Cyber Security
Cybersecurity
US and EU Agencies Warn Refrigeration Hacks Have Reached Blood Banks
FBI, CISA and EU agencies warn that attacks on refrigeration controllers have spread from European supermarkets to French blood service sites, advisories say.
Application Security
OpenSSH 10.6p2 Fixes ‘*sshole’ Password Bypass on Alpine, musl
OpenSSH 10.6p2 fixes a critical flaw that lets attackers log in to passwordless accounts on musl-based Linux such as Alpine by sending an overlong password.
Cybersecurity
Ransomware Disrupts Queens Public Library Across All 66 Branches
A ransomware attack encrypted Queens Public Library systems, knocking out Wi-Fi, computers, the website and app across 66 branches in New York City.
Cybersecurity
Norad Confirms Hackers Stole Data on All 20,614 Grants Portal Users
Norway's aid agency Norad says attackers stole names and emails of all 20,614 Grants Portal users across 12,511 organizations after abusing 27 accounts.
Cybersecurity
White House Network Addresses Found Acting as Residential Proxy Exits
Layer3 Intel says six White House network addresses relayed residential proxy traffic 236 times in a month, likely from a device running proxy software.
Application Security
Microsoft Patches Paint Remote Code Execution Flaw CVE-2026-83844
Microsoft fixed CVE-2026-83844, an out-of-bounds read in Paint on Windows 10 and 11 rated CVSS 8.1, with no exploitation or public exploit code reported.
Application Security
Apache OFBiz 24.09.08 Fixes 46 Flaws, Including Unauthenticated RCE
Apache OFBiz 24.09.08 fixes 46 vulnerabilities, including CVE-2026-83542, a CVSS 9.8 unauthenticated remote code execution flaw in the ERP platform.
Cybersecurity
GhostMap Android Bug Traps Phones in Boot Loop; Google Won’t Fix
Bitdefender disclosed GhostMap, an Android 10+ flaw that lets a permissionless app trap phones in an endless crash loop; Google has declined to issue a ...
AI Security
Check Point: ChatGPT HTML Preview Flaw Bypassed Lockdown Mode
Check Point Research says a patched ChatGPT HTML preview flaw escaped the sandbox and bypassed Lockdown Mode, enabling silent chat theft via custom GPTs.
Cybersecurity
Treasury Sanctions 4 People, 41 Firms in Third Prince Group Round
The US Treasury sanctioned four people and 41 companies tied to Cambodia's Prince Group scam network in a third round aimed at money-laundering shell firms.
AI Security
Researcher: Claude Dispatch Flaw Lets Browser Extension Run Code
Forever Security's Gal Weizman says a Claude Dispatch flaw lets a browser extension send commands to Claude Desktop and run code; Anthropic has not fixed ...
Application Security
Sonatype Fixes Seven Nexus Repository Flaws, Including CVSS 9.1 Bypass
Sonatype's Nexus Repository 3.98.0 fixes seven flaws, led by CVE-2026-113373, a CVSS 9.1 SAML and OAuth2 bypass that lets locked accounts sign back in.
Application Security
Zoho Patches 11 ManageEngine Flaws in Log360 and Key Manager Plus
Zoho fixed 11 ManageEngine flaws, including CVE-2026-13594, a CVSS 9.1 access-control bug in Log360 and EventLog Analyzer, with no known exploitation.
CVE Vulnerability Alerts
CISA Flags Two Critical Flaws in Subnet PowerSYSTEM Center
CISA advisory ICSA-26-307-01 covers two CVSS 9.4 flaws in Subnet Solutions PowerSYSTEM Center, software used to manage power-grid equipment worldwide.
CVE Vulnerability Alerts
CISA Adds Apple CVE-2024-27834 to KEV After APT29 Phone Attacks
CISA added Apple's CVE-2024-27834 to its KEV catalog after Sekoia tied watering-hole attacks on iPhones and Android phones to Russia's APT29 hacking group.
Application Security
Debian, Ubuntu Patch Critical APT Flaw CVE-2026-109518
Debian and Ubuntu patched CVE-2026-109518, a critical APT flaw that lets a network attacker swap a verified package for malicious code that installs as root.
Cybersecurity
Credit Mutuel Arkea Confirms Attack Tied to $133M Bank Theft
Credit Mutuel Arkea confirmed a sophisticated supplier-linked attack after ZachXBT reported more than $133 million stolen, saying customer accounts are safe.
CVE Vulnerability Alerts
Xen Flaws CVE-2026-102703, CVE-2026-102704 Break VM Isolation
Xen advisory XSA-523 covers two grant copy flaws that let a malicious guest read and write any other VM's memory, including dom0, with no known ...
CVE Vulnerability Alerts
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
Attackers are exploiting GPUStack CVE-2026-102895, a CVSS 9.8 authentication bypass that grants admin access and lets them run reverse shells on AI servers.
Application Security
Ten Control Web Panel Flaws Chain Into Root RCE; PoC Public
VulnCheck disclosed ten Control Web Panel flaws that chain into unauthenticated root code execution, with a public exploit module and fixes in version 1.29.
TOP CYBERSECURITY HEADLINES
Application Security
Microsoft Patches Paint Remote Code Execution Flaw CVE-2026-83844
Application Security
Apache OFBiz 24.09.08 Fixes 46 Flaws, Including Unauthenticated RCE
This Week’s Security Spotlight
CVE Vulnerability Alerts
Citrix Fixes CVSS 9.8 XenServer Flaw and Brotli Bug in Scout
CVE Vulnerability Alerts
ASUS Patches AiCloud Root Flaw CVE-2026-84730 in Four Alerts
CVE Vulnerability Alerts
Barracuda Flaws Chain Into Root Access on Email Security Gateway
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- AI Security
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Norad Confirms Hackers Stole Data on All 20,614 Grants Portal Users
Norway's aid agency Norad says attackers stole names and emails of all 20,614 Grants Portal users across 12,511 organizations after abusing 27 accounts.
White House Network Addresses Found Acting as Residential Proxy Exits
Layer3 Intel says six White House network addresses relayed residential proxy traffic 236 times in a month, likely from a device running proxy software.
Microsoft Patches Paint Remote Code Execution Flaw CVE-2026-83844
Microsoft fixed CVE-2026-83844, an out-of-bounds read in Paint on Windows 10 and 11 rated CVSS 8.1, with no exploitation or public exploit code reported.
Apache OFBiz 24.09.08 Fixes 46 Flaws, Including Unauthenticated RCE
Apache OFBiz 24.09.08 fixes 46 vulnerabilities, including CVE-2026-83542, a CVSS 9.8 unauthenticated remote code execution flaw in the ERP platform.
GhostMap Android Bug Traps Phones in Boot Loop; Google Won’t Fix
Bitdefender disclosed GhostMap, an Android 10+ flaw that lets a permissionless app trap phones in an endless crash loop; Google has declined to issue a ...
Check Point: ChatGPT HTML Preview Flaw Bypassed Lockdown Mode
Check Point Research says a patched ChatGPT HTML preview flaw escaped the sandbox and bypassed Lockdown Mode, enabling silent chat theft via custom GPTs.
Treasury Sanctions 4 People, 41 Firms in Third Prince Group Round
The US Treasury sanctioned four people and 41 companies tied to Cambodia's Prince Group scam network in a third round aimed at money-laundering shell firms.
Researcher: Claude Dispatch Flaw Lets Browser Extension Run Code
Forever Security's Gal Weizman says a Claude Dispatch flaw lets a browser extension send commands to Claude Desktop and run code; Anthropic has not fixed ...
Sonatype Fixes Seven Nexus Repository Flaws, Including CVSS 9.1 Bypass
Sonatype's Nexus Repository 3.98.0 fixes seven flaws, led by CVE-2026-113373, a CVSS 9.1 SAML and OAuth2 bypass that lets locked accounts sign back in.
Zoho Patches 11 ManageEngine Flaws in Log360 and Key Manager Plus
Zoho fixed 11 ManageEngine flaws, including CVE-2026-13594, a CVSS 9.1 access-control bug in Log360 and EventLog Analyzer, with no known exploitation.
CISA Flags Two Critical Flaws in Subnet PowerSYSTEM Center
CISA advisory ICSA-26-307-01 covers two CVSS 9.4 flaws in Subnet Solutions PowerSYSTEM Center, software used to manage power-grid equipment worldwide.
CISA Adds Apple CVE-2024-27834 to KEV After APT29 Phone Attacks
CISA added Apple's CVE-2024-27834 to its KEV catalog after Sekoia tied watering-hole attacks on iPhones and Android phones to Russia's APT29 hacking group.
Debian, Ubuntu Patch Critical APT Flaw CVE-2026-109518
Debian and Ubuntu patched CVE-2026-109518, a critical APT flaw that lets a network attacker swap a verified package for malicious code that installs as root.
Credit Mutuel Arkea Confirms Attack Tied to $133M Bank Theft
Credit Mutuel Arkea confirmed a sophisticated supplier-linked attack after ZachXBT reported more than $133 million stolen, saying customer accounts are safe.
Xen Flaws CVE-2026-102703, CVE-2026-102704 Break VM Isolation
Xen advisory XSA-523 covers two grant copy flaws that let a malicious guest read and write any other VM's memory, including dom0, with no known ...
GPUStack Auth Bypass CVE-2026-102895 Exploited on AI Servers
Attackers are exploiting GPUStack CVE-2026-102895, a CVSS 9.8 authentication bypass that grants admin access and lets them run reverse shells on AI servers.
Ten Control Web Panel Flaws Chain Into Root RCE; PoC Public
VulnCheck disclosed ten Control Web Panel flaws that chain into unauthenticated root code execution, with a public exploit module and fixes in version 1.29.
Cisco Patches UCS Central Flaw CVE-2026-76506 and ISE Bugs
Cisco patched UCS Central flaw CVE-2026-76506, an ISE certificate authorization bypass and a Unified CM XSS bug. No workarounds exist and no attacks are known.
Citrix Fixes CVSS 9.8 XenServer Flaw and Brotli Bug in Scout
Citrix patched a CVSS 9.8 XenServer race condition, CVE-2026-98432, plus pre-boot and Brotli decoder flaws. The company reports no attacks against customers.
NIKKE PC Launcher Scripts Tampered to Spread K2F Malware
Attackers tampered with Goddess of Victory: NIKKE PC launcher scripts on an official CDN to install the K2F remote-access agent and a wallet-stealing DLL.