News

The article is a webinar promotion rather than a cybersecurity news report. It advertises a session on governing enterprise AI agents, reducing excessive access and controlling “shadow AI”. The promotional text claims that AI agents are operating inside…

The article discusses the Carbonato botnet, which compromises Docker hosts to deploy a Telegram-controlled Hermes AI agent. This security threat highlights vulnerabilities in cloud infrastructure, emphasizing the need for enhanced cybersecurity measures. The…

The District of Columbia Department of Health Care Finance (DHCF) is notifying 399,086 Medicaid and DC Healthcare Alliance beneficiaries that their personal information may have been exposed. The affected people enrolled between 2023 and 2026. DHCF said the…

Mandiant and the Google Threat Intelligence Group (GTIG) have warned that the ShinyHunters extortion group, tracked by Google as UNC6240, is conducting a fresh mass-exploitation campaign against Oracle PeopleSoft customers. PeopleSoft is used by large…

A New Mexico jury has found Facebook, owned by Meta, liable for deceiving users about privacy protections and misleading the public about investigations into third-party applications that harvested user data. Prosecutors said the case involved a personality…

Nvidia has announced the Open Agent Safety Platform, combining open-source software with a reference system design intended to keep AI agents within defined boundaries from testing through deployment. Its two main components are OpenShell, a sandboxed…

Model Context Protocol (MCP) servers are creating a governance gap for organisations deploying AI, according to research by Ox Security. MCP lets AI applications connect to external tools and data, including APIs and databases, without developers writing…

Kiteworks, the secure data-sharing provider formerly known as Accellion, advised customers to shut down on-premises and customer-hosted servers for a “nine-hour precautionary shutdown” after receiving credible threat intelligence from federal authorities.…

OpenAI is reportedly preparing to unveil a persistent AI assistant codenamed “O” at its DevDay conference in San Francisco on 29 September. The report attributes the claim to confidential sources and says it is not yet confirmed by OpenAI. The alleged…

Jamf Threat Labs says it has identified an active campaign distributing PamStealer, a macOS information stealer, through websites impersonating cryptocurrency platforms. The lure is a fake multi-chain wallet called Wavel, delivered in a malicious DMG file.…

CISA has reported that attackers are exploiting two critical vulnerabilities in Citrix NetScaler devices. These flaws pose significant risks to network security, especially for organizations using Citrix technology. The vulnerabilities allow unauthorized…

Group-IB researchers have identified a new Android banking trojan, RemControl, operated by a group they track as UNKK. The malware is being distributed through malicious adverts on Meta platforms that lead users to fake Google Play pages offering a free…

The SOCRadar Threat Research Unit says the suspected North Korean group Konni, also tracked as TA406 and Opal Sleet, began a targeted cyber-espionage campaign in early August 2026 against foreign-policy think tanks, diplomatic organisations and…

Roundcube Webmail vulnerability CVE-2026-48842, rated 8.1 by CVSS, is being exploited in the wild, according to an advisory from the Canadian Centre for Cyber Security published on 21 September 2026. The flaw affects Roundcube 1.6.x versions before 1.6.16…

Windows 11 still supports the legacy 8.3 file-naming system inherited from MS-DOS. On modern file systems such as NTFS, this creates shortened aliases for long file names, often containing a tilde (~), despite Windows supporting much longer names.…

Kiteworks told customers worldwide to temporarily isolate their secure file-transfer servers after receiving sensitive intelligence from unnamed federal authorities about a possible attack against certain deployments. The initial customer notice requested a…

GitHub has suspended new account registrations using Outlook and Hotmail email addresses. Applicants attempting to sign up with either domain reportedly receive an error saying that the address cannot be verified. Existing GitHub accounts registered with…

Microsoft has enabled a mouse-pointer locator in Windows 11 beta build 26220.9568, alongside expanded pointer-colour customisation. The changes are available under Settings > Accessibility > Mouse pointer and touch. Users can choose preset colours or create…

Canonical is changing Ubuntu’s stable kernel update process in response to the growing volume of vulnerability reports. Instead of a standard four-week cycle, with separate two-week emergency security releases, it plans to use overlapping two-week Stable…

Brad Duncan has analysed malware delivered through the active “Macfinger ClickFix” campaign, which uses injected scripts on legitimate websites to display fake CAPTCHA or bot-protection pages. Victims are instructed to paste commands into Terminal, causing a…

CVE WATCHTOWER recorded 2,825 new vulnerabilities between 21 and 27 September 2026, including 221 rated Critical and 218 scoring CVSS 9.0 or higher. Daily Cybersecurity identified nine flaws being exploited, eight of which were also added to CISA’s Known…

SentinelOne says the suspected North Korean group TraderTraitor, also known as UNC4899, Jade Sleet and PUKCHONG, used fake recruitment exercises to compromise a developer workstation at an IT services company outside the cryptocurrency sector. The attackers…

Apple has issued patches for a local privilege-escalation vulnerability in macOS CoreServices, tracked as CVE-2026-43786 and rated 7.8 (High) under CVSSv3. The flaw affects versions before macOS Sequoia 15.8, Tahoe 26.7 and Golden Gate 27. A malicious…

CISA has added CVE-2026-88772 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects Citrix NetScaler ADC and NetScaler Gateway and is an improper restriction of operations within the bounds of a memory buffer that could permit…

Cloudflare’s 2026 annual founders’ letter says the internet is undergoing its biggest transformation since the company launched on 27 September 2010, driven by AI-assisted development and rapidly increasing automated traffic. Cloudflare says more than 7…

Security Affairs published its first AI-cybersecurity newsletter on 27 September 2026, presenting a collection of external reports and research about the developing relationship between artificial intelligence and cyber security. The publication says AI…

Security Affairs’ Malware Newsletter Round 116, published on 27 September 2026, is a curated list of malware-related research and threat reports rather than a single incident. It links to investigations covering malware-as-a-service campaigns using GitHub…

Wireshark 4.6.9 was released on 27 September 2026, according to the SANS Internet Storm Centre. The update fixes 19 vulnerabilities and 16 bugs. The supplied report does not provide details of the individual vulnerabilities, affected components, exploitation…