← Back to Blog
Security News
Security News — 28 September 2026
A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 10 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 28 September 2026 · 16 items.
Urgent Vulnerabilities 4
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
SANS Internet Storm Center (Handler Diary)28 Sep
KEV · exploited
- Exploited
- Yes — CISA KEV
- Product
- Apple Multiple Products
- Impact
- Out-of-bounds write
- Audience
- Endpoint/mobile users
- Action
- Patch per vendor / CISA KEV
Apple today released patches for all of its operating systems. However, only patches for older branches include a security fix. The vulnerability being addressed in iOS 26, macOS 26 and macOS 15 is already being exploited. iOS and macOS 27…
Read at source →
The Hacker News28 Sep
KEV · exploited
- Exploited
- Yes — CISA KEV
- Product
- Apple Multiple Products
- Impact
- Out-of-bounds write
- Audience
- Endpoint/mobile users
- Action
- Patch per vendor / CISA KEV
Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950, refers to an out-of-bounds w…
Read at source →
Palo Alto Unit 4228 Sep
KEV · exploited
- Exploited
- Yes — CISA KEV
- Product
- Citrix NetScaler
- Impact
- Memory corruption
- Audience
- Network/firewall admins
- Action
- Patch per vendor / CISA KEV
Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in…
Read at source →
CVEDatabase - Critical CVEs28 Sep
HighCVSS 8.5
- Product
- D-Link DI-8400
- Action
- Patch when a fix is available; monitor exposure
CVSS 8.5 HIGH A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service. The manipulation of the argumen…
Read at source →
Threat Activity 4
Malware, campaigns and adversary tradecraft.
Dark Reading28 Sep
Exploited
A high-severity zero-day vulnerability affects the TDengine time-series database used across industrial, IoT, energy, and automotive environments.
Read at source →
Dark Reading28 Sep
The Open Agent Safety Platform relies on both hardware and software components to monitor agent activities and quarantine unruly agents before they cause harm.
Read at source →
Dark Reading28 Sep
Enterprises regularly rigorously monitor human employees, while autonomous AI agents quietly operate with broad privileges that could turn them into the next generation of insider threats.
Read at source →
The Hacker News28 Sep
What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of…
Read at source →
Breaches & Incidents 4
Ransomware, data breaches and supply-chain events.
The Hacker News28 Sep
Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecom…
Read at source →
Microsoft Security Blog28 Sep
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and supp…
Read at source →
Dark Reading28 Sep
The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.
Read at source →
Krebs on Security28 Sep
Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, rema…
Read at source →
Research & Detection 2
Detection engineering, tooling and defensive analysis.
Elastic Security Labs28 Sep
The native Sublime Security integration sends email detections into Elastic Security, where phishing incident response can tie a quarantined email to what happens next on the endpoint and pull the threat from every mailbox it reached.
Read at source →
SANS Internet Storm Center (Handler Diary)28 Sep
Read at source →
Policy & Commentary 2
Industry, executive and AI-security perspective.
Daniel Miessler28 Sep
A charcoal sketch of a classical college building sliced into five sections: a professor, students meeting, and two friends sketching in warm sienna rooms, while the textbook shelf and the diploma at either end crumble into purple dust/ima…
Read at source →
Schneier on Security28 Sep
ArsTechnica is reporting on a “new” attack against RSA, one that bypasses factoring. First, this attack isn’t new. The original research is from 2007 . What is new is the implementation. Second, it is a forgery attack. It allows an attacke…
Read at source →