The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Critical WordPress flaw under active exploitation within hours of patch (CVE-2026-87902)
An unauthenticated path traversal flaw (CVSS 9.2) in WordPress core's template-resolution logic lets attackers include a readable local PHP file from outside the active theme directory, chaining it to pearcmd.php to write malicious files and drop shells. WordPress patched it September 22 (7.1.2…
-
Exploit released for unpatched Ubuntu Linux container-escape flaw (CVE-2026-80521)
A flaw in the Linux kernel's AFUNIX socket subsystem (CVSS 7.8) lets an attacker inside a container escape to root on the host. It affects Ubuntu 22.04, 24.04, and 26.04 LTS, and reaches into AWS/Azure/GCP kernel packages too, because AFUNIX sockets are allowed by default in standard Docker and…
-
F5 BIG-IP APM zero-day added to CISA KEV, actively exploited (CVE-2026-94127)
A heap-based buffer overflow (CVSS 9.8/9.3) in F5 BIG-IP Access Policy Manager, exploitable when APM is acting as an OAuth authorization server issuing access tokens, is under active exploitation. CISA added it to the KEV catalog September 22. Affected: 21.1.0; 17.5.0–17.5.1; 17.1.0–17.1.3. F5…
-
ShinyHunters claims FBI breach exposing employee and applicant data
ShinyHunters claims to have breached FBIjobs.gov via an unidentified Oracle PeopleSoft zero-day and obtained personal data on FBI personnel and applicants — names, home addresses, phone numbers, dates of birth, and spouse information. The group released a sample of roughly 5,000 records, some…
-
Cyber insurance: AI reshaping exposure as rates keep falling (lead only, not fully verified)
This piece is dated within the window and is the most current cyber insurance headline found, but the source blocks automated retrieval (robots.txt), so the specifics below are not confirmed beyond the headline. Broader context from adjacent late-August/early-September reporting (Swiss Re) has…
-
NIST releases draft SP 800-82 Rev. 4, overhauling OT security guidance
NIST released a 321-page initial public draft of SP 800-82 Rev. 4, the core OT security guide, dated September 21. The rewrite aligns with Cybersecurity Framework 2.0, adds consequence-driven risk management (focusing on preventing unsafe/destructive outcomes, not just network protection), and…
-
Meta's Muse AI assistant can be turned into a backdoor via hidden setting
Researcher Patrick Wardle found that Muse (Meta's Mac AI assistant) has an undocumented preference, endovoyagerdictationendpoint, that any user-level program can redirect to an attacker's server. Once redirected, dictated audio and text route through the attacker instead of Meta, letting them read…
-
Zyxel switch and Veeam agent flaws under active exploitation (CVE-2026-7273, CVE-2026-32996)
Two unrelated flaws are both being exploited now. CVE-2026-7273 is a stack-based buffer overflow (CVSS 8.8) in Zyxel GS1900 series switches letting an unauthenticated LAN attacker run OS commands; GreyNoise says a suspected Chinese-speaking actor has been exploiting it since August 17, pulling…
Also covered by BleepingComputer
-
Check Point Security Management Server zero-day, actively exploited (CVE-2026-93616)
Check Point patched a path traversal flaw (CVSS 9.8) in its Security Management Server web service that let an attacker who can reach the service run scripts without logging in, because the service doesn't properly limit which files and folders a request can touch. Check Point confirmed it was…
-
LinkedIn wins a federal court order shutting down a mass-scraping operation
A California federal judge finalized an order against ProAPIs, Netswift, and their CEO, requiring them to stop scraping LinkedIn data, stop selling or transferring what they already scraped, stop using fake accounts to access the platform, and delete all previously scraped data. LinkedIn's suit…
-
Ireland's Data Protection Commission fines Google €403 million over location data handling
Ireland's DPC fined Google €403 million (roughly $460 million) following an inquiry into how three Google features processed users' location data, finding GDPR violations. This is one of the larger single GDPR penalties of the year and adds to a growing line of location-data enforcement actions…
-
ShinyHunters escalates its hijack of Clop's leak site into an eight-figure extortion demand; Clop responds
ShinyHunters, having defaced and taken over Clop's dark web leak site (first reported September 19), has now issued a formal extortion demand: an eight-figure payment, interest, and a public apology from Clop. Clop posted back on the compromised site: "Shiny Hunters we trying to reach you. Your…
-
BigCommerce notifies merchants of a breach traced to compromised Ribon app credentials
BigCommerce says credentials for the third-party Ribon and Ribon 1.5 storefront apps were compromised and used to inject malicious scripts into merchant sites between September 13 and 17. The platform itself was not breached; only the third-party app credentials were. UK spirits retailer Master of…
-
Fake LastPass Authenticator installer abuses a Microsoft-signed driver to kill 145 security tools
A counterfeit LastPass Authenticator installer distributed through GitHub uses a Bring Your Own Vulnerable Driver (BYOVD) technique, loading a legitimately Microsoft-signed kernel driver to kill 145 security processes from kernel mode before installing a password stealer. The stealer then harvests…
-
Jade Sleet (North Korea) breaches an Indian IT provider's DevOps engineer with FLATROOF and ROOFDECK macOS backdoors
Jade Sleet, the North Korean group also tracked as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899, compromised an India-based IT services provider through a DevOps engineer's Apple Silicon MacBook. The backdoors were planted by March 18, 2026, stayed dormant until beaconing began on March 29…
-
ClickFix lures deploy the ChainScript RAT, using a Polygon smart contract to rotate C2 infrastructure
Victims are tricked by a fake CAPTCHA or verification page into running a command that launches msiexec.exe, which installs a Node.js remote access trojan disguised as Spotify, Zoom, or Microsoft Teams. Instead of hardcoding a command server, the malware queries a Polygon blockchain smart contract…
-
TASK#STOMP PowerShell backdoor steals business documents, Wi-Fi passwords, and clipboard data
Securonix researchers Akshay Gaikwad and Aaron Beardslee analyzed a Windows backdoor, likely delivered through phishing emails carrying ZIP or ISO/IMG attachments. It runs two hidden PowerShell modules that monitor each other, sets five separate persistence mechanisms, and prioritizes Word…
-
AI compliance and governance incidents hit 40 percent of large companies, with process design named as the cause
Sapio Research surveyed 1,000 senior IT, operations, and transformation leaders and found 40 percent of large companies had an AI-related compliance or governance issue in the past 12 months, with process-related problems contributing to 84 percent of them. The core finding is that companies drop…
-
Researchers model intent injection attacks against AI-native 6G intent-based networking
University of Ottawa and Nokia Bell Labs researchers describe adversarial intent injection, where an attacker holding a compromised API key submits malicious machine-readable intents that pass as routine network policy updates. Possible consequences named in the paper include denial of service…
-
RunSafe index finds 24 percent of healthcare organizations hit by a medical device attack or exploited flaw
RunSafe Security's 2026 Medical Device Cybersecurity Index found 24 percent of surveyed healthcare organizations experienced an attack or exploited vulnerability involving a medical device, up from 22 percent in 2025. Among those affected, 80 percent reported a moderate or significant effect on…
-
Health-ISAC publishes a nine-domain MedTech security baseline for device procurement and lifecycle decisions
Health-ISAC's Medical Device Security Council released a MedTech Security Baselines paper naming nine foundational cybersecurity capability domains for healthcare delivery organizations and device manufacturers to use during evaluation, procurement, deployment, exception review, and lifecycle…
-
AI-generated intelligence report falsely flagged nuclear components on a Chinese ship, nearly triggering a boarding
CNN reported, citing four sources, that an intelligence report circulated across the US military this spring claiming a Chinese vessel in the Middle East carried nuclear weapons program components. Armed boarding teams were preparing to move and military aircraft were airborne before someone…
-
Researchers escape the OpenAI Codex sandbox two ways, one from its most restricted mode
Oren Yomtov of Accomplish AI reported two sandbox escapes to OpenAI on August 12, both fixed within eight days. The more serious, called Heapjack, turns opening someone else's repository in Codex and asking a question about the code into unsandboxed command execution on the developer's machine…
-
Malicious npm package hides its loader in runtime code to slip past npm's new install-script controls
Checkmarx found a package called indexed-btree impersonating the legitimate sorted-btree library, with roughly 2 million weekly downloads. Instead of using a preinstall or postinstall script, which GitHub's June 2026 npm hardening now blocks unless explicitly approved, the malware hides its loader…
-
TigerByte Cyber leaves stealth with $3M seed and more than $7M in government contracts
Seed round led by Hale Capital Partners with Tenon VC. Contracts in place with DARPA, the US Space Force, and the US Navy.