News Archive
2287 stories · page 4 of 96Every story we've published, newest first. Vulnerability records live in the CVE Tracker.
Atlassian Patches Critical Vulnerability Affecting 8 Products
Atlassian has released patches for a critical vulnerability impacting eight of its products. The flaw, if exploited, could allow unauthenticated attackers to gain access to specific files located within the web application's root directory. This type of access could potentially expose sensitive configuration or application data, depending on the contents of the accessible files.
AI Agent Gateway: Open-source tool keeps credentials out of agent configs
Tuskira has released AI Agent Gateway, an open-source tool designed to enhance the security of AI agent deployments by centralizing credential management and access control. The gateway operates as an intermediary between AI agents and the services they interact with, including both tool servers (referred to as MCP tools) for platforms like GitHub and Jira, and various large language model…
OpenSSH 10.6 enables a post-quantum signature algorithm, so experimental keys need replacing
The OpenSSH project released version 10.6 on October 6, introducing a new hybrid post-quantum signature algorithm and addressing several security vulnerabilities. The maintainers indicated that future releases may occur more frequently to expedite bug fixes, noting a rise in security reports, many identified with the assistance of AI models.
AI endpoint management: Visibility, compliance, and remediation
Organizations today face a growing challenge in managing their endpoint estates, which are expanding rapidly due to factors like hybrid work models, increased cloud adoption, and the use of contractor devices. This expansion, coupled with a constant stream of new Common Vulnerabilities and Exposures (CVEs) and escalating compliance demands, often overwhelms security teams. Manual tracking and…
Even with OT network visibility, critical infrastructure operators struggle with legacy equipment
A recent survey of over 1,600 security and operations leaders in critical infrastructure organizations reveals that despite widespread adoption of security tools, many operators still lack full visibility into their operational technology (OT) networks and struggle with the risks posed by legacy equipment. The study, conducted by Palo Alto Networks, highlights a significant challenge in…
Automation, AI agents or people? Sorting out who handles each security finding
A recent survey of 200 senior security and technology leaders reveals significant concerns about the escalating complexity of software security programs, particularly in the wake of increased AI adoption. Over half of the respondents, primarily from companies with 10,000 or more employees, anticipate struggles in simplifying their security operations if current practices persist.
Check your X.Org server version because a dozen vulnerabilities have been patched
X.Org has released patches for a dozen security vulnerabilities affecting its X server and Xwayland components, with updates available in versions xorg-server 21.1.25 and xwayland-24.1.14. Nine of these flaws are critical, potentially allowing for arbitrary code execution, while the remaining three could lead to server crashes or information disclosure.
South Korean president calls for creation of tools that stop all cyber-attacks
South Korean President Lee Jae Myung has called for a comprehensive overhaul of the nation's cybersecurity defenses, urging the development of AI-powered tools to preemptively detect and block cyberattacks. Speaking to his cabinet on October 6, 2026, President Lee emphasized the need for a "complete security paradigm refresh" to address the challenges posed by AI-wielding attackers.
Anthropic reconfigures its cool kids security program
Anthropic has announced a restructuring of its cybersecurity initiatives, merging its Project Glasswing and Cyber Verification Program (CVP) into a single, tiered offering. This change, effective as of October 2026, aims to provide more security organizations with access to Anthropic's AI capabilities for system protection.
ASOS Hackers Hijack App Notifications, Claim Snowflake Data Breach
ASOS is currently investigating a cybersecurity incident where unauthorized actors leveraged the company's official mobile application to disseminate threatening notifications to its customer base. The messages, sent directly through the app's notification system, asserted that the attackers had successfully breached Snowflake and subsequently gained access to ASOS customer data.
Karina Portugal Makes the Case for Know Your Agent
Karina Portugal, a Director at Prove Identity, has reportedly advocated for a new security paradigm termed "Know Your Agent" (KYA). This concept addresses the emerging challenges in verifying autonomous software agents, which traditional "Know Your Customer" (KYC) methodologies are not equipped to handle. The core argument is that existing KYC frameworks primarily focus on human user identity,…
Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks
The FBI and Secret Service have issued a joint alert regarding "FortiBleed," a credential compromise campaign targeting Fortinet firewalls and VPN gateways. The agencies confirm that the campaign remains active and poses a significant threat, potentially leading to user lockouts and serving as an initial entry point for ransomware attacks.
Ninja Forms plugin flaw exploited to hack WordPress sites
Cybersecurity researchers have identified an active exploitation campaign targeting two WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, leveraging stored cross-site scripting (XSS) vulnerabilities to compromise websites. The attacks, first observed on October 4 against WPC Product Bundles for WooCommerce users and then on October 5 against Ninja Forms users, involve the…
ClickFix Attacks Evolve to Better Hide Malicious Payloads
Recent reports indicate a significant evolution in ClickFix attack methodologies, with cybercriminals now employing more sophisticated techniques to mask their malicious payloads. The updated tactics reportedly involve the use of DNS TXT records and browser cache pre-fetching, strategies designed to make the early detection of these threats considerably more difficult for security systems and…
Wiretapping change sparks big privacy fight in the Golden State
California Governor Gavin Newsom has signed a bipartisan update to the state's wiretapping law, the California Invasion of Privacy Act (CIPA), which will eliminate the ability for private citizens to sue over certain internet-based surveillance. The amendment, known as SB 690, specifically targets the private right to sue websites and mobile applications for unauthorized use of "pen registers"…
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
Security researchers collectively uncovered 32 zero-day vulnerabilities on the first day of the Pwn2Own Ireland 2026 competition, earning a total of $388,500. The event, organized by the Zero Day Initiative (ZDI), aims to identify critical flaws in various products before malicious actors can exploit them.
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Cybersecurity researchers have uncovered a human-operated phishing platform designed to impersonate advertising portals for popular artificial intelligence (AI) chatbots. The platform specifically targets users by mimicking ad products for services such as Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and Manus. Its primary objective is to capture user credentials and…
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Recent reports indicate the discovery of Linux backdoors actively targeting telecommunications and network appliances within South Korea and Taiwan. These sophisticated backdoors are designed to evade detection by masquerading their malicious traffic as legitimate email services and by impersonating benign system processes. This tactic allows the malware to blend into normal network activity…
Google's PageBreak AI Agent Finds 500 Flaws in Its Web Apps
Google has reportedly developed an artificial intelligence agent, named PageBreak, which has identified approximately 500 flaws within Google's own web applications. This development highlights an emerging trend in the cybersecurity industry: the application of AI and deterministic validation methods to automate the discovery of vulnerabilities, assess their exploitability, and provide a…
Former NSA chief Nakasone says agency overhaul is ‘probably needed’
Former National Security Agency Director Paul Nakasone stated that a reported comprehensive reorganization of the agency is likely necessary to address rapidly evolving cyber threats and the competitive landscape in artificial intelligence (AI). Nakasone, who led the NSA and U.S. Cyber Command from 2018 to 2024, made these remarks on Tuesday at VulnCheck's ThreatCon1 conference.
Microsoft extends the Outlook naughty step with two more file types
Microsoft is implementing new security measures for Outlook, adding two file types, .msix and .msixbundle, to its default block list for attachments. These file types are associated with Windows application packages and bundles. The change is set to affect users of the New Outlook for Windows client and Outlook on the Web within Exchange Online.
Mitigate Risks of AI-Generated Apps by Citizen Coders
The increasing use of AI tools by non-technical employees, often referred to as "citizen coders," to develop workplace applications presents significant security and data risks for organizations. While these AI-generated applications can boost productivity and streamline workflows, their rapid creation without proper oversight can lead to "shadow AI" assets with critical vulnerabilities,…
ClickFix Attack Hides VBScript Payload in Browser Cache
A new "ClickFix" social engineering campaign has been identified that leverages browser caches to conceal malicious VBScript payloads. The technique, detailed by Microsoft Threat Intelligence on October 3, involves compromised websites pre-fetching a script disguised as an image into a visitor's browser cache. This allows the payload to be present on the victim's device before they are tricked…
Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access
Dell has issued an urgent advisory to customers, recommending they patch a critical vulnerability in its System Update (DSU) tool that could allow attackers to gain root access on affected PowerEdge servers. The flaw, identified as CVE-2026-86360, carries a CVSS score of 9.6, indicating its severe potential impact.