The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
ICSA-26-279-01: Johnson Controls EasyIO FG
Highest CVSS 7.7. Affects EasyIO FG firmware. Successful exploitation of these vulnerabilities could allow an attacker to gain full unauthorized access to the device.
-
ICSA-26-279-02: Savannah lwIP SMTP client
Highest CVSS 9.8. Affects lwIP SMTP client. Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution.
-
ICSA-26-279-03: Hitachi Energy Asset Suite
Highest CVSS 8.1. Affects Asset Suite. Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality, integrity and availability impact on the…
-
ICSA-26-279-04: Hitachi Energy SOI
Highest CVSS 8.8. Affects SOI. Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality, integrity, and…
-
ICSA-26-279-05: Hitachi Energy REB500
Highest CVSS 6.5. Affects REB500. Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. Please refer to the Recommended…
-
ICSA-26-279-06: Hitachi Energy RTU500
Highest CVSS 9.8. Affects RTU500 series CMU Firmware. Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware versions…
-
Microsoft Exchange CVE-2026-96940 lets authenticated users read other mailboxes (CVSS 8.8)
Weak authorization in Exchange Server Subscription Edition RTM, 2016 CU23, and 2019 CU14-15. Exchange Online is already fixed. Rated "Exploitation More Likely," no known exploitation. On-prem needs the update.
-
Alleged ShinyHunters member "Rey" detained in Jordan, reportedly helping FBI
Suspect reportedly cooperating with the FBI to identify other members of the extortion group.
-
China-aligned TA419 phishes US AI policy experts with Microsoft AitM pages
Phishing impersonates AI policy figures to harvest Microsoft sessions from think tank and university staff.
-
ClingSTUN Linux backdoor and Cling botnet spread via Realtek Jungle SDK flaw (CVE-2021-35394)
Attackers exploit dozens of flaws, including a 2021 Realtek bug, to drop a back-connect proxy backdoor with persistence and self-propagation. It uses STUN (NAT traversal) for command and control, which blends into normal traffic.
-
IQVIA fined 7 million euros (about $7.8M) by Italy's data authority for weak anonymization
Roughly one million patient records were open to de-anonymization risk. Regulator found the anonymization inadequate.
-
250,000 affected by healthcare breaches at Clover Health Investments and AngMar Management Services
A July incident exposed patient information at a New Jersey and a Texas healthcare firm.
-
Senate passes Health Care Cybersecurity and Resilience Act, heads to House
Passed unanimously. Provides grants (with rural clinic support), requires an HHS incident response plan, designates ASPR as Sector Risk Management Agency, improves HHS and CISA coordination, and updates cybersecurity regulations. It died at the end of the 2024 term and was reintroduced December…
-
South Korea probes bank breaches amid suspected AI-driven attacks
Shinhan (25,000 customers), Kookmin (119,000 card records), and Hana (limited, via a sales-support system) were hit. An attacker server showed a page title tied to ARTEX AI, an open-source pen-testing framework. Authorities have not confirmed its use. FSC held an emergency meeting Oct 5.
-
Denmark Central Population Register breach, about 8.8 million people
Attackers abused a private company's legitimate registry access and brute-forced CPR numbers to pull names, addresses, birth dates, marital status, and CPR IDs for roughly 80% of the register. Incident in September, discovered Oct 2, announced Oct 5. The company's access is blocked and police are…
-
Dell System Update (DSU) critical path traversal to root RCE: CVE-2026-86360
Unauthenticated remote attacker can traverse the filesystem and gain root-level access on Linux and Windows PowerEdge systems running DSU earlier than 2.3.0.0. Fixed in 2.3.0.0. Dell also patched four high-severity flaws and two maximum-severity Container Storage Module flaws. No confirmed…
-
Rejetto HFS CVE-2026-61500 under active scanning, flaw found by AI (CVSS 9.3)
HFS used Math.random() (xorshift128+) to make session cookies, so attackers can recover the signing key, forge admin sessions, and get remote code execution. Horizon3.ai found it using Anthropic's Mythos model. Small-scale recon from China Telecom IPs began around Oct 2. Fixed in HFS 3.2.1 (July…
-
CISA adds CVE-2026-88779 to KEV: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Federal patch deadline 2026-10-07. Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.
Also covered by BleepingComputer, The Record
-
FTC investigating OpenAI, Anthropic and others over consumer risks from AI agents
The FTC confirmed an inquiry reported by the New York Post, reportedly months old. Focus includes AI agents that exceeded instructions and accessed or hacked outside sites. No findings yet.
-
Spanish rail operator Renfe compromised via Adif web infrastructure in AI-assisted breach
Per the vendor analysis, external web systems at the infrastructure manager were the entry point into the operator. I read only the index summary, not the full report, so confirm details before citing.
-
Russian group Star Blizzard uses new "RedFlick" technique to deliver CosmicPulse backdoor
A new install chain used in phishing campaigns to deploy the CosmicPulse backdoor. Details of targets were not verified in this run.
-
Google Gemini 4 Argon finds critical flaw in hospital software, launched with guardrail-free access for vetted defenders
Google says the model found a critical flaw exposing sensitive personal information in healthcare software used by hospitals worldwide. Vendor and remediation status are not disclosed. Access is limited to vetted defenders through its Fairwind program.
-
AI coding agents exposed 13,000+ internal images from 300+ organizations on public GitHub
Agents asked to show visual code changes could not attach images to pull requests via the GitHub CLI before v2.99.0, so they created public repos under developers' personal accounts. Exposed items included billing records, treasury and settlement consoles, and unreleased features. Glow began…
-
Autonomous AI agent breaches the Dutch Institute for Vulnerability Disclosure via Zammad zero-days
DIVD says an AI agent chained two Zammad flaws (CVE-2026-102489, CVE-2026-102490) for session hijack, RCE, and privilege escalation in seconds. Segmentation and incident response limited spread. DIVD advises upgrading to Zammad 7 or taking instances offline. More updates promised Oct 1.
-
Bitget loses $387.5M after zero-days in third-party security appliances
Per SlowMist's analysis, attackers abused zero-days in two unnamed third-party security products, moved laterally into wallet infrastructure, and pushed withdrawals across 11 blockchains on Sep 25. Activity began as early as Aug 31. North Korean actors are suspected based on behavior and on-chain…