FBI Blames Contractor’s Missed Patch for ShinyHunters Breach
The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees.
Security Feed
Cybersecurity news & advisories
500 articles 47 of 47 sources updated RSS ↗
Trending
Cross-source coverage · last 72 h
Meta and Microsoft are Actively Cutting Employee Use of Claude AI
Bleeping Computer
CCCS Alerts & Advisories
CrowdStrike Blog
Cyber Security News
The Hacker News
+2
Meta and Microsoft are reducing employee use of Anthropic’s Claude AI while pushing their own coding tools, according to an October 5 report by The Information . The changes focus on internal spending and staff workflows, rather than ending customer access to Claude through Microsoft’s products. The shift highlights growing pressure to control AI costs as coding assistants become part of daily software work. Both companies remain major Anthropic customers, but they also compete with it. Their decisions show how AI spending, product strategy, and control over developer tools are becoming…
Cyber Security News
Meta and Microsoft are Actively Cutting Employee Use of Claude AI
3h ago
CCCS Alerts & Advisories
Microsoft security advisory (AV26-1001)
19h ago
The Hacker News
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
21h ago
Bleeping Computer
tenfold CE: Our free Identity Governance tool just got 2 new features
5 Oct
Bleeping Computer
Microsoft: Windows KB5124010 update crashes some games and apps
5 Oct
CrowdStrike Blog
Falcon Data Security for SaaS Secures Sensitive Data in Microsoft 365
5 Oct
The Hacker News
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
4 Oct
The Hacker News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
3 Oct
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Bleeping Computer
Infosecurity Magazine
Malwarebytes Labs
SecurityWeek
The Hacker News
+2
Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted, and reports filed before October 1 are
Bleeping Computer
Nikkei discloses breaches of employees’ Microsoft, Google email accounts
4h ago
The Hacker News
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
4h ago
Malwarebytes Labs
Google pauses open source bug bounty program after rise in AI submissions
23h ago
SecurityWeek
Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports
23h ago
Infosecurity Magazine
Google Suspends Open-Source Bug Bounty Due to AI Vulnerability Reports
5 Oct
Bleeping Computer
Google halts open-source bug bounty program amid AI spam surge
5 Oct
Atlassian Patches Critical Vulnerabilities in Jira, Confluence, Bitbucket, and Five More Products
CCCS Alerts & Advisories
Cyber Security News
The Hacker News
The Register Security
+1
CVE-2026-21589 ↗
Atlassian has disclosed a critical arbitrary file access vulnerability affecting eight products, including Jira, Confluence, and Bitbucket. Tracked as CVE-2026-21589, the flaw has a CVSS score of 9.3. It lets unauthenticated attackers access specific files in an affected application’s web root directory. The advisory, published on October 5, 2026, covers Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Atlassian urges customers running affected installations to patch…
CCCS Alerts & Advisories
Atlassian security advisory (AV26-1002)
34m ago
Cyber Security News
Atlassian Patches Critical Vulnerabilities in Jira, Confluence, Bitbucket, and Five More Products
6h ago
The Hacker News
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
7h ago
The Register Security
Atlassian warns of critical file access flaw in its datacenter products
9h ago
ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access
Cyber Security News
Dark Reading
Infosecurity Magazine
SecurityWeek
The Register Security
+2
ClingSTUN is a Linux backdoor that exploits vulnerable internet-connected devices to give attackers lasting remote access. Rather than simply infecting routers and cameras, it turns compromised equipment into remotely controlled proxy nodes that can relay traffic and run commands. The campaign targets known security flaws across multiple vendors, expanding its attack methods as it evolves. Unpatched firmware, unsupported hardware, and exposed services create openings for infections that can survive device restarts and conceal their activity from routine checks. Fortinet researchers identified…
Cyber Security News
ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access
5h ago
The Register Security
Security researcher claims they found KVM guest-host escape flaw
12h ago
Dark Reading
ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes
16h ago
The Register Security
Debian's latest kernel security update has 1,313 reasons to patch
22h ago
Infosecurity Magazine
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
5 Oct
SecurityWeek
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
5 Oct
Citrix NetScaler security snafus get even worse amid more 0-day reports
CCCS Alerts & Advisories
CyberScoop
Infosecurity Magazine
The Record
The Register Security
+2
CVE-2026-88771 ↗
CVE-2026-88772 ↗
The attackers just keep coming after Citrix NetScaler appliances, as both the feds and private security researchers warn that someone found - and has already exploited - yet another Citrix bug before it had a patch. This latest vulnerability, tracked as CVE-2026-88779, is a memory overflow bug that leads to denial of service attacks. It only affects NetScaler ADC and Gateway appliances configured as a SAML (Security Assertion Markup Language) service provider or identity provider, used for single sign-on authentication. Late Friday, amid exploitation reports, Citrix confirmed that it was…
CyberScoop
Citrix discloses third actively exploited NetScaler zero-day in less than a week
15h ago
The Register Security
Citrix NetScaler security snafus get even worse amid more 0-day reports
17h ago
The Record
US, Australia warn of latest Citrix vulnerability after NetScaler advisory
20h ago
Infosecurity Magazine
Citrix NetScaler Targeted Via New Zero Day
5 Oct
CCCS Alerts & Advisories
Citrix security advisory (AV26-996)
5 Oct
CCCS Alerts & Advisories
AL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway – CVE-2026-88771 and CVE-2026-88772 – Update 1
3 Oct
Red Hat’s Lightwell Project Remediates 400 Open-Source Vulnerabilities
CCCS Alerts & Advisories
Infosecurity Magazine
SecurityWeek
The IBM subsidiary has also announced its Lightwell Clearinghouse is now available to all customers
Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access
Schneier on Security
SecurityWeek
The Hacker News
Apple has announced that it's taking steps to tighten controls around a macOS setting called Full Disk Access (FDA) due to security risks posed by artificial intelligence (AI) agents. "Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history – without users' full knowledge
Google Adds 6 Advanced Protection Features to Android 17 Against Sophisticated Attacks
CCCS Alerts & Advisories
Cyber Security News
Google has detailed six Advanced Protection enhancements for Android 17, targeting sophisticated attacks, scams and unauthorized access. Announced on October 1, 2026, the changes combine stronger restrictions with tools that preserve evidence when someone suspects their phone has been compromised. The update expands protections introduced with Android 16 rather than announcing a newly discovered malware campaign. Building on Android 16 security protections , the approach brings security controls together for journalists, elected officials, public figures and other users facing elevated risks…
Zombie instructions on carefully constructed web pages could trick GitHub Copilot CLI into sharing secrets
Palo Alto Unit 42
The Register Security
GitHub Copilot CLI may reveal developer secrets if it comes across instructions that tell it to do so, depending on the underlying model. The coding agent tool was flagged earlier this year for being susceptible to indirect prompt injection. That's when a model ingests text from a source other than the user that directs it to take some action outside the scope of its intended function. This is more of the same, with a twist. According to security researchers at Adversa AI, GitHub Copilot CLI suffers from the same vulnerability identified in Grok two months ago: Cryptographic Context Injection…
Need for Speed: AI-Driven Attacks Are Changing Security Strategies
Dark Reading
The Hacker News
Wiz Research
AI-powered attacks are fast, relentless, and automated. How security teams can keep up is top of mind, according to the latest Dark Reading reader poll.
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
CISA Alerts & Advisories
Sophos Threat Research
The Hacker News
CVE-2026-88779 ↗
Citrix has released security updates for a high-severity security flaw in NetScaler ADC and NetScaler Gateway that has been exploited as part of targeted zero-day attacks. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7 out of 10.0. "CVE-2026-88779 is a memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway that can lead to
Critical Dell System Update Tool Vulnerability Allows Attackers to Execute Code as Root User
Bleeping Computer
Cyber Security News
Dell has released security updates for five vulnerabilities in Dell System Update (DSU), including a critical flaw that could let an unauthenticated remote attacker execute code with root privileges. The issues affect versions before 2.3.0.0, and Dell urges customers to upgrade at the earliest opportunity. The company published security advisory DSA-2026-324 on October 1, 2026. DSU is a command-line tool that helps administrators deploy BIOS, firmware, and software updates across Dell PowerEdge servers running Linux and Windows, making its security important for enterprise server management…
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
Microsoft Security
The Hacker News
CVE-2026-69267 ↗
A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file," the Microsoft Threat Intelligence team said in a post on X.
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Bleeping Computer
The Hacker News
CVE-2026-61500 ↗
A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak pseudo-random number generator (PRNG) that can lead to a predictable key, which an attacker can then use to gain unauthorized access and
Latest
Ransomware Hacker Uses AI Coding Assistant as Attack Channel Against Enterprise Networks
A ransomware affiliate has turned an AI coding assistant into a channel for running attacks inside enterprise networks. The operator, known as Azazel, combined stolen development credentials, remote command execution…
How to secure RMM software: 8 controls MSPs should test
RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from…
Nikkei Discloses Two Employee Cloud Account Compromises
Nikkei says two employee cloud accounts were accessed, with one used to send 9,000 phishing emails
Introducing Wiz AI SAST: Application Security that Understands Your Code and Your Infrastructure
Find, validate, and fix complex business logic flaws with an AI code scanner backed by Wiz Research, operationalized within your existing security program.
OpenAI Agents Caught Editing Wikis, Making Millions of Requests That Led to Outage
The Wikimedia Foundation has uncovered unauthorized wiki edits, failed hacking attempts, and millions of automated requests that it believes came from AI agents operated by OpenAI. Its October 5 disclosure raises…
Hackers Exploit Exposed Industrial Controllers to Disrupt US Water and Critical Infrastructure
Hackers are exploiting internet-connected industrial controllers to disrupt US water utilities and other essential services. Recent incidents show that poorly protected equipment can give attackers direct access to…
Lawmakers Introduce Multiple Laws to Curb Flock After 404 Media Coverage
Multiple Democrat, Republican, and Independent lawmakers have introduced new pieces of legislation that, if passed, would dramatically curb federal agencies’ access to Flock cameras, with the lawmakers referencing…
ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
CERT-UA found fake Cloudflare verification pages that led visitors into a now-familiar ClickFix trap. This time the goal was to infect machines with an infostealer.
More RMM Tools In the Wild, (Tue, Oct 6th)
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today…
Red Hat’s Lightwell Project Remediates 400 Open-Source Vulnerabilities
The IBM subsidiary has also announced its Lightwell Clearinghouse is now available to all customers
Zombie instructions on carefully constructed web pages could trick GitHub Copilot CLI into sharing secrets
GitHub Copilot CLI may reveal developer secrets if it comes across instructions that tell it to do so, depending on the underlying model. The coding agent tool was flagged earlier this year for being susceptible to…
Critical Dell System Update Tool Vulnerability Allows Attackers to Execute Code as Root User
Dell has released security updates for five vulnerabilities in Dell System Update (DSU), including a critical flaw that could let an unauthenticated remote attacker execute code with root privileges. The issues affect…
FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026.
Critical Medical Devices Unable to Support PQC Transition
Forescout found that just 6% of Internet of Medical Things (IoMT) and 16% of medical OT are capable of supporting post quantum cryptography
Facebook Marketplace scam uses your name and number
Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller. It works like this. You receive a message (in this case iMessage) asking “Is this still…
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows…
Asos app delivers a data leak threat instead of fast fashion
Asos customers have reported receiving a rogue app notification claiming the online clothing retailer's Snowflake instance has been compromised and threatening to leak data. The notification included a link to a…
Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks
Citing growing risks posed by more capable and autonomous AI agents, Apple will introduce additional controls.
Denmark's ID register spills more people's details than the country has residents
An unauthorized party abused a private Danish company's legitimate access to the country's Central Population Register (CPR), exposing names, addresses, identification numbers, and other personal information about…
ASOS Customers Receive Bizarre “Hacked” Message Amid Suspected Snowflake Compromise
ASOS customers have received a seemingly legitimate push notifications claiming the retailer’s IT systems have been breached through a Snowflake breach
Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits
The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have been partially responsible for a May outage.
Here’s how experts think CISA should tell agencies to protect OT
A coalition of cyber firms and critical infrastructure operators on Tuesday spelled out its views on the tasks that the Cybersecurity and Infrastructure Security Agency should assign federal agencies to protect…
IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime
Editor’s note: This research was conducted by Himanshu Anand, an independent cybersecurity researcher ( follow Himanshu on X ). During Cybersecurity Awareness Month, ransomware remains one of the clearest examples of…
Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies
The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool…
Domino’s customers targeted in credential stuffing attacks
Domino’s Pizza customers tell us they have received emails saying they account has been accessed by a third party. Domino’s says its internal systems weren’t breached, but that individual accounts were logged into using…
Possible Vulnerability in Apple’s Automatic Reboot
404Media is reporting (alternate link ) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone…
Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers
In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and…
Cybersecurity M&A Roundup: 39 Deals Announced in September 2026
Significant cybersecurity M&A deals announced by Dragos, IBM, Palo Alto Networks, Kiteworks, and Upwind.
Midnight Blizzard Abuses Hotel Wi-Fi Captive Portals to Deliver Malware and Steal Credentials
Travelers connecting to hotel Wi-Fi may now face more than an unreliable internet signal. A campaign linked to Midnight Blizzard has turned captive portals, the sign-in pages shown before online access, into a route for…
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign.
Meta and Microsoft are Actively Cutting Employee Use of Claude AI
Meta and Microsoft are reducing employee use of Anthropic’s Claude AI while pushing their own coding tools, according to an October 5 report by The Information . The changes focus on internal spending and staff…
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Analysis of Blinder Tunnel, an Iran-nexus campaign using fake Dubai Airports recruitment lures and GitHub C2 malware to target critical infrastructure.
8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
Hackers abused a company’s lawful access to the CPR system to steal the personal information of registered citizens.
Legacy sign-on service comes back to bite school software provider Bromcom
UK education software provider Bromcom has notified customers of a personal data breach affecting its single sign-on (SSO) technology. In a September 24 EduGeek post, an account named Bromcom_Alastair said an…
Nikkei discloses breaches of employees’ Microsoft, Google email accounts
Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails.
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit security flaws in the…
Police Urge Passkey Use After Surge in Cybercrime Profits
Report Fraud says cybercrime revenue stemming from account takeover increased 417% annually
ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access
ClingSTUN is a Linux backdoor that exploits vulnerable internet-connected devices to give attackers lasting remote access. Rather than simply infecting routers and cameras, it turns compromised equipment into remotely…
FBI Cuts Accenture Contractor Over Unpatched PeopleSoft Flaw Exposing Thousands
The FBI removed an Accenture contractor on October 5, 2026, after a missed security patch led to a data breach exposing sensitive personal details of thousands of employees. According to Reuters , two sources identified…
Social Engineering Detection Moves Into the Live Conversation
Companies are pouring time and dollars into security awareness training, but little evidence shows it actually works against social engineering.
Google Adds 6 Advanced Protection Features to Android 17 Against Sophisticated Attacks
Google has detailed six Advanced Protection enhancements for Android 17, targeting sophisticated attacks, scams and unauthorized access. Announced on October 1, 2026, the changes combine stronger restrictions with tools…
Ransomware Affiliate Double-Crosses RaaS Operator to Steal Victim Funds
An affiliate of The Gentlemen RaaS group ran a parallel leak site during extortion of two dozen victims
Engineer sentenced for locking over 3,000 devices on employer network
A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack.
Atlassian Patches Critical Vulnerabilities in Jira, Confluence, Bitbucket, and Five More Products
Atlassian has disclosed a critical arbitrary file access vulnerability affecting eight products, including Jira, Confluence, and Bitbucket. Tracked as CVE-2026-21589, the flaw has a CVSS score of 9.3. It lets…
180: Conti
The word Conti struck fear in IT departments across the world. It's a type of ransomware that you hope to never come across. Like most ransomware gangs, the Conti group fell apart. But what's special about this story is…
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must…
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees. That's…
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in Denmark's national population register, the country's digitalization…
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical…
Atlassian warns of critical file access flaw in its datacenter products
Atlassian has told its users to patch its datacenter products, pronto, to prevent attackers accessing their files. The Australian collaborationware company on Monday sent users an email that opens with the words “Action…
Shares in British clothing company ASOS dive after hackers apparently send push notification
Several mysteries surround what appeared to be an unauthorized push notification sent to customers of London-based clothing company ASOS.
Security researcher claims they found KVM guest-host escape flaw
Linux KVM, the hypervisor favoured by hyperscale clouds, apparently has a full VM escape bug. That nasty news came from security researcher Paulos Yibelo, who on X shared a screenshot of a bug bounty award he won for…
Citrix discloses third actively exploited NetScaler zero-day in less than a week
Citrix customers just got through back-to-back weekends filled with varying levels of uncertainty and worry, as yet another actively exploited zero-day vulnerability was discovered in Citrix NetScaler products…
OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU
OpenAI is preparing to add invisible watermarks to text generated by ChatGPT and Codex in the European Union.
Wikimedia Foundation: OpenAI agents tried to edit pages and compromise notes tool
Beyond the potential misuses of its services, Wikimedia said activity by AI agents can be a drain on web platforms that are already operating with limited resources.
ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes
The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications.
Citrix NetScaler security snafus get even worse amid more 0-day reports
The attackers just keep coming after Citrix NetScaler appliances, as both the feds and private security researchers warn that someone found - and has already exploited - yet another Citrix bug before it had a patch…
Rejetto HFS servers now actively scanned for critical RCE flaw
Hackers are actively scanning for a Rejetto HFS weak signing key vulnerability, tracked as CVE-2026-61500, that allows session forgery, account takeover, and remote code execution (RCE).
Alleged ShinyHunters member reportedly detained in Jordan, assisting law enforcement
Saif al-Din Khader is cooperating with the FBI, reports said, as the bureau responds to a massive breach that exposed employee data.
No articles found
Try adjusting your search, category, tags, source selection, or date range.