All articles
-
Patches & Advisories
Microsoft's record October Patch Tuesday fixes more than 1,400 flaws, including an exploited Mark-of-the-Web bypass
Microsoft's October 13 Patch Tuesday fixed a record of more than 1,400 vulnerabilities. One of them, CVE-2026-96951, is a Windows Shell Mark-of-the-Web bypass that attackers were already exploiting, and CISA added it to the KEV catalog the same day.
-
Zero-Days & Exploits
Palo Alto patches exploited PAN-OS management-interface flaw that grants root (CVE-2026-0322)
Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management-interface code-injection flaw that is being exploited in a very limited number of attacks. It gives authenticated attackers root on PA-Series and VM-Series firewalls and on Panorama, and CISA set an Oct 17 deadline for agencies to patch and check for compromise.
-
Industry
Citizen Lab: Ad-tech firm Discover-Tech used targeted ads to deliver Candiru spyware without a click
Citizen Lab says Israeli ad-tech firm Discover-Tech bought placements on mainstream ad exchanges to deliver Candiru spyware in zero-click attacks, with at least 45 Al Jazeera devices targeted in 2024-2025. Google and IAB Europe have since removed the firm.
-
Zero-Days & Exploits
SiteGuard WAF flaw CVE-2026-106931 exploited in the wild to run commands as root or SYSTEM
EG Secure Solutions and JPCERT/CC confirm in-the-wild exploitation of CVE-2026-106931, an OS command injection in SiteGuard Server Edition's default-on statistics feature that runs commands as root or SYSTEM. Fixed builds are 8.00 Update 5 and 7.00 Update 6.
-
Patches & Advisories
October Windows Server updates break on-prem Exchange sign-in and mail flow; Microsoft publishes registry workaround
Microsoft says the October 2026 Windows Server updates can stall on-prem Exchange 2016, 2019 and Subscription Edition: OWA sign-in fails, mail stays in Outboxes and queues grow, because of a new Endpoint Mapper cap. The fix for now is a registry change, not removing the update.
-
Policy & Government
FBI and CISA warn election and campaign officials of AI-polished phishing and smishing ahead of midterms
A joint FBI-CISA alert, I-101626-PSA, warns election officials, candidates and political groups that phishing, smishing and deepfake impersonation aimed at stealing credentials are rising before the 2026 midterms. It urges phishing-resistant MFA first.
-
Ransomware
Anne Arundel County confirms files were copied in August intrusion after Rhysida ransomware claim
Anne Arundel County, Md., says an unauthorized actor got into a limited number of systems in August and copied files. The Rhysida gang claimed the attack and says it wants $2 million, but the county won't comment on what data the group says it took.
-
Zero-Days & Exploits
CISA orders patching of exploited Fortinet path-traversal flaw tied to stealthy FortiGate implant at telecom
CISA added Fortinet's CVE-2025-61624 to its KEV catalog with an Oct 19 deadline and a forensic-triage requirement, as Palo Alto Networks links the flaw to a long-running telecom intrusion using a memory-resident FortiGate implant it calls PeerStitch.
-
Patches & Advisories
Drupal ships critical fixes for Field UI remote code execution flaw, warns exploits could follow within hours
Drupal fixed a critical remote code execution flaw in core's Field UI module (CVE-2026-108097, SA-CORE-2026-014) and a related Entity List bug, warned that exploits may appear within hours or days, and urged sites to update to 10.6.19, 11.3.19 or 11.4.10.
-
Industry
US Cybersecurity Job Postings Fall 26% to a Four-Year Low as AI Security Engineer Demand More Than Triples
CyberSN counted 235,786 US cybersecurity job postings from January to September 2026, down 26.4% from a year earlier and a four-year low, while AI security engineer postings rose 268.3% and GRC roles grew their share to 14.8%.
-
Breaches
Cyber incident at contractor BAE Systems knocks out federal bankruptcy court noticing systems
A cybersecurity incident at BAE Systems, which runs the federal judiciary's Bankruptcy Noticing Center, has stopped the production and distribution of bankruptcy notices and taken four uscourts.gov services offline, with no restoration timeline yet.
-
Zero-Days & Exploits
Chinese espionage group exploited BeyondTrust Remote Support zero-day since August; CISA deadline is today
BeyondTrust has patched CVE-2026-102764, a Remote Support authentication bypass that Mandiant says has been exploited since Aug. 29 by Armory Castle (formerly UNC5221). CISA's KEV deadline for federal agencies is Oct. 19.
Page 4 of 5
