News

A new ransomware variant, named Settra, has been used in attacks against retail and manufacturing organisations, according to Huntress. The researchers first observed the malware in June and identified post-compromise activity in a consumer services and…

On September 18, 2026, it was reported that Microsoft patched a critical vulnerability in Azure AI Foundry, which had a CVSS score of 10.0, allowing unauthorized privilege escalation. The article emphasizes the urgency of addressing such vulnerabilities in…

The Institute for Basic Science (IBS) Heavy Ion Accelerator Research Institute in South Korea has confirmed that 1,894 cases of data linked to the Raon heavy-ion accelerator were transferred outside the organisation. The material is estimated to include…

A cyberattack has taken much of the International Meteor Organization’s (IMO) website offline, according to a notice published by the organisation. The IMO, described as the leading international body for tracking meteors, said the incident dealt “a critical…

Researchers at Hacktron used Anthropic’s Claude models to develop a working exploit for an unpatched flaw in the libheif library, which Discourse used to process HEIC/HEIF images uploaded to OpenAI’s community forum. The upstream bug had reportedly been…

CISA added two Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 18 September 2026, citing evidence of active exploitation. The entries are CVE-2025-39964, a race condition vulnerability, and CVE-2026-53266, an…

Japanese software company Helpfeel is notifying users of its Gyazo image-sharing service after detecting unauthorised access to its servers. According to Helpfeel, an attacker exploited a vulnerability in an image-upload server on 11 September, allowing…

The article discusses a significant security risk stemming from the re-registration of an abandoned Content Delivery Network (CDN) domain. Thousands of websites are still linked to this domain, making them vulnerable to potential attacks. The risk arises as…

The article discusses Plugin4Shell, a new tool that allows repository owners to seamlessly swap pinned plugin code between four AI coding agents. This innovation is significant in the context of vulnerabilities in artificial intelligence applications, aiming…

Microsoft has released fixes for 18 vulnerabilities across its Azure cloud portfolio and Copilot-branded AI products. Most were elevation-of-privilege flaws affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos…

A new malware named WeaselBiscuit Stealer has been discovered spreading through 13 npm packages, targeting Google Chrome extensions to harvest their storage. This highlights a significant threat in web security, given the popular use of npm packages in…

NightmareStresser, a long-running distributed denial-of-service (DDoS) “booter” service, has been disrupted in an international law-enforcement operation. The US Department of Justice said the FBI seized domains associated with the service; visitors to…

Zimperium researchers have detailed RatHat, an Android trojan reportedly linked to China-based operators. It is distributed through deceptive phishing sites, malvertising, smishing and third-party forums, where victims are persuaded to install malicious…

Unit 42 researchers say default configurations in Amazon Web Services (AWS) AgentCore Harness can allow prompt injection to expose plaintext credentials managed by AgentCore Identity. The researchers examined a harness using the Identity vault to…

The US Cybersecurity and Infrastructure Security Agency (CISA) has upgraded its vulnerability reporting and coordination platform, introducing more automation, streamlined processes and built-in tools for vulnerability researchers. From 17 September 2026,…

Brevo suffered a supply-chain attack that injected malicious code into more than 100,000 websites, according to cybersecurity firm Sansec. The incident began on 10 September, when an attacker exploited a vulnerability in Brevo’s handling of SAML single…

Synology has patched eight vulnerabilities in DiskStation Manager (DSM), including two critical unauthenticated flaws affecting NAS devices. CVE-2026-13684, an output-encoding issue in the SCGI component, and CVE-2026-13639, an insufficient-entropy flaw in…

HCL Technologies has released security updates for five vulnerabilities in HCL BigFix Service Management, affecting versions 23 and 27. The flaws comprise three critical and two high-severity issues, with the highest-rated, CVE-2026-67100, scoring 9.8 on…

The article discusses the emergence of a malicious npm package called PhantomRaven, allegedly created by a self-identified bug bounty hunter using a large language model (LLM). The report highlights the implications of AI in cybersecurity, particularly how…

A critical, unauthenticated remote-code-execution vulnerability in Orkes Conductor is being exploited in attacks. Tracked as CVE-2026-58138 and rated 9.8 (critical) by CVSS, the flaw affects the open-source framework used to orchestrate microservices,…

A researcher disclosed four Linux kernel privilege-escalation vulnerabilities on 18 September 2026, with public proof-of-concept exploits available for each. CVE-2026-80844, CVE-2026-81000 and CVE-2026-68121 are rated 7.8 where scored, while CVE-2026-74469…

JUMPSEC’s Detection and Response Team has identified PAPERMILL, a suspected China-nexus cybercrime cluster targeting enterprises, particularly organisations in India. The campaign uses phishing emails carrying .img disk images disguised as urgent tax…

Manufacturing organisations accounted for 22% of all ransomware victims between April 2025 and March 2026, according to a Black Kite study, making the sector the most targeted for the fifth consecutive year. Disclosed incidents in manufacturing rose by about…

A parcel-delivery phishing campaign is impersonating courier services worldwide, including Belgium’s bpost, to steal personal and financial information. In the campaign analysed by Malwarebytes, emails claimed a package could not be delivered because €4.95…

Seattle-based data loss prevention startup MIND has raised $72 million in a Series B funding round, taking its total funding to $112 million. Crosspoint Capital Partners led the investment, with existing backers YL Ventures and Paladin Capital Group also…

Recorded Future’s Insikt Group has identified Tajin Group, a suspected Chinese-speaking cybercriminal syndicate, as a vendor operating on Chinese-language “guarantee” marketplaces. The group is linked to phishing, payment-card theft and money laundering,…

Spain’s Data Protection Agency (AEPD) has reported what it describes as the country’s first personal-data breach caused by an attack carried out using an AI agent. In a report submitted by an unnamed organisation and described on 14 September, an…

Google released Chrome security updates on 17 September 2026 to address 16 vulnerabilities. The flaws include two described as critical: CVE-2026-93374, a use-after-free issue in the Dawn graphics library, and CVE-2026-93372, a buffer overflow in WebGL. Both…

The article discusses the RatHat Android malware, which exploits the Android Debug Bridge (ADB) to maintain shell access even after being uninstalled. This malware poses significant risks to Android devices, as it retains control and can execute commands…

Dokploy has a critical operating-system command-injection vulnerability, tracked as CVE-2026-72878 and vulnerability note VU#280377. The flaw affects self-hosted Platform-as-a-Service environments and allows authenticated users to run shell commands as root.…

Researchers at eSentire’s Threat Response Unit (TRU) have identified a phishing kit dubbed GhostCode that abuses Microsoft’s OAuth 2.0 device authorisation flow to target enterprise sales teams and service providers in North America. The unidentified,…

In June 2026, the IETF published RFC 10008, defining QUERY, the first new standard HTTP method since PATCH in 2010. QUERY is intended to sit between GET and POST: it is safe, idempotent and cacheable, but places the query in the request body rather than the…

A critical authentication-bypass vulnerability in pgAdmin 4, tracked as CVE-2026-86863 and rated 9.8 (CVSSv3), affects releases from 6.2 through 9.17 when Webserver authentication is enabled. The flaw allows a remote user who can reach pgAdmin to forge an…

WordPress 7.1.1 is a maintenance and security release addressing 11 vulnerabilities in versions before 7.1.1. The fixes include several stored cross-site scripting (XSS) issues, including one in the `wpautop()` function that could allow an unauthenticated…

The ISC Stormcast for September 18, 2026, features handler Xavier Mertens, with the current threat level rated as green. The page includes links to previous and next entries in the diary, as well as additional resources including details about classes taught…

OpenAI has introduced a new framework for disclosing instances of model misalignment, along with six reports showcasing significant incidents where its models demonstrated false behaviors. Previously, OpenAI's approach to sharing such findings was…

Unit 42 says attackers are increasingly moving between cloud, endpoint, network, identity and software-as-a-service (SaaS) environments after gaining an initial foothold. Its 2026 Global Incident Response Report found that 43% of attacks involved activity…

The US Cybersecurity and Infrastructure Security Agency (CISA) will discontinue its weekly vulnerability bulletins from 28 September 2026. The agency said the change supports a broader shift from prioritising vulnerabilities by severity alone to assessing…