What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
Rey detained in Jordan.
Reuters reports Rey, a suspected ShinyHunters member, was detained in Jordan. Rey, aka Saif al-Din Khader, is cooperating with the FBI. The detention occurred on September 29, 2026.
Recommended by the publisher: The FBI is investigating.
Read the original at thehackernews.com · Machine-written brief
TA419 targets US AI experts with phishing.
The Hacker News reports TA419 targets US AI experts with phishing, impersonating economists and policymakers, according to the news outlet. The group targets think tanks, universities, and legal sector organizations. The Hacker News says the campaigns single out AI policy experts.
Read the original at thehackernews.com · Machine-written brief
MI5 says China's MSS funded research with 100+ U.K.-linked academics.
The Hacker News reports MI5 warned that over 100 academics helped China's intelligence gathering efforts. MI5 says the China General Technology Research Institute funded this research. The primary purpose of this institute is to fund research, according to MI5. The Hacker News reports this warning was issued in a Security Service Espionage Alert.
Read the original at thehackernews.com · Machine-written brief
Warlock exploits SharePoint flaws.
The Hacker News reports Warlock targets organizations in Portuguese- and Spanish-speaking countries. Symantec and Carbon Black Threat Hunter Team observed the activity. It hit critical infrastructure, government, and education organizations. Warlock likely uses old and new vulnerabilities.
Read the original at thehackernews.com · Machine-written brief
The Hacker News reports cybersecurity is shifting.
The Hacker News reports cybersecurity is shifting toward continuous visibility and control. Organizations manage more identities and devices. Security is changing due to cloud infrastructure and AI.
Read the original at thehackernews.com · Machine-written brief
GitLab patches command execution flaw in AI Gateway.
GitLab says a critical flaw in its AI Gateway allows command execution under certain conditions. The flaw affects self-hosted servers with Duo Agent Platform access. GitLab fixed the flaw in versions 19.2.4, 19.3.2, and 19.4.1.
Recommended by the publisher: Update to gateway versions 19.2.4, 19.3.2, or 19.4.1.
Read the original at thehackernews.com · Machine-written brief
China-nexus actor targets Asian governments.
The Hacker News reports a China-nexus threat actor is targeting government and policy organizations in Asia. Cisco Talos is tracking the cluster, which involves a backdoor called Antino. The campaign has targeted organizations in Taiwan, India, and other countries. The Hacker News says the backdoor uses Outlook and OneDrive for command and control.
Read the original at thehackernews.com · Machine-written brief
Dell CSM flaws enable unauthenticated admin access.
The Hacker News reports Dell Container Storage Modules have critical flaws. CVE-2026-63688 affects the csm-authorization-storage gRPC server.
Recommended by the publisher: Dell has released security updates.
Read the original at thehackernews.com · Machine-written brief
OpenAI parts ways with three safety researchers.
The Wall Street Journal reports that OpenAI parted ways with three members of its safety team for leaking private information, according to a company spokesperson. The individuals violated company policies on accessing and handling sensitive information. OpenAI confirmed this after an investigation.
Read the original at thehackernews.com · Machine-written brief
CISOs struggle to answer boards' security questions.
The Hacker News reports CISOs have difficulty answering boards' questions on security. Boards ask about overall security and other topics. The security team gathers data from various tools.
Read the original at thehackernews.com · Machine-written brief
Google limits Android accessibility services.
The Hacker News reports Google announced a security measure limiting accessibility services to verified tools when Advanced Protection is enabled, blocking a major attack pathway for malware and financial fraud, according to the tech giant.
Recommended by the publisher: Enable Advanced Protection.
Read the original at thehackernews.com · Machine-written brief
FortiMail has a zero-day flaw.
The Hacker News reports a critical FortiMail flaw, tracked as CVE-2026-104286, allows unauthenticated arbitrary file writes. CISA added it to its Known Exploited Vulnerabilities catalog. The vulnerability has a CVSS score of 9.8.
Recommended by the publisher: The Hacker News reports no recommended action.
Read the original at thehackernews.com · Machine-written brief
Spanish police arrest 16-year-old suspected of running KillSec ransomware group.
The Hacker News reports that police in Spain arrested a 16-year-old suspected of running KillSec. KillSec is accused of stealing data from organizations. Police took control of the leak site and servers. The arrest was made on September 30.
Read the original at thehackernews.com · Machine-written brief
Attackers use expected system actions as attack paths.
The Hacker News reports attackers can use system actions as attack paths. A model check can run code. A cache can mix up requests. Public secrets can stay useful for years.
Read the original at thehackernews.com · Machine-written brief
Threat actors deployed a WordPress backdoor.
The Hacker News reports a WordPress compromise with multiple persistence mechanisms. Sucuri describes the malware as a self-healing mesh. The backdoor is codenamed SC.
Read the original at thehackernews.com · Machine-written brief