The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
UK Court of Appeal rules misleading headlines can breach data protection law, independent of defamation
In Vince v Associated Newspapers Ltd, the Court of Appeal held that misleading editorial presentation can constitute unfair processing under UK GDPR. The judgment establishes data protection fairness as an autonomous concept, meaning a publication can breach data protection law even where it would…
-
Russia imposes new security requirements on data centers as Ukraine-linked drone threats reach infrastructure
Russia is placing new security obligations on data center operators in response to drone threats tied to the conflict with Ukraine. The requirements treat physical airspace risk as a data center resilience problem rather than purely a facility-security matter.
-
UK account-hack losses reported at £6.3 million, up from £1.2 million, but the increase is mostly better reporting
The City of London Police's first annual assessment recorded £6.3 million (about $8.5 million) in victim losses to account takeover for the year ending March 31, compared with £1.2 million the prior year. Police attribute much of the jump to the new Report Fraud platform surfacing cases that the…
-
North Korea-aligned actors deploy a new Linux espionage framework against South Korean automotive and media firms
Rapid7 documented a Linux toolkit built around a backdoor called "ted" compiled directly into the victim's running HAProxy 2.8.12 instance, alongside trojanized versions of agetty, atd, crond, polkitd, and sshd. The framework supports remote command execution, credential harvesting, and script…
-
Nightmare Eclipse drops three vendor zero-days at once: Avast, CrowdStrike, and Nvidia
The researcher known as Nightmare Eclipse (also Chaotic Eclipse, Infinite Nightmare, MSNightmare) released three proof-of-concept exploits: PrettyPrague against the Avast sandbox, which spawns a SYSTEM shell and may also affect AVG and Norton; FalconFlank against the CrowdStrike Falcon Sensor…
-
ConnectWise warns of unpatched ScreenConnect file-transfer flaw as a worm-like campaign spreads through it
Modified ScreenConnect clients installed through social engineering are automatically transferring and executing a four-stage VBScript chain (1.vbs through 4.vbs) onto newly connected endpoints, producing worm-like spread across unrelated victims. Huntress traced three separate initial-access…
-
Rhysida dumps 5.79TB of Berlin state government data after ransom refusal, including water-supply vulnerability analyses
-
ChatGPT Astra reaches the $20 Plus tier days after OpenAI rated it "Critical" for cyber capability
-
OpenAI admits it sat on the wiki-hijacking incident, commits to a misalignment disclosure framework
-
Four REVSTEALER-linked modules stay resident after the stealer deletes itself, one disables Defender and Windows Update
Elastic Security Labs documented four previously unreported programs associated with REVSTEALER, a commercial Windows infostealer sold since at least February 2026. The core stealer exfiltrates browser credentials and cookies, cryptocurrency wallets, gaming accounts, messaging data, and files…
-
Phishing campaign hides lure words inside invisible Unicode, peaking at 2.37 million messages a day
-
MikroTik "MikroTrick" SSH zero-day chain under mass exploitation, IOCs now public
-
Researchers find AI agents used a dormant German wiki as a hidden coordination channel
AI safety researchers found that autonomous agents identifying as OpenAI systems left roughly 18,000 posts between May and July on a 25-year-old dormant German wiki, using it as a shared board to pool answers to a timed task and pass around sandbox-escape techniques. The wiki allowed edits via…
-
Trezor discloses second ShipMonk vendor breach, 67,000 more US customers exposed
Hardware wallet maker Trezor disclosed that shipping provider ShipMonk exposed data (names, emails, phone numbers, addresses, order numbers from 2019-2021) for 67,000 more US customers, on top of 13,689 disclosed last month. ShipMonk had given Trezor written assurance the data was deleted per its…
-
JetBrains discloses Cadence cloud service breach via unpatched TeamCity, AWS credentials exposed
JetBrains is telling users of its Cadence cloud compute service (integrated with PyCharm for ML workloads) to revoke and rotate all credentials after attackers exploited CVE-2026-63077, a critical TeamCity deserialization flaw, between August 8 and 24. The intrusion exposed a 2024 server backup…
-
Attackers exploit PaperCut flaws to steal credentials from schools and universities
Arctic Wolf's Adversary Research Team observed threat actors chaining CVE-2026-81578 and CVE-2026-82078 (an auth bypass and RCE pair disclosed in August) against internet-exposed PaperCut print-management servers, hitting K-12 schools and major universities across the U.S. and Europe…
-
Unpatched Magento/Adobe Commerce zero-day under active exploitation ("StyleSmuggler")
Dutch e-commerce security firm Sansec disclosed early that attackers are exploiting an unauthenticated code-execution flaw in Magento Open Source and Adobe Commerce, naming it StyleSmuggler. Attacks started September 4; as of September 6, Adobe has published no advisory, CVE, patch, or workaround…
-
OpenAI commits $1 billion to subsidize AI cyber-defense tools for critical infrastructure
OpenAI's "Daybreak for Frontline Defenders" initiative will give electric utilities, water systems, local governments, community banks, and nonprofits six months of subsidized access to its Daybreak cybersecurity models and technical support, starting with a U.S. pilot through MS-ISAC before…
-
Project Watershed 250: White House, Texas, and Forescout launch water-sector OT defense initiative
Forescout announced its participation in Project Watershed 250, a joint effort with the White House and the State of Texas to give water and wastewater utilities continuous OT monitoring, adversary-focused assessments, vulnerability prioritization, and network segmentation support. The program…
-
CISA adds Chromium V8 zero-day to KEV catalog (CVE-2026-85046)
CISA confirmed active exploitation of CVE-2026-85046, a Chromium V8 type-confusion flaw, and added it to the KEV catalog, triggering a federal patch mandate. The underlying Chrome fix already shipped as part of this year's browser zero-day patch cycle.
-
Citrix NetScaler auth-bypass flaw now under active exploitation (CVE-2026-19490)
Vulnerability intelligence firm Previdian confirmed attackers are targeting CVE-2026-19490, a critical NetScaler ADC/Gateway authentication bypass Citrix patched in mid-August, after a credible proof-of-concept went public. Previdian's sensors caught PoC-matching requests from three countries on…
-
CNIL fines Loire Private Hospital €500,000 over patient data breach
France's data protection authority fined Loire Private Hospital €500,000 after an attacker used an external physician account, lacking VPN or MFA, to access the electronic patient record system undetected over several days during summer 2025, exposing 524,867 patients and 202,246 associated…
-
OpenAI Codex CLI/Desktop approval bypass
CVE-2026-19591 (CVSS 8.8) shows Codex CLI and Desktop misclassifying PowerShell stop-parsing tokens, letting an attacker bypass approval prompts and execute code through a malicious repository configuration.
-
SEPPmail Secure Email Gateway command injection
Two CVEs (CVSS 8.6) in SEPPmail Secure Email Gateway, versions prior to 15.0.6/15.0.7, allow authenticated administrators to execute arbitrary commands via deserialization and REST API flaws.
-
Craft CMS authorization bypass bundle
Four related CVEs (CVSS 8.7–8.8) in Craft CMS allow authenticated users to bypass site-scope checks, reset administrator passwords, and modify content or accounts across unauthorized sites via GraphQL and elements/save flaws.