Cybersecurity News
Stay informed about the latest cybersecurity incidents, vulnerabilities, and threat landscape changes. We cover data breaches, ransomware campaigns, critical CVEs, and regulatory updates – with context on what it means for you and how to protect yourself.
FortiSandbox GUI authentication bypass vulnerability: what is known and what actions to take
Fortinet has published security advisory FG-IR-26-185 describing an authentication bypass vulnerability in the FortiSandbox web management interface. The vulnerability has ...
Critical CVE-2026-97229 vulnerability in GitLab CE/EE allows unauthenticated code execution on the server
GitLab has released emergency updates to address CVE-2026-97229, a critical vulnerability with the maximum score of 10.0 on the CVSS ...
New critical SonicWall SMA 1000 vulnerability — the third this year, with signs of exploitation after patch release
A critical vulnerability CVE-2026-102255 — unauthenticated server-side request forgery (SSRF) — has been discovered in SonicWall SMA 1000 appliances. According ...
Anthropic warns about the risk of self-propagating AI worms targeting IoT devices
Anthropic has published a study describing a scenario for the emergence of self-propagating AI worms—small models capable of autonomously infecting ...
Key cybersecurity events of the first week of October 2026: arrests, vulnerabilities and new attack techniques
The first week of October 2026 was marked by several significant events: a third arrest in the ShinyHunters case, the ...
Critical vulnerability in SAP Cloud SDK for Python enables interception of OAuth2 credentials
SAP has disclosed a critical vulnerability CVE-2026-89111 with the maximum score of CVSS 10.0 in its Cloud SDK for Python, ...
Critical Cisco Catalyst SD-WAN Manager vulnerability is being actively exploited — CISA requires patching by October 3
On September 30, 2026, CISA added critical vulnerability CVE-2026-76504 in Cisco Catalyst SD-WAN Manager (vManage) to the Known Exploited Vulnerabilities ...
CVE-2026-86950: a public PoC appeared after Apple’s patch — what is known about the delivery vector via WhatsApp
On September 30, 2026, researchers from Calif published the first public proof-of-concept for the CVE-2026-86950 vulnerability — an out-of-bounds write ...
How Integrity Technology Group sold access to stolen Microsoft 365 and Exchange email
Since 2021, the China-linked company Integrity Technology Group, sanctioned by the US and the UK, has been systematically hacking the ...
Spike in personal data breaches in Japan due to attacks on APIs and Metabase
From July to September 2026, Japanese organizations faced a sharp increase in personal data breaches via web systems: according to ...
