Cybersecurity News

CVE-2026-21589 is a critical Atlassian vulnerability under active attack against self-hosted products. Administrators should patch every node and mirror immediately, isolate systems that cannot yet be upgraded, inspect access logs, and treat exposed Crowd credentials as compromised. Atlassian disclosed the unauthenticated file-access flaw on October 5, 2026, with a CVSS 4.0 score of 9.3. What

PoeLLM malware had compromised more than 3,400 servers by October 7, 2026, according to Lumen Black Lotus Labs and independent reporting. The active Canto Incognito campaign targets exposed services including LiteLLM, Ollama, Gotenberg and Gitea, then installs cryptocurrency miners and reuses infected hosts to scan for more victims. Operators should restrict exposure, patch services and

The AhsayCBS vulnerabilities require immediate action from backup administrators and managed service providers. AhsayCBS 10.3.4.0 remains exposed; Ahsay instructed version 10 partners on October 10, 2026, to install hotfix 10.3.4.45 and reboot. Restrict the management interface now, hunt for webshells and disguised miners, and rebuild a server from trusted backups if compromise is found. What

The Claude ClickFix attack used a Google sponsored result that displayed a trusted Bing address but led macOS users to a counterfeit Claude installer. Documented by Push Security and BleepingComputer on October 9, 2026, the page showed Anthropic’s real installation command while its Copy button placed a different command on the clipboard. The final downloaded

AgentCorruption AWS research showed how one exposed Amazon Bedrock AgentCore agent could reveal temporary role credentials and open paths to neighboring agents in the same AWS account and Region. Published by Zenity Labs on October 8, 2026, the controlled attack relied on network-capable tools and excessive IAM permissions. It was not an AWS-wide breach, and

ARTEX AI cyberattacks targeted South Korean financial organizations in September and October 2026, according to CrowdStrike. Exposed records showed an attacker using ARTEX, Claude Code sessions, proxies and several large language models to support data-exfiltration activity. The evidence documents AI-assisted intrusion workflows, but it does not show that Anthropic’s Claude was compromised or identify a

CVE-2026-97229 is a critical GitLab vulnerability that can allow unauthenticated remote code execution through a crafted regular expression in CI/CD configuration. Self-managed administrators running affected GitLab 19.2, 19.3, or 19.4 releases should install version 19.2.8, 19.3.5, or 19.4.2, respectively. GitLab.com was already patched when GitLab disclosed the flaw on October 12, 2026. What is CVE-2026-97229?

The Elementor CSRF vulnerability affects Elementor Website Builder 4.3.0 and 4.3.1 and can let an attacker create a rogue WordPress administrator after a logged-in admin opens a crafted link. Elementor fixed CVE-2026-62062 in version 4.3.2 on September 24, 2026. Cross-site request forgery, or CSRF, is an attack that makes an authenticated browser perform an action

Best password managers 2026 tested for security and usability The next breach story often starts with something boring, a reused password, an old credential, a login saved in the wrong place. That became painfully clear in mid-2025, when attackers used stolen Snowflake credentials to compromise 165 companies, with names like Ticketmaster, Santander, and AT&T caught

Poper Blocker spyware allegations show that Chrome Web Store badges, ratings and user counts aren’t security guarantees. On September 28, 2026, Bay Area Labs reported observing the extension transmit complete visited URLs, referrers, browser identifiers and interactions with major AI services. Poper Blocker remained listed on October 1, 2026, with 2 million users, a Featured

The JFrog Artifactory vulnerability requires more than a software update. Upgrade every self-hosted instance to a fixed release, then assume attackers may already have minted administrator tokens. Revoke suspicious credentials, inspect administrators, SSH keys and Groovy plugins, rotate exposed cluster keys, and verify stored artifacts against trusted records. Active exploitation was documented in August and

Most cybersecurity teams assume their threat detection systems capture everything that matters. They monitor network traffic, endpoint activity, and access logs. But they miss something fundamental: they have no visibility into whether anyone actually verified that a security guard was physically present at a critical location when they claimed to be there. Systems that allow

AI Governance Is Moving From Policy to Runtime because autonomous agents can take consequential actions between scheduled compliance reviews. Effective governance now checks identity, permissions, tools, data scope and approval state before each action, then records the result and preserves a tested way to stop the agent. Prompts still guide behavior. They can’t serve as

The GitLab vulnerability tracked as CVE-2026-85706 lets an unauthenticated attacker read arbitrary server files under certain conditions. It received a CVSS 3.1 score of 10.0, was under active exploitation by September 11, 2026, and can expose secrets that lead from GitLab into CI/CD systems and production. Self-managed administrators should upgrade to GitLab 19.1.8, 19.2.6 or

Magento StyleSmuggler is an actively exploited Adobe Commerce and Magento Open Source zero-day. Adobe identifies it as CVE-2026-75650, a critical unauthenticated code-execution flaw with a CVSS 10.0 score. If you run an affected store, apply Adobe’s VULN-39341 hotfix now, rotate encryption keys and credentials, then hunt for persistence. Patching alone may close the hole, but

The SAP OVERPASS vulnerability is CVE-2026-44756, a critical SAP Extended Passport processing flaw fixed by SAP Security Note 3747649 on September 8, 2026. SAP rated it CVSS 10.0. If exploited, it can let an unauthenticated attacker reach kernel-level code before login and, according to Onapsis, execute operating-system commands in the SAP installation owner or admin

September 2026 Patch Tuesday is a record-scale Microsoft release, but your first move is simple: patch the two exploited zero-days, CVE-2026-81963 and CVE-2026-85880. Then move to internet-facing servers and potentially wormable remote-code-execution bugs, especially Exchange Server and Remote Desktop Services. Don’t chase the biggest CVE number first. Chase reachable risk. September 2026 Patch Tuesday: why

A BGP hijacking attack can poison software updates when attackers reroute an update server’s IP traffic, obtain believable TLS coverage, and serve a modified package to clients that don’t verify signed artifacts. The August 2026 Virtualizor incident showed the chain clearly: routing control first, certificate validation second, update compromise third. HTTPS helped less than many

AI coding agent security has changed the risk of cloning an unknown repository. A repo isn’t just source code once an agent can read instructions, load settings, run Bash, install packages, and push commits. Treat untrusted Git projects like executable software: isolate them, disable broad permissions, pin agent versions, and never expose production secrets to

A BGP hijacking attack redirected Softaculous and Virtualizor update traffic to an attacker-controlled server between August 28 and August 30, 2026, letting malicious Virtualizor packages reach a handful of installations. The short lesson is uncomfortable: HTTPS can prove you’re talking to a domain only if routing and certificate issuance haven’t been bent first. Update systems

The PaperCut vulnerability to act on now is the August 2026 NG/MF emergency: CVE-2026-82078, a Critical CVSS 9.4 unsafe dynamic class-loading flaw, and CVE-2026-81578, a High CVSS 8.8 authentication-bypass flaw. If you run PaperCut NG or PaperCut MF, install Emergency Patch Release 3 for v24, v25, or v26 and restrict web interface access to trusted

The TerminalFix attack is a ClickFix-style social engineering campaign that tricks users into pasting malicious PowerShell into Windows Terminal. Reported by Microsoft on August 28, 2026, it uses fake Cloudflare CAPTCHA overlays, downloads a ZIP, abuses DLL sideloading, hides payload data in PNG pixels, and ends with a Python reverse-tunnel implant. Treat any infected host

Autonomous red teaming uses AI and automation to run authorized attacks against your systems before real intruders do. It can repeat tests, validate exploitable weaknesses, and check fixes faster than a traditional annual penetration test. It isn’t a replacement for skilled red teamers yet. The best use in 2026 is narrower: continuous offensive-security validation with

Online payment security isn’t the most exciting topic. But it’s one of those things you really can’t afford to ignore. Whether you’re running a small business or just trying to buy something without getting your card details stolen, knowing how to navigate this stuff can save you a serious headache down the road. Here’s a

Back in the day, enterprise security leaned on perimeter controls and signature matching. Meanwhile, analysts patiently reviewed yesterday’s logs. However, that rhythm no longer fits. Cloud workloads appear overnight Identities move across platforms Attackers hide harmful activity among ordinary administrative actions. SIEM now sits closer to the operational center. It connects scattered events before weak

Cyberattackers have grown smarter in the past couple of years. Let us show you how with this scenario: It’s 2 o’clock in the middle of the night. A legitimate credential just authenticated from a country the employee has never visited. But the credentials were accurate. The user logged into the system and pulled out some

UEBA user behavior analytics helps security teams catch threats by learning what normal activity looks like for each user, device, host, application, and IP address, then flagging behavior that no longer fits. It’s most useful for insider threats, account takeovers, lateral movement, and unusual data access. It won’t replace endpoint security or identity controls, but

The Verizon DBIR 2026 marks a real break in breach patterns: vulnerability exploitation is now the top entry point, behind 31% of breaches. Stolen credentials fell to 13%, while phishing accounted for 16%. The practical answer is blunt. If you still treat patching as back-office hygiene, you’re defending yesterday’s breach model. Verizon DBIR 2026: the