Spanish police arrested a 16-year-old suspected of running the KillSec ransomware group as investigators took its leak site, five servers and at least 110TB of stolen data. Three suspects were arrested and a fourth, the alleged developer, has been identified.
Atlassian disclosed a critical file-read flaw in eight self-hosted products on Monday. On Tuesday a research firm explained how it turns into Jira administrator access in some setups, and honeypots saw attacks within two hours.
Federal agencies had until 30 September to put Citrix's fix on their NetScaler gateways. By Friday the fixed build was crashing under a new attack. Citrix has now patched its third exploited NetScaler zero-day in a week, and CISA wants it in by Wednesday, with a forensic check, for a flaw Citrix describes as a denial-of-service bug.
A flaw that Anthropic's Mythos model found in an open-source file server was patched 80 days before anyone was seen exploiting it. The attacks began the day after the researchers who found it published how the model had worked the exploit out, step by step.
Cisco says attackers are using a flaw in Catalyst SD-WAN Manager that lets a request with no login act as the admin user. CISA added it to its exploited list on Wednesday with a Saturday deadline. It is the ninth Cisco SD-WAN entry the catalogue has taken in 2026, and the seventh to name the Manager.
Apple patched an actively exploited CoreGraphics flaw on Monday in iOS 26.7.1 and two older macOS lines. Its own note says the attacks it knows of hit versions of iOS before iOS 27. The CVE does not appear in iOS 27's security notes, and CISA has given federal agencies until Friday.
ShinyHunters says it broke into the FBI's jobs portal with an unknown PeopleSoft flaw. The PeopleSoft flaw it is known to use has been on the federal must-patch list since 12 June, with a deadline three days later. Either answer is awkward, and the FBI has not yet said whose server it was.
Google says its model reached three real companies during a security evaluation in May, stopped on its own, and did not need to be disclosed. It disclosed on Friday anyway.
A small team used a newly released frontier model to reach OpenAI's internal code repository, proved it with a harmless pull request, and got paid a bug bounty. The price is the story.
Japan's Digital Agency lost about 246,000 records of personal data through a remote access device. The vulnerability was rated medium and was not new.
Revolut says an impersonator used a legitimate government email domain to file fraudulent data requests. The control that fails here is one almost every institution relies on.
The models that make headlines by breaking out may be the least capable ones. The strategy worth fearing is the one that never gets noticed at all.
A third misuse report describes blocked attempts at cyberattacks, surveillance and biological research, and argues the capability floor for serious attacks has dropped.
Nearly 1.44 million documents from two city departments were published after a two-million-euro demand was declined. Refusing a ransom ends the payment, not the exposure.
A record 123 cases in six months, most of them at smaller companies, and the most common way in was the remote access appliance sitting at the edge of the network.