News
-
DIVD: Zammad zero-days let an AI agent breach its network
The Dutch Institute for Vulnerability Disclosure says its network was breached through a chain of two zero-day flaws in the open-source Zammad ticketing system — with an autonomous AI agent at the controls.
-
Hackers steal personal records of millions of US military personnel
The US Department of Defense is notifying current and former service members that their personal data was stolen during a months-long breach of Pentagon personnel records.
-
Google unveils Gemini 4 Argon — and immediately locks it down
Google says its new frontier model is so capable that, for now, only a set of "trusted cyber defenders" gets to use it.
-
Reddit is shutting down RSS feeds and public API, blaming AI bots
Reddit is ending support for RSS and winding down its public API, citing large-scale scraping — and protecting a content trove that has become a lucrative source of AI licensing revenue.
-
Attackers Weaponize Zimbra Flaw to Plant Web Shells and Steal Auth Secrets
Microsoft reports that attackers exploited an already-patched Zimbra Collaboration Suite flaw to deploy web shells, read mailboxes, and harvest server-wide authentication secrets.
-
CISA flags critical pre-auth RCE flaw in MikroTik RouterOS
The U.S. cybersecurity agency warns of a flaw in the RouterOS web interface that lets an unauthenticated attacker run code as root with a single request.
-
Qt 6.12 LTS Released With QML Hot Reloading and Experimental StyleKit
Qt 6.12 is out as the newest version of the Qt6 toolkit, and it also carries Long Term Support (LTS) status.
-
TeamViewer urges users to patch severe flaws as soon as possible
The remote access software maker issued a rare advisory, urging all users to update to version 15.82 without delay.
-
Cisco patches fifth SD-WAN Manager zero-day of the year amid active attacks
A critical authentication-bypass flaw, CVE-2026-76504, lets an unauthenticated attacker gain admin rights on Catalyst SD-WAN Manager. Cisco has confirmed active exploitation and shipped fixes.
-
CSuite Phishing Targets US Firms, Steals Microsoft 365 Sessions and Plants RMM Tools
ANY.RUN researchers detailed a US-focused phishing campaign called CSuite that pairs Microsoft 365 session theft with the deployment of legitimate remote-access tools.
-
OpenSSL Patches High-Severity DTLS Bug That Can Leak Heap Memory in the Clear
On September 29 OpenSSL shipped fixes for a High-severity DTLS flaw that can send heap memory to the other side of a connection unencrypted, or crash the program.
-
OpenBSD rejects uutils port as Theo de Raadt smells an 'agenda'
A proposal to add the Rust-rewritten uutils to OpenBSD's ports tree met firm pushback from Stuart Henderson and Theo de Raadt.
-
Inside the Citrix NetScaler Exploit: From a DTLS Packet to Root-Level Code
Researchers have published technical details of CVE-2026-88772, a critical flaw in Citrix NetScaler ADC and Gateway. The DTLS buffer overflow is already being abused in the wild.
-
DirtyBlanket: fake Express packages on npm spread a self-replicating Linux worm
In 33 minutes the npm account dirtyblanket published nine malicious packages impersonating Express and React. Installing any of them on Linux starts a worm that steals keys and tokens and infects new machines.
-
Archinstall 4.5: AArch64 Improvements and RT Kernel Options
Ahead of October's refresh of the Arch Linux install media, Archinstall 4.5 has arrived — a new release of the handy text-based system installer.
-
WSL gains support for Linux containers
Microsoft has made WSL Containers generally available: the Windows Subsystem for Linux can now build and run Linux containers directly, without a separate stack.
-
Trump orders US government to call AI ‘Super Intelligence’
A presidential order bars federal agencies from saying “artificial intelligence”: from now on, official documents and releases must use only “Super Intelligence.”
-
San Francisco Keeps Its License-Plate Cameras, Offering Only Weak Safeguards
EFF has criticized the city's decision to retain its automated license-plate reader network, arguing that the new rules do nothing to remove the core danger — the surveillance itself.
-
Signal completes rollout of encrypted backups across all platforms
Version 8.30 brings the secure backups feature to iOS and desktop apps. Chats can now be stored locally or on Signal's servers and restored on another device.
-
French Tax Data Theft: Weak Passwords and Seven Weeks Unnoticed
An attacker logged into France's tax administration with stolen staff passwords and siphoned data on hundreds of thousands of people and firms for nearly two months. ANSSI's verdict: the attack was not sophisticated — weak login protection and monitoring gaps did the rest.
- More