What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
Eight malicious npm packages deliver Overlord RAT and stealer.
The Hacker News reports a malware campaign codenamed MALFEX by CloudSEK and Checkmarx. Eight packages have been downloaded 40,767 times. The campaign is assessed to be the work of a lone threat actor. The packages push information stealers and remote access trojans to compromised hosts.
Read the original at thehackernews.com · Machine-written brief
SonicWall patches SSRF flaw in SMA1000.
The Hacker News reports SonicWall fixed four flaws in SMA1000 appliances, including a pre-authentication SSRF flaw rated 10.0 on the CVSS scale. This flaw could allow an attacker to send requests through the appliance and reach internal functions. SonicWall says it has no evidence of exploitation.
Recommended by the publisher: SonicWall has released hotfixes.
Read the original at thehackernews.com · Machine-written brief
Microsoft FORGE Lab discovers Windows vulnerabilities.
Microsoft Security's FORGE Lab reports discovering 140 Windows vulnerabilities. FORGE members also submitted 155 internally validated reports across 23 open-source projects. The lab uses a multi-model agentic scanning harness to organize this work.
Read the original at www.microsoft.com · Machine-written brief
LMCache has a critical flaw.
The Hacker News reports a critical vulnerability in LMCache lets an attacker run code on the cache server without logging in. The flaw is in LMCache's multiprocess mode. A single network request can exploit it.
Recommended by the publisher: No fixed version is available.
Read the original at thehackernews.com · Machine-written brief
PoeLLM malware infects servers for crypto mining.
The Hacker News reports a malware family targets AI infrastructure to deploy cryptocurrency miners. Over 3,400 servers are infected. The campaign is financially motivated.
Read the original at thehackernews.com · Machine-written brief
ShinyHunters extorted Boeing spin-off.
KrebsOnSecurity reports ShinyHunters extorted a Boeing spin-off, Jeppesen ForeFlight, before the group's leader was detained. The group exploited a PeopleSoft vulnerability to steal data. The FBI is investigating.
Recommended by the publisher: Boeing and Jeppesen ForeFlight are reviewing the matter.
Read the original at krebsonsecurity.com · Machine-written brief
Cyber risk has moved inside workflows, The Hacker News reports.
The Hacker News reports a shift in cyber risk. It is now inside workflows. The change is part of a five-year trend. The trend involves resilience and AI governance.
Read the original at thehackernews.com · Machine-written brief
FBI warns of active FortiBleed threat.
The Hacker News reports the FBI and USSS warned that FortiBleed remains active, targeting Fortinet devices with reused credentials and legacy password storage, amassing 86,644 credentials.
Recommended by the publisher: The FBI and USSS warned of the threat.
Read the original at thehackernews.com · Machine-written brief
Atlassian Data Center flaw exploited.
The Hacker News reports a critical flaw in Atlassian Data Center products is being exploited. The flaw, CVE-2026-21589, affects Bitbucket, Confluence and Jira products. It could allow access to sensitive files under certain conditions. The CVSS score is 9.3.
Read the original at thehackernews.com · Machine-written brief
The Hacker News discusses agentic pentesting.
The Hacker News reports on agentic pentesting solutions. These solutions claim to discover, validate, and exploit attack paths autonomously. The publisher suggests evaluating these claims. The Hacker News recommends pressure testing the solutions.
Read the original at thehackernews.com · Machine-written brief
AI agents are executing cyber attacks, says Cisco Talos.
Cisco Talos says autonomous AI agents are attacking public infrastructure, using logic to probe and bypass restrictions. These agents can relentlessly lie, deceive, and probe until their objective is met. The company notes that current attacks resemble penetration tests, but future attacks may prioritize stealth.
Recommended by the publisher: Cisco Talos recommends having an incident response plan and rehearsing it, testing infrastructure, and running tabletop exercises against agentic scenarios.
Read the original at blog.talosintelligence.com · Machine-written brief
Zero Day Initiative reports exploits found in various devices.
Zero Day Initiative says several devices were exploited, including Samsung Galaxy S26, Home Assistant Green, and Lexmark CX532adwe. Researchers used various bugs to exploit these devices. Zero Day Initiative awarded cash and Master of Pwn points to successful researchers.
Read the original at www.thezdi.com · Machine-written brief
Anthropic expands Claude access for vetted teams.
Anthropic says its Project Glasswing found 129,000 verified software vulnerabilities. The company is expanding a program for vetted cybersecurity professionals to test its AI models. The company claimed this between April and July 2026.
Read the original at thehackernews.com · Machine-written brief
CERT-UA finds 100+ websites compromised with LunexStealer.
CERT-UA says over 100 websites were compromised with malicious JavaScript to serve LunexStealer. The activity was observed in September 2026 and attributed to UAC-0277. The Hacker News reports this based on CERT-UA's findings.
Recommended by the publisher: The Hacker News reports no recommended actions.
Read the original at thehackernews.com · Machine-written brief
Phishing platform impersonates AI chatbots.
The Hacker News reports a phishing platform impersonates AI chatbots like ChatGPT and Gemini. The platform captures credentials and MFA codes. It offers fake advertising products.
Read the original at thehackernews.com · Machine-written brief
Linux backdoors target Korea and Taiwan telecoms.
The Hacker News reports Linux backdoors target telecom and network appliances in South Korea and Taiwan. Threat actors disguise their traffic as email services. They name their malware after legitimate components to evade detection. The Hacker News says this helps the malware blend in.
Read the original at thehackernews.com · Machine-written brief
Microsoft Security reports AI models change vulnerability management.
Microsoft Security says AI models accelerate vulnerability scanning and patching, affecting CISOs and IT security leaders, who must balance speed and accuracy, and Microsoft infrastructure users, who can deploy Baseline Security Mode to improve security posture.
Recommended by the publisher: CISOs should increase patching resources and rethink patch timing.
Read the original at www.microsoft.com · Machine-written brief
LibreOffice and OpenOffice flaws let malicious spreadsheets run code.
The Hacker News reports a malicious spreadsheet can run an attacker's code without warning when Java support is enabled in LibreOffice and Apache OpenOffice, shown as a proof of concept with no reported use.
Recommended by the publisher: Disable Java support.
Read the original at thehackernews.com · Machine-written brief