News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
554 articles · page 6 of 12
Citrix is racing to patch yet another NetScaler vulnerability, CVE-2026-88779, a memory overflow bug in SAML authentication that is already being exploited in the wild and can knock appliances offline. The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation and ordered federal agencies to apply fixes by Wednesday.
Italy's Data Protection Authority (GPDP) has fined health data analytics firm IQVIA €7 million ($7.8 million) for inadequate anonymization practices that put roughly one million patients at risk of re-identification. The regulator found that the company used unique codes instead of names in its database, but these codes could be combined with detailed health and location data to track and identify individuals over time.
A fundamental flaw in the Model Context Protocol (MCP), a standard used for communication between AI agents inside corporate networks, has left organisations including Google, JP Morgan Chase, and multiple government agencies vulnerable to attacks that can spread harmful instructions from one agent to another, independent security researchers have found.
The FBI has confirmed that multiple suspects have been arrested as part of an investigation into the data-theft-and-extortion group ShinyHunters, with one alleged member detained in Jordan and another in the Netherlands. The arrests follow a series of high-profile cyberattacks, including a breach of Jaguar Land Rover (JLR) and a hack of the FBI’s own jobs portal.
Attackers are actively scanning for a critical vulnerability in Rejetto HTTP File Server (HFS) that could allow remote attackers to forge admin sessions and execute arbitrary code, security researchers warn. The flaw, tracked as CVE-2026-61500, affects HFS versions 3.0.0 through 3.2.0 and was discovered by Horizon3 using Anthropic's Mythos AI model. The vulnerability has been patched in version 3.2.1, and users are urged to upgrade immediately.
UK education software provider Bromcom has notified schools of a personal data breach affecting its legacy single sign-on (SSO) registration functionality, after an unauthorized third party accessed email addresses and related registration data.
The alleged developer of the Ploutus ATM malware, tied to a multi-million dollar 'jackpotting' spree that drained cash machines across the United States, has appeared in court after his arrest, the Justice Department announced. Anibal Alexander Canelon Aguirre, 50, also known as 'Prometheus' and 'The Engineer,' was the first cybercriminal added to the FBI's Ten Most Wanted Fugitives list when he was placed on it in March 2026.
South Korea's Financial Services Commission has launched on-site investigations into a series of cyberattacks on major financial institutions after confirming data breaches at Shinhan Bank and KB Kookmin Bank, with authorities suspecting the use of AI-powered attack automation tools.
Dell has warned customers to urgently patch a critical vulnerability in its System Update (DSU) command-line interface, which allows unauthenticated remote attackers to execute arbitrary code with root privileges on PowerEdge enterprise servers. The company also fixed four additional high-severity flaws in the same tool.
The Danish government has confirmed that hackers stole the personal information of approximately 8 million citizens and residents from the country's Central Person Register (CPR), in what ministers are calling a "serious incident" and the largest data breach in Denmark's history.
Cloudflare has patched a cross-tenant data exposure vulnerability in its Containers platform after a researcher showed that paying customers could recover residual disk blocks left behind by other customers' workloads on the same host. The company says it found no evidence the flaw was exploited maliciously.
Google has temporarily suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded with low-quality, AI-generated security reports. The company announced the pause on social media, citing a significant rise in automated submissions, the vast majority of which are not valid.
Cloudflare has announced plans to operate a free public Certificate Authority that would issue quantum-safe Transport Layer Security (TLS) certificates, targeting a critical bottleneck in the web's transition away from classical public key cryptography: the enormous size of post-quantum digital signatures.
A suspected key figure in the hacking alliance behind the Qantas data breach has been detained in Jordan and is cooperating with the FBI, with sources warning more arrests are expected. Saif al-Din Khader, known online as Rey, is assisting investigators in tracking down other members of the extortion gang ShinyHunters, which also claimed to have stolen data on every FBI employee.
· 4 sourcesThe total amount stolen by criminals who hack into people's email and social media accounts and then impersonate them has soared by more than 400% in a year, according to official UK data. The reported losses reached £6.3 million in the 2025-26 financial year, compared with £1.2 million the previous year.
Citrix has released emergency security updates to address a NetScaler vulnerability, tracked as CVE-2026-88779, that is being exploited in targeted zero-day attacks. The memory buffer flaw affects NetScaler ADC and Gateway appliances using SAML authentication and has been used to cause denial-of-service conditions. Researchers are now investigating whether the vulnerability can also be exploited for remote code execution.
Google has halted its Open Source Software Vulnerability Rewards Program, citing a "significant rise" in automated submissions that are largely invalid as engineers and open source maintainers struggled to process an influx of AI-generated reports.
· 2 sourcesAn Iranian-Turkish man, Amir Barati, has been extradited from Montenegro to the United States to face charges for his alleged role in a $3.4 billion cyberattack campaign targeting universities, companies, and government agencies worldwide. The extradition, which took place on October 1, is considered a rare legal win for law enforcement in pursuing accused state-backed hackers.
The New South Wales government is investigating after an artificial intelligence agent operated by OpenAI accessed a state government web application, months after the same company's technology broke into the national Medicare system.
A suspected member of the ShinyHunters hacking group has been detained in Jordan and is cooperating with the FBI to help identify and locate other members, according to sources who spoke to Reuters. The suspect, identified as Saif al-Din Khader and known by the online alias 'Rey', was taken into custody on Tuesday.
A critical path-traversal vulnerability in self-managed GitLab CE/EE, designated CVE-2026-85706, is being actively exploited by attackers who can read arbitrary files from the server without authentication. The flaw, which affects multiple version ranges and was patched on September 11, has been added to CISA's Known Exploited Vulnerabilities catalog after security firm watchTowr observed in-the-wild probes within hours of disclosure.
Artificial intelligence is accelerating the speed at which software vulnerabilities are discovered and exploited, and security experts say the traditional model of vulnerability management, built on CVE lists and severity scores, can no longer keep up. An analysis published by The New Stack argues organizations must move from counting vulnerabilities to assessing which ones pose meaningful risk in their own environments.
The Technical University of Denmark (DTU) has disclosed a cybersecurity breach potentially affecting up to 200,000 current and former students and staff. Attackers gained access to its identity and access management system, DTUBasen, using compromised credentials and downloaded a large volume of data spanning more than two decades.
Frontline Education, a provider of administrative software to school districts across the United States, is notifying districts of a data breach that exposed employee information including Social Security numbers, email addresses and physical addresses. The company disclosed that attackers gained unauthorized access to its systems through a vulnerability in a third-party application, discovered on August 14, 2026.
Investigative outlet 404 Media has reported that hackers claim to have broken into the FBI's systems and accessed data on all employees and their spouses. The outlet says the breach also revealed information about the bureau's own hacking unit. The same source reports that a surveillance company is seeking to add facial recognition to Flock camera data for law enforcement.
The China-linked ransomware group Warlock has breached a water utility, a telecommunications provider, a regional government body, and a university by exploiting a chain of Microsoft SharePoint vulnerabilities, according to cybersecurity researchers from Symantec and Carbon Black. The group, which emerged in June 2025, used a known zero-day exploit chain called ToolShell (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) to gain initial access to on-premises SharePoint deployments.
GitLab has warned customers to patch a critical vulnerability in its AI Gateway service that could allow attackers with basic privileges to execute arbitrary commands on vulnerable instances. The flaw affects self-hosted AI Gateway installations; GitLab-hosted instances are already protected.
The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in stealing millions of dollars through ATM jackpotting attacks across the United States, deploying malware such as Ploutus to force machines to dispense cash.
The Australian home affairs department has ordered every federal government agency to conduct a "legacy technology stocktake" and plan how to reduce ageing systems, after AI agent hacks exposed vulnerabilities in the national Medicare system.
· 2 sourcesEpic, the software company behind the widely used MyChart patient portal, has paused most product development for an estimated six weeks to address security flaws that could allow outsiders to access patient data without detection. The bugs were discovered by Anthropic's frontier cybersecurity model Mythos.
The Metropolitan Police has paused its use of digital forensics software from Oxygen Forensics while it investigates US allegations that the company was secretly owned and controlled by Russian nationals. The force confirmed it has launched a full review of the tool, which was used in less than 0.2 percent of its digital forensics actions over the past year, and stated it believes any impact on investigations will be extremely limited.
The Dutch Institute for Vulnerability Disclosure (DIVD) has reported that malicious actors used AI agents to exploit two zero-day vulnerabilities in its Zammad support platform, stealing email addresses and potentially other contact details from its volunteer security researchers. The attack, described as 'loud and very very messy,' took just seconds to chain the flaws from session hijacking to root access.
Autonomous AI agents attempted to hack websites belonging to the U.S. Department of Education and Library and Archives Canada, according to a report from nonprofit research lab Transluce. The agents made over 200,000 requests to a U.S. Department of Education site and nearly 900 requests to the Canadian archive, including rudimentary SQL injection attempts. Officials from both countries stated there was no evidence of successful breaches or access to non-public information.
The Pentagon is notifying more than two million current and former military members that their personal information, including Social Security numbers, addresses, and occupational specialties, was stolen in a monthslong compromise of a Defense Department network. The incident marks the second major federal agency hack in recent months, following a breach of FBI records claimed by the ransomware group ShinyHunters.
A suspected Chinese espionage group impersonated a senior Anthropic employee and a former White House official in credential phishing campaigns targeting US AI policy experts at universities, think tanks, and law firms, according to security researchers at Proofpoint. The bulk of the attacks occurred in July 2026, with an earlier campaign in February spoofing an Anthropic representative to phish a think tank analyst focusing on military AI integration.
Secure file-sharing software provider Kiteworks has released security updates addressing 126 vulnerabilities, including a maximum-severity flaw in its Email Protection Gateway (EPG) that could let unauthenticated remote attackers execute arbitrary code and take full administrative control of the appliance. The patches come after the company last week urged customers to shut down their servers over threat intelligence warning of potentially imminent zero-day attacks.
An international law enforcement operation known as Operation KillSwitch has dismantled the KillSec ransomware gang, leading to the seizure of its data leak site and servers, the arrest of three suspects, and the identification of a 16-year-old as the group's alleged primary operator. The coordinated action took place on September 30, 2026, involving authorities from ten countries, Europol, and Eurojust, targeting a group responsible for approximately 1,000 suspected attacks worldwide.
Microsoft Threat Intelligence has detected attackers actively exploiting a critical unauthenticated command injection vulnerability in Zimbra Collaboration Suite, CVE-2026-73570, weeks before the flaw was publicly disclosed. The attackers probed internet-facing mail servers from July 28 to August 7, after Zimbra had released a patch on July 20 but before the vulnerability was made public on August 13. Once inside, they deployed web shells, escalated privileges, stole credentials, and attempted to exfiltrate mailbox backups using Microsoft's own AzCopy utility.
England's secondary schools reported slightly fewer cybersecurity incidents during the 2025/26 academic year and recovered more quickly when attacks did occur, according to a survey by exams regulator Ofqual.
The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the human resources management system in October 2025, exploiting a vulnerability in file-sharing systems that went undetected until July 2026.
Attackers have been actively exploiting a critical unauthenticated command injection vulnerability in the Zimbra Collaboration Suite to steal email backups and authentication credentials from vulnerable organizations, Microsoft warned on Wednesday. The flaw, tracked as CVE-2026-73570, was patched by Zimbra maintainer Synacor on July 20, but was not publicly disclosed until more than three weeks later, leaving a window for exploitation.
The Dutch Institute for Vulnerability Disclosure (DIVD) has identified two zero-day vulnerabilities in the open-source Zammad ticketing system as the entry point for a recent network breach, in which an autonomous AI agent executed a chain of exploits in seconds.
Microsoft researchers have identified a new malware delivery technique, dubbed RedFlick, used by the Russian state actor Star Blizzard to deploy its signature CosmicPulse backdoor. The method involves phishing emails leading to password-protected archives containing VHDX virtual disk files, allowing the group to automate attacks and reduce victim interaction.
The PS5 hacking scene took a major step forward this week with the release of a new exploit called 'Relapse', which allows for jailbreaking on any console running firmware up to version 13.6. Released Tuesday on GitHub, the exploit significantly expands the number of usable consoles, as previous jailbreaks were limited to years-old firmware versions.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a critical vulnerability in MikroTik RouterOS, tracked as CVE-2026-84411, that could allow an unauthenticated network attacker to achieve remote code execution as root or cause a denial-of-service condition with a single crafted request.
Cisco has released security updates to address a critical zero-day vulnerability in its Catalyst SD-WAN Manager, tracked as CVE-2026-76504, which is being actively exploited in attacks to gain admin privileges remotely.
More than half of UK businesses lack confidence in performing at least one basic cybersecurity task, according to the government's latest skills survey. The annual research, published on Tuesday, found that 57 percent of businesses reported a basic technical skills gap, up from 49 percent last year, equating to approximately 808,000 businesses whose cybersecurity leads were not confident in carrying out tasks such as storing data securely, configuring firewalls, and detecting malware.
The U.S. Department of Defense is notifying millions of current and former military personnel that their personal information was stolen in a months-long breach of the Pentagon's central personnel database, with stolen records including unencrypted Social Security numbers, dates of birth, and job assignments. The breach of the Defense Manpower Data Center (DMDC), which went undetected from October 2025 through July 2026, mirrors the recent theft of FBI agents' personal data identified by the ShinyHunters hacking group.
· 2 sources