“Networks”

Malware at contractor Nippon Columbia exposed 8.7 million customer and employee records, including personal data of karaoke fans.

US agencies seized domains and disrupted tools tied to Integrity Technology Group and Flax Typhoon used against critical infrastructure.

Ransomware groups exploit Palo Alto GlobalProtect authentication bypass (CVE-2026-0257) to create unauthorized VPN sessions and access internal networks.

UK NCSC and partners publish advisory calling out China-linked actors targeting sensitive data across multiple sectors worldwide.

SonicWall released hotfixes for four SMA1000 flaws; most serious was a CVSS 10.0 pre-auth SSRF potentially reaching internal functions.

Critical unauthenticated RCE in LMCache (LLM cache servers) allows remote code execution; no fixed version available yet.

Increased scanning and RCE attempts targeted unpatched Hikvision CVE-2021-36260 surveillance devices, especially in Ukraine.

Belarusian Cyber Partisans reportedly conducted a two-year espionage campaign within Russian healthcare networks for intel and disruption.

Profile of the newly emerged N0n ransomware extortion gang that published dozens of victims shortly after appearing in September 2026.

A suspected ShinyHunters member 'Rey' was reportedly detained in Jordan and is cooperating with the FBI to ID other group members.

Critical FortiMail zero-day (CVE-2026-104286) is actively exploited enabling arbitrary file writes; urgent patching required.

Malicious sponsored search results promote custom ChatGPTs that guide users into ClickFix flows to install RATs.

Microsoft links NeedyMantis malware to long-term persistence in telcos, universities, medical nonprofits, and government contractor networks.

Two critical Citrix NetScaler zero-days were actively exploited, prompting emergency advisories and widespread patching urgency.

Interpol reports large-scale global fraud losses, highlighting growth of organized scam economies and financial crime trends.

Arista issued patch for a critical zero-day in VeloCloud Orchestrator that was being actively exploited.

Active exploitation of a critical F5 BIG-IP OAuth/APM zero-day enables unauthenticated remote code execution; immediate patching required.

Japan dismantled a North Korean laptop farm; allied report details WaterPlum campaign and large-scale credential theft.

D-Link warns of maximum-severity zero-day CVE-2026-86296 with PoC affecting legacy DIR-822A routers and no patch yet.