Daily curated cyber threat intelligence for security professionals.
Sourcethehackernews.com
Curated
Attackers began attempting to exploit the critical Atlassian Data Center flaw (CVE-2026-21589) within two hours of public details emerging, The Hacker News reports. The rapid move from disclosure to exploitation attempts shows how fast the patching window is closing.
Sourcewww.bleepingcomputer.com
Curated
Advantest Corporation is notifying affected individuals that a ransomware attack earlier this year exposed their personally identifiable data. The Japanese semiconductor test equipment manufacturer said a threat actor breached its network on February 15 and deployed a ransomware payload; an October 6 notification confirms customer or employee data was impacted.
Sourcewww.bleepingcomputer.com
Curated
A 54-year-old North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music and YouTube Music in a massive streaming fraud scheme. Michael Smith pleaded guilty after being indicted for fraudulently inflating his songs' listening stats between 2017 and 2024, uploading hundreds of thousands of AI-generated songs.
Sourcewww.malwarebytes.com
Curated
Google has released updates for the Chrome browser and ChromeOS. The October 6 Stable Channel update brings Chrome to version 155.0.8059.39 for Linux and 154.0.8037.39/.40 for Windows and Mac, including 247 security fixes with four rated Critical. Android and ChromeOS updates were released the same day.
Sourcewww.helpnetsecurity.com
Curated
SonicWall has patched four vulnerabilities in its Secure Mobile Access (SMA) 1000 series appliances, including CVE-2026-102255, which could let remote unauthenticated attackers direct the appliance to issue requests on their behalf and perform unauthorized operations. The vendor says there is currently no evidence of in-the-wild exploitation, but attackers' track record with similar flaws suggests it could come soon.
Sourcewww.malwarebytes.com
Curated
Malwarebytes researchers report on a turnkey kit that makes it possible for almost anyone to launch a sophisticated online scam, bundling the command center, victim tracking and administrative tools into a ready-to-use package. The discovery highlights how criminals can buy ready-made services rather than building infrastructure, with subscription-based platforms making convincing phishing attacks easy to launch.
Sourcewww.schneier.com
Curated
Apple has released a system called ‘Reference Image’ that can verify an image is exactly as taken by an iPhone — new models only — without tying it to a specific device or photographer. The final reference image is signed by Apple’s signing service after validation. The design avoids requiring photographers, such as those operating in conflict zones, to give up anonymity in order to prove image authenticity.
Sourcewww.csoonline.com
Curated
Attackers are increasingly weaponizing already-disclosed vulnerabilities rather than new zero-days, CSO Online reports, and AI is accelerating both flaw disclosures and exploit development. The trend is compressing the window between disclosure and exploitation.
Sourcecyber.gc.ca
Curated
The Canadian Centre for Cyber Security has published its October 2026 Android security rollup, summarizing the month’s patches for the Android platform. Organizations and users should review the bulletin and apply the fixes.
Sourcedatabreaches.net
Curated
Florida man Mark Asea, who describes himself as a “cybersecurity engineer” on TikTok and Twitch, was arrested after police reopened an investigation that had been closed earlier this year. He is charged with an offense against computer users, WPEC reports via DataBreaches.net.
Sourcethehackernews.com
Curated
OX Security researchers examined 15,465 publicly reachable MCP (Model Context Protocol) servers and report widespread security problems in the ecosystem connecting AI agents to tools and data. The findings add to concerns that the agent-to-agent protocol is expanding the attack surface, The Hacker News reports.
Sourcewww.crowdstrike.com
Curated
CrowdStrike’s research team shows that decomposing a harmful task into individually benign subtasks can systematically bypass the safety classifiers guarding frontier AI models, producing working offensive code across 9 of 10 tested attack categories. Microsoft Research independently discovered the same technique, which it calls “Capability Laundering.”
Sourcewww.csoonline.com
Curated
A new Linux backdoor is turning vulnerable internet-facing devices into remotely controlled proxy nodes, CSO Online reports. The malware converts compromised devices into infrastructure the attackers can route their own traffic through.
Sourcewww.huntress.com
Curated
Huntress researchers detail how they reconstructed an Akira ransomware attack using registry artifacts, Akira’s own logs, and other post-compromise evidence. The walkthrough maps the attacker’s steps from initial access through encryption.
Sourcedatabreaches.net
Curated
Japanese police have captured a Russian national believed to be a key member of the Qilin ransomware group and extradited him to Germany, investigative sources told JiJi. Qilin has claimed ransomware attacks against companies worldwide, DataBreaches.net reports.
Sourcewww.malwarebytes.com
Curated
Facebook users are receiving messages containing a fake Marketplace listing that uses their own name as the seller. The phishing messages also include the recipient’s phone number, Malwarebytes reports.
Sourcewww.helpnetsecurity.com
Curated
X.Org has fixed 12 security flaws in the X server and Xwayland, shipping the repairs in xorg-server 21.1.25 and xwayland-24.1.14. Nine of the flaws can lead to arbitrary code execution; most require an already-authenticated X client, Help Net Security reports.
Sourcesiliconangle.com
Curated
IBM and Red Hat say their Lightwell open-source security program has found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries. The companies also made the Lightwell Clearinghouse generally available so enterprise customers can submit dependencies for priority review, SiliconANGLE reports.
Sourcethehackernews.com
Curated
Researchers have disclosed a “human-operated phishing platform” that impersonates advertising products for AI chatbots including ChatGPT, Gemini, Claude, Perplexity, and Meta’s Muse. The fake portals are designed to capture business credentials and MFA codes, The Hacker News reports.
Sourcehackread.com
Curated
The FBI has confirmed multiple arrests in its investigation of the ShinyHunters hacking group, Hackread reports. The confirmation follows reports that suspected member Saif al-Din Khader was detained in Jordan.
Sourcetherecord.media
Curated
Ukraine’s CERT-UA found more than 100 compromised websites serving fake Cloudflare verification pages that push visitors into a ClickFix trap. The campaign’s goal was to infect machines with the Lunex infostealer, The Record reports.
Sourcewww.bleepingcomputer.com
Curated
Attackers are exploiting stored cross-site scripting vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce. The flaws are being used to install backdoors and create rogue administrator accounts, BleepingComputer reports.
Sourcesecurityaffairs.com
Curated
Microsoft has released out-of-band security updates for Exchange Server to fix CVE-2026-96940, a high-severity (CVSS 8.8) weak authorization flaw that can let an authenticated attacker gain higher privileges. Microsoft assesses exploitation as more likely, SecurityAffairs reports.
Sourcewww.helpnetsecurity.com
Curated
The OpenSSH team released version 10.6 on Oct. 6, enabling a post-quantum signature algorithm, which means keys generated with the experimental algorithm need to be replaced. The team says it will ship releases more often to get bug fixes out faster, noting many recent security reports were found with AI assistance, Help Net Security reports.
Sourcethehackernews.com
Curated
Security researchers have shown that a malicious spreadsheet can make LibreOffice and Apache OpenOffice execute attacker code as soon as the file is opened, with no macro warning shown first. The attack requires Java support to be enabled and has so far only been demonstrated as a proof of concept, The Hacker News reports.