Cyber Security
Cybersecurity
North Macedonia Charges Alleged OLVX Marketplace Administrator
North Macedonia charged the alleged administrator of the OLVX cybercrime marketplace in the first FBI joint cyber operation with the country, officials said.
CVE Vulnerability Alerts
JPCERT/CC Warns SiteGuard WAF Flaw CVE-2026-106931 Is Exploited
JPCERT/CC warns attackers are exploiting CVE-2026-106931, an OS command injection in SiteGuard Server Edition WAF that grants root or SYSTEM privileges.
Application Security
Ahsay Issues New AhsayCBS Hotfixes After Earlier Patches Failed
Ahsay released new AhsayCBS hotfixes after its August patches did not fully close CVE-2026-105133 and CVE-2026-105134, and CISA added both flaws to KEV.
Cybersecurity
Hirudo Android Trojan Replaces Banking Apps With Patched Copies
ThreatFabric details Hirudo, an Android banking trojan that uninstalls real banking apps and installs modified copies that disable their own security checks.
Cybersecurity
ICO Reprimands Met Police Over Unvetted Use of Auror Platform
The UK ICO reprimanded the Metropolitan Police and issued an enforcement notice after officers used the Auror retail crime platform without data checks.
CVE Vulnerability Alerts
Juniper, Dell, NLnet Labs and SonicWall Patch Critical Flaws
Juniper, Dell, NLnet Labs and SonicWall released fixes for critical Junos OS, Wyse Management Suite, NSD and NSM On-Prem flaws; no exploitation is reported.
Application Security
curl 8.23.0 Fixes High-Severity HTTP/2 Flaw CVE-2026-92392
curl 8.23.0 fixes CVE-2026-92392, a High-severity HTTP/2 upload use-after-free that a researcher turned into code execution, plus 23 Low-severity CVEs.
Application Security
F5 Patches Three NGINX Memory-Corruption Flaws Enabling RCE
F5 patched three NGINX memory-corruption flaws, CVE-2026-97205, CVE-2026-93479 and CVE-2026-15176, rated CVSS 8.1 that could allow remote code execution.
Application Security
Check Point Finds Two Critical LiteLLM Flaws Enabling Key Theft
Check Point Research disclosed CVE-2026-35029 and CVE-2026-59823 in LiteLLM, flaws enabling admin takeover and theft of OpenAI, Anthropic and Google API keys.
Cybersecurity
Brooklyn DA and FBI Seize 241 Domains in Crypto Scam Takedown
Brooklyn District Attorney Eric Gonzalez and the FBI seized 241 domains and 112 servers behind a crypto investment scam aimed at Russian-speaking victims.
Cybersecurity
Unsecured Database Holds 13.7M Breach Records Tied to Vibetech
Researcher Jeremiah Fowler found an unsecured database of 13.7 million records tied to AT&T, Amazon, Walmart and PayPal, linked to India-based Vibetech.
CVE Vulnerability Alerts
Microsoft Patches Record 1,413 CVEs, Including Exploited Zero-Day
Microsoft's October Patch Tuesday fixes a record 1,413 CVEs, including CVE-2026-96951, a Windows Shell zero-day that bypasses Mark of the Web protections.
CVE Vulnerability Alerts
Ivanti Connect Secure Zero-Day Chain Gives Root on Patched VPNs
Volexity found actor UTA0576 chaining three Ivanti Connect Secure zero-days to gain root on a fully patched VPN appliance; one flaw remains unpatched.
Cybersecurity
DOJ Charges OpenAI Engineer Over Hidden Conference Room Recorder
A DOJ complaint charges OpenAI engineer Abdulrahman Alfozan with planting a covert recording device in an executive conference room at the company's office.
Cybersecurity
DOJ Charges 14 in North Korean IT Worker Laptop Farm Case
DOJ unsealed an indictment charging 14 people in a North Korean IT worker scheme that took in more than $3 million; the FBI searched 40 ...
Application Security
Public Exploit Released for CVSS 10.0 GitLab Flaw CVE-2026-97229
Rapid7 published a proof-of-concept for GitLab CVE-2026-97229, a CVSS 10.0 flaw; Censys counts 25,766 internet-facing hosts running vulnerable versions.
Cybersecurity
Meta Notifies 1,500 After Stolen Credentials Expose GitHub Code
Meta is notifying about 1,500 people after hackers used an employee's stolen credentials to take product code and a small amount of personal data from ...
Application Security
Docker Fixes Critical Docker Hub Flaw GhostPat, CVE-2026-105445
Docker patched GhostPat, a critical Docker Hub flaw (CVE-2026-105445, CVSS 9.4) that let attackers act as other accounts at the registry level for two years.
Application Security
Nextcloud Collabora Flaw CVE-2026-110447 Exploited for Webshells
SecurityOnline reports attackers are exploiting CVE-2026-110447, a CVSS 9.2 command injection in Nextcloud's Collabora CODE app, to plant PHP webshells.
Cybersecurity
ShinyHunters Claims H&M Database Breach; Retailer Sees No Compromise
ShinyHunters claims it accessed H&M internal databases covering inventory and logistics; H&M says it is investigating and sees no sign of compromise yet.
Application Security
TeamUpdraft Breach Lets Attackers Backdoor WordPress Sites
TOP CYBERSECURITY HEADLINES
Application Security
Roundcube 1.6.20 and 1.7.5 Fix 20 Flaws, Including IMAP Injection
Application Security
AIA0001 Hacker Uses AI Agents to Breach 100+ Company Websites
This Week’s Security Spotlight
Application Security
Siemens Software Center Flaw Exploited in ROMULUS ClickFix Attacks
Application Security
Microsoft Confirms Windows Update Breaks Exchange Sign-In, Mail Flow
CVE Vulnerability Alerts
AWS Patches Critical Amazon Neptune Flaw Rated CVSS 9.9
CVE Vulnerability Alerts
Cisco Secure Email Gateway Zero-Day CVE-2026-76519 Exploited
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Featured Videos
Podcasts
Cyber Security News
- All
- Application Security
- Blog
- CVE Vulnerability Alerts
- Cybersecurity
- Cybersecurity Newsletter
- Data Security
- Endpoint Security
- Identity and Access Management
- Information Security
- Network Security
- News
- Phishing
- Podcasts
- Product Reviews
- Ransomware
- Ransomware Victims
- Resources
- Security Spotlight
- Sponsored
- Threat Actors
- Threat Actors
- Threat Detection Tools
Hirudo Android Trojan Replaces Banking Apps With Patched Copies
ThreatFabric details Hirudo, an Android banking trojan that uninstalls real banking apps and installs modified copies that disable their own security checks.
ICO Reprimands Met Police Over Unvetted Use of Auror Platform
The UK ICO reprimanded the Metropolitan Police and issued an enforcement notice after officers used the Auror retail crime platform without data checks.
Juniper, Dell, NLnet Labs and SonicWall Patch Critical Flaws
Juniper, Dell, NLnet Labs and SonicWall released fixes for critical Junos OS, Wyse Management Suite, NSD and NSM On-Prem flaws; no exploitation is reported.
curl 8.23.0 Fixes High-Severity HTTP/2 Flaw CVE-2026-92392
curl 8.23.0 fixes CVE-2026-92392, a High-severity HTTP/2 upload use-after-free that a researcher turned into code execution, plus 23 Low-severity CVEs.
F5 Patches Three NGINX Memory-Corruption Flaws Enabling RCE
F5 patched three NGINX memory-corruption flaws, CVE-2026-97205, CVE-2026-93479 and CVE-2026-15176, rated CVSS 8.1 that could allow remote code execution.
Check Point Finds Two Critical LiteLLM Flaws Enabling Key Theft
Check Point Research disclosed CVE-2026-35029 and CVE-2026-59823 in LiteLLM, flaws enabling admin takeover and theft of OpenAI, Anthropic and Google API keys.
Brooklyn DA and FBI Seize 241 Domains in Crypto Scam Takedown
Brooklyn District Attorney Eric Gonzalez and the FBI seized 241 domains and 112 servers behind a crypto investment scam aimed at Russian-speaking victims.
Unsecured Database Holds 13.7M Breach Records Tied to Vibetech
Researcher Jeremiah Fowler found an unsecured database of 13.7 million records tied to AT&T, Amazon, Walmart and PayPal, linked to India-based Vibetech.
Microsoft Patches Record 1,413 CVEs, Including Exploited Zero-Day
Microsoft's October Patch Tuesday fixes a record 1,413 CVEs, including CVE-2026-96951, a Windows Shell zero-day that bypasses Mark of the Web protections.
Ivanti Connect Secure Zero-Day Chain Gives Root on Patched VPNs
Volexity found actor UTA0576 chaining three Ivanti Connect Secure zero-days to gain root on a fully patched VPN appliance; one flaw remains unpatched.
DOJ Charges OpenAI Engineer Over Hidden Conference Room Recorder
A DOJ complaint charges OpenAI engineer Abdulrahman Alfozan with planting a covert recording device in an executive conference room at the company's office.
DOJ Charges 14 in North Korean IT Worker Laptop Farm Case
DOJ unsealed an indictment charging 14 people in a North Korean IT worker scheme that took in more than $3 million; the FBI searched 40 ...
Public Exploit Released for CVSS 10.0 GitLab Flaw CVE-2026-97229
Rapid7 published a proof-of-concept for GitLab CVE-2026-97229, a CVSS 10.0 flaw; Censys counts 25,766 internet-facing hosts running vulnerable versions.
Meta Notifies 1,500 After Stolen Credentials Expose GitHub Code
Meta is notifying about 1,500 people after hackers used an employee's stolen credentials to take product code and a small amount of personal data from ...
Docker Fixes Critical Docker Hub Flaw GhostPat, CVE-2026-105445
Docker patched GhostPat, a critical Docker Hub flaw (CVE-2026-105445, CVSS 9.4) that let attackers act as other accounts at the registry level for two years.
Nextcloud Collabora Flaw CVE-2026-110447 Exploited for Webshells
SecurityOnline reports attackers are exploiting CVE-2026-110447, a CVSS 9.2 command injection in Nextcloud's Collabora CODE app, to plant PHP webshells.
ShinyHunters Claims H&M Database Breach; Retailer Sees No Compromise
ShinyHunters claims it accessed H&M internal databases covering inventory and logistics; H&M says it is investigating and sees no sign of compromise yet.
FTC Sues Sextortion Help Operator Dmitry Belkin Over $60M Fraud
The FTC sued Dmitry Belkin and Digital Forensics Corporation, alleging a fake sextortion help scheme took in at least $60 million from blackmail victims.
Joint Disruption Week Nets 28 Arrests in West African Scam Crackdown
A week-long operation hosted by the UK NCA led to 28 arrests in Ghana and Nigeria, identified 117 trafficking victims and removed 3.7 million scam ...
UK Housing Ombudsman Probes Third-Party Incident, Pauses Complaints
The UK Housing Ombudsman Service is investigating a third-party security incident at its case management system and has blocked new online complaints.