The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
96 stories match. Clear filters
-
ToxicPanda Android banking trojan abuses VPN permissions to block Google Play
ToxicPanda has expanded to target 349 applications and now supports 167 remote commands. The notable change is its use of Android VPN permissions to cut the device off from Google Play, blocking Play Protect updates and remediation while the malware operates. Related Zimperium research on…
-
Citrix patches NetScaler authentication bypass, exploitation expected
Citrix released fixes for CVE-2026-19490, a critical authentication bypass in NetScaler ADC and NetScaler Gateway that lets unauthenticated remote attackers bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), with…
-
July cybersecurity M&A hit 21 deals as Team8 raises another $365 million
SecurityWeek's monthly roundup counted 21 cybersecurity acquisitions announced in July 2026, with deals from Barracuda, CrowdStrike, Cyera, Okta, Palo Alto Networks, and Qualcomm. Separately, Israeli venture firm Team8 secured an additional $365 million, bringing it to nearly $2 billion in total…
-
PATCHCORD backdoor hits Afghan telecom and South Asian critical infrastructure
A previously undocumented C/C++ backdoor called PATCHCORD is being delivered to Afghan telecom providers and South Asian critical infrastructure organizations through sector-specific lures, including fake VPN installers impersonating Afghan Telecom and telecom management tools. Acronis also found…
-
Fortinet patches authentication bypasses in FortiWeb and FortiManager
CVE-2026-26035 in FortiWeb is an improper authentication flaw that lets a remote unauthenticated attacker log into the GUI or CLI with a random username and password. It only applies when the wildcard setting for administrator accounts is enabled, which is not the default, and the workaround is to…
-
Picus Blue Report 2026: perimeter defenses improved, interior defenses got worse
Based on more than 338 million attack simulations in real client production environments during the first half of 2026, average prevention effectiveness rose from 62 percent to 69 percent and logging hit a four-year high of 58 percent. The gains are concentrated at the perimeter. Once inside…
-
737 fake Chrome VPN extensions route users' entire browser sessions through one provider's proxies
Socket identified 737 free VPN and proxy extensions across at least 40 Chrome Web Store developer accounts, totaling 75,486 installs. Of those, 274 impersonate 66 known brands including Proton VPN, NordVPN, ExpressVPN, and Cloudflare's 1.1.1.1. Nearly all route the full browser session through…
-
Ivanti EPM update fixes remotely exploitable credential-leak and agent-crash flaws
The vulnerabilities can leak credentials for external SQL connections or crash an agent service. Endpoint Manager is a privileged management platform, so credential exposure there is a lateral-movement problem rather than a single-host problem.
-
SonicWall patches unauthenticated remote code execution in a platform it already discontinued
CVE-2026-66147 (command injection) and CVE-2026-66145 (zip slip) allow unauthenticated remote code execution and sensitive data disclosure in Global Management System virtual appliance and Windows versions 9.5.1 and earlier, fixed in 9.5.2. Eight flaws total across GMS and Email Security…
-
Cisco patches an ASA and FTD firewall zero-day already used in denial-of-service attacks
CVE-2026-20349 lets a remote, unauthenticated attacker send a crafted HTTP request to the Remote Access SSL VPN service and force the appliance to reload into a denial-of-service state. Cisco confirmed active exploitation in August but has released no detail on the attacks. CISA added it to the…
-
Sandworm subgroup runs fake job interviews at Ukrainian IT staff to install a VPN client that executes commands
CERT-UA attributes an ongoing campaign since May 2026 to UAC-0145, a subgroup of Sandworm (APT44, Seashell Blizzard), tied to the GRU. Attackers review resumes on job boards, contact system administrators and IT specialists posing as recruiters from firms such as ATLAS Business Group, move the…
-
Joint federal advisory: Gunra ransomware bypasses MFA through Fortinet SSL-VPN and Schneider Electric flaws
FBI, CISA, DC3, NSA, the Secret Service, and South Korea's National Police Agency issued a joint #StopRansomware advisory on Gunra, a Conti-derived RaaS operation that has matured through 2026. Gunra actors modified authentication processing files on a corporate VDI portal so that one specific…
-
Fortinet FortiOS symlink-persistence flaw (CVE-2025-68686) hits FCEB patch deadline today
CISA-mandated mitigations for the actively exploited FortiOS flaw were due for Federal Civilian Executive Branch agencies by Aug 10, 2026 (today). A remote, unauthenticated attacker can bypass a prior patch and re-establish a symbolic-link persistence technique via crafted HTTP requests to…
-
CISA adds Fortinet FortiOS and Arista VeloCloud flaws to KEV catalog
CISA added CVE-2025-68686 (Fortinet FortiOS, exposure of sensitive information) and CVE-2026-16812 (Arista VeloCloud Orchestrator On-Prem, OS command injection) based on evidence of active exploitation. The FortiOS issue lets a remote unauthenticated attacker bypass a prior patch against a symlink…
-
Cisco Secure FMC zero-day exploited via hard-coded credentials (CVE-2026-20316)
Cisco Secure Firewall Management Center contains static, hard-coded credentials in its web interface, letting a remote, unauthenticated attacker log in and manage the appliance. Cisco confirmed active exploitation, CISA added it to the KEV catalog, and the federal remediation deadline was August…
-
Fortinet FortiOS SSL-VPN flaw added to CISA KEV (CVE-2025-68686)
CISA added an actively exploited FortiOS SSL-VPN flaw (exposure of sensitive information, tied to a bypass of an earlier symbolic-link persistence fix) to the KEV catalog on July 27. Reporting links Qilin ransomware affiliates to abuse of edge VPN and firewall appliances across multiple vendors…
-
SonicWall SMA 1000 zero-days exploited since June 22, attributed to UTA0533
Volexity attributed exploitation of CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) to a previously undocumented actor tracked as UTA0533, active against SonicWall SMA 1000 VPN appliances since June 22, ahead of public disclosure. Chaining the two gives arbitrary command execution and…
-
CISA adds exploited Fortinet FortiSandbox and Microsoft SharePoint flaws to KEV
CISA added actively exploited Fortinet FortiSandbox and Microsoft SharePoint Server vulnerabilities to the Known Exploited Vulnerabilities catalog, carrying binding remediation deadlines for federal civilian agencies. This follows the July 17 addition of SharePoint RCE CVE-2026-58644 (CVSS 9.8…
Also covered by The Hacker News
-
CISA adds three actively exploited flaws to KEV: two FortiSandbox, one SharePoint
CISA added two Fortinet FortiSandbox OS command injection flaws (CVE-2026-39808 and CVE-2026-25089) and a Microsoft SharePoint deserialization flaw to the Known Exploited Vulnerabilities catalog on July 16, confirming active exploitation. CVE-2026-25089 hits on-prem, Cloud, and PaaS FortiSandbox…
-
SonicWall SMA 1000 zero-days let attackers chain to full admin command execution
SonicWall confirmed active zero-day exploitation of two flaws in SMA 1000 series appliances (SMA6210, SMA7210, SMA8200v): CVE-2026-15409, a CVSS 10.0 unauthenticated SSRF in the Work Place interface, and CVE-2026-15410, a CVSS 7.2 post-auth code injection in the Management Console. Chained…
-
FortiBleed campaign: compromised firewalls turned into credential stealers
New June 23 reporting details how FortiBleed operators deploy "FortigateSniffer," abusing the FortiOS built-in diagnose sniffer packet command to passively capture authentication traffic across 24 protocols on already-compromised FortiGate devices. The broader campaign exposed valid admin/SSL-VPN…