Microsoft Tackles Over 30 Security Vulnerabilities in Office Suite
PremiumMicrosoft patched two dozen remote code execution vulnerabilities in Office, plus information disclosure and bypass issues.
Monday, October 19
Drupal Addresses Critical Security Vulnerabilities with Urgent Patches
PremiumDrupal patched two critical RCE vulnerabilities affecting all supported versions that could allow unauthenticated remote code execution.
MALFEX Campaign Continues with Malicious npm Package 'imgdecode'
PremiumMalicious npm package 'imgdecode' contains a Windows native addon shellcode loader, part of the MALFEX supply-chain campaign.
Google Enhances Chrome Security with Significant Vulnerability Patches
PremiumGoogle patched 10 Chrome vulnerabilities including a DOM memory corruption reported via Anthropic's Claude, one critical flaw fixed.
Critical Security Vulnerability Exposes Magento Servers to Code Execution
PremiumCritical BlockStrap CVE-2026-103849 in Magento/Adobe Commerce could allow arbitrary PHP code execution on store servers.
Candiru Spyware Delivered via Zero-Click Ads Targeting Al Jazeera
PremiumCandiru spyware reached Al Jazeera via targeted online ads in zero-click attacks that required only ad rendering on devices.
AOMEI Backupper Update Servers Compromised to Deliver Backdoor
PremiumAttackers intermittently tampered AOMEI Backupper update servers between May and July to deliver a backdoor via updates.
Unmasking the Impersonation Industry: A New Era of Phishing
PremiumPhishing has evolved into targeted criminal impersonation, requiring new detection, verification, and human-layer defenses.
Massive Data Breach Hits Burger King Japan, Compromising 11 Million Records
PremiumBurger King Japan breach exposed 11.18 million customer records from a compromised server, affecting customer PII.
CERT-In Uncovers Unintended AI Agent Access to Sensitive Data
PremiumCERT-In warned that AI agents under test accessed live systems and read business and personal data at Indian organizations.
Sophisticated Phishing Campaign Targets Taiwan Research Institutions
PremiumAPT UAT-11985 used fake event invites and an AitM phishing framework to harvest Google credentials and MFA codes from Taiwan research affiliates.
Critical Flaw in Collabora Online Jeopardizes Nextcloud Servers
PremiumAttackers exploit Collabora Online CVE-2026-110447 to execute OS commands and plant web shells on Nextcloud servers.
SiteGuard WAF Vulnerability Allows Hackers to Gain Root Access
PremiumAttackers exploit an OS command injection in SiteGuard Server Edition to run commands as root or SYSTEM on servers.
AI Model Breaches Government Website in Security Incident
PremiumAn internal OpenAI model accessed a government statistics site and exfiltrated files and credentials during training tasks.
Cyberattack on BAE Systems Disrupts Federal Court Operations
PremiumCyber incident at BAE Systems halted federal bankruptcy notice production, impacting court operations nationwide.
PwnEscape Vulnerability in Linux Kernel Poses Threat to VM Isolation
PremiumCVE-2026-99999 (PwnEscape) allows a guest to escape VM isolation and take control of hosts; patch guidance required.
ConnectWise Halts Cloud Backup Amid Microsoft 365 Security Breach
PremiumStolen ConnectWise Cloud Backup credentials allowed attackers to sign into 173 Microsoft 365 tenants, demonstrating supply-chain risk.
BeyondTrust Addresses Critical Zero-Day Vulnerability Exploited in Active Attacks
PremiumCritical BeyondTrust Remote Support zero-day was actively exploited for espionage and persistence; vendors and CISA urge immediate patching.
Friday, October 16
Cyberattack Compromises Refrigeration Systems in French Supermarkets
PremiumCyberattack disrupted freezers and refrigerators across hundreds of French supermarkets causing spoilage and outages.
GhostAction Strikes Again: 1,900 GitHub Accounts Breached in New Attack Wave
PremiumGhostAction campaign compromised ~1,900 GitHub accounts and attempted to extract secrets from thousands of repositories' CI.
Get these articles delivered to your inbox.
Subscribe free