Infosecurity-magazine

Comparitech reports Q3 2026 recorded 2,627 claimed ransomware attacks, with finance, tech, education, and healthcare hit hardest.

Critical CVE-2026-21589 in Atlassian Data Center products is being targeted within hours of PoC publication.

Forescout finds only 6% of IoMT and 16% of medical OT devices are capable of post-quantum cryptography transition.

Frontline Education breach exposed K-12 staff employee data from school district software provider.

Law enforcement urges passkeys as account takeover revenue surged 417% year-over-year, increasing fraud and credential theft risk.

Two zero-days were exploited against the Dutch Institute for Vulnerability Disclosure (DIVD), leveraging Zammad flaws and agentic AI elements.

Apple fixed CoreGraphics zero-day CVE-2026-86950 that was being exploited to compromise iOS devices via malicious content.

MI5 warns UK academics about contributions to China General Technology Research Institute tied to potential espionage concerns.

Critical Catalyst SD-WAN Manager zero-day allows attackers to escalate to admin privileges and is actively exploited.

Report warns deepfakes cost businesses heavily; a quarter of victims lost over $1M and CISOs report board ignorance.

Tokyo Metro and Keio reported separate cyberattacks disrupting systems and services over the weekend.

RemControl banking trojan abuses Android Accessibility Service to take remote control and harvest banking credentials.

WaterPlum/Contagious campaign compromised ~30,000 devices and siphoned funds or credentials from 7,000 crypto wallets.

Spanish regulator AEPD reports first AI-agent-powered multi-stage data breach exfiltrating personal data via automated agent.

OPSWAT researchers found two zero-days in TP-Link cameras that enable remote eavesdropping and data exposure.

Microsoft issued out-of-band emergency fixes after Patch Tuesday caused RDS issues, addressing service failures and related regressions.

Revolut disclosed that fraudsters using a legitimate government email domain obtained customer KYC data via fake emergency requests.

Threat actors exploit a maximum-severity GitLab path traversal (CVE-2026-85706) to risk supply-chain and repo compromises.

Researchers demonstrate a WeChat zero-click worm capable of hijacking phones via crafted calls using AI tooling.