-
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser’s …
-
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living …
-
U.S. Bank CISO says the security role keeps growing and no one can own all of it
In this interview with Help Net Security, Ann Barron-DiCamillo, EVP, CISO at U.S. Bank, talks about how the CISO role has grown to cover …
-
NIS2 compliance: 7 low-cost steps to secure credentials
Security budgets rarely stretch to cover a full NIS2 programme in one pass. Credential controls are where a constrained team can start, …
-
Apple changes Full Disk Access permission in macOS
Apple’s macOS has a Full Disk Access permission, designed to allow backup applications full access to, well, the disk, so they can …
-
Atlassian warns of critical file access flaw in its datacenter products
Atlassian has told its users to patch its datacenter products, pronto, to prevent attackers accessing their files. The Australian …
-
Product showcase: Webroot Mobile Security screens texts, blocks risky sites, and checks for data leaks
Webroot Mobile Security combines device security checks, Safari protection, text scam filtering, and data breach monitoring. It is …
-
Cybersecurity jobs available right now: October 6, 2026
Associate IAM Engineer New York City Office of Technology & Innovation | USA | On-site – View job details As an Associate IAM Engineer, …
-
Security researcher claims they found KVM guest-host escape flaw
Linux KVM, the hypervisor favoured by hyperscale clouds, apparently has a full VM escape bug. That nasty news came from security researcher …
-
Security researcher claims to they found KVM guest-host escape flaw
Linux KVM, the hypervisor favoured by hyperscale clouds, apparently has a full VM escape bug. That nasty news came from security researcher …
-
Google, JPMorgan and two governments fixed the same MCP flaw
Security teams at Google, JPMorgan Chase, Weaviate, France’s interministerial digital directorate (DINUM) and the city government of …
-
CVE-2026-97300 – Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 ...
Unauthenticated Broken Access Control in WP Event Solution
●●●
NVD
- CVE-2026-105764 – Immich is a high-performance self-hosted photo and video management solution. Prior to …
- CVE-2026-105471 – A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up …
- CVE-2026-105762 – Dify is an open-source LLM app development platform. Prior to 1.13.0, the …
- CVE-2026-105763 – Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 …
- CVE-2026-97300 – Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 ...
EXPLOITS
- Ecava_ntegraXor IGX_16.0.701.10 – RCE
- WordPress 7.0.2 – Path Travesal
- Teltonika_RutOS 00.07.06.21 – command injection
- Food-Ordering 1.0 – LFI
- TigerGraph_Community_Edition 4.2.4 – arbitrary file write
SECURELIST
- MacSync under the microscope: new delivery methods and a new payload
- The Odyssey and Trojans again: MovieReaper attacks users in multiple countries through com
- Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
- The Odyssey and trojans again: MovieReaper attacks users in multiple countries via comprom
- NightEagle targets Russian companies