Category: Cyber Security
-
An Interpol child abuse operation involving authorities in 17 countries has led to 95 arrests and the rescue of a five-year-old child in Colombia. Investigators targeted networks producing, sharing and selling child sexual abuse material online. The coordinated effort brought together four parallel investigations between March and September 2026. During that period, authorities executed 127…
-
Apple has updated its App Review Guidelines to explicitly prohibit apps that generate sexually explicit images of real people without consent. The Apple nudification app ban clarifies how the company’s existing restrictions apply to AI tools that digitally remove clothing. The App Store has long prohibited pornographic material. However, the revised wording directly addresses non-consensual…
-
Microsoft has confirmed that October 2026 Windows Server security updates can cause Exchange email issues on some on-premises systems. The problems include failed webmail sign-ins, undelivered messages and difficulties accessing mailboxes during replication. The issue affects Exchange deployments running on Windows Server 2019 and later. However, its severity depends on server workload, and some installations…
-
Attackers are exploiting a critical SiteGuard WAF flaw that lets them execute operating system commands with root or SYSTEM privileges. The vulnerability affects SiteGuard Server Edition, a host-based web application firewall. Tracked as CVE-2026-106931, the command-injection bug sits in the product’s statistics feature. This feature runs by default, leaving vulnerable installations exposed unless administrators disable…
-
A ConnectWise supply-chain attack has compromised Microsoft 365 tenants through trusted application identities used by its cloud services. Security firm Huntress identified at least 162 affected tenants within its monitoring environment. ConnectWise suspended customer and partner access to Cloud Backup, formerly SkyKick Cloud Backup, while investigating unauthorized access to application identities. However, the company said…
-
Drupal has released security updates for two critical vulnerabilities that could allow remote code execution on affected websites. The Drupal RCE flaws involve the core Field UI module and the contributed Entity List module. The project’s security team warned that attackers could develop exploits within hours or days of disclosure. Consequently, administrators should prioritize the…
-
The BlockStrap flaw could allow attackers to execute arbitrary PHP code on servers running Magento Open Source and Adobe Commerce. Researchers warn that store operators should apply the available fix promptly, despite no observed attacks so far. Tracked as CVE-2026-103849, the maximum-severity vulnerability affects the platforms’ email-template engine. Security firm Sansec identified four potential attack…
-
Candiru spyware reached devices at Al Jazeera Media Network through targeted online advertisements that required no clicks. Simply displaying a malicious ad on a selected device could trigger the attack. Citizen Lab researchers named the technique AdFection. Their investigation linked the operation to Discover-Tech, an Israeli company that connects surveillance vendors with online advertising services.…
-
BeyondTrust has patched a critical authentication bypass vulnerability that attackers have exploited since late August. The BeyondTrust zero-day affects Remote Support appliances and has enabled intrusions involving credential exposure, custom malware and movement into connected systems. Tracked as CVE-2026-102764, the flaw affects Remote Support version 26.2.3 and earlier. It allows remote attackers without elevated privileges…
-
Attackers are exploiting a Collabora RCE flaw to compromise Nextcloud installations running the optional Built-in CODE Server app. Administrator reports describe PHP webshells and searches for password databases, password manager files and cryptocurrency wallets. The vulnerability, tracked as CVE-2026-110447, affects app versions earlier than 26.4.303. Reports place malicious activity as early as September 10, more…