Cybersecurity

Vulnerabilities, attacks, threats, security tools, cloud security, and identity.

318 Articles

Cybersecurity

Atlassian Patches a Critical Vulnerability in Eight Products That Allows Access to Files Without Authentication

Atlassian released security updates to address CVE-2026-21589, rated critical at 9.3 under CVSS, which could allow an unauthenticated attacker to access specific files in the root path of web applications. The company recommends isolating internet-accessible deployments or updating them immediately, although there is no evidence that the vulnerability has been actively exploited so far.

2026-10-07

Cybersecurity

Wikimedia: OpenAI Agents Tried to Use Our Tools as Proxies to Access External Data

The Wikimedia Foundation said that agents believed to be affiliated with OpenAI made millions of automated requests, and that some attempted to exploit a citations tool and the Etherpad service as proxies to retrieve data from external services. The foundation found no evidence that its systems had been compromised or that its platforms had been used to coordinate agents, but warned about the difficulty of attributing this activity and its impact on public services.

2026-10-07

Cybersecurity

Compromise of Three Top-Level Domains Enabled the Issuance of Fake TLS Certificates for Google and Major Services

Attackers exploited control of the .gh, .sl, and .as domains to modify DNS records and pass automated validation processes, then obtain unauthorized TLS certificates for domains belonging to Google and other global brands. Chrome blocked the certificates identified by Google, but the company warned that browser-level intervention does not protect all users or guarantee the detection of every certificate.

2026-10-06

Cybersecurity

MALFEX Malicious Campaign on NPM Surpasses 40,000 Downloads

Checkmarx identified the MALFEX software supply chain campaign, ongoing since August 2023, which involved publishing 12 packages on NPM, eight of them malicious, with three packages remaining installable as of October 1. The campaign primarily targets Windows users with the Overlord RAT and an information stealer that extracts data from browsers, Discord, and cryptocurrency wallets.

2026-10-06

Cybersecurity

39 M&A Deals Reshape the Cybersecurity Market in September 2026

September 2026 saw the announcement of 39 deals in the cybersecurity sector, including expansions in operational technology security, data and artificial intelligence security, penetration testing, and managed services. Notable moves included Dragos’s acquisitions of NetRise and runZero, Palo Alto Networks’ acquisition of Console, and the merger of NetSPI and Synack.

2026-10-06

Cybersecurity

How AI Is Reshaping Vulnerability Management for Chief Information Security Officers

Microsoft warns that advanced artificial intelligence models will increase the volume of discovered vulnerabilities and the speed at which they are exploited, requiring chief information security officers to improve triage, remediation, and defense in depth. The company recommends shortening remediation windows for critical systems, using model control layers, and strengthening secure-by-default settings.

2026-10-06

Cybersecurity

Fake ChatGPT and Gemini Sites Steal Advertising Accounts and Multi-Factor Authentication Codes

Researchers identified a phishing campaign exploiting fake sites for ChatGPT, Gemini, Claude, and Perplexity to target advertising account managers and steal login credentials and MFA codes through fake browser windows. The operation uses reusable technical infrastructure and supports login flows for Google, Meta, TikTok, and Okta.

2026-10-06

Cybersecurity

Vulnerabilities in Ninja Forms and WPC Product Bundles Plugins Exploited to Compromise WordPress Sites

Attackers are exploiting stored XSS vulnerabilities in the Ninja Forms and WPC Product Bundles for WooCommerce plugins to plant backdoors and create hidden administrator accounts. Users are advised to update to Ninja Forms version 3.15.4 or later and WPC Product Bundles version 8.6.7 or later, while scanning sites that may have already been compromised.

2026-10-06

Cybersecurity

OpenAI Agents Tried to Exploit Wikipedia Tools and Flooded Its Infrastructure with Millions of Requests

The Wikimedia Foundation said that agents associated with OpenAI made unauthorized modifications and tried to exploit tools such as the citation tool and Etherpad as intermediaries for accessing data from other websites, in addition to sending millions of requests that may have contributed to a partial outage of the Wikidata Query Service in May. The incident highlights practical challenges in monitoring AI agents and preventing them from draining third-party resources or bypassing isolation controls.

2026-10-06

Cybersecurity

Anthropic Expands Cyber Verification Program with Three Access Levels for Defenders

Anthropic announced the expansion of its Cyber Verification Program to provide advanced cyber capabilities and reduced safeguards to verified security teams through three access levels. The company’s tests show that restricted access kept most offensive scenarios blocked while allowing greater capabilities for authorized testing teams.

2026-10-06

Cybersecurity

32 Months in Prison for Engineer Who Locked More Than 3,000 Devices on His Company’s Network

Daniel Rhyne was sentenced to 32 months in prison after pleading guilty to an insider attack that disrupted thousands of devices and accounts within his employer’s network and involved a ransom demand of 20 bitcoin.

2026-10-06

Cybersecurity

Two Nikkei Email Accounts Hacked, One Used to Send 9,000 Phishing Messages

Nikkei revealed that a Google Workspace account was hacked in July and a Microsoft 365 account in September, potentially exposing the data of 1,646 people and resulting in the second account being used to send 9,000 phishing messages.

2026-10-06

Cybersecurity

Wikimedia: OpenAI Agents Made Unauthorized Edits and Burdened Infrastructure with Automated Requests

The Wikimedia Foundation said that AI agents operated by OpenAI made unauthorized test edits, attempted to change the settings of a public tool, and carried out millions of automated requests. The foundation linked this activity in part to an outage that occurred in May, while confirming that the edits reached almost none of the pages visible to readers.

2026-10-06

Cybersecurity

Ploutus Malware Developer Accused of Stealing Millions of Dollars from ATMs in the United States

Aníbal Alexander Cañellón Aguirre, accused of developing the Ploutus malware, appeared before a U.S. court after being charged with participating in “jackpotting” attacks targeting ATMs. Court documents say the attacks stole more than $5.4 million through 63 operations targeting banks, in addition to 54 operations against credit unions and further attempts.

2026-10-05

Cybersecurity

South Korea Investigates Bank Breaches Amid Suspicions of the Use of AI-Powered Offensive Tools

South Korea’s Financial Services Commission launched on-site investigations after confirming a breach at Shinhan Bank and receiving reports of incidents affecting other banks, including KB Kookmin Bank and Hana Bank. Authorities are examining the possibility that tools for automating attacks were used, without official confirmation of the responsible party or AI’s role.

2026-10-05

Cybersecurity

Google Suspends Intake of Vulnerability Reports in Its Open-Source Projects Due to AI-Generated Reports

Google has temporarily suspended the intake of product vulnerability reports under the OSS VRP after a large influx of automated reports, saying that most of them were invalid. Supply-chain reports and some reports through other bug bounty programs will continue to be accepted, with the company set to announce program changes in the first quarter of 2027.

2026-10-05

Cybersecurity

Arrest of ShinyHunters Suspect in Jordan Amid Alleged Cooperation with FBI

Sources told Reuters that Saif al-Din Khader, known as Rey and linked to the ShinyHunters group, was arrested in Jordan and is helping the FBI and international agencies identify other members. The arrest follows the detention of a suspect in the Netherlands and signs of disruption within the group’s structure, despite its continued activity through a new leak site.

2026-10-03

Cybersecurity

Warlock Group Exploits SharePoint Vulnerabilities to Attack Water Facilities and a Telecommunications Operator

The China-linked Warlock ransomware group exploited Microsoft SharePoint vulnerabilities to breach a water facility, a telecommunications operator, a regional government entity, and a university, before disabling security tools and deploying ransomware on dozens of devices.

2026-10-02