Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3594 articles
Authorizer combines sign-in and fine-grained access control, letting AI assistants check document permissions before retrieval. Its maintainers say the built-in MCP server is read-only and local-only.
Aikido joined OpenJS’s Security Stewardship Program as an inaugural partner, funding a pool split between vulnerability bounties and maintainer support, starting with Node.js. The program also provides vulnerability triage and CVE coordination.
Bay Area Labs says Poper Blocker, a popular Chrome extension, exfiltrates browsing histories, screenshots, and AI chat data. The extension remained on the Chrome Web Store after researchers reported it to Google.
ThreatDown researchers found Carbonato exploiting unauthenticated Docker daemons exposed on port 2375. It installs a persistent implant and a Telegram-controlled AI agent to collect credentials, especially AI API keys, and spreads to other reachable Docker hosts.
Nvidia introduced an open platform that combines software sandboxing and hardware monitoring to enforce limits on AI agents, including when a host system is compromised.
Recorded Future’s MCP is generally available, giving AI agents OAuth-authenticated access to more than 80 threat-intelligence tools for security workflows including enrichment, detection engineering, threat hunting, and incident response.
EclecticIQ says Intelligence Center 3.9 supports ATT&CK v19.1, updating threat research, entity tagging, and tactical mappings to reflect changes across the Enterprise, ICS, and Mobile matrices.
A September roundup covers EU cyber risks, an AI-agent-assisted breach, new AI and privacy guidance, NIST’s OT security draft, and widespread federal agency delays in implementing cloud security controls.
Citrix confirmed active exploitation of two critical NetScaler RCE flaws and released updates for affected ADC and Gateway appliances. Administrators should upgrade promptly or reduce internet exposure until they can patch.
A flaw in Cloudflare Containers could let Workers Paid customers recover residual data from other customers’ containers on the same host. Cloudflare fixed the issue and found no evidence of customer data exposure.
Anthropic has launched Claude Marketplace, offering more than 2,000 plugins and connectors, partner-built Claude products, and consulting services. Developers can publish connectors and plugins using MCP and Agent Skills.
This cybersecurity roundup covers Gyazo's confirmed breach affecting about 23.62 million user records, TASK#STOMP malware, exploited ZyXEL and Check Point flaws, Microsoft's disruption of EvilTokens, and other security developments.
Two GitHub Actions compromised in the Mini Shai-Hulud campaign were re-enabled from September 16 to 25, 2026, with malicious tags still active. Socket advised removing or pinning them, reviewing workflow runs, and rotating exposed secrets.
OpenAI says its agents accessed public SEC and Census Bureau data but found no compromise. Researchers separately reported an unsuccessful probe of a Department of Education website and other activity, some not clearly attributable to OpenAI.
Qrator reports that a threat actor is selling x47.c, a Windows botnet advertised with DDoS, credential theft, proxy and AI API-draining features. Its AI stealth module is promoted as using xAI Grok to help maintain persistence.
Cameron Wagenius, a U.S. soldier who pleaded guilty to hacking telecom companies and extorting victims, was sentenced to 70 months in prison and ordered to pay nearly $295,000 in restitution.
Cameron John Wagenius was sentenced to 70 months in prison for cybercrime that included stealing credentials, targeting cloud platforms and attempting to extort organizations including AT&T. He was also ordered to pay nearly $295,000 in restitution.
Kiteworks advised customers worldwide to take servers offline for six hours after receiving law-enforcement threat intelligence about a potentially imminent attack. The company says the warning is precautionary and no compromise is known.
Labcorp settled a lawsuit brought by 44 state attorneys general, agreeing to pay $2.3 million and strengthen vendor security practices after a 2019 breach at debt collector AMCA exposed data belonging to 10.2 million Labcorp customers.
Kiteworks recommended a six-hour shutdown after receiving credible threat intelligence about possible targeting of customer systems. The company said it knows of no compromise and recommends using version 9.5.1.
Two actions-cool GitHub Actions became accessible again with malicious tags still in place, potentially resuming payload delivery. Developers are advised to remove the actions, pin clean commit SHAs, rotate secrets, and review workflow history.
ShinyHunters claim they stole data on about 38,000 FBI staff and applicants and briefly defaced the FBI jobs site. The FBI is investigating; the group says the action was retaliation for an FBI advisory, not extortion.
Gen’s AI Data Checker helps users identify AI and other services that may have their data and review how those services may use or retain it, including for model training, personalization, and advertising.
This roundup covers a Clop leak-site takeover, flaws in browser AI assistants, malware targeting secrets and AI keys, water-sector credential exposure, and security updates including an Ubuntu kernel schedule change and a TDengine fix.
