Atlassian disclosed a critical file-read flaw in eight self-hosted products on Monday. On Tuesday a research firm explained how it turns into Jira administrator access in some setups, and honeypots saw attacks within two hours.
Anthropic has folded Project Glasswing into a three-tier programme that loosens Claude's cyber safeguards for verified defenders. Every tier comes with the same condition, for now: members must accept data retention so Anthropic can monitor for misuse.
The FBI and Secret Service say the FortiBleed campaign is still running, and that some victims may be locked out of their own firewalls. The advisory lists the account names attackers leave behind.
Oracle learned of the theft of patient data from old Cerner servers in February 2025 and told hospitals that notifying patients was their job. On Friday a filing under Cerner's name appeared on the Texas attorney general's breach list: 2,992,244 Texans, Social Security numbers included, letters sent by mail.
Federal agencies had until 30 September to put Citrix's fix on their NetScaler gateways. By Friday the fixed build was crashing under a new attack. Citrix has now patched its third exploited NetScaler zero-day in a week, and CISA wants it in by Wednesday, with a forensic check, for a flaw Citrix describes as a denial-of-service bug.
Google has stopped taking product vulnerability reports in its open-source reward programme, saying a rise in automated submissions has left most of them invalid. Curl ended its bounty in January for the same reason. Intel dropped its cash rewards last month and has not said why.
Christine Lagarde has named this summer's US-ordered suspension of two Anthropic models as a financial-stability warning for Europe. Nothing broke this time, she said. Her concern is what happens once banks and trading firms depend on those models.
Cisco says attackers are using a flaw in Catalyst SD-WAN Manager that lets a request with no login act as the admin user. CISA added it to its exploited list on Wednesday with a Saturday deadline. It is the ninth Cisco SD-WAN entry the catalogue has taken in 2026, and the seventh to name the Manager.
Apple patched an actively exploited CoreGraphics flaw on Monday in iOS 26.7.1 and two older macOS lines. Its own note says the attacks it knows of hit versions of iOS before iOS 27. The CVE does not appear in iOS 27's security notes, and CISA has given federal agencies until Friday.
Bitget says the $387.5m taken from its hot wallets falls within its user protection fund, and withdrawals began reopening on Monday. The fund is 5,500 bitcoin, not dollars. Below $70,455 it no longer covers the loss, and bitcoin closed below that on 126 of this year's 270 days, most recently on 19 August.
CISA put two actively exploited NetScaler flaws on its must-patch list on Sunday evening, with a Wednesday deadline and a forensic check attached. It is the fourth NetScaler entry in 32 days. The three-day window is new this year, and September has already brought more additions to the catalogue than any other month of 2026.
ShinyHunters says it broke into the FBI's jobs portal with an unknown PeopleSoft flaw. The PeopleSoft flaw it is known to use has been on the federal must-patch list since 12 June, with a deadline three days later. Either answer is awkward, and the FBI has not yet said whose server it was.
Budgets are moving from perimeter tools to identity infrastructure and recovery capability, tracking where the losses actually happen.
Synthetic audio and video have broken trust in familiar channels, and treasury teams are reverting to procedure over recognition.
Machine-generated phishing and reconnaissance are raising attack volume, and security operations are deploying their own automation to keep triage humanly possible.
Managed browsers with built-in policy, logging, and data controls are displacing a stack of security tools, one deployment at a time.
Attestation requirements and liability shifts are turning software provenance from a security topic into a commercial one.
Consortium models and real-time intelligence exchanges are countering scams that exploit the gaps between institutions.
Service accounts, API keys, and agent credentials now outnumber human identities many times over, and governance is racing the growth.
Organizations that rehearsed recovery are turning ransomware from existential events into bad weeks, and insurers are pricing the difference.
Government timetables for retiring vulnerable cryptography have converted a distant threat into a scheduled program with budgets and audits.
CISOs are consolidating dozens of point products onto platforms, trading marginal capability for integration and one renewal fight.
Mandatory disclosure windows are standardizing how fast operators must tell regulators, and readiness has become a drill.