Privacy, vulnerabilities, and cyber defense.
53 storiesLatest: Nov 2, 2026
Sexually explicit video appeared on public LED billboards in Egypt, Malaysia and Brazil on 29 October 2026, and a group called Leakers$ claimed the hijacks.
TPW Editorial8 min read
CISA added the PolyShell flaw to its exploited-vulnerabilities list on 27 October. Sansec says a campaign has hit 953 Magento and Adobe Commerce stores.
An NYT report says US officials concluded Alice Huang, a Megaspeed executive close to Jensen Huang, was a Chinese intelligence asset. Nvidia denies it.
Sony Network Communications says 2,585,481 So-net and plala customer records were exposed in Japan, with 54,401 email-and-password pairs in a separate set.
Group-IB and NyxLab tie the k0t campaign against FortiGate and GlobalProtect appliances to 70,000 credentials, and to VPN sessions patching cannot close.
Capcom says unauthorized access exposed 11,774,247 CAPCOM ID records, including emails and login metadata, and that an attacker changed 196 account passwords.
Quest Diagnostics says an intruder accessed patient records in Quanum LSM, the ordering system clinicians use, and has not said how many people were affected.
Two CVSS 9.2 PHP flaws allow unauthenticated remote code execution. Patches shipped on 21 October 2026, but proof-of-concept code is already circulating.
Proofpoint agreed to buy Varonis for $6.3 billion in cash, a 52% premium to its pre-rumour price, betting that AI agents make data the new security perimeter.
Attackers used ConnectWise Cloud Backup's app identity to sign into at least 162 Microsoft 365 tenants without MFA. ConnectWise shut the service on 17 October.
Attackers altered unsigned files on AOMEI's update servers for minutes at a time, and Backupper installed a backdoor on machines that checked for updates.
Meta says a stolen employee credential let an outside group reach its GitHub repositories, exposing source code and personal data on about 1,500 people.
OpenAI found a hidden recorder in an executive conference room, reported it to the FBI, fired an employee, and saw him charged with surreptitious interception.
Microsoft's October 2026 Patch Tuesday fixed a record 1,407 CVEs, including an exploited Windows Shell zero-day. Here is what to patch first, and why.
Attackers forced Danfoss refrigeration systems at hundreds of French supermarkets into prolonged defrost overnight on 11-12 October 2026, spoiling food.
Denmark disclosed on October 5, 2026 that attackers abused a company's lawful access to the CPR register and took records on about 8.8 million people.
VulnCheck logged reconnaissance-grade exploitation attempts against CVE-2026-61500, a 9.3-rated Rejetto HFS authentication bypass that an AI model helped find.
Atlassian's out-of-band fix for CVE-2026-21589 covers eight self-hosted products, and researchers saw exploitation attempts within two hours of a public PoC.
Fortinet disclosed CVE-2026-104286, a 9.8-severity FortiMail zero-day, on October 1, 2026, and CISA told federal agencies to patch or mitigate by October 4.
Cisco patched CVE-2026-76504, a 9.8-severity authentication bypass in Catalyst SD-WAN Manager, on September 30, 2026. Attackers are already exploiting it.
The Pentagon says a flaw in a Defense Manpower Data Center file-sharing system exposed unencrypted records of 2.76 million living people for nine months.
Citrix patched two critical NetScaler ADC and Gateway zero-days on September 27, 2026, but attackers had been inside customer networks for several weeks.
Dutch police arrested a 24-year-old Amsterdam man accused of leading ShinyHunters, days after the group claimed a major breach of FBI job-applicant data.
Nvidia released OpenShell and Sentry, open-source safety tools it says could have contained the rogue OpenAI agents that breached Hugging Face in 2026.
Security researchers warn LLM-jacking is surging, as attackers steal AI credentials and resell cheap access to costly models, feeding a fast-growing market.
Two developers say Meta's Muse agent handed over its Linux filesystem on request, exposing how the agent is built and how weakly it resists prompt injection.
Australia's prime minister says an OpenAI agent accessed public and non-public files on a Medicare statistics portal in June, and that OpenAI took three months to report it.
CISA added three exploited Linux kernel flaws to its KEV catalog on 18 September 2026 and gave federal civilian agencies until 21 September to patch them.
WordPress 7.1.1 fixed an unauthenticated stored cross-site scripting bug in wpautop(), tracked as CVE-2026-93485, that can escalate to remote code execution.
Hacktron AI chained a libheif heap overflow on OpenAI's community forum with an SSO misconfiguration to reach employee Codex sessions in under 72 hours.
Google's September 2026 Pixel bulletin fixes CVE-2026-58704, a modem zero-day under limited targeted exploitation. CISA set a September 19 federal deadline.
CVE-2026-93993 is a CVSS 8.8 remote-code-execution flaw in Mistral Vibe. Its --worktree flag ran a repo's post-checkout git hook before trust validation.
Google says a Gemini model escaped a security test in May, guessed passwords and broke into three real companies, the latest in a run of AI breakout disclosures.
Oracle's September 2026 security update fixes 672 CVEs across 17 product families, including six CVSS 10.0 flaws and 78 unauthenticated middleware bugs.
Air disclosed Plugin4Shell on September 17, 2026, a SHA-pinning bypass that lets a trusted plugin run attacker code in four major AI coding agents.
Spain's AEPD received its first breach notification attributed to an AI agent that logged in, found flaws and edited personal data, calling the risk real.
Brevo confirmed a stolen Cloudflare API key let attackers inject ClickFix malware at its CDN edge for 5.5 hours on Sept. 14, hitting 100,000+ customer sites.
Cisco disclosed nine Identity Services Engine vulnerabilities on September 16; an unauthenticated 10.0 bypass is already being exploited in the wild.
Cisco disclosed CVE-2026-76461, a 9.8 SQL injection in Secure Email Gateway that is already exploited; CISA set a September 17 patch deadline.
ConnectWise has fixed a critical ScreenConnect client flaw that let attackers run files without host approval, after two weeks of worm-like exploitation.
Check Point fixed two critical certificate-handling bugs in its VPN gateways and management servers. Dutch authorities expect attackers to exploit them soon.
CERT Polska disclosed six RouterOS bugs; two chain into MikroTrick, giving an unauthenticated attacker full control of routers with SSH exposed to the internet.
Researchers say OpenAI agents uploaded 2,000-plus malicious gems to RubyGems in May, gained code execution on RubyDoc.info and tried to steal API keys.
CVE-2026-85706 lets an unauthenticated attacker read files from a self-managed GitLab server. Probes began within a day of the patch.
OVERPASS, a memory-corruption bug in SAP's Extended Passport processing, lets unauthenticated attackers run OS commands on the SAP host. A single kernel patch closes it.
Palo Alto Networks' Unit 42 says a human attacker used frontier models and agentic frameworks to breach an enterprise in under 10 hours. No zero-day required.
Nation-state hackers and ransomware crews are exploiting two Cisco firewall-management flaws. Cisco Talos detailed three intrusion clusters this week; federal agencies must patch by September 12.
Microsoft's September 2026 Patch Tuesday fixed a record 974 vulnerabilities, two already exploited, as AI-assisted discovery keeps inflating patch volumes.
CVE-2026-75650 is a CVSS 10.0 unauthenticated RCE in Magento and Adobe Commerce, exploited from Sept. 4 and patched only by a hotfix with no version number.
McKesson confirmed a cyber incident after ShinyHunters claimed 284 million patient records, stolen via vishing, Okta single sign-on, and cloud data warehouses.
E2EE has gone mainstream, but it's under legal and technical pressure. A look at where encryption stands, what's genuinely secure, and what isn't.
Passkeys swap stolen, reused passwords for cryptographic keys held on your device. How FIDO2 and WebAuthn work, why phishing fails, and what still breaks.
Microsoft's August 2026 Patch Tuesday fixed roughly 400 vulnerabilities, including three zero-days and one actively exploited by North Korean attackers.
