The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
Brevo supply-chain attack injected ClickFix scripts on up to 100,000 customer sites
Attackers used a long-lived Cloudflare API key with full account permissions, hardcoded in Brevo application source code, to create a malicious Cloudflare Worker that rewrote responses at the CDN edge for about five and a half hours on September 14. Because the rewrite happened at the edge and…
-
Critical Check Point management server flaw lets unauthenticated attackers run code as root
CVE-2026-91843, rated 9.8 by Check Point, is a stack overflow in the pre-authentication login path of Check Point Security Management and Log Servers. Censys says the overflow is triggered by a login request carrying a very long username, and the vulnerable path runs only through the Trusted…
-
Cisco Identity Services Engine zero day rated CVSS 10.0 under active exploitation, federal deadline is Saturday
CVE-2026-76460 lets an unauthenticated remote attacker bypass the web management interface through an API endpoint with insufficient authentication control, and Cisco says successful exploitation yields command execution as root. There are no workarounds, only patches (3.1 P12, 3.2 P11, 3.3 P12…
Also covered by SecurityWeek
-
Data Broker Radaris Loses Domains in Privacy Fight
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that…
-
Cyolo and Nozomi Networks integrate asset intelligence with OT access controls
The integration links Nozomi asset discovery to Cyolo access enforcement so that OT access decisions carry asset context. Vendor news, not an incident.
-
NASCIO reports state CIOs facing expanding critical infrastructure risk with local capability and governance gaps
NASCIO's report covers states taking on a widening critical infrastructure protection role while local governments lack capability and governance lines remain unclear. Relevant to municipal water, transit, and public-sector prospects.
-
Six-nation guidance published on detecting and mitigating 17 Active Directory compromise techniques
ASD ACSC led with CISA, NSA, the Canadian Centre for Cyber Security, NCSC-UK, and NCSC-NZ on guidance covering Kerberoasting, AS-REP roasting, password spraying, AD CS abuse, DCSync, Golden Ticket, Silver Ticket, Golden SAML, and Shadow Credentials, among others. The document leans on Microsoft's…
-
FERC approves NERC CIP-014-4, tightening physical security assessments for critical transmission facilities
CIP-014-4 extends applicability to jointly owned transmission facilities, requires identification of Bulk Electric System stations within 1,500 feet of applicable facilities, and mandates a documented risk assessment methodology with technically justified thresholds plus both steady-state and…
-
Spain's data protection agency receives its first breach notification attributed to an AI agent
The reporting organization told the AEPD that an AI agent running on a known large language model searched for flaws, logged in, then autonomously probed the application for more issues, ultimately modifying personal data and accessing invoices. The AEPD has not verified the claim yet but says…
-
Windows 11 KB5124008 breaks Active Directory domain trust on some enterprise systems
Administrators report Windows 11 25H2 machines losing their secure channel with Active Directory after installing KB5124008 and rebooting, producing domain trust errors and rejected valid credentials. Reports point at the Machine Identity Isolation feature being set to enforcement mode after the…
-
Kaspersky tracks three separate clusters attacking Russian enterprises with backdoors, ransomware, and wipers
Kaspersky reports NightEagle (also APT-Q-95, active since at least 2023), Hacking Cat, and Toy Ghouls targeting Russian enterprises. NightEagle mostly used compromised valid credentials to reach corporate VPNs, with connections originating from Russian IP space tied to Cloudflare WARP tunnels and…
-
US, UK, and Dutch agencies detail Iranian intelligence malware used against dissidents and journalists
The FBI calls it HEAVYGRAM and the UK NCSC calls it CHOSEN BRICK. The Windows malware is controlled through Telegram and can copy emails and chat messages, take screenshots, and activate the microphone. The joint advisory came from NCSC-UK, the FBI, and the Netherlands AIVD, and the FBI attributes…
-
KREMLIN banking toolkit force-installs Chrome and Edge extensions by defeating browser integrity checks
Active since at least May 2025 and impersonating a dozen Brazilian banks, the KREMLIN ecosystem uses multi-stage JavaScript loaders and custom C++ installers to plant malicious browser extensions that steal credentials and session tokens. The notable technical detail is that it bypasses Chromium…
-
Parallels Desktop flaw gives a normal Mac user root, and Intel Macs cannot install the fix
JFrog published CVE-2026-90894, which it calls ParaShells and rates 7.8. The prldispservice background process runs as root to handle host networking and VM package unpacking, and a local non-admin account can abuse it to run code as root on the Mac itself, not inside the VM. The fix is in…
-
Attacker hijacked a live AI coding assistant session and spread Shai-Hulud across roughly 100 internal repositories
At an unnamed SaaS provider, an attacker took over an active AI coding-assistant session. The assistant then recommended software the attacker had poisoned, a developer accepted the recommendation, and an infostealer installed through a poisoned PyPI package. The attacker took GitHub OAuth tokens…
-
One browser extension can take over the AI assistants built into Chrome, Comet, Edge, Opera Neon, and Claude
Forever Security demonstrated that a single ordinary browser extension can reach the built-in AI assistant in five Chromium-based products with one click after install. On Comet, Edge, Opera Neon, and the Claude in Chrome extension it could drive the agent to act on the attacker's behalf. On…
-
CISA confirms active exploitation of the critical ConnectWise ScreenConnect flaw
CISA now reports in-the-wild exploitation of the critical ScreenConnect vulnerability. The September 14 roundup covered this flaw when it had a patch and a federal deadline but no confirmed exploitation, so the change from "patch it" to "it is being used against people right now" is the new fact.
-
Issabel Framework hard-coded JWT signing key exploited for unauthenticated command execution
CVE-2026-89026 (CVSS v3.1 9.8, v4.0 9.3) exists because the Issabel PBX web framework ships a hard-coded HS256 JWT signing key in pbxapi index.php that is identical on every installation. VulnCheck reports attackers forging valid bearer tokens and calling the manager originate endpoint to make…
-
WSO2 API Manager JWT bypass under active exploitation with forged admin tokens
CVE-2026-5430 (CVSS 9.8, described by watchTowr as effectively a 10) lets an attacker bypass JWT authentication by signing a token with an algorithm the product does not support, which the product then accepts anyway. watchTowr honeypots captured forged tokens carrying administrator privileges…
-
Yokogawa opens an Industrial Cyber Resilience Center in Singapore
Yokogawa Engineering Asia opened an Industrial Cyber Resilience Center at its Singapore office to support OT cybersecurity for regional industrial customers. Automation vendors continuing to build dedicated OT security service arms is a competitive signal worth tracking.
-
Dispel opens a free remote-access program for small US water and electric utilities
Dispel launched its Community Power and Water Program at the American Public Power Association Cybersecurity and Technology Summit, extending secure remote access tooling used by large utilities to small ones. Internet-exposed PLCs at small water and electric utilities remain one of the most…
-
DOE funds three OT security vendors under the SENTRY energy cybersecurity program
The Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response named Frenos, Raptor Dynamix, and Bastazo as recipients under the Securing Energy Technology Resiliency program. Federal funding direction is a reasonable leading indicator of where energy-sector OT…
-
Zelensky appoints former police chief to lead Ukraine's cyber coordination center
Ukraine named Ihor Klymenko, formerly head of the national police, to lead its cyber coordination center. Ukraine's wartime cyber defense structure continues to consolidate under centralized coordination, and personnel choices signal whether the emphasis sits with law enforcement, military, or…
-
China's intelligence chief names US AI models as a cyber threat to Chinese infrastructure
Chen Yixin, head of China's Ministry of State Security, wrote in the Cyberspace Administration of China's journal that Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber represent a "disruptive upgrade" in cyber capability, accelerating vulnerability discovery and malware development. He stopped…
-
Manhattan DA takes down 12 AI deepfake pornography sites
The Manhattan District Attorney's office seized or shut down twelve sites generating non-consensual AI deepfake sexual imagery. This is local prosecutorial action against AI-abuse infrastructure rather than federal or regulatory enforcement, which is a notable venue for this category of case.