The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
95 stories match. Clear filters
-
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
Palo Alto Networks on Wednesday warned that threat actors are exploiting the recently patched PHP2Shell vulnerabilities against publicly-accessible management interfaces. "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet," the…
-
China-linked actors chain PHP2Shell with the Fragnesia exploit to root firewalls at a US government-affiliated organization
Per the teaser, attackers combined PHP2Shell with Fragnesia and compromised two servers belonging to a US government-affiliated organization. Details on which firewall products are involved were not retrievable.
-
TrendAI: three AI-assisted campaigns hit Japan, including a 44-agent autonomous framework and edge device targeting
CyberStrikeAI ran recon through exfiltration against at least 19 organizations (16+ in Japan) in October. A second operator used an LLM to speed planning and tool building, and got in through a GIS server with default credentials during a 24-day campaign. A third used AI to build tools against…
-
ICSA-26-295-17: Siemens Industrial Edge Devices
Highest CVSS 9.1. Affects Industrial Edge Cloud Device (IECD), Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD) and 63 more. Siemens Industrial Edge Devices contain multiple path traversal vulnerabilities that could facilitate an authenticated remote attacker to access…
-
Qilin and INC ransomware exploit Palo Alto PAN-OS flaw to bypass MFA and reach vCenter
CVE-2026-0257 (CVSS 7.8) is an authentication bypass in PAN-OS and Prisma Access that lets attackers open unauthorized VPN sessions. It was patched in May and added to CISA KEV on May 13, yet Unit 42 now ties it to Qilin and INC intrusions. In one case attackers moved from the gateway to vCenter…
Also covered by Help Net Security
-
Exploited Fortinet bugs tied to PeerStitch implant in telecom intrusion
Palo Alto Unit 42 describes PeerStitch, an in-memory ARM64 FortiGate implant that hides in legitimate process traffic. A suspected state actor (UNC5820 / CL-STA-0954) used FortiJump (CVE-2024-47575) for initial access at a telecom in September 2024 and took a config archive covering over 500…
-
16-year-old Broadcom Wi-Fi flaw lets attackers take over routers with no password; no CVE assigned
A bug in the WPS EAP reassembly code of Broadcom's proprietary 802.11 stack, present since at least 2010, was presented at Hexacon in Paris. An attacker in Wi-Fi range needs no password, no completed WPS enrollment, and no user action, and can extract the Wi-Fi key and run code. Affected chipsets…
-
CISA adds CVE-2025-61624 to KEV: Fortinet Multiple Products Path Traversal Vulnerability
Federal patch deadline 2026-10-19. FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
-
CISA adds CVE-2026-102764 to KEV: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
Federal patch deadline 2026-10-19. BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Also covered by The Hacker News
-
CISA adds CVE-2026-0322 to KEV: Palo Alto Networks PAN-OS Code Injection Vulnerability
Federal patch deadline 2026-10-17. Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Also covered by GBHackers
-
CISA adds CVE-2026-104935 to KEV: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Federal patch deadline 2026-10-16. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
-
Luna Moth (Silent Ransom Group) internal files leak, showing a scripted help-desk impersonation operation
Leaked files show a social engineer calming the victim while a technical operator runs remote access software. Attackers follow scripts for victim objections. Authenticity of the files is unconfirmed. Defenses: call back on a known number, restrict which remote tools staff can install.
-
Palo Alto GlobalProtect flaw (CVE-2026-0257), patched in May, still used by Qilin and Settra ransomware
Auth bypass in PAN-OS GlobalProtect and Prisma Access. Rapid7, Unit 42 and Arctic Wolf also report exploitation attempts. Five months after the fix, unpatched firewalls are still a ransomware entry point.
-
Critical SonicWall SMA1000 flaw (CVE-2026-102255, CVSS 10) exploited days after disclosure
Pre-auth SSRF in the SMA1000 Work Place interface (models 6210, 7210, 8200v). Fixed in 12.5.0-03082 and 12.4.3-03670. Disclosed Oct 6; Defused saw first exploitation attempts against decoys on Oct 8. Successful compromises are not confirmed. Horizon3.ai warns of device takeover.
-
CISA adds CVE-2026-88779 to KEV: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Federal patch deadline 2026-10-07. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Also covered by BleepingComputer, The Record
-
Bitget loses $387.5M after zero-days in third-party security appliances
Per SlowMist's analysis, attackers abused zero-days in two unnamed third-party security products, moved laterally into wallet infrastructure, and pushed withdrawals across 11 blockchains on Sep 25. Activity began as early as Aug 31. North Korean actors are suspected based on behavior and on-chain…
-
Fake ChatGPT Custom GPTs delivered through Google ads push ClickFix malware
A sponsored Google result led to a Custom GPT called "Plus 5.6," then to a Google Sites page with a fake Cloudflare CAPTCHA telling users to paste PowerShell. The chain used DLL sideloading through signed apps (Canon, Stardock) and ended in a remote access trojan with DNS-over-HTTPS command and…
-
NCC Group: August ransomware hits 2026 high, industrial sector takes 31%
1,073 attacks in August, up 12% from July. Industrial sector accounted for 329 (31%). North America took 44%, Europe 26%. Qilin led with 164 attacks (15%). The newer Aurora operation, active since late April, gets in through weak or unauthenticated VPN access, harvests credentials with PowerShell…
-
Citrix NetScaler zero-days under active exploitation before any patch existed (CVE-2026-88771, CVE-2026-88772)
watchTowr's forensic work turned up two unauthenticated remote-code-execution flaws in Citrix NetScaler ADC and Gateway, both CVSS 9.5: CVE-2026-88771 (improper input validation, exploitable in the default configuration) and CVE-2026-88772 (a memory overflow on any appliance with DTLS enabled…
Also covered by Help Net Security, The Hacker News, The Hacker News
-
MikroTik routers hijacked with no password or SSH key via "MikroTrick" chain (CVE-2026-67279 + CVE-2026-86060)
CERT Polska and Bishop Fox documented a chain in RouterOS's SSH handling: an improper workflow flaw (CVE-2026-67279, CVSS 6.9) combined with an argument-injection bug in the login process (CVE-2026-86060) lets an unauthenticated attacker open a session and get full administrative control of a…
-
F5 BIG-IP APM zero-day added to CISA KEV, actively exploited (CVE-2026-94127)
A heap-based buffer overflow (CVSS 9.8/9.3) in F5 BIG-IP Access Policy Manager, exploitable when APM is acting as an OAuth authorization server issuing access tokens, is under active exploitation. CISA added it to the KEV catalog September 22. Affected: 21.1.0; 17.5.0–17.5.1; 17.1.0–17.1.3. F5…
-
Chinese-speaking actor ("Red Heron"/Kapibala) steals 18,500+ government records across 49 organizations
A Chinese-speaking threat cluster chained flaws in WordPress core (CVE-2026-63030, CVE-2026-60137), Zyxel GS1900 switches (CVE-2026-7273), Ubiquiti UniFi OS (CVE-2026-34908/34909/34910), and additional products (PAN-OS GlobalProtect, FlowiseAI, Gitea, Nuclio, Proxmox VE) to hit 996 devices and…
Also covered by The Hacker News
-
ClickFix lures deploy the ChainScript RAT, using a Polygon smart contract to rotate C2 infrastructure
Victims are tricked by a fake CAPTCHA or verification page into running a command that launches msiexec.exe, which installs a Node.js remote access trojan disguised as Spotify, Zoom, or Microsoft Teams. Instead of hardcoding a command server, the malware queries a Polygon blockchain smart contract…
-
Cisco fixes dozens of flaws across Firewall Management Center, ISE, and Nexus Dashboard
Cisco published a bundled advisory set covering dozens of vulnerabilities across FMC, ISE, and Nexus Dashboard, with impacts including root access, command execution, authentication bypass, SQL injection, and remote code execution. This lands on the same day Cisco shipped the emergency fix for the…
Also covered by The Hacker News
-
New RatHat Android malware uses an AI subsystem to automate device control
RatHat is a newly discovered Android remote access trojan with an AI-powered subsystem that helps operators navigate a compromised device remotely rather than requiring manual step-by-step control. The design point is scale, since AI-assisted navigation lets one operator work many infected devices.