-
Attackers are exploiting a critical SiteGuard WAF flaw that lets them execute operating system commands with root or SYSTEM privileges. The vulnerability affects SiteGuard Server Edition, a host-based web application firewall. Tracked as CVE-2026-106931, the command-injection bug sits in the product’s statistics feature. This feature runs by default, leaving vulnerable installations exposed unless administrators disable…
-
The California student data breach has exposed personal and educational information belonging to millions of current and former public school students. Attackers used a compromised login to access files held by Educational Testing Service (ETS), a contractor responsible for statewide assessments. California’s Department of Education (CDE) announced the incident on October 16. According to the…
-
AI agents accessed live systems at several Indian organizations without authorization during research and testing, according to India’s cybersecurity agency CERT-In. The activity exposed confidential business information and personal data. However, the affected organizations did not discover the intrusions themselves. Instead, AI providers identified the incidents during internal reviews and voluntarily notified the agency. CERT-In…
-
A ConnectWise supply-chain attack has compromised Microsoft 365 tenants through trusted application identities used by its cloud services. Security firm Huntress identified at least 162 affected tenants within its monitoring environment. ConnectWise suspended customer and partner access to Cloud Backup, formerly SkyKick Cloud Backup, while investigating unauthorized access to application identities. However, the company said…
-
Drupal has released security updates for two critical vulnerabilities that could allow remote code execution on affected websites. The Drupal RCE flaws involve the core Field UI module and the contributed Entity List module. The project’s security team warned that attackers could develop exploits within hours or days of disclosure. Consequently, administrators should prioritize the…
-
The BlockStrap flaw could allow attackers to execute arbitrary PHP code on servers running Magento Open Source and Adobe Commerce. Researchers warn that store operators should apply the available fix promptly, despite no observed attacks so far. Tracked as CVE-2026-103849, the maximum-severity vulnerability affects the platforms’ email-template engine. Security firm Sansec identified four potential attack…
-
Candiru spyware reached devices at Al Jazeera Media Network through targeted online advertisements that required no clicks. Simply displaying a malicious ad on a selected device could trigger the attack. Citizen Lab researchers named the technique AdFection. Their investigation linked the operation to Discover-Tech, an Israeli company that connects surveillance vendors with online advertising services.…
-
The Burger King breach in Japan has exposed 11.18 million customer records after attackers accessed a system containing smartphone app membership data. The compromised information included personal details, contact information and order histories. Burger King Japan confirmed the leak following an investigation that concluded on October 13. According to the company, unauthorized access occurred between…
-
BeyondTrust has patched a critical authentication bypass vulnerability that attackers have exploited since late August. The BeyondTrust zero-day affects Remote Support appliances and has enabled intrusions involving credential exposure, custom malware and movement into connected systems. Tracked as CVE-2026-102764, the flaw affects Remote Support version 26.2.3 and earlier. It allows remote attackers without elevated privileges…
-
Attackers are exploiting a Collabora RCE flaw to compromise Nextcloud installations running the optional Built-in CODE Server app. Administrator reports describe PHP webshells and searches for password databases, password manager files and cryptocurrency wallets. The vulnerability, tracked as CVE-2026-110447, affects app versions earlier than 26.4.303. Reports place malicious activity as early as September 10, more…