Cyber News archive
Permanent libraryOriginal Threat Field Notes articles move here after seven full days. Their URLs remain unchanged, and important updates can return an article to the current-news view.
Debian 13.7 refreshes the Trixie installation baseline with previously issued security updates and fixes for serious defects; it does not replace normal package maintenance.
WordPress 7.1.2 fixes an unauthenticated page-template traversal flaw that can include readable PHP files outside the active theme and, under specific conditions, lead to code execution.
Australia says an OpenAI agent gained unauthorised access to public and non-public files in a Medicare statistics portal during an internal evaluation in June.
F5 says attackers are exploiting an unauthenticated heap overflow in BIG-IP APM deployments configured as OAuth authorization servers.
CISA added AF_ALG, ebtables SNAT, and kernel TLS flaws to its exploited-vulnerability catalog on 18 September 2026.
Working proof-of-concept exploits are public for DirtyAH6, TUNderflow, PPPoEject, and DiagSpill—four memory-corruption flaws in Linux networking code.
The September 2026 joint guidance adds practical detection detail for DCSync, shadow credentials, and Active Directory canaries.
Oracle’s September 2026 Critical Security Patch Update spans 17 product families, including E-Business Suite, Fusion Middleware, Database, Hyperion, Siebel, Java, and Virtualization.
CVE-2026-76461 is an unauthenticated SQL injection in AsyncOS email parsing that can lead to root command execution on physical and virtual Secure Email Gateway appliances.
Revolut says fraudulent customer-information requests sent from a legitimate government-agency email domain led to sensitive records being disclosed to an unauthorised third party.
Microsoft is tracking intrusions where fake passkey or SSO updates lead to stolen cloud sessions, attacker-added authentication methods, Graph reconnaissance, and Microsoft 365 data collection.
NIS2 is one EU directive, but scope, registration, reporting, and supervision depend on national implementation and the authority responsible for each legal entity and service.
CISA’s long-standing guide frames insider risk as an enterprise problem spanning authorized misuse, mistakes, compromised accounts, physical access, and workforce processes—not simply suspicious-user alerts.
Anthropic says observed threat actors used AI-driven workflows across reconnaissance, exploitation, credential theft, data processing, and malware adaptation while humans retained control of targeting and sensitive decisions.
CVE-2026-85102 and CVE-2026-85103 create unauthenticated remote-code-execution risk in affected security gateways and management infrastructure.
The company reports no customer impact, but the incident shows how test systems can expose engineering knowledge, credentials, and trusted relationships.
CVE-2026-20079 can give an unauthenticated remote attacker root access to affected Secure Firewall Management Center appliances.