News — Cybersecurity News | CyberSecureToday

45 articlesUpdated 23 Oct 2026

NewsCloud & SaaS

Meta Ordered to Pay $25 Billion After New Mexico Court Finds Consumer Privacy Deceptions

A New Mexico state court orders Meta to pay $25 billion for 43 million deceptive trade violations stemming from the Cambridge Analytica data-harvesting scandal.

23 Oct 202610 min read

Daniel Okafor

NewsBanking & Fintech
Singapore PDPC Enforces Enhanced 10% Turnover Penalty Regime Following Marina Bay Sands and SaaS Data Breaches
Singapore's PDPC levies major penalties on Marina Bay Sands and SaaS vendors, rejecting financial hardship defenses under the enhanced 10% turnover statutory fine framework.
Tom Verhoeven21 Oct 202613 min read
NewsIndustrial & OTCritical
Yokogawa CENTUM VP Operator Station Flaw Enables Code Execution via Graphics Macros
Yokogawa Electric releases critical patches for CENTUM VP Human Interface Station software addressing a remote code execution vulnerability in graphics macros.
CST Editorial Desk13 Oct 20268 min read
NewsCloud & SaaSHigh
Google Cloud Armor Flaw Allowed WAF Bypass via HTTP/3 Stream Desynchronization
Google patches a high-severity desynchronization flaw in Cloud Armor edge proxies that allowed attackers to smuggle malicious HTTP/3 payloads past WAF rules.
Priya Raman13 Oct 20268 min read
NewsIndustrial & OTHigh
Siemens SIMATIC S7-1500 PLC Vulnerability Enables Unauthenticated PROFINET DCP Network Parameter Tampering (CVE-2026-79880)
Siemens issues urgent firmware updates for SIMATIC S7-1500 industrial controllers to remediate an unauthenticated PROFINET DCP configuration tampering vulnerability.
CST Editorial Desk13 Oct 20268 min read
NewsIndustrial & OTCritical
ABB System 800xA Flaw Allows Recipe Injection in Chemical and Pharma Plants
ABB releases emergency advisories for System 800xA Batch Management software after researchers uncover an unauthenticated recipe injection vulnerability.
CST Editorial Desk13 Oct 20268 min read
NewsCloud & SaaSCritical
AWS IAM Identity Center SAML Canonicalization Flaw Enables Cross-Account Administrative Role Assumption (CVE-2026-78520)
AWS patches a critical vulnerability in IAM Identity Center (CVE-2026-78520) allowing manipulated SAML XML comments to bypass role assignment boundaries.
CST Editorial Desk13 Oct 20268 min read
NewsIndustrial & OTCritical
GE Vernova Mark VIe Flaw Allows Unauthenticated Packet Injection and Turbine Trips
GE Vernova issues an emergency advisory for Mark VIe DCS controllers (CVE-2026-79220, CVSS 9.6) resolving an unauthenticated Ethernet Global Data injection defect.
CST Editorial Desk13 Oct 20268 min read
NewsCloud & SaaSCritical
vLLM Multi-LoRA Serving Engine Flaw Enables Cross-Tenant Adapter Memory Extraction and Model Poisoning (CVE-2026-78430)
vLLM patches a high-severity vulnerability (CVE-2026-78430) in multi-LoRA serving allowing concurrent tenants to extract proprietary adapter weights from GPU memory.
CST Editorial Desk13 Oct 20268 min read
NewsIndustrial & OTCritical
Honeywell MasterLogic-200 PLC Ethernet Module Vulnerability Enables Unauthenticated Memory Overwrite and Controller Takeover (CVE-2026-79110)
Honeywell releases emergency firmware for MasterLogic-200 PLCs (CVE-2026-79110, CVSS 9.4) addressing an unauthenticated Ethernet stack buffer overflow.
CST Editorial Desk13 Oct 20268 min read
NewsBanking & Fintech
EU DORA Enforces Mandatory Oversight Framework and Direct Regulatory Audits for Critical Cloud Providers (CTPPs)
European Supervisory Authorities designate Critical ICT Third-Party Providers under DORA, granting regulators direct inspection powers over major cloud hyperscalers.
Priya Raman13 Oct 20268 min read
NewsCloud & SaaSCritical
Hugging Face Text Generation Inference Flaw Enables Rust FFI Memory Corruption and Host Takeover (CVE-2026-78320)
Hugging Face issues an urgent patch for Text Generation Inference (CVE-2026-78320, CVSS 9.3) fixing a critical Rust tokenizer deserialization vulnerability.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Phoenix Contact ILC Inline Modular Controller Vulnerability Enables Unauthenticated PROFINET Protocol Memory Corruption (CVE-2026-78950)
Phoenix Contact issues an emergency advisory for Inline Modular Controllers (CVE-2026-78950, CVSS 9.5) fixing a critical PROFINET stack buffer overflow.
CST Editorial Desk12 Oct 20268 min read
NewsCloud & SaaSCritical
ChromaDB Vector Database Vulnerability Enables Unauthenticated Metadata Filter SQL Injection and Host Takeover (CVE-2026-78110)
ChromaDB patches a critical vulnerability (CVE-2026-78110) in vector metadata filtering that allows unauthenticated remote attackers to execute arbitrary code.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Mitsubishi Electric MELSEC-Q PLC Vulnerability Enables Unauthenticated Memory Corruption via SLMP Protocol Injection (CVE-2026-78820)
Mitsubishi Electric issues an emergency advisory for MELSEC-Q PLCs (CVE-2026-78820, CVSS 9.3) resolving an unauthenticated SLMP protocol injection flaw.
CST Editorial Desk12 Oct 20268 min read
NewsCloud & SaaS
India DPDP Rules 2026: Government Mandates Strict Cross-Border Data Transfer Controls and Independent Algorithmic Audits
India notifies updated DPDP Rules 2026 mandating Significant Data Fiduciaries implement cross-border transfer whitelists and third-party algorithmic audits.
Priya Raman12 Oct 20268 min read
NewsCloud & SaaSCritical
HashiCorp Consul Service Mesh Flaw Enables SPIFFE mTLS Identity Impersonation and Cross-Namespace Access (CVE-2026-77340)
HashiCorp patches a critical flaw in Consul Service Mesh (CVE-2026-77340) allowing forged SPIFFE identity URIs to bypass mTLS intent enforcement.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Schneider Electric Foxboro DCS Flaw Allows Unauthenticated Fieldbus Module Memory Corruption (CVE-2026-77880)
Schneider Electric releases emergency fixes for Foxboro DCS Fieldbus Modules (CVE-2026-77880, CVSS 9.6) resolving a critical memory corruption flaw.
CST Editorial Desk12 Oct 20268 min read
NewsCloud & SaaSCritical
Google Vertex AI Agent Builder Flaw Enables Sandbox Breakout and Token Exfiltration
Google patches a critical breakout flaw in Vertex AI Agent Builder (CVE-2026-76215) allowing recursive tool invocations to escape sandboxes and exfiltrate IAM tokens.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Siemens SIMATIC Energy Manager PRO Flaw Enables Unauthenticated Remote Code Execution
Siemens issues emergency updates for SIMATIC Energy Manager PRO (CVE-2026-76880, CVSS 9.8) resolving an unauthenticated OPC UA deserialization vulnerability.
CST Editorial Desk12 Oct 20268 min read
NewsBanking & Fintech
Reserve Bank of India Issues Directives on Multi-Cloud Concentration Risk and Mandatory Immutable Air-Gapped Vaults
The Reserve Bank of India mandates regulated banking entities deploy multi-cloud architecture and air-gapped cryptographic vaults to prevent concentration risk.
Priya Raman12 Oct 20268 min read
NewsIndustrial & OTCritical
Mitsubishi Electric MELSEC iQ-F PLC Flaw Enables Memory Overwrite and Axis Stoppage
Mitsubishi Electric and CISA disclose advisory for MELSEC iQ-F compact PLCs, patching a critical Modbus RTU communication buffer overflow (CVE-2026-75890).
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Delta Electronics CNC HMI Flaw Allows Remote Unauthenticated G-Code Toolpath Manipulation and Spindle Override (CVE-2026-74810)
Delta Electronics and CISA issue advisory for CNC HMI controllers, patching a critical memory corruption flaw (CVE-2026-74810) allowing remote toolpath tampering.
CST Editorial Desk12 Oct 20268 min read
NewsIndustrial & OTCritical
Honeywell IQ4 BACnet Flaw Allows Unauthenticated Denial of Service and HVAC Override
Honeywell and CISA issue advisory for IQ4 building automation controllers, patching a critical BACnet/IP stack buffer overflow (CVE-2026-73850).
CST Editorial Desk11 Oct 20268 min read