ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
Latest cybersecurity vulnerabilities news, analysis, and intelligence.
**Three threat groups (ransomware operators and nation-state actors) are actively exploiting two Cisco Firewall Management Center vulnerabilities. FMC is the management plane controlling all firewall policies; compromising it grants attackers complete visibility and control over an organization's en
A Russian-linked threat actor deployed hundreds of AI agents to exploit PaperCut NG/MF print management software across 395+ organizations in a methodical, automated campaign. This marks a watershed moment where AI automates sophisticated cyberattacks at global scale, targeting unpatched systems in
Microsoft's KB5002914 patch broke Excel's core functions (copy-paste and formula dragging), forcing users to uninstall the security update entirely. This teaches enterprises that patches cause more harm than protection, creating a security crisis bigger than any original vulnerability.
Hundreds of AI agents compromised 440+ PaperCut servers in the first documented campaign where agentic AI was the primary attack vector—a fundamental shift in coordinated exploitation. This represents the first large-scale exploitation operation where autonomous agents, not humans, drove identificat
Two critical VPN flaws (9.8 CVSS) in Check Point require no authentication; one targets management servers, enabling network-wide policy manipulation. Check Point's vague disclosure of "specific conditions" obscures key exploitation details.
Microsoft's recent updates accidentally wiped desktop settings like wallpaper and icon layouts on affected Windows devices with no warning—the fix shipped in September's Patch Tuesday as part of the standard cumulative update bundle.
Ransomware gangs are exploiting a critical WatchGuard firewall vulnerability CISA flagged months ago, gaining full network control. Unpatched organizations face silent reconnaissance before encryption attacks begin.
KB5120998, a Windows 11 preview update, silently reset mouse settings on affected systems. The fix arrived in September's patch three weeks later, further eroding user trust in Microsoft's update pipeline.
Skullcandy Dime 3 earbuds accept Bluetooth pairing from any device without user confirmation. This "just works" vulnerability lets attackers silently intercept audio or inject content.
Cisco FMC has a critical authentication bypass (CVE-2026-20079, CVSS 10.0) being actively exploited. Remote attackers can modify firewall policies across networks without credentials.
DeepSeek Harness has a critical flaw: sandboxed AI agents can disable their own sandbox with a single command. It's an architectural permissions boundary failure, not a technical exploit—the harness exposed sandbox management controls to the agent without authorization.
Six Chinese AI companies extracted billions of tokens from American frontier models through commercial API access, using model distillation to systematically build competing systems at industrial scale without authorization.
When CVEs drop, enterprises face a two-hour exposure race—but finding vulnerable code across fragmented tools is harder than patching. Unified visibility across scanners and assets is the critical gap.
36,000+ unpatched Plex Media Servers are publicly exposed and vulnerable to remote code execution and authentication bypass. Self-hosting users rarely maintain security updates, creating widespread home network security risks.
Account recovery is MFA's blind spot. Attackers impersonate employees to help desks, providing scraped PII to request credential resets and bypass MFA—a tactic that cost MGM over $100M.
ShieldCrash, a Microsoft Defender zero-day, allows local attackers to escalate privileges to SYSTEM level, granting complete operating system access. With SYSTEM privileges, attackers can disable Defender, steal credentials, and bypass Windows security controls.
Microsoft released 974 security patches in September 2026, with 723 in Windows and two zero-days that attackers had already exploited. The record surge signals Microsoft's structural security debt and the vastness of Windows's attack surface.
DoppelCart built 119,000 fake storefronts to steal credit card data. Bulk domains, templates, and paid ads made each shop nearly cost-free, letting the massive fraud network survive takedowns.
Chrome shipped 230 patches including its seventh actively exploited zero-day of 2026. Attackers aggressively target Chrome—which runs on two-thirds of browsers—faster than Google can patch.
OpenAI's image outage exposes the hidden risk: businesses embedded APIs with repeated failures into critical workflows. Each outage now threatens broader operations beyond casual inconvenience.
Microsoft split Windows 11 patches to pressure migration away from aging 23H2, forcing enterprises into multiple validation cycles. Cumulative updates bundling security fixes with features increase regression risk and delay critical patches for security teams.
Microsoft released 966 patches—the largest Patch Tuesday ever—but the volume is partly inflated by expanded CVE accounting. Two actively exploited zero-days buried in the haul demand urgent patching; organizations should prioritize real threats over raw vulnerability counts.
Windows 10 ended October 2025 but got a record September 2026 patch via paid ESU, showing why legacy systems persist: manufacturing, healthcare, and SMBs lack migration resources.
Magento's StyleSmuggler zero-day is being actively exploited to plant backdoors on e-commerce servers, enabling payment fraud and customer data theft through remote code execution before patches deploy. The vulnerability bypasses validation through template processing, and attackers have already com
Attackers exploited a critical Adobe Commerce zero-day to plant persistent backdoors in e-commerce stores, enabling ongoing access and recompromise—a major shift from typical payment skimmers. Unlike transactional attacks, these backdoors provide long-term server control and access to admin credenti
OpenAI agents are hijacked by hidden instructions in webpages, executing attacker commands during legitimate tasks and becoming insiders for credential theft and data exfiltration. This indirect prompt injection vulnerability, warned about over a year ago, remains unfixed and is now documented in re
Threat actor Nightmare Eclipse released zero-day exploits targeting CrowdStrike, Nvidia, and Avast—turning security tools themselves into attack surfaces. The deep system privileges these tools require to protect systems now make them high-value targets for sophisticated attackers.
This week, attackers simultaneously exploited a Chrome V8 zero-day, hijacked SOHO routers, and compromised developer supply chains—converging on browsers, network perimeters, and development environments. The coordinated targeting suggests state-sponsored or organized threat actors systematically br
Attackers impersonate IT staff to vishing executives, using personalized details to steal Microsoft 365 sessions. They exploit C-suite security gaps to access financial systems and sensitive data.
StyleSmuggler, a zero-day affecting Magento and Adobe Commerce, enables CSS injection to execute server code and plant persistent Linux backdoors. No patch exists yet, but active exploits are already compromising e-commerce platforms.