What security media and vendors’ research teams have published, newest first. A brief is written from what the publisher puts in its feed, says who reports what, and links to the original; where the feed has only a headline, so do we. These are not authorities: read the claims as theirs.
Citrix patches NetScaler flaw.
Citrix says CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service. The vulnerability affects NetScaler ADC and NetScaler Gateway under certain conditions. Citrix released patches for the flaw.
Recommended by the publisher: Citrix released patches.
Read the original at thehackernews.com · Machine-written brief
FBI seizes 7 domains, disrupts Flax Typhoon tools.
The Hacker News reports the FBI and Department of Justice disrupted Flax Typhoon tools used in U.S. critical infrastructure intrusions. The agencies seized several domains. The tools were used to scan and infiltrate infrastructure.
Recommended by the publisher: The FBI and DoJ blocked access to platforms used to scan U.S. critical infrastructure.
Read the original at thehackernews.com · Machine-written brief
China-linked hackers stole emails from organizations.
The Hacker News reports hackers tied to Integrity Technology Group stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia. The hackers scanned websites for flaws using a tool. The company has been sanctioned by the U.S. and the UK.
Recommended by the publisher: The FBI and agencies in 6 other countries reported this.
Read the original at thehackernews.com · Machine-written brief
Ransomware affiliate betrays others.
The Hacker News reports a ransomware affiliate kept profits for himself. An attacker exposed a server with tools. Malicious code was found in developer packages.
Read the original at thehackernews.com · Machine-written brief
JPCERT/CC reports data leaks in Japan.
The Hacker News reports JPCERT/CC found API abuse and software flaws were used. Japanese organizations are affected. JPCERT/CC based this on incident reports.
Read the original at thehackernews.com · Machine-written brief
UAC-0099 targets Ukrainian government personnel with ASHVEIN RAT.
The Russia-aligned threat actor UAC-0099 uses ASHVEIN RAT in attacks. TrendAI tracks the cluster as Earth Sirrush. ASHVEIN is a .NET infostealer and RAT.
Read the original at thehackernews.com · Machine-written brief
ARTEX AI tool used in attacks on South Korean financial firms.
CrowdStrike Intelligence reports a campaign targeting South Korean financial organizations from late September to early October 2026. The threat actor used ARTEX to carry out the attacks. The activity resulted in data exfiltration.
Read the original at thehackernews.com · Machine-written brief
ANY.RUN identifies Wazza phishkit targeting organizations.
ANY.RUN has identified Wazza, a new phishkit targeting banking, manufacturing, and government organizations across the US, Europe and Australia. The Hacker News reports this affects multiple sectors. ANY.RUN says it has traffic controls and session management. The phishkit is part of the infrastructure that delivers the phishing page.
Read the original at thehackernews.com · Machine-written brief
16 Firefox extensions steal recovery phrases.
The Hacker News reports 16 malicious Firefox extensions pose as Rabby and OKX Wallets to steal recovery phrases and private keys, they masquerade as wallet portals and browser tools, intercepting secrets during wallet import flows.
Recommended by the publisher: Remove malicious extensions.
Read the original at thehackernews.com · Machine-written brief
US offers $10 million for Zhang Yu tips.
The Hacker News reports the US State Department is offering a reward for information on Zhang Yu, charged in the HAFNIUM hacks, according to NTD, citing a notice, the reward is for his identification or location.
Read the original at thehackernews.com · Machine-written brief
MonsterCloud owner charged with fraud.
The Hacker News reports the US Department of Justice charged Zohar Pinhasi with wire fraud. He allegedly paid attackers for decryptors. The Hacker News says he billed over $19M.
Recommended by the publisher: The Hacker News reports no recommended action.
Read the original at thehackernews.com · Machine-written brief
Tensorlake npm package compromised.
The Hacker News reports the tensorlake npm package was compromised to deliver malware. Socket says the malicious version 0.5.144 harvests credentials and executes remotely supplied code. This affects Tensorlake applications and services.
Recommended by the publisher: No action recommended.
Read the original at thehackernews.com · Machine-written brief
Attackers hijacked .gh, .sl, and .as registries.
The Hacker News reports attackers compromised three country-code top-level domains and obtained unauthorized HTTPS certificates for Google domains, Google said. Google's systems were not breached, but domains ending in .gh, .sl, or .as were put at risk. An attacker could pose as the real site over an encrypted connection with such a certificate.
Recommended by the publisher: The Hacker News reports no recommended actions.
Read the original at thehackernews.com · Machine-written brief
Eight malicious npm packages deliver Overlord RAT and stealer.
The Hacker News reports a malware campaign codenamed MALFEX by CloudSEK and Checkmarx. Eight packages have been downloaded 40,767 times. The campaign is assessed to be the work of a lone threat actor. The packages push information stealers and remote access trojans to compromised hosts.
Read the original at thehackernews.com · Machine-written brief
SonicWall patches SSRF flaw in SMA1000.
The Hacker News reports SonicWall fixed four flaws in SMA1000 appliances, including a pre-authentication SSRF flaw rated 10.0 on the CVSS scale. This flaw could allow an attacker to send requests through the appliance and reach internal functions. SonicWall says it has no evidence of exploitation.
Recommended by the publisher: SonicWall has released hotfixes.
Read the original at thehackernews.com · Machine-written brief
LMCache has a critical flaw.
The Hacker News reports a critical vulnerability in LMCache lets an attacker run code on the cache server without logging in. The flaw is in LMCache's multiprocess mode. A single network request can exploit it.
Recommended by the publisher: No fixed version is available.
Read the original at thehackernews.com · Machine-written brief
PoeLLM malware infects servers for crypto mining.
The Hacker News reports a malware family targets AI infrastructure to deploy cryptocurrency miners. Over 3,400 servers are infected. The campaign is financially motivated.
Read the original at thehackernews.com · Machine-written brief
Cyber risk has moved inside workflows, The Hacker News reports.
The Hacker News reports a shift in cyber risk. It is now inside workflows. The change is part of a five-year trend. The trend involves resilience and AI governance.
Read the original at thehackernews.com · Machine-written brief
FBI warns of active FortiBleed threat.
The Hacker News reports the FBI and USSS warned that FortiBleed remains active, targeting Fortinet devices with reused credentials and legacy password storage, amassing 86,644 credentials.
Recommended by the publisher: The FBI and USSS warned of the threat.
Read the original at thehackernews.com · Machine-written brief
Atlassian Data Center flaw exploited.
The Hacker News reports a critical flaw in Atlassian Data Center products is being exploited. The flaw, CVE-2026-21589, affects Bitbucket, Confluence and Jira products. It could allow access to sensitive files under certain conditions. The CVSS score is 9.3.
Read the original at thehackernews.com · Machine-written brief