./Most covered stories (3+ outlets)Mon, 19 Oct 2026 12:28:44 GMT https://cyberscoop.com/proofpoint-acquires-varonis-systems-data-security/zziq5uThu, 15 Oct 2026 21:13:58 GMTCyberScoop (+3 more sources). The deal pairs the email security giant's massive threat intelligence with Varonis' visibility into corporate data, as both companies race to secure the AI agents now roaming enterprise networks.AI https://thehackernews.com/2026/10/critical-pwnescape-linux-kernel.html1sbpu0qThu, 15 Oct 2026 20:24:36 GMTThe Hacker News (+3 more sources). A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked…AdvisoryVulnerability https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/hn0p1gThu, 15 Oct 2026 14:00:00 GMTGoogle Threat Intelligence (+4 more sources). Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…ResearchVulnerabilityZero-dayAPTMalwareAdvisory https://www.bleepingcomputer.com/news/security/uk-legal-aid-agency-hackers-stole-records-dating-back-to-1978/13fcq7nThu, 15 Oct 2026 08:06:47 GMTBleepingComputer (+3 more sources). The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. [...]Breach https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/1pc963bWed, 14 Oct 2026 22:56:47 GMTBleepingComputer (+3 more sources). Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]VulnerabilityZero-dayAdvisory https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/1ugpdvWed, 14 Oct 2026 17:29:14 GMTBleepingComputer (+5 more sources). Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]AdvisoryVulnerabilityZero-day https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/l74trlWed, 14 Oct 2026 13:12:52 GMTBleepingComputer (+5 more sources). A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]PhishingLaw & policyAPT https://cybersecuritynews.com/windows-shell-0-day-exploited/nyg2b4Wed, 14 Oct 2026 03:28:11 GMTCybersecurity News (+4 more sources). Microsoft has patched an actively exploited Windows Shell zero-day vulnerability that allows attackers to bypass Mark of the Web protections. Tracked as CVE-2026-96951, the flaw was addressed in the October 2026 Patch Tuesday updates. It carries a CVSS score…VulnerabilityZero-day https://blog.qualys.com/vulnerabilities-threat-research/2026/10/13/microsoft-patch-tuesday-october-2026-security-update-review70ydhjTue, 13 Oct 2026 21:32:08 GMTQualys Threat Research (+2 more sources). Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches promptly remains critical to…AdvisoryVulnerabilityResearch https://www.bleepingcomputer.com/news/security/ivanti-warns-of-connect-secure-zero-day-exploited-in-attacks/12hvz0uTue, 13 Oct 2026 15:45:50 GMTBleepingComputer (+10 more sources). Ivanti urged customers on Tuesday to immediately patch an actively exploited zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway. [...]AdvisoryVulnerabilityZero-dayResearch https://www.securityweek.com/small-ai-models-may-soon-be-able-to-self-replicate-on-iot-devices-anthropic-warns/hvpv4aTue, 13 Oct 2026 11:58:29 GMTSecurityWeek (+4 more sources). Experiments show cheap TV boxes can run capable AI models, and small models may soon be able to spread across such devices on their own.AIMalware https://www.helpnetsecurity.com/2026/10/13/gitlab-ci-cd-regular-expression-compiler-vulnerability-cve-2026-97229/90t0klTue, 13 Oct 2026 09:19:45 GMTHelp Net Security (+3 more sources). GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab servers. About CVE-2026-97229 CVE-2026-97229 is…VulnerabilityResearchZero-dayAdvisory https://www.threathunter.ai/blog/october-2026-patch-tuesday-1411-fixes/b3v197Tue, 13 Oct 2026 00:00:00 GMTThreatHunter.ai (+9 more sources). The largest Patch Tuesday in 23 years. One zero-day being exploited right now, two more disclosed, 70 Critical bugs, and a twelve-month curve that says this is the new normal. Here is what to patch first, what we are hunting for, and the detection pack to go…ResearchVulnerabilityZero-dayAdvisory https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.htmlvmd4sjMon, 12 Oct 2026 09:02:14 GMTThe Hacker News (+2 more sources). A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated…VulnerabilityZero-day https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/7zdndrFri, 09 Oct 2026 10:23:42 GMTSecurityWeek (+2 more sources). The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.VulnerabilityZero-dayResearch https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/1b7gi85Fri, 09 Oct 2026 06:53:53 GMTSecurityWeek (+2 more sources). The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service.Vulnerability https://www.theverge.com/ai-artificial-intelligence/1008521/anthropic-open-source-oss-scannerliniinThu, 08 Oct 2026 21:53:51 GMTThe Verge (+2 more sources). Anthropic's offering to help open-source projects track down security vulnerabilities with a new service called OSS Scanner. It says open-source projects that opt-in will get "thorough, periodic security scans by our strongest models at no cost." That could…VulnerabilitySupply chainAI https://socket.dev/blog/tensorlake-compromise1m0ajydThu, 08 Oct 2026 02:54:50 GMTSocket (+2 more sources). Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.ResearchSupply chainMalwareVulnerability https://www.helpnetsecurity.com/2026/10/07/google-unauthorized-https-certificates-cctld-hijacks/29ncWed, 07 Oct 2026 11:10:29 GMTHelp Net Security (+3 more sources). Attackers who took control of three country-code top-level domains (ccTLDs) used that access to obtain HTTPS certificates for several Google domains and for domains run by other large organizations, Google disclosed on Tuesday. Attackers compromised the…Breach https://www.helpnetsecurity.com/2026/10/07/sonicwall-fixes-pre-auth-ssrf-flaw-in-sma-1000-appliances-cve-2026-102255/fanu0iWed, 07 Oct 2026 10:37:53 GMTHelp Net Security (+5 more sources). SonicWall has patched four vulnerabilities in its popular Secure Mobile Access (SMA) 1000 series of appliances, including one (CVE-2026-102255) that could allow remote unauthenticated attackers “to direct the appliance to issue requests on their behalf and…VulnerabilityZero-day https://news.google.com/rss/articles/CBMihwFBVV95cUxQOF93dG5DNkU3Uk9jblJ5VUtMMDhyZW1lOUVOX1dKWElya0swM3A5Ujk0aGk2ZmVfZ28yRnFTZkd2RXJwRVBwNHNmWlpCSkFITkZWZDVxdlVmcm50MHRhNkplYmZfSzM5S1M0N1JYSHdjSzJ4MWNKS2FMczVnYTZEYXhndENCVWs?oc=516nkye0Tue, 06 Oct 2026 12:26:30 GMTHelp Net Security (+2 more sources). Atlassian urges immediate patching of critical Data Center file access vulnerability (CVE-2026-21589) Help Net SecurityVulnerabilityZero-day https://www.theregister.com/security/2026/10/06/atlassian-warns-of-critical-file-access-flaw-in-its-datacenter-products/53012846ckfefTue, 06 Oct 2026 04:20:00 GMTThe Register (+9 more sources). Tells users ‘action required’ – but maybe don’t make that action a Jira ticket, because it has this bugVulnerabilityZero-dayAdvisoryResearch https://www.bleepingcomputer.com/news/security/new-dell-system-update-flaw-lets-hackers-gain-root-privileges/ktkfulMon, 05 Oct 2026 14:53:06 GMTBleepingComputer (+2 more sources). Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. [...]Vulnerability https://www.bleepingcomputer.com/news/security/suspected-dev-of-ploutus-atm-malware-appears-in-us-court-after-arrest/1br8kaMon, 05 Oct 2026 13:01:45 GMTBleepingComputer (+2 more sources). The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States. [...]MalwareLaw & policy https://therecord.media/denmark-breach-register-cyberattackkjzsneMon, 05 Oct 2026 12:00:00 GMTThe Record (+5 more sources). Denmark is investigating a data breach affecting approximately 8.8 million people after unauthorized users gained access to its national population register.Breach https://thehackernews.com/2026/10/attackers-target-rejetto-hfs-flaw-that.html1v885p0Mon, 05 Oct 2026 08:09:23 GMTThe Hacker News (+2 more sources). A critical security flaw impacting Rejetto HTTP File Server (HFS) is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 (CVSS score: 9.3), a case of session forgery stemming from the use of a weak…VulnerabilityZero-dayAI https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/16njwdqSun, 04 Oct 2026 21:58:01 GMTBleepingComputer (+6 more sources). Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote code execution. [...]VulnerabilityZero-dayResearch https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/12p8822Thu, 01 Oct 2026 22:42:49 GMTBleepingComputer (+4 more sources). Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...]VulnerabilityZero-day https://www.infosecurity-magazine.com/news/cloudsyncd-macos-backdoor-fake/18u1y3wThu, 01 Oct 2026 13:30:00 GMTInfosecurity Magazine (+2 more sources). CloudSyncD uses a fake Zoom installer to phish Mac passwords and launch a two-stage backdoorMalware https://www.bleepingcomputer.com/news/security/metamask-discloses-security-incident-affecting-its-infrastructure/by9rerThu, 01 Oct 2026 07:33:57 GMTBleepingComputer (+2 more sources). On Thursday, cryptocurrency wallet provider MetaMask has disclosed an ongoing infrastructure security incident affecting some of its infrastructure. [...]Breach https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/1enmcx3Wed, 30 Sep 2026 14:46:40 GMTBleepingComputer (+8 more sources). Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. [...]VulnerabilityZero-dayResearchAdvisory https://www.bleepingcomputer.com/news/security/apple-patches-coregraphics-zero-day-flaw-exploited-in-attacks/1llq9udTue, 29 Sep 2026 07:33:12 GMTBleepingComputer (+6 more sources). Apple released security updates to fix a zero-day vulnerability exploited in "extremely sophisticated" targeted attacks on iOS devices. [...]AdvisoryVulnerabilityZero-day https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat1vw3e2iMon, 28 Sep 2026 20:00:00 GMTHuntress (+3 more sources). Huntress researchers reveal how attackers are exploiting ChatGPT Custom GPTs to spread ClickFix lures and DLL-sideloaded malware. See the full breakdown.ResearchMalwareAI https://decipher.sc/2026/09/27/researchers-warn-of-citrix-netscaler-exploitation/zcxlxrSun, 27 Sep 2026 14:05:55 GMTDecipher (+14 more sources). On Saturday, researchers from watchTowr Labs said they had credible information that attackers were exploiting an unknown RCE vulnerability in Citrix NetScaler boxes.AdvisoryVulnerabilityZero-dayResearch https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm1spj0hjWed, 23 Sep 2026 08:43:39 GMTRapid7 (+2 more sources). Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127 , a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated…ResearchVulnerabilityAdvisory