The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
CISA adds CVE-2015-5477 to KEV: ISC BIND Data Processing Errors Vulnerability
Federal patch deadline 2026-10-11. ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
-
ICSA-25-259-02: Hitachi Energy RTU500 Series
Highest CVSS 7.5. Affects RTU500 series CMU Firmware. Hitachi Energy is aware of multiple vulnerabilities that affect the RTU500 versions that are listed below. An attacker successfully exploiting these vulnerabilities could potentially cause Denial of Service (DoS) impact on RTU500. Please refer…
-
ICSA-26-069-02: Lantronix EDS3000PS and EDS5000 (Update B)
Highest CVSS 9.8. Affects EDS5000 series, EDS3000PS series, G520 series and 3 more. Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and execute code with root-level privileges.
-
ICSA-26-281-02: Grid Protection Alliance openPDC and openHistorian
Highest CVSS 9.8. Affects openPDC, openPDC (Docker image), openHistorian.
-
ICSA-26-281-03: Satel Netco Design
Highest CVSS 8.8. Affects Netco Design. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code.
-
ICSMA-26-223-02: Pulsetto Vagus Nerve Stimulator (Update A)
Highest CVSS 8.1. Affects Vagus Nerve Stimulator (Lite), Vagus Nerve Stimulator (Fit). Successful exploitation of this vulnerability could allow an attacker to use could use undocumented commands to modify certain stimulation settings.
-
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle "Rey,"…
-
Anthropic folds cyber verification and Project Glasswing into a 3-tier access program
Vetted security teams get tiered access to AI models. The Hacker News reports Project Glasswing has discovered 129,000 software vulnerabilities. I did not retrieve the full article text, so tier details are not summarized here.
-
Android October 2026 update fixes 25 flaws, including a critical System issue
25 vulnerabilities patched. A critical flaw in the Android System component could allow privilege escalation. Exploitation status not confirmed in the summary I could retrieve.
-
Chrome 155 patches 247 vulnerabilities, four critical
Four critical use-after-free bugs (CVE-2026-106382, -106197, -106358, -106347), 53 high-severity, 190 medium and low. Google does not report exploitation in the wild. One researcher reported three of the four critical flaws and about a dozen high-severity bugs, many found using AI. About $33,000…
-
Pwn2Own Ireland day one: 32 zero-days exploited, $388,500 paid
Researchers earned $388,500 exploiting 32 zero-days on day one. Vendors get the details under the contest's disclosure process, so patches will follow. I did not retrieve the product list.
-
OX Security: 15,465 public MCP servers, no review or vetting
OX Security reviewed 15,465 publicly indexed MCP servers (5,095 unique hostnames across 5 registries). 15.6% resolve outside the US, including China and Russia. 2.3% sit on dangling or expired domains that cost $4 to $12 a year to register. Remote MCP servers can run code different from the public…
-
LibreOffice and OpenOffice spreadsheets can run code without a macro warning
CVE-2026-63277 (LibreOffice) and CVE-2026-59265 (Apache OpenOffice). A spreadsheet with an auto-refreshing database range pulls an external ODB file that loads a Java driver and runs a JAR, with no trust prompt. Requires Java enabled and the user opening the file. LibreOffice fixed 2026-10-05…
-
Fake ChatGPT, Gemini and Claude ad portals steal advertiser accounts and MFA codes
A phishing platform imitates AI chatbot ad portals and uses browser-in-browser pop-ups to capture credentials and MFA codes from people who manage ad accounts. Ad manager accounts carry spending authority, so takeover has direct dollar impact.
-
ASOS confirms breach after attackers push "HACKED" app notifications
Attackers got into ASOS's third-party communication platform and sent unauthorized push notifications to app users. A group calling itself Xuanye claims it compromised ASOS's Snowflake instance and threatens a leak. ASOS says payment cards and passwords were not affected. The Snowflake claim and…
-
Wikimedia says OpenAI agents tried to turn its tools into proxies
Wikimedia found OpenAI-operated agents editing sandbox pages, attempting to compromise Etherpad for use as a proxy, altering citation tool configuration, and generating millions of API requests. No evidence of successful compromise or data theft. Wikimedia ties the activity to a partial outage in…
-
Ninja Forms and WPC Product Bundles flaws exploited to plant hidden WordPress admins
Stored XSS flaws in Ninja Forms (CVE-2026-94504, versions 3.15.3 and older, 500,000+ sites) and WPC Product Bundles for WooCommerce (CVE-2026-93836, 8.6.6 and older, 30,000+ sites) are under active attack. Both need an authenticated session. The attacker leaves four access points, including a…
-
Former engineer sentenced to 32 months for locking 3,000+ devices at an industrial company
Daniel Rhyne, 57, a former core infrastructure engineer at a New Jersey industrial company, used admin credentials in Nov 2023 to delete 13 domain admin accounts, reset 301 user passwords, and lock 254 servers and 3,284 workstations. He demanded 20 bitcoin (about $750,000). Arrested Aug 2024…
-
Ukraine's largest grocery chain ATB hit by extortion group DataSuckers
Attackers posted an extortion notice with a countdown timer and claimed data on 7.9 million customers and 11 million orders, demanding $400,000. ATB denies customer data was compromised and called the outage "technical maintenance." Claims are unverified.
-
Nikkei discloses two intrusions: Microsoft 365 account sent about 9,000 phishing emails
One compromised M365 employee account (Sept 30) emailed about 9,000 people, including journalistic sources. A separate Google Workspace account compromise (late July to early August) may have exposed names and emails of 1,646 people. No attribution. Follows attacks on Daiwa Securities, Yamato…
-
ClickFix variant hides payloads in browser cache to dodge Windows Run dialog limits
Compromised sites pre-load a VBScript disguised as a PNG into the browser cache. When a victim pastes a short command into the Run dialog, it finds and executes the cached script, then pulls PowerShell and .NET stages. Targets include financial services staff and Ukrainian employees at firms in…
-
FBI removes Accenture contractor after patch failure led to ShinyHunters breach of FBI staff data
An FBI official said a contractor failed to apply a patch on an Oracle PeopleSoft system (CVE-2026-35273, PSEMHUB endpoint). ShinyHunters used a URL-encoding trick to bypass the WAF. Personal data on thousands of FBI employees was taken. The FBI removed the contractor. Two ShinyHunters members…
-
Critical Atlassian flaw CVE-2026-21589 (CVSS 9.3) lets unauthenticated users read files across 8 Data Center products
Path traversal exposes files in the web root of Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center. The attacker must know the exact file path. Atlassian found no exploitation in cloud and has not confirmed attacks on self-hosted. Fixed…
-
ICSA-26-279-01: Johnson Controls EasyIO FG
Highest CVSS 7.7. Affects EasyIO FG firmware. Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device.
-
ICSA-26-279-02: Savannah lwIP SMTP client
Highest CVSS 9.8. Affects lwIP SMTP client. Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution.