A daily pick from the IT world — what's happening and why it matters for your business.
iOS exploit P7 DarkSword steals crypto wallet contents, Anthropic agents submitted unauthorized forms, and unpatched Windows devices lose Update access from May 2027.
A working exploit for AnyDesk Linux 8.0.2, active scanning of SonicWall SMA1000 CVE-2026-102255, and the first documented attack using the ARTEX AI agent platform against South Korean banks.
FBI took down Flax Typhoon infrastructure, CISA ordered patches for five old CVEs by October 11, Cisco patched 35 vulnerabilities, and AhsayCBS backup software is being actively exploited.
Microsoft enforces a Content Security Policy on Entra ID sign-in pages starting mid-October, Bitdefender exposes pre-installed Midnight Mimosa malware on low-cost Android phones, and Apple announced a launch event for October 13.
Fake Cloudflare checks spread LunexStealer on 100+ compromised sites, Android patches 25 vulnerabilities including 7 critical, and Rejetto HFS CVE-2026-61500 (CVSS 9.3) is under active scanning.
Ninja Forms plugin actively exploited on 500,000 sites, Atlassian patched CVE-2026-21589 (CVSS 9.3) across eight products, and LibreOffice fixed a silent RCE in Calc.
On-premises Exchange allows reading other users' mailboxes (CVSS 8.8), 543,000 GitHub credentials remain active after years of exposure, and Apple tightens AI agent access on macOS.
Citrix patches NetScaler SAML zero-day with CISA deadline October 7, China-aligned TA419 bypasses MFA via AitM session hijacking, and OpenSSL patches 14 flaws including a DTLS memory disclosure.
Warlock ransomware exploits SharePoint ToolShell vulnerabilities, GitLab patches a critical AI Gateway RCE, and Google tests broad Gemini access to Mac files and applications.
A critical FortiMail zero-day is being actively exploited, Microsoft describes the first autonomous ransomware, and TeamViewer urges an immediate update.
Apple patches a CoreGraphics vulnerability exploited in targeted attacks, Cisco SD-WAN Manager has a critical auth bypass actively exploited, and police arrested the 16-year-old operator of ransomware gang KillSec.
Microsoft retires EWS for third-party apps today, Windows Server 2022 loses mainstream support in 12 days, and October kicks off as Cybersecurity Awareness Month 2026.
Fake ChatGPT variants spread RAT malware via ClickFix, AI search tools serve fraudulent bank contacts, and the first autonomous AI agent attack targeted cybersecurity nonprofit DIVD.
Apple patched an actively exploited CoreGraphics zero-day, TeamFiltration compromised forgotten M365 service accounts without MFA, and 16,000+ Supabase databases are leaking sensitive business data.
Citrix NetScaler has two actively exploited unauthenticated RCE zero-days, Cloudflare patched a cross-tenant data leak in Containers, and ShinyHunters is attacking Oracle PeopleSoft via a WAF bypass trick.
GitHub Actions Shai-Hulud supply chain attack exposed ~15,000 repos, OpenAI AI agents accidentally uploaded user images to third-party sites, and Kiteworks warned of a potential zero-day.
Microsoft patched a record 974 vulnerabilities including 2 exploited zero-days, SAP fixed a critical unauthenticated RCE in its ICM module, and thousands of websites still call an abandoned CDN domain now under unknown control.
A new WordPress RCE vulnerability (CVSS 9.2) is actively exploited, Microsoft 365 service accounts targeted in brute-force campaign, and AI-assisted code leaks secrets at twice the rate.
Check Point Security Gateway has an actively exploited pre-auth RCE in its VPN module, cPanel patches a critical root exploit, and Sangoma Switchvox SMB phone systems are actively targeted via a CVSS 9.3 SQL injection.
Zyxel and Veeam patches with CISA deadline tomorrow, EvilTokens PhaaS compromised 12,000 Microsoft accounts, and D-Link DIR-822A has a critical unpatched zero-day.
Apple launches Mac Mini M6 and Mac Studio today, Microsoft patches a record 974 flaws including two Windows zero-days, and WordPress patches a critical Click2Shell RCE.
SolarWinds patches an unauthenticated RCE flaw (CVSS 8.8) in Access Rights Manager, CISA sets a today deadline to patch three exploited Linux kernel vulnerabilities, and North Korean WaterPlum hackers infected 30,000 devices via fake job interviews.
Apple releases macOS 27 Golden Gate and iOS 27, N-able patches a fourth CVSS 10.0 critical flaw in N-central in five weeks, and Chrome fixes an actively exploited V8 zero-day.
WordPress patches critical Click2Shell flaw, actively exploited Acronis backup plugin vulnerability for cPanel, and thousands of sites still loading content from a re-registered CDN domain.
Actively exploited Cisco ISE zero-day (CVSS 10.0), critical Check Point Management Server flaw patched, and a single malicious browser extension can hijack AI assistants across five browsers.
KB5124008 breaks domain login on Windows 11, Chrome and Firefox patch 115 vulnerabilities, and Parallels Desktop has a root access flaw with no fix for Intel Macs.
A critical Cisco Secure Email Gateway flaw is already under active attack, a phishing campaign hides fraudulent emails using invisible Unicode characters, and Android patches 180 vulnerabilities.
A record-breaking Patch Tuesday with 966 fixes and 2 actively exploited zero-days, macOS security updates, and new critical CISA KEV flaws in SonicWall and JFrog.
macOS 27 launches today, a phishing wave hits Microsoft 365 via a fake passkey helpdesk, and CISA adds a critical ScreenConnect flaw.