Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 110 stories in 24 hours
Malware & Exploits
Malware, exploited flaws, phishing and botnets, from the researchers who found them.
127stories this week
27today
the last seven days
Most fromThe Hacker News, BleepingComputer, SecurityWeek, Help Net Security
In the news hereMicrosoft8Fortinet6Linux5GitHub5Lazarus2APT411APT29 (Cozy Bear)1Lumma Stealer1
MyCyberWay trainingYou can't patch everything at once. Learn what to fix first.See the Analyst curriculum
-
The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs.
Dark Reading
-
Exploited
Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
The security vendor said it initially discovered a portion of the defect during internal security checks in June, but the company said it didn’t meet the threshold for an out-of-band release.
CyberScoop
-
A . is all you need! Today Microsoft shipped the patch for a vulnerability in Visual Studio Copilot that I reported in August. Microsoft classified it as Important severity Remote Code Execution vulnerability. At the root cause it allows Copilot in Visual Studio or SQL Server Management Studio to bypass a path validation check and…
Embrace The Red
-
Unit 42 dissects a cyberattack targeting a European bank’s IT infrastructure, delivering concrete defense strategies to help organizations detect and counter comparable threats.
Unit 42
-
A critical heap buffer overflow vulnerability (CVE-2026-39919) in the Ghostscript interpreter and rendering engine could allow remote code execution through specially crafted PDF files.
BleepingComputer
-
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker fixed the flaw on September 30 and says it found no evidence that anyone exploited it. The flaw was in the feature that converts a personal account into an…
The Hacker News
-
A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP’s official Python client for BTP services. An attacker must…
The Hacker News
-
Exploited
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to “act immediately.” A fix for the third is still pending, according…
The Hacker News
-
Blog post covering the vulnerabilities disclosed during Microsoft Patch Tuesday.
Cisco Talos
-
Anthropic’s latest study combined IoT and network tests to explore AI self-replication, which researchers said would be “challenging” to shut down.
Dark Reading
-
Today is Microsoft’s October 2026 Patch Tuesday, with security updates addressing a record-breaking 1,411 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.
BleepingComputer
-
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today&#;x26;#;39;s patch Tuesday, and one is already exploited.
SANS Internet Storm Center
