A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 5 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 4 October 2026 · 10 items.
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in zero-day attacks, with researchers investigating whether it can also be exploited for remote cod…
Read at source →CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer V…
Read at source →CVSS 9.3 CRITICAL ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields withou…
Read at source →CVSS 9.3 CRITICAL ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not t…
Read at source →CVSS 9.3 CRITICAL ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 s…
Read at source →CVSS 9.3 CRITICAL A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument input…
Read at source →Malware, campaigns and adversary tradecraft.
Anthropic has started asking Claude users to voluntarily share their voice conversations to help train and improve its AI models. [...]
Read at source →Ransomware, data breaches and supply-chain events.
A suspected member of the ShinyHunters digital extortion group, who goes by the online alias "Rey," has been allegedly detained by authorities in Jordan, Reuters reported, citing three people familiar with the matter. Rey, whose real name…
Read at source →Detection engineering, tooling and defensive analysis.
Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.
Read at source →Industry, executive and AI-security perspective.
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations.…
Read at source →