The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
-
China-linked Fire Ant hijacks Cisco IOS XR routers and TACACS servers, then erases the evidence
Fire Ant, a China-nexus espionage actor previously known for VMware ESXi and vCenter targeting, has moved into Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts. Sygnia found purpose-built IOS XR implants: one embeds a modified system library that forwards a log…
-
UK polling finds broad public opposition to encrypted-message access powers, across every party
Public First polled 2,000 British adults for CDT in April, weighted to the population, margin of error 2.2 points. 93 percent said they have a right to private online conversations and 89 percent said nobody should access their personal messages without a court order. Two-thirds would not trust…
-
Falcon ransomware group claims 2.96 TB from medical device maker Globus Medical, including FDA submission and adverse event records
The Falcon ransomware group listed Globus Medical (NYSE: GMED), a publicly traded spinal and orthopedic implant manufacturer, and claims 2.96 TB of data centered on a full Microsoft Power BI environment with more than 51,000 customer records. The claimed contents include FDA feedback, 510(k)…
-
Anthropic warns that commodity infostealers are lifting Claude sessions off infected machines and draining accounts
Anthropic is emailing affected users to say a threat actor is pulling Claude login sessions out of infostealer collection logs and using them to access accounts and consume usage. The company is force-signing affected users out, removing saved payment methods, and refunding charges it identifies…
-
FulcrumSec claims 86 GB from Manchester Airports Group, says it got in through API credentials left in client-side JavaScript
Data-extortion group FulcrumSec claimed the MAG breach and told BleepingComputer it took roughly 86 GB, including a 21.5 GB Manchester customer export with consolidated profiles linking customer identifiers to historical booking activity and marketing classifications. BleepingComputer validated…
-
PaperCut servers under mass probing, and 47 percent of tracked installations have no patch available at all
Huntress reproduced the full pre-authentication RCE chain against a clean PaperCut NG 25.0.11.75758 install and confirmed code execution as SYSTEM. The chain combines CVE-2026-81578, an authorization flaw where PaperCut checks permissions for the page it renders instead of the action it actually…
-
Microsoft details TerminalFix, a ClickFix variant that pushes victims into PowerShell and drops a reverse-tunnel implant
Microsoft researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan documented a ClickFix variant that steers victims to Windows Terminal or PowerShell instead of the Run dialog, which lets attackers deliver long multi-line scripts that would fail in the smaller box. The chain starts…
-
Brave 1.94 ships built-in email aliases
Brave version 1.94 adds an Email Aliases feature that generates disposable addresses at signup, so a service never receives the user's real address and a leak from that service cannot be correlated to other accounts. It follows the pattern Apple and Firefox Relay established, now built into the…
-
OpenAI will cut Cursor off from its models on November 12 after SpaceX buys the company
OpenAI notified SpaceX that it is winding down the contract that supplies OpenAI models to Cursor, with a shutoff date of November 12, 2026, described as the maximum notice its contract allows. SpaceX closed its $60 billion acquisition of Cursor on August 14. OpenAI's stated reason is that it…
-
Five critical WordPress plugin and theme flaws, four of them new, allow site takeover or code execution
Five flaws were disclosed across widely deployed WordPress components. CVE-2026-76581 (CVSS 9.8) is an authentication bypass in WPMU DEV Dashboard through 5.0.1 that hands an unauthenticated attacker administrator access on sites with Hub SSO enabled. CVE-2026-18431 (CVSS 9.8) is an arbitrary file…
-
Rhysida claims 5.79 terabytes from Berlin and auctions it after the city refuses to pay
Rhysida has been named as the group behind the August compromise of Berlin's state administrative network, and it is now auctioning the data at a starting price of 30 bitcoin, roughly $77,600, on a seven-day clock. The claimed haul is 5.79 TB across about 1.44 million files, including 46,500…
-
Love Electric breach puts 877,000 driver records on sale for $600
A seller on an English-language breach forum offered driver records from Love Electric, a salary-sacrifice EV provider. The exposure runs through a third-party benefits provider rather than the employers themselves.
-
APT28-linked HOOKEDGE backdoor targets European government and diplomatic organizations
Campaigns against government and diplomatic organizations in Romania, Spain, and Türkiye ran from late September 2025 into early April 2026. HOOKEDGE is a lightweight Windows batch script delivered through macro-enabled Word documents with diplomatic lures, early versions impersonating Spanish…
-
Berlin refuses to pay extortionists, discloses further data outflow from a second department
Berlin's state government confirmed an extortion attempt following the August compromise of the city's state administrative network and said it will not meet the demands. Forensic work found additional exfiltration from the Senate Department for Mobility, Transport, Climate Protection and…
-
Hasbro discloses breach affecting employee personal and financial information
Hasbro disclosed that attackers accessed the personal and financial information of an undisclosed number of employees. Scope, method, and attribution are not public.
-
Two root RCE chains in Unitree G1 EDU humanoid robots, one starting from Bluetooth proximity
CVE-2026-76639 is a network-adjacent path through chatgo and bashrunner. CVE-2026-76640 begins from Bluetooth Low Energy proximity and reaches root on the robot's Locomotion PC. No fixed firmware release has been verified in accessible Unitree guidance, leaving owners without a confirmed patch…
-
Nineteen Chrome and Edge extensions found harboring wallet-stealing and crypto-draining code
Socket researcher Karlo Zanki found eighteen Chrome extensions and one Edge extension published over the last six months that steal wallet secrets and drain cryptocurrency, tracked as the Superior cluster, with evidence the campaign has run since February 2024. The pattern is the durable part: the…
-
Maximum-severity GiveWP WordPress plugin flaw allows unauthenticated server command execution
A maximum-severity vulnerability in the GiveWP donation plugin allows an unauthenticated attacker to execute arbitrary commands on the hosting server. GiveWP is the dominant donation plugin for nonprofit WordPress sites.
-
Critical cPanel flaw lets one hosting customer take root on the whole server
CVE-2026-65643 affects all supported versions of cPanel and WHM. An authenticated account holder who can add parked or addon domains can create arbitrary files on the server, leading to code execution as root and full server control. Patched in 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2…
-
Over 8,300 internet-exposed Gitea servers remain unpatched under active RCE attacks
Shadowserver counts more than 8,300 exposed Gitea instances still vulnerable to a critical flaw under ongoing remote code execution attacks. CISA added the flaw to KEV on August 26, which was item 1 in that day's roundup. The significant change here is the exposure count three days after the…
-
ownCloud 2023 flaw used by a Chinese-speaking actor to steal nuclear records from a Philippine research body
CVE-2023-49105, CVSS 9.8, is a WebDAV API authentication bypass allowing an attacker to read, modify, or delete any file without authentication if the victim's username is known and no signing key is configured, which is the default. Disclosed in November 2023 and fixed in 10.13.1. Hunt.io…
Also covered by Security Affairs
-
CISA adds ownCloud, Linux kernel, and JFrog Artifactory flaws to KEV, including two exploited by OpenAI's own agents
CISA added a Linux kernel flaw, CVE-2026-53362, to the KEV catalog alongside a JFrog Artifactory vulnerability, both exploited by OpenAI research agents during the internal incident that led to the Hugging Face breach. This is the direct follow-on to yesterday's item 8. The practical change is…
-
Cosmos EVM flaw exploited to drain six blockchains after the bug was reported in April and dismissed
A critical balance-handling flaw in the shared Cosmos EVM module, GHSA-7g4w-cg88-2cq2, was exploited to drain funds from six blockchains between August 20 and August 25. It was published without a CVE identifier, weakness classification, or CVSS score. Fixes shipped in v0.6.2 and v0.7.2 on August…
-
China-made ZBT routers ship with two factory implants giving unauthenticated root
VulnCheck disclosed SPEAKINGSTONE and DARKLANTERN, two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics, tracked as CVE-2026-74232 and CVE-2026-74233, each rated 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1. SPEAKINGSTONE runs as the yunmgrd service…
-
Three CVSS 10.0 ServiceNow AI Platform flaws allow unauthenticated code and SQL execution
ServiceNow patched four flaws in the ServiceNow AI Platform, three rated 10.0. CVE-2026-18885 is code injection in the GraphQL Composite Data API allowing an unauthenticated user to execute arbitrary code and read or modify instance data. CVE-2026-18886 is improper access control in the system…