Industry Vertical20 stories tracked

Banking, Financial Services & Fintech

Banks, NBFCs, insurance, payments, lending and capital markets.

3D conceptual illustration of Citrix NetScaler ADC perimeter gateway chassis experiencing memory buffer overflow denial-of-service alert with glowing crimson traffic streams

High

ThreatsTechnology, Cloud & SaaS

Citrix NetScaler Gateway Memory Buffer Overflow Added to CISA Known Exploited Catalog

CISA issued a binding directive on CVE-2026-8452, a high-severity memory buffer vulnerability in Citrix NetScaler ADC and Gateway appliances triggering perimeter denial of service.

14 Sept 20267 min read

Priya Raman

ThreatsTechnology, Cloud & SaaSCritical
CISA Mandates Remediation for ownCloud Improper Authentication Flaw Under Active Exploitation
Federal agencies face urgent remediation deadlines as CISA confirms active exploitation of CVE-2023-49105, allowing attackers to access and delete cloud storage files without credentials.
Aisha Noor14 Sept 20267 min read
IndustryGovernment & DefenceHigh
CISA Finalizes CIRCIA Mandate: 72-Hour Incident and 24-Hour Ransomware Reporting Enforced
CISA issued its landmark final rule under CIRCIA, legally mandating critical infrastructure operators report major cyber incidents within 72 hours and ransom payments within 24 hours.
Tom Verhoeven14 Sept 20268 min read
NewsBanking & FintechHigh
CERT-In Warns of Massive Android Smishing Campaign Masquerading as Traffic E-Challans
CERT-In issued advisory CIAD-2026-0038 warning against an aggressive smishing blitz delivering trojanized APKs disguised as official Parivahan traffic e-challan notices.
Mei-Lin Chen14 Sept 20267 min read
ThreatsTechnology, Cloud & SaaSBreaking
Citrix NetScaler CVSS 9.3 authentication bypass CVE-2026-19490 under active in-the-wild exploitation
CISA and threat researchers warn that CVE-2026-19490 in Citrix NetScaler ADC and Gateway is under active exploitation, granting unauthenticated access to perimeter gateways.
Daniel Okafor14 Sept 20266 min read
ThreatsTechnology, Cloud & SaaSBreaking
Microsoft traces passkey-themed lures to persistent Microsoft 365 cloud compromise
Microsoft says attackers are using passkey and SSO update pretexts to capture sessions, add MFA methods and collect Microsoft 365 data.
Aisha Noor13 Sept 20266 min read
InsightsBanking & FintechBreaking
RBI drafts a time-bound debit-hold SOP for suspected money-mule accounts
RBI’s draft KYC amendment proposes a time-bound process for temporary debit holds on suspected money-mule accounts linked to cyber-enabled fraud.
Tom Verhoeven12 Sept 20266 min read
NewsBanking & FintechHigh
StreamRAT Android banking trojan targeted 570,000 European users through deceptive Meta streaming ads
ThreatFabric uncovers StreamRAT, a sophisticated Android banking trojan promoted via fraudulent Meta TV streaming ads, hijacking Accessibility services to drain accounts.
Aisha Noor12 Sept 20265 min read
InsightsTechnology, Cloud & SaaSMedium
Entra ID's February 2027 Sign-In Block: A Dated Migration Plan for the Accounts That Will Break
Microsoft retires SMS and voice MFA on 1 February 2027 with a blocking passkey prompt and no opt-out. Here is a dated plan for service accounts, break-glass and phoneless users.
Aisha Noor11 Sept 20266 min read
GuidesGovernment & DefenceMedium
CERT-In's six-hour clock meets DPDP: one intake process, two notification deadlines
India's six-hour CERT-In reporting clock has run since June 2022. From May 2027 a second DPDP clock starts on the same incident. Build one intake process now.
Tom Verhoeven11 Sept 20266 min read
ThreatsBanking & FintechHigh
Gigabud Android Banking Trojan Abuses Work Profiles to Evade Client-Side Detection
Group-IB uncovered a major evolution in the Gigabud banking trojan, which uses Android enterprise Work Profiles to isolate tampered banking apps and blind client security checks.
Mei-Lin Chen10 Sept 20265 min read
InsightsTechnology, Cloud & SaaSHigh
The agentic AI security gap: 83% are deploying, 29% feel ready
Prompt injection is now OWASP’s top LLM risk with reported success rates of 50–84%. Organisations are shipping agents into production well ahead of their controls.
Priya Raman10 Sept 20268 min read
ThreatsTechnology, Cloud & SaaSCritical
SAP OVERPASS: CVSS 10.0 Kernel Flaw Enables Pre-Auth Remote Code Execution
SAP and Onapsis disclosed OVERPASS (CVE-2026-44756), a maximum-severity kernel flaw in Extended Passport processing enabling unauthenticated root RCE on enterprise ERP hosts.
Priya Raman9 Sept 20266 min read
InsightsTechnology, Cloud & SaaSHigh
88% Had an AI Agent Incident. 82% Believe Their Policy Covers It.
Gravitee says 88% of organisations had a confirmed or suspected AI agent incident, while 82% of executives trust their policy. Both figures, one population.
Priya Raman9 Sept 20266 min read
ThreatsBanking & FintechHigh
Slim Spider Targets Brazilian Instant Payments (Pix) and Crypto Custody Infrastructure
CrowdStrike revealed Slim Spider, a financially motivated cybercrime group abusing cloud IMDS credentials to penetrate Brazilian instant payment (Pix) and crypto custody systems.
Daniel Okafor8 Sept 20266 min read
NewsCrypto & Web3Critical
Liquid Network Elements Protocol Exploit Triggers 4,000 BTC Sidechain Drain
A vulnerability in the Elements sidechain protocol led to an unauthorized 4,000 BTC withdrawal from the Liquid Federation multi-sig peg, prompting an emergency network freeze and partial fund recovery.
CST Newsroom7 Sept 20266 min read
InsightsTechnology, Cloud & SaaS
MFA failed in 84% of incident responses. The problem is the session, not the factor
With 99% of SaaS compromises originating at the identity provider, MFA is no longer the control organisations think they bought. Here is what changed.
Aisha Noor6 Sept 20267 min read
ThreatsBanking & FintechHigh
Infostealers harvested 1.7 billion credentials in six months as Vidar and Lumma dominate
Researchers logged 7.4 million infected devices between January and June 2026 — a 27% jump — as the infostealer market matured into a fully automated criminal supply chain.
Mei-Lin Chen3 Sept 20267 min read
InsightsBanking & Fintech
The SEC’s four-day disclosure clock in practice: materiality is the hard part
Public companies must disclose material cyber incidents within four business days. The deadline is simple; deciding what counts as material is not.
Tom Verhoeven3 Sept 20266 min read
ThreatsBanking & FintechHigh
One AiTM phishing campaign compromised 35,000 users across 13,000 organisations in three days
Adversary-in-the-middle phishing now defeats standard MFA at industrial scale. Microsoft tracked a single April 2026 campaign spanning 26 countries in 72 hours.
Aisha Noor2 Sept 20267 min read