OpenSSL Patches High-Severity DTLS Memory Leak Flaw
October 1, 2026
OpenSSL patched a high-severity DTLS flaw that can expose unencrypted heap memory or crash affected software running its widely used
Network Security
OpenSSL Patches High-Severity DTLS Memory Leak Flaw
OpenSSL patched a high-severity DTLS flaw that can expose unencrypted heap memory or crash affected software running its widely used cryptographic library.
Citrix NetScaler Zero-Days Deployed WHIPSHOT, SLAPSHOT
Attackers exploited two Citrix NetScaler zero-days to plant custom WHIPSHOT and SLAPSHOT malware, hitting government, financial, and legal-sector networks.
Suspected North Korean Hackers Steal $351.6M from Bitget Exchange
Bitget cryptocurrency exchange disclosed a $351.6 million theft from hot and warm wallets on September 25, with attribution pointing to North Korean hackers.
Roundcube Webmail SQL Injection Flaw Exploited Four Months After Patch
Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube Webmail patched in May.
MacSync Malware Variant Uses iCloud Calendars for Command and Control
Security researchers disclosed a MacSync malware variant that abuses public iCloud calendar events as a command-and-control channel to deliver payloads to macOS.
Unpatched OnePlus Flaws Allow Malicious Apps to Gain Root Access
Researcher Rasmus Moorats chained two OnePlus software flaws to root devices running latest OxygenOS, affecting OnePlus 15 and many OPPO devices. Unpatched.
Ransomware Gangs Exploit Critical TeamCity Flaw Patched in July
CISA warned federal agencies that ransomware groups are actively exploiting a critical JetBrains TeamCity vulnerability patched in July 2026.
SolarWinds Patches Critical Unauthenticated RCE Vulnerabilities
SolarWinds released patches for CVE-2026-28324 and CVE-2026-28325, two critical unauthenticated RCE flaws in Observability Self-Hosted platform.
Carbonato Botnet Uses AI Agents to Hijack Exposed Docker Hosts
Security researchers disclosed Carbonato botnet malware that uses Hermes Agent AI framework to autonomously compromise exposed Docker daemon hosts.
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September 8.
Citrix NetScaler Zero-Days Deployed WHIPSHOT, SLAPSHOT
September 30, 2026
Attackers exploited two Citrix NetScaler zero-days to plant custom WHIPSHOT and SLAPSHOT malware, hitting government, financial, and legal-sector networks.
Suspected North Korean Hackers Steal $351.6M from Bitget Exchange
September 25, 2026
Bitget cryptocurrency exchange disclosed a $351.6 million theft from hot and warm wallets on September 25, with attribution pointing to
Roundcube Webmail SQL Injection Flaw Exploited Four Months After Patch
September 25, 2026
Canadian Centre for Cyber Security confirmed active exploitation of CVE-2026-48842, an unauthenticated SQL injection flaw in Roundcube Webmail patched in
MacSync Malware Variant Uses iCloud Calendars for Command and Control
September 25, 2026
Security researchers disclosed a MacSync malware variant that abuses public iCloud calendar events as a command-and-control channel to deliver payloads
Unpatched OnePlus Flaws Allow Malicious Apps to Gain Root Access
September 25, 2026
Researcher Rasmus Moorats chained two OnePlus software flaws to root devices running latest OxygenOS, affecting OnePlus 15 and many OPPO
Ransomware Gangs Exploit Critical TeamCity Flaw Patched in July
September 25, 2026
CISA warned federal agencies that ransomware groups are actively exploiting a critical JetBrains TeamCity vulnerability patched in July 2026.
SolarWinds Patches Critical Unauthenticated RCE Vulnerabilities
September 25, 2026
SolarWinds released patches for CVE-2026-28324 and CVE-2026-28325, two critical unauthenticated RCE flaws in Observability Self-Hosted platform.
Carbonato Botnet Uses AI Agents to Hijack Exposed Docker Hosts
September 25, 2026
Security researchers disclosed Carbonato botnet malware that uses Hermes Agent AI framework to autonomously compromise exposed Docker daemon hosts.
Russian Actor Uses AI to Exploit PaperCut, Hits 440+ Organizations
September 11, 2026
Russian threat actor deployed hundreds of AI agents to exploit PaperCut vulnerabilities, compromising 395-440+ organizations between August 15 and September
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.