A daily, automatically-compiled digest of the cyber security stories that broke in the last 24 hours, drawn from 12 trusted feeds. Each entry is a short excerpt — follow the link to read the full article at its original publisher. Compiled 15 October 2026 · 21 items.
Actively exploited, critical, or high-severity flaws — patch or mitigate first.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerabil…
Read at source →CVSS 9.3 CRITICAL A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_A…
Read at source →Lower-severity or unconfirmed-exploitation vulnerabilities.
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode) for Nextcloud. [...]
Read at source →Malware, campaigns and adversary tradecraft.
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. The following versions of Thermo Fisher Torrent Suite Software are affected: Torrent Suite Software <=5.…
Read at source →View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-…
Read at source →View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4.9.6 (CVE…
Read at source →View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The foll…
Read at source →Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft. The post AI-Powered Espionage Campaign Targets Government Linux Infrastructure appeared…
Read at source →A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The…
Read at source →Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices. [...]
Read at source →The event closed in Toronto last week, with experts sharing critical perspectives on emerging risks, drawing record attendance and marking 22% growth.
Read at source →Built from decades of threat intelligence research, the new resource explains scams from the victims' perspective and tracks emerging forms of cyber crime.
Read at source →Don't buy the hype! AI has been dumbing down cyberattacks, and serious threat actors are barely touching it.
Read at source →Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.
Read at source →<p>Some of the best infrastructure improvements start with one bad afternoon. In the final part of this blog series, we walk through the configuration, release engineering, and pre-commit guardrails that came out of it.</p>
Read at source →Is the cybersecurity world really facing a "Bugmageddon?" Thor breaks down the latest CVE and KEV trends in the latest Threat Source newsletter.
Read at source →Detection engineering, tooling and defensive analysis.
[This is a Guest Diary by Zachary Norwood, an ISC intern as part of the SANS.edu BACS program]
Read at source →Industry, executive and AI-security perspective.
Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has receive…
Read at source →A huge theater of purple steel rigging builds castles, starships and temples for one viewer in the only seat, while a tiny studio off to the side holds up a single boxed game/images/custom-content-for-everyone.webp/images/custom-content-fo…
Read at source →A giant made of a worker's emails and records kneels and offers him small copies of himself/images/agi-prediction-update.webp/images/agi-prediction-update.webp I said, I think in 2023, that we’d have AGI between 2025 and 2028/blog/why-well…
Read at source →