A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. North Korean IT Workers Used Stolen US Identities to Earn $3 MillionU.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalogBAE Systems Cyber Incident Takes US Bankruptcy Noticing Center Offline for a WeekAI Agents Accessed Indian Organizations Without Authorization, CERT-In WarnsBurger King Japan Data Breach Impacted 11 Million CustomersF5 addressed critical RCE flaws in NGINXU.S. CISA adds Atlassian flaw to its Known Exploited Vulnerabilities catalogPEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManagerCenterPoint Energy Data Breach: More Than 1 Million Texans AffectedU.S. CISA adds Palo Alto Networks PAN-OS, Ahsay AhsayCBS, and Cisco Secure Email Gateway flaws to its Known Exploited Vulnerabilities catalogSilent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and GovernmentAdFection: Beyond the Click: Citizen Lab Exposes Ad-Delivered Spyware NetworksCisco Urges Customers to Patch Email Gateway Flaw and Check for CompromiseHirudo Android Trojan Replaces Banking Apps to Steal CredentialsU.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalogMicrosoft Patch Tuesday Sets New Record with 1,415 CVEs in October 2026 UpdatesHidden Audio Recorder Found at OpenAI as Employee Faces Federal ChargesVolexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day VulnerabilitiesHow a leaked builder of XWorm turned a remote access trojan into a surveillance kitU.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalogAnthropic Shows How Small AI Models Could Replicate Across IoT DevicesGitLab Patches Max-Severity Vulnerability CVE-2026-97229Hackers cranked French supermarkets’ freezers up to 50 degrees, causing hundreds of stores to lose their stockShinyHunters arrest number three: a Canadian ransomware negotiatorCanonical Hit by Second DDoS Attack in 2026, Public Websites DisruptedSonicWall Patches CVSS 10.0 SSRF Flaw as Attacks BeginCyberXero Used 51 AI Agents to Steal 628,000 Ukrainian RecordsGTA 6 Leaker Demands $30M Meme Coin Market Cap to Release Full GameBitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countriesU.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog International Press – Newsletter Cybercrime Leaked chats show Russian extortion gang sending ‘agents’ into US law firms GTA 6 leaker CyberLeek is now reportedly threatening to release a full, playable build of the game CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure ShinyHunters: Six Years of Cybercrime — Expert Analysis and Ransomware Group Perspectives Canonical Websites Disrupted in Second DDoS Attack This Year Canadian ransomware negotiator arrested amid FBI hacker crackdown Saudi National Arrested for Installing Surreptitious Audio Recording Device at OpenAI Ransomware gets personal: ‘We-know-where-you-are kind of stuff’ Malware IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime XWorm Reborn: From infostealer to surveillance platform Hirudo: From Fake Updates to Patched Banking Apps The campaign that never stopped: tracking GhostAction from 2025 to 2026 Malfex imgdecode npm native addon loader Hacking Hackers heat French supermarket fridges, sparking fires and spoiling food Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch Super Intelligence Reached OT Systems and Moved Equipment AI models may be capable of self-replicating without access to a datacenter A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days Vghost: Beyond the Privilege Boundary Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified Using a funded test cryptocurrency wallet without authorization Intelligence and Information Warfare Disrupting AI-enabled “false front” operations Britain steps up national defences against growing AI risks Russia’s Yandex bot traffic nearly eliminated overnight after Ukraine drone strikes cripple multiple of ‘Russia’s Google’ data centers — Ukraine intensifies bombing of Yandex data centers in response to Moscow’s strikes on Kyiv data centers UK keeps AI safeguards in the maybe pile for Cyber Security BIll UAE faces over 800,000 cyberattacks daily: How the country is fighting back Exposing AdFection How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware BREAK THE SILENCE: TRACKING SILENT LYNX THROUGH EXPOSED INFRASTRUCTURE Flock CEO defends surveillance technology amid national backlash: ‘We shouldn’t pause progress’ ARMORY CASTLE and BT26-05: What Security Teams Need to Know Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance Cybersecurity ‘123456’ password linked to Denmark data breach affecting 8.8M people AI Governance Is Being Decided Now, and the Public Isn’t in the Room The October 2026 Security Update Review Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability Millions of phones exposed to Israeli spyware operation through online ads, researchers say More than 1 million Texans affected by CenterPoint data breach, AG report shows US federal bankruptcy court operations disrupted by cybersecurity incident Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system. The security issues impact the software core's Field UI module and the contributed Entity List module. Drupal issued an advance warning at the beginning of the week, urging administrators to apply updates promptly because attackers could develop exploits shortly after the vulnerabilities’ disclosure. “The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days,” the project's security team warned. “We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.”
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. According to e-commerce security firm Sansec, attacks leveraging the vulnerability, dubbed BlockStrap, have not yet been observed, but threat actors are expected to find a way to exploit it. The researchers based their assessment on identifying four potential attack paths involving CVE-2026-103849 in less than 24 hours. The flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3. The security firm warned that Adobe’s “priority 2” rating of this flaw does not reflect the danger and urgency in this case, despite the more complex attack path.
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing The post Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026 appeared first on Unit 42.
Candiru spyware was delivered to devices at Al Jazeera Media Network via targeted online advertisements in a zero-click attack that required only rendering the malicious ads on the victim's device. Researchers at Citizen Labs investigating the attacks referred to this technique as AdFection, noting that their report is the first public technical confirmation of mercenary spyware delivered through targeted ads. A similar method was documented in late 2025 by Amnesty International, involving ads that infected targets with Predator spyware without them clicking anything. That infection mechanism was called Aladdin and surfaced due to a collection of marketing files and documents leaked from the Intellexa surveillance company that researchers studied and corroborated with technical details from forensic investigations.
Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts.
F5 addressed multiple vulnerabilities, including critical RCE flaws in NGINX that attackers could exploit without authentication. Security and application delivery firm F5 announced fixes for eleven security issues in NGINX. Among them, critical vulnerabilities tracked as CVE-2026-15176 and CVE-2026-93479 could be exploited without authentication via crafted HTTP requests. Under certain conditions beyond their control, an unauthenticated attacker could exploit the security flaws to trigger a buffer overflow leading to a restart. If ASLR is disabled or can be bypassed, the attacker could achieve RCE. The flaw CVE-2026-15176 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code by sending crafted HTTP requests. The vulnerability occurs under specific configurations involving the alias directive and the $request_filename variable. Remote code execution may be possible if ASLR is disabled or bypassed. The flaw CVE-2026-93479 (CVSS score of 9.2) is a heap-based buffer overflow vulnerability in NGINX Plus and NGINX Open Source that could allow an unauthenticated attacker to trigger a denial-of-service condition or potentially execute arbitrary code through crafted HTTP requests. It affects specific configurations where regular-expression capture variables from the map directive are referenced before the map output variable, or where a non-cacheable variable is used in a string expression under certain conditions. Remote code execution may be possible if ASLR is disabled or bypassed. The third critical flaw fixed by the vendor, tracked as CVE-2026-97205 (CVSS score of 9.2), is a use-after-free vulnerability in NGINX ngx_http_core_module that, under certain configurations with asynchronous file I/O (AIO) enabled, may cause memory corruption or unexpected worker process termination when processing Server Side Includes (SSI) pages containing include virtual commands. A remote attacker could exploit the flaw to cause a denial-of-service (DoS) or potentially execute code, particularly when ASLR is disabled or can be bypassed. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, NGINX)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Atlassian flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Atlassian flaw, tracked as CVE-2026-21589 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) catalog. In early October, threat actors started exploiting CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center products. The vulnerability could allow attackers to access sensitive files under certain conditions. Affected products include Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. “This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.” reads the advisory. “In some configurations, there may be some sensitive files that make this highly severe.” Previdian telemetry has detected 15 exploitation attempts from three IP addresses in Japan and the U.S.. “Exploitation has now started to hit our honeypot network” Previdian Founder Ryan Dewhurst wrote on LinkedIn. On October 6, watchTowr Labs published a technical analysis of CVE-2026-21589 after comparing vulnerable and patched Atlassian packages. Researchers found a path traversal flaw where double-colon (::) sequences can be treated as path separators, allowing attackers to read files from the application web root. “While semicolons (;) are very common in path traversal within Java applications, along with the everyday dots (.) and slashes (/), one item stood out: the matching of double colons (::).” reads the analysis. “This is uncommon syntax for this type of vulnerability, but grepping through the codebase we came across an all too familiar sight.” In one Crowd deployment with Jira, researchers were able to read crowd.properties, which exposed application credentials. They then used those credentials to create a user and add it to the jira-administrators group. Crowd IP allowlisting can block this attack path. Exploitation attempts against its honeypot network reportedly began two hours after watchTowr published additional technical details about the vulnerability. According to watchTowr, the problem is in Atlassian’s web-resource handling. It can turn a string such as ..::..::..::..::WEB-INF::web.xml into ../../../../WEB-INF/web.xml, allowing attackers to move through directories and access files they should not be able to read. Atlassian says all versions before the listed fixed versions are affected: ProductFixed versionsBitbucket Data Center9.4.26, 10.2.8, 10.5.1Confluence Data Center9.2.26, 10.2.19Jira Service Management Data Center5.12.40, 10.3.26, 11.3.12Jira Software Data Center9.12.40, 10.3.26, 11.3.12Bamboo Data Center10.2.24, 12.1.12Crowd Data Center6.3.7, 7.0.3, 7.1.7, 7.2.4Crucible4.9.15Fisheye4.9.15 watchTowr has released a free tool on GitHub to help check if a server is vulnerable. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by October 18, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. Smart App Control is a Windows 11 security feature that uses Microsoft's app intelligence services and code integrity features and works alongside Microsoft Defender and SmartScreen to block potentially harmful apps or binaries. According to the company, on affected devices running Windows 11, version 24H2 and later, the Smart App Control option is grayed out and cannot be toggled. "After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in an update to the KB5127648 advisory.
Confirm this action.
Leaving now will discard your changes.