Cybersecurity stories from our curated feeds, ranked by recency, source coverage, and outlet weight.
2
hottest
desk
Microsoft's October 2026 Patch Tuesday fixes 1,411 flaws, including CVE-2026-96951, a security feature bypass in Windows Shell already exploited in the wild. The batch dwarfs September's record of nearly 1,000 fixes; at least 78 flaws are rated critical and allow remote code execution. CVE-2026-108398 (.NET Framework security feature bypass) was publicly disclosed ahead of the patch, giving attackers advance notice. Microsoft also quietly extended Windows 10 free updates until October 2027.
3
hottest
desk
Fortinet's October 13, 2026 advisory batch closes thirteen vulnerabilities across FortiAnalyzer, FortiManager, FortiMail, FortiSIEM, and FortiSandbox, and two of them are critical and pre-authenticated. CVE-2026-106173, tracked as FG-IR-26-180, is a CWE-22 path traversal in FortiSIEM that lets an unauthenticated attacker execute unauthorized code or commands via specially crafted packets; Fortinet scores it 9.4, lists FortiSIEM 7.5.0 as the only affected release, and fixes it in 7.5.1.
securityonline.infofortiguard.fortinet.com
+1 more
CVE-2026-106173CVE-2026-107656
6h ago
4
hottest
desk
Recorded Future's Insikt Group counted 94 high-impact vulnerabilities for September 2026, 59 of them Very Critical on its risk scale, a 29% rise over August, with public PoCs or scanners already available for 75 of the 94. The sourcing split is the mechanism: 43 arrived through CISA's KEV catalog, 37 through open-source validation, and 14 only through honeypot data, so a majority of the month entered the record as observed exploitation rather than advisory text.
5
hottest
desk
SonicWall SMA1000 appliances face two zero-day flaws with CVSS 10.0, confirmed actively exploited and added to CISA KEV. The vulnerabilities allow unauthenticated remote code execution. Organizations using SMA1000 should apply emergency patches immediately, audit for indicators of compromise, and restrict management interface exposure.
6
hot
desk
Adobe's September 2026 release patched roughly 140 vulnerabilities across ten advisories, but the urgent item landed a day earlier. CVE-2026-75650 is an unauthenticated remote code execution flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, named StyleSmuggler by Sansec, whose forensics team published research on September 5 after finding exploited stores. Adobe shipped Hotfix VULN-39341 on September 7, and Tenable's Research Special Operations team confirmed exploitation began September 4, three days before any fix existed, with victims confirmed across multiple campaigns.
7
hot
desk
GitLab has released emergency updates for CVE-2026-97229, a critical integer overflow in its CI/CD Regular Expression Compiler rated CVSS 10.0. An unauthenticated attacker can execute arbitrary code on the server with a specially crafted regular expression embedded in a project's pipeline configuration file, due to insufficient regex validation. The flaw affects both Community Edition and Enterprise Edition. Researcher joaxcar reported it through GitLab's HackerOne bounty program.
securityonline.infobleepingcomputer.com
+11 more
CVE-2026-97229
5h ago
8
hot
desk
CVE-2026-85097 is a critical unauthenticated file upload leading to remote code execution in the Bricksforge WordPress plugin (CVSS 10.0 per Patchstack). Exploitation has been observed since October 7 from 63 IPs. The vulnerability allows unauthenticated attackers to upload arbitrary files. Administrators using Bricksforge should patch immediately and review access logs for indicators of exploitation.
radar.offseq.comthehackernews.com
+3 more
CVE-2026-85097
16h ago
9
hot
desk
Citrix NetScaler ADC and Gateway appliances spent late September under active exploitation with no patches available. On September 25, 2026, a reddit thread on r/Citrix carried shutdown advice attributed to the Dutch national cyber security center, and by September 26 researchers at watchTowr and Kevin Beaumont had confirmed reports of two unpatched zero-day RCE flaws being exploited in the wild. Tenable's Research Special Operations team set up an FAQ while details were still thin, and some organizations simply took NetScalers offline rather than run them exposed.
10
hot
desk
On the night of October 11, attackers hijacked Danfoss refrigeration controllers at hundreds of European supermarkets and used the controllers' built-in defrost function to push fridge and freezer temperatures to 50C. French outlets count 250 to 350 affected stores, BFM TV reports more than 300, and the damage lands hardest in France: Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, Auchan, and Super U all confirmed or were named as victims. Food retailers in Belgium, Germany, the Netherlands, Poland, Portugal, and Spain were also hit.
tomshardware.combfmtv.com
+32 more
CVE-2025-41450CVE-2025-41451
+1 more
4h ago
11
hot
desk
A Qilin ransomware core member, an alleged Russian national, was extradited from Japan to Germany after detention in Osaka. International cooperation spans Japan, Germany, and other partners investigating the Ransomware-as-a-Service operation. The extradition follows sustained Qilin activity linked to CVE-2026-50751. Watch for further legal proceedings and any operational impact on the group's attack tempo.
12
hot
NVIDIA AIStore vulnerabilities include a CVSS 10.0 remote code execution flaw tracked as CVE-2026-65162, part of a broader 18-fix release across NVIDIA AI tools. The event notes remote code execution potential via AIStore. Organizations deploying NVIDIA AI infrastructure should upgrade to the patched release immediately. The CVSS 10.0 score indicates unauthenticated remote exploitation potential; treat as urgent.
securityonline.info
CVE-2026-65162
3h ago
13
hot
SAP Cloud SDK for Python carries a critical server-side request forgery tracked as CVE-2026-89111 with CVSS 10.0. In multi-tenant SAP BTP applications, an attacker controlling a tenant can exploit the OAuth2 flow to perform SSRF. The advisory comes from SAP via GitHub (GHSA-4mv3-jxxm-9cx2). Multi-tenant deployments should upgrade immediately; single-tenant environments should still apply the patch because the flaw is unauthenticated in scope.
github.com
CVE-2026-89111
2h ago
14
hot
desk
SAP released its October 2026 Patch Day bulletin on October 13, closing six CVEs with peak CVSS 9.9 and one Cloud SDK flaw at CVSS 10.0. CVE-2026-89107 (9.9) is a scripting injection in S/4HANA that enables full system compromise; CVE-2026-89110 and CVE-2026-89108 (both 9.9) hit Visual Compose, while CVE-2026-58249, CVE-2026-89113, and CVE-2026-89120 fill out the critical tier. The bulletin carries 16 new security notes, four GitHub security advisories, two updates to prior notes, and covers 22 CVEs total. Four of those are rated Critical.
securityonline.infothreataft.com
+1 more
CVE-2026-58249CVE-2026-89107
+4 more
13h ago
15
hot
desk
An OpenAI engineer, 35-year-old Saudi national Abdulrahman Alfozan, was charged with planting a hidden audio recording device in a company conference room to capture sensitive technology conversations. The device was discovered by OpenAI, which used its own models to trace it to the employee, fired him, referred the case to the FBI, and made an arrest within a week. The company states there is no indication of model weights, source code, or customer data being accessed. The complaint does not specify what Alfozan intended to do with captured audio.
bleepingcomputer.comjustice.gov
+2 more
4h ago
16
hot
desk
Anthropic's Frontier Red Team reported on October 12, 2026 that small AI models are months away from self-replicating across commercial IoT hardware with no data center involved. Authors William Zhou and Daniel Freeman split the 26-billion-parameter Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about $55 each, reaching 0.39 tokens per second, and got a 9-billion-parameter model running inference on 8 of 9 unfamiliar hardware types.
gbhackers.combleepingcomputer.com
+3 more
5h ago
17
hot
desk
Progress disclosed 31 vulnerabilities in MarkLogic Server on October 12, 2026, with the most severe carrying a CVSS 9.9 score. The bulletin covers privilege escalation that lets delegated accounts reach full admin persistence, server-side code execution, authentication bypass, credential exposure, and data compromise. Updates are MarkLogic 12.1 and 11.3.7. The vendor explicitly warns that affected instances may run normally without any prior signs of exploitation, which removes the usual pre-breach indicators defenders rely on. This is not a routine patch cycle.
securityonline.infocyberworldops.eu
+1 more
16h ago
18
hot
desk
Chrome 155.0.8059.39 for Linux and 154.0.8037.39/.40 for Windows and Mac patches 247 vulnerabilities, with four critical use-after-free bugs tracked as CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, and CVE-2026-106347 affecting the Chromecast, Browser, Navigation, and Track components. All four critical flaws are use-after-free; one was found by Google and the other three were reported by researcher Xinyang Ge, who used AI to discover two of them.
securityweek.commalware.news
+1 more
CVE-2026-106197CVE-2026-106347
+2 more
2h ago
19
hot
desk
Ahold Delhaize, the Dutch-Belgian retail giant with more than 9,400 stores across Europe, the US, and Indonesia, disconnected some systems after identifying a security issue in its network. The company runs about 400,000 employees, serves around 60 million customers weekly, and reported over $104 billion in net sales for 2024. Disruption is visible at the brand level. Preventive measures hit deliveries and online orders at Albert Heijn and Delhaize in Belgium and the Netherlands, US operations appear affected too, and Stop & Shop employees reported trouble accessing schedules and pay stubs.
securityweek.combleepingcomputer.com
+3 more
9h ago
20
hot
desk
Federal authorities in Texas have charged 14 people and seized 187 laptops in Operation Lonestar Roundup, the latest strike against North Korea's remote IT worker scheme. More than 40 Texas residences suspected of operating as laptop farms were searched. The farms housed employer-issued computers so North Korean engineers working abroad could access U.S. corporate networks under false identities, with U.S.-based facilitators configuring the devices and routing pay to regime-controlled accounts. An indictment unsealed in the Northern District of Ohio charges two U.S.
malware.newscrowdstrike.com
+2 more
5h ago
21
hot
desk
CVE-2026-105445 was a flaw in Docker Hub's account-to-organization conversion. From August 26, 2024, converting a personal account also reassigned its personal access tokens to whatever existing user the converter named as the new organization's owner: the token's owner record changed, the secret never rotated, and no consent or notification was requested. An attacker could create an account, mint a PAT, convert, and name a victim, ending up with a live credential that authenticated to the registry as that victim and carried the victim's org memberships.
bleepingcomputer.comsecurityonline.info
+1 more
CVE-2026-105445
3h ago
22
hot
Wazuh 4.14.8 addresses fifteen vulnerabilities, including two CVSS 9.4 flaws that enable remote code execution as root. The event points to a securityonline.info advisory. No CVEs are listed in the event, but the severity claims are explicit. A root-level RCE in a security monitoring platform is serious. Organizations running Wazuh managers should treat the 4.14.8 upgrade as urgent. Confirm whether the two critical flaws are accessible remotely or require prior authentication before assessing exposure.
securityonline.info
8h ago