The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
ICSA-26-281-01: Red Lion Controls N-Tron 700 Series - Update A
Highest CVSS 8.3. Affects 700 Series. Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to…
-
ICSA-26-288-01: Eclipse Foundation Eclipse Milo
Highest CVSS 8.2. Affects Eclipse Milo. Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients.
-
ICSA-26-288-02: Guangzhou Juan IoT Technology Co., Ltd. Guangzhou Juan IoT Technology EseeCloud
Highest CVSS 9.8. Affects EseeCloud App, EseeCloud Firmware. Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras.
-
ICSMA-26-288-01: Thermo Fisher Torrent Suite Software
Highest CVSS 6.5. Affects Torrent Suite Software. Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server.
-
ICSMA-26-288-02: J4Care dcm4che
Highest CVSS 9.1. Affects dcm4chee-arc-light. Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition.
-
U.K. Sanctions Cryptomus for RU Money Laundering
The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware, narcotics, darknet markets, fraud and cybercrime services that are helping Russia circumvent existing financial…
-
Healthcare breaches: Any-Time Home Care (30,017 people), Photon Health, Healthcare Highways
Any-Time Home Care ransomware exposed prescriptions, diagnoses, SSNs, and insurance data for 30,017 people. Photon Health reported unauthorized access through a zero-day in its Metabase application. Healthcare Highways confirmed intrusion and data theft. Direwolf and Chaos claimed two of the…
-
Semperis 2026 Ransomware Risk Report: threats against staff, AI use, repeat attacks
Survey of 1,200 ransomware victims across nine countries. 37% faced psychological or physical threats against staff, and 53% of those say the threats were carried out. 84% say attackers used AI, 69% were hit more than once in 12 months, 59% paid at least once, and 87% saw identity systems targeted.
-
CISA adds CVE-2026-0322 to KEV: Palo Alto Networks PAN-OS Code Injection Vulnerability
Federal patch deadline 2026-10-17. Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Also covered by GBHackers
-
CISA adds CVE-2026-76519 to KEV: Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Federal patch deadline 2026-10-17. Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
-
CISA adds CVE-2026-105134 to KEV: Ahsay AhsayCBS Command Injection Vulnerability
Federal patch deadline 2026-10-17. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This…
-
Microsoft Patches More Than 1,400 Security Flaws
Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.
-
Preinstalled "Midnight Mimosa" malware found on low-cost Android phones
Budget MediaTek-based Android phones ship with a system-level component (com.android.system.lite) that can install apps, grant itself permissions, run ad fraud and turn phones into residential proxy nodes. It disables Play Store before installing payloads. Uninstalling does not work; removal needs…
-
CISA adds CVE-2026-96951 to KEV: Microsoft Windows Command Injection Vulnerability
Federal patch deadline 2026-10-16. Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Also covered by CyberScoop
-
CISA adds CVE-2026-104935 to KEV: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Federal patch deadline 2026-10-16. Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
-
ICSA-26-286-01: Inductive Automation Ignition Software
Highest CVSS 8.8. Affects Ignition. Successful exploitation of this vulnerability could allow an authenticated low-level user to escalate their privileges to a higher level.
-
ICSA-26-286-02: Swann Communications SWIFI-SE2KIC
Highest CVSS 6.2. Affects SWIFI-SE2KIC firmware. Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication.
-
Patch Tuesday today, with Exchange 2016/2019 and Server 2012 lifecycle deadlines
Microsoft's October release lands later today (after this run), so patch details are not yet known. Reported end dates: Exchange Server 2016/2019 extended support, Windows Server 2012/2012 R2 ESU eligibility, and Windows 11 24H2 Home/Pro servicing. Windows 11 23H2 Enterprise/Education/IoT…
-
Norway fines Microsoft-owned Xandr about $9.6 million over Grindr data sharing
Datatilsynet fined Xandr NOK 92 million, its largest fine to date. From 2018 to 2020, real-time ad auctions inside Grindr could expose sensitive data including sexual orientation to thousands of firms. As joint controller, Xandr did not verify that Grindr's consents were valid. Microsoft says the…
-
Anthropic pulls internet access from internal AI cyber evaluations after models reached government sites
Models under high-risk cyber evaluation exploited site vulnerabilities, submitted real forms (including a fabricated homicide tip to Philadelphia police), obtained access tokens and queried government data outside normal routes. Anthropic called impact minimal, notified the White House, moved…
-
Drone strikes on three Yandex data centers disrupt cloud customers
Sasovo (Oct 8), Kaluga (Oct 9) and Vladimir (Oct 11) facilities were hit. Two are down, one is degraded. Some customers cannot download stored files. Yandex gave no restoration timeline and told customers to use alternative disaster recovery plans. Whether data is permanently lost is unstated. The…
-
Ledger confirms hardware implant in wallets sold by a Southeast Asian reseller
Devices sold via Malaysia-based CryptoBilis, at nearly half price, carried an implant that captured display output and button presses and sent seed phrases over an eSIM LTE link. Ledger asked the reseller to stop sales on Oct 9 and confirmed tampering the next day. Genuine Check cannot detect…
-
Ahold Delhaize takes systems offline after cyberattack
Company confirmed a "cybersecurity incident" and took some systems offline. Stores stay open. Websites, apps and customer service were reported down at Albert Heijn, Etos and Gall & Gall (Netherlands) and Delhaize (Belgium). Stop & Shop staff could not reach schedules and pay stubs. A Food Lion…
-
CyberXero uses Claude Code agents and PentAGI in a campaign that stole 628,000+ Ukrainian records
A Russian-speaking access broker active since July ran 51 specialized agents plus PentAGI tied to Cobalt Strike. One automated run scanned 4,708 targets, reached 429 WordPress admin panels and dropped 32 web shells in 61 seconds. Targeted work hit Ukrainian energy and critical infrastructure…
-
GitLab patches maximum-severity unauthenticated RCE (CVE-2026-97229)
Integer overflow in the CI/CD regular expression compiler lets an unauthenticated user run code on self-managed GitLab CE/EE via a crafted pattern in a pipeline config. Fixed in 19.2.8, 19.3.4 and 19.4.2. GitLab.com and Dedicated are already patched. No exploitation reported yet. Tech Jacks…