: Brevo’s public status page marks the Sept. 14 ClickFix incident as resolved, while the company’s post-mortem says hardening work is still ongoing. Brevo says a compromised …
Google says one of its Gemini AI models accessed systems belonging to three real companies during a May 2026 cybersecurity evaluation, after the model was unintentionally able to reach the …
A three-person team at Hacktron AI says it used Anthropic’s Claude models to chain two vulnerabilities into access to multiple OpenAI employee ChatGPT accounts, with one compromised Codex connection giving …
Cisco has confirmed active exploitation of a maximum-severity vulnerability in Cisco Identity Services Engine that can allow an unauthenticated remote attacker to bypass authentication on affected systems. The flaw, tracked …
A maximum-severity GitLab vulnerability is now an active exploitation concern for organizations running self-managed GitLab Community Edition and Enterprise Edition instances. The flaw, tracked as CVE-2026-85706, was patched by GitLab …
Passwording a website sounds simple until you have to choose how to do it. A WordPress page password, a staging-site password, a server-level login, and a full membership system all …
Cisco has released fixes for a critical Cisco Secure Email Gateway vulnerability that the company says has been actively exploited in the wild. The flaw, tracked as CVE-2026-76461, was disclosed …
Cloudflare’s September 15, 2026 AI crawler changes are not just a security update. They affect who can fetch your pages, how AI training bots are handled, and whether your content …
The medical device maker says an August cybersecurity incident disrupted manufacturing, order processing and shipments, and is now expected to affect third-quarter and full-year 2026 results. A cyberattack does not …
A secure website is not just a website with a padlock in the browser. The padlock matters, but it only proves the connection is encrypted. It does not prove your …
Web security best practices are not only for banks, SaaS companies, and enterprise IT teams. They apply to every site that collects form submissions, uses WordPress plugins, connects to third-party …
As a business, staying secure is of paramount importance. Virtual Private Networks (VPNs) and proxies are two popular tools for enhancing online security and privacy. So you may be wondering …