The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
September Windows Server updates break Remote Desktop Services on 2019, 2022, and 2025
Administrators report that the September 2026 Patch Tuesday cumulative updates are causing Remote Desktop Services session hosts to freeze several hours after boot, leaving new RDP connections hanging at "Connecting" and preventing logged-in users from disconnecting or logging off cleanly. Some…
-
CISA publishes healthcare and industrial advisories: NextGen Mirth Connect, Orthanc DICOM Server, AVEVA Pipeline Integrity Monitor
CISA released three advisories on September 10. ICSMA-26-253-01 covers NextGen Healthcare Mirth Connect, where versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, potentially disclosing stored credentials for connected systems, writing…
-
IDScan confirms breach behind 153 million driver's license scans offered on the dark web, FBI investigating, lawsuits filed
Identity verification vendor IDScan has confirmed that an unauthorized third party may have accessed or copied customer information stored in accounts on its cloud platform, after initially disclosing on September 4 that it learned of possible unauthorized access around September 1. The…
-
Check Point patches two CVSS 9.8 VPN certificate flaws allowing unauthenticated remote code execution
Check Point disclosed two critical flaws in how its firewall and management products handle VPN certificates, both rated CVSS 9.8. CVE-2026-85102 is a failure to properly validate certificate trust during VPN negotiation, affecting Security Gateway and Check Point Spark Firewall configured for…
Also covered by BleepingComputer
-
CISA confirms ransomware gangs exploiting critical WatchGuard Firebox flaw, roughly 9,000 firewalls still unpatched after nine months
CISA updated its Known Exploited Vulnerabilities entry for CVE-2025-14733 to confirm that ransomware operators are now using it. The flaw is an out of bounds write in WatchGuard Fireware OS that allows unauthenticated remote code execution, and CISA rates the exploitation complexity as low…
-
New N0va phishkit uses device code phishing to reach Primary Refresh Token SSO access
ANY.RUN documented N0va, a phishkit targeting organizations across North America and Europe in government, technology, consulting, and healthcare. It uses lures imitating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign, then runs device code phishing to…
-
ICS Patch Tuesday: Schneider Electric ships a CVSS 9.2 authentication flaw fix for Modicon M580, Siemens fixes two critical account takeover and root access bugs
Schneider Electric published four new advisories and updated four others. The most severe is CVE-2026-3869, a critical authentication vulnerability in Modicon M580 and Modicon M580 Safety controllers scoring CVSS 9.2, affecting every M580 running an application level below 4.00 and every M580…
-
Veradigm discloses third-party vendor breach exposing patient SSNs, ransomware gang claims 3.5 million records
Veradigm, formerly Allscripts, told the SEC that an attacker obtained credentials from a vendor's environment for a Veradigm API reserved for customer services, then used that access to copy patient data including names, addresses, and Social Security numbers. Clinical and medical information was…
-
Cisco confirms active exploitation of a CVSS 10.0 auth bypass in Secure Firewall Management Center, three attacker clusters including Sandworm and Qilin
Talos is tracking in the wild exploitation of CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure FMC that lets an unauthenticated remote attacker execute scripts and obtain root on the underlying OS, chained in some intrusions with CVE-2026-20316, a static credential flaw scoring…
-
Google patches its seventh actively exploited Chrome zero-day of 2026
Google patched 230 vulnerabilities including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine that allows remote code execution inside the sandbox through a crafted HTML page. It is rated Medium severity but is confirmed under active exploitation. Fixes shipped in…
-
Microsoft Plugs Nearly 1,000 Security Holes
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many…
-
FortiGate flaw exploited to deploy PivotC2, an AI-assisted Node.js RAT built for firewall persistence
SOCRadar documented an ongoing campaign exploiting CVE-2025-25249, a heap-based buffer overflow in the FortiOS and FortiSwitchManager cwacd daemon listening on UDP 5246, the CAPWAP port. Unauthenticated exploitation yields remote code execution and an outbound Node.js reverse shell. The payload…
Also covered by CISA, SecurityWeek
-
OpenAI says GPT-6 Astra is the first broadly deployed model at Critical cybersecurity capability
OpenAI confirmed GPT-6 Astra is the first model it has broadly deployed that reaches the Critical level for cybersecurity under its Preparedness Framework, defined as being able to identify and develop functional zero-day exploits of all severity levels in many hardened real-world systems without…
-
NSA, CISA, and FBI name six China-based AI firms in a joint advisory on industrial-scale model distillation
The three agencies issued a joint advisory naming DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun, and Z.AI as running what it calls aggressive, malicious, and targeted knowledge distillation campaigns against US frontier models since at least late 2024, likely with Chinese government awareness…
-
Exposed Advance Passenger Information System database held 220 million traveler records
An exposed Advance Passenger Information System database linked to Vietnam held 220 million passenger and crew records covering 2017 through 2026, including names, passport numbers, dates of birth, nationalities, and flight details. Researchers reached the system through a cloud path using default…
-
DoppelCart: 119,000 fake shops, now the largest documented storefront fraud cluster
German security startup Nebty documented a network of more than 119,000 domains running fake e-commerce storefronts that harvest payment card details, mostly on the .SHOP top-level domain where they account for 2.72% of all registered sites. Around 105,000 remain live. Ninety-six percent of…
-
ShinyHunters claims breach of Florida's DAVID driver database, 200,000 records
ShinyHunters told BleepingComputer it compromised DAVID, the Driver and Vehicle Information Database operated by Florida Highway Safety and Motor Vehicles, through a password-reset flaw that allowed takeover of multiple accounts, allegedly including DMV employees and an FBI agent. The group claims…
-
ShieldCrash Defender zero-day released hours after Patch Tuesday, bypassing the flaw Microsoft just fixed
The researcher known as Nightmare Eclipse released ShieldCrash immediately after Microsoft shipped its September updates. ShieldCrash bypasses ShieldBreak, the Defender privilege escalation flaw patched last week, which itself bypassed RoguePlanet, disclosed in June and patched in July. The proof…
-
SAP discloses maximum-severity OVERPASS kernel flaw, CVSS 10.0
SAP's September Security Patch Day covered 20 vulnerabilities across 19 new notes and one update. The headline item is CVE-2026-44756, named OVERPASS by Onapsis researchers, a buffer overflow in the Extended Passport Protocol processing library carrying CVSS 10.0. Successful exploitation lets an…
-
Microsoft ships its largest Patch Tuesday ever: 966 flaws and two exploited zero-days
Microsoft released fixes for a record 966 vulnerabilities, including 105 rated Critical, of which 81 are remote code execution. Two are actively exploited: CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack caused by improper link resolution before file access, and…
-
Google Threat Intelligence documents attackers running full multi-agent attack chains, one credential operation built in under six hours
GTIG reports that threat actors have moved past AI coding assistants to multi-agent frameworks that automate reconnaissance, exploitation, credential harvesting, and error recovery with minimal human input. One financially motivated actor stood up a large-scale credential theft operation in under…
-
Fileless Linux rootkit found inside compromised F5 BIG-IP APM appliances
SophosLabs published analysis of an implant ESET calls PoisonedRefresh, tracked by Sophos as Linux/Agnt-IC, found in F5 BIG-IP Access Policy Manager environments. The rootkit intercepts PHP file loading and builds a modified in-memory copy containing the original content plus an attacker web…
-
ToolHive launches as an open-source way to run MCP servers with security controls
ToolHive is a new open-source project for running Model Context Protocol servers under isolation and access controls rather than as bare processes with ambient credentials. It arrives while MCP adoption is outrunning any consensus on how to sandbox the servers, which are effectively arbitrary code…
-
Trezor breach impact expands to 81,000 customers
Trezor's disclosure now covers roughly 81,000 customers, up from the 67,000 figure reported earlier in the week and tied to the ShipMonk third-party fulfillment compromise. The exposed data is customer and shipping information rather than wallet keys, but for a hardware wallet vendor a validated…
-
UK Court of Appeal rules misleading headlines can breach data protection law, independent of defamation
In Vince v Associated Newspapers Ltd, the Court of Appeal held that misleading editorial presentation can constitute unfair processing under UK GDPR. The judgment establishes data protection fairness as an autonomous concept, meaning a publication can breach data protection law even where it would…