A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 5 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 3 October 2026 · 10 items.
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
CVSS 9.4 CRITICAL · Vendor: zammad Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, bu…
Read at source →CVSS 9.4 CRITICAL · Vendor: zammad All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
Read at source →CVSS 8.8 HIGH Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
Read at source →Malware, campaigns and adversary tradecraft.
Google's Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time. [...]
Read at source →The U.K.'s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering efforts on behalf of Beijing's state security service. In a "Security Service Espionage Alert"…
Read at source →The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. [...]
Read at source →Featuring: Cybersecurity is being reshaped by the expansion of cloud infrastructure, AI, distributed systems, and increasingly complex digital environments. As organizations manage more identities, devices, data, and internet-facing infras…
Read at source →Ransomware, data breaches and supply-chain events.
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The…
Read at source →A suspected ShinyHunters hacking group member known online as "Rey" has reportedly been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group. [...]
Read at source →Detection engineering, tooling and defensive analysis.
YARA-X&#;x26;#;39;s 1.21.0 release brings 5 improvements and 4 bugfixes.
Read at source →