Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

Search Subscribe

Archive

Latest coverage, page 2

Everything we've published, newest first, across threats, news, research, analysis and guides.

324 articlesUpdated 28 Sep 2026Page 2 of 14

ThreatsCloud & SaaSHigh
Critical AWS Transform MCP Server Path Traversal Flaw Enables Arbitrary File Overwrites in Agent Workflows CVE-2026-18953
AWS Security Bulletin 2026-075-AWS discloses critical path traversal flaw CVE-2026-18953 in aws-transform-mcp-server enabling unauthenticated arbitrary file overwrites.
Daniel Okafor26 Sep 202614 min read
InsightsCloud & SaaS
California SB 446 Enforces Strict 30-Day Data Breach Notification Mandate and Accelerated Attorney General Reporting
California enacts landmark SB 446 establishing a rigid 30-day consumer breach notice clock and mandatory 15-day Attorney General disclosures for enterprise intrusions.
Priya Raman26 Sep 202615 min read
ThreatsCloud & SaaSHigh
Critical AWS pgcollection Type Confusion Flaw Enables Remote Code Execution in PostgreSQL Workloads CVE-2026-96883
AWS Security Bulletin 2026-118-AWS warns of a critical type confusion flaw CVE-2026-96883 in open-source pgcollection enabling RCE in PostgreSQL database hosts.
CST Newsroom26 Sep 202614 min read
InsightsBanking & Fintech
Data Protection Board of India Operationalizes Penalty Framework and Breach Reporting Protocols Under DPDP Rules 2026
The Data Protection Board of India issues operational directives detailing tiered penalties up to ₹250 Crore and mandatory personal data breach notification rules.
Priya Raman26 Sep 202615 min read
ThreatsIndustrial & OTCritical
Critical Eufy Smart Appliance Command Injection Flaw Exposes Facility Networks to Root Compromise CVE-2026-93289
CISA issues advisory ICSA-26-267-02 for critical command injection flaw CVE-2026-93289 in Eufy Omni robotic appliances enabling unauthenticated root code execution.
CST Newsroom26 Sep 202614 min read
ThreatsCloud & SaaSCritical
Critical WordPress Core Template Traversal Flaw Weaponized for Remote Code Execution CVE-2026-87902
WordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Mei-Lin Chen26 Sep 202614 min read
ThreatsCloud & SaaSHigh
Critical MCP-Fetch Tool Flaw Exposes Enterprise Agent Infrastructure to IPv6 SSRF Exploitation CVE-2026-80347
Security researchers disclose CVE-2026-80347 in mcp-fetch, where unbracketed IPv6 parsing allows autonomous AI agents to be manipulated into internal cloud SSRF.
Daniel Okafor26 Sep 202615 min read
ThreatsIndustrial & OT
Schneider Electric SCADAPack RTU Secure Lock Flaw Exposes Oil and Gas Telemetry to Tampering CVE-2026-81861
CISA issues advisory ICSA-26-258-04 warning of credential protection flaw CVE-2026-81861 in Schneider Electric SCADAPack RTUs managing critical pipeline infrastructure.
CST Newsroom26 Sep 202614 min read
ThreatsCloud & SaaSCritical
Critical Microsoft SharePoint SafeControls Bypass Weaponized for Remote Code Execution CVE-2026-65660
Microsoft reclassifies CVE-2026-65660 as an 8.8 CVSS RCE flaw after threat actors bypass SharePoint SafeControls filtering to execute arbitrary .NET code.
CST Newsroom26 Sep 202614 min read
ThreatsIndustrial & OTCritical
Critical Wärtsilä FOS-Onboard Maritime Navigation Hardcoded Key Flaws Expose Vessel Fleets to Remote Takeover CVE-2026-78225
CISA issues advisory ICSA-26-258-02 for critical hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard, allowing remote attackers to hijack navigation systems.
CST Newsroom26 Sep 202615 min read
ThreatsCloud & SaaSHigh
Critical AWS Amazon Connect Salesforce Integration Flaw Enables IAM Privilege Escalation via Lambda Proxy CVE-2026-94384
AWS Security Bulletin 2026-115-AWS warns of a critical authorization flaw in AmazonConnectSalesforceLambda enabling unprivileged IAM users to execute arbitrary AWS APIs.
CST Newsroom26 Sep 202614 min read
ThreatsCloud & SaaS
Critical MikroTik RouterOS SSH Rekey Workflow Flaw Weaponized with MikroTrick Chain to Hijack Enterprise Routers CVE-2026-67279
Threat actors weaponize MikroTik RouterOS flaw CVE-2026-67279 in the "MikroTrick" chain, bypassing SSH authentication to hijack core routing infrastructure.
Daniel Okafor26 Sep 202618 min read
ThreatsCloud & SaaSHigh
Critical AWS HealthLake MCP Server Flaw Exposes Cloud IAM Credentials and Healthcare Telemetry to SSRF CVE-2026-15643
AWS discloses high-severity SSRF flaw CVE-2026-15643 in the HealthLake MCP server, enabling attackers to leak temporary SigV4 IAM credentials and healthcare FHIR records.
Priya Raman26 Sep 202617 min read
InsightsBanking & Fintech
Reserve Bank of India Mandates Multi-Cloud Exit Architectures and 6-Hour Incident Notification Under IT Outsourcing Master Direction
The Reserve Bank of India enforces comprehensive IT outsourcing directives, mandating multi-cloud exit plans, 6-hour incident disclosure, and strict concentration risk controls.
Mei-Lin Chen26 Sep 202618 min read
ThreatsCloud & SaaSCritical
Critical Dify Cross-Tenant Path Traversal Flaw Enables Unauthorized Access to Internal Plugin APIs CVE-2026-41948
A critical CVSS 9.4 path traversal flaw CVE-2026-41948 in Dify allows unauthenticated attackers to bypass workspace isolation and invoke internal Plugin Daemon APIs.
Priya Raman25 Sep 202617 min read
ThreatsCloud & SaaSCritical
Critical Fortinet FortiPAM Authentication Bypass Flaw Enables Remote Session Hijacking and Traffic Proxying CVE-2026-84388
Fortinet releases emergency fixes for critical CVSS 9.6 flaw CVE-2026-84388 in FortiPAM and its Chrome Extension, allowing remote attackers to hijack administrative sessions.
Daniel Okafor25 Sep 202618 min read
ThreatsIndustrial & OTCritical
Critical Siemens SIMATIC IoT2050 Advanced Gateway Flaw Enables Unauthenticated Remote Code Execution on Industrial OS
CISA and Siemens warn of critical CVSS 9.8 flaw in SIMATIC IoT2050 Advanced (ICSA-26-237-03), enabling remote attackers to execute arbitrary code with root privileges.
Mei-Lin Chen25 Sep 202617 min read
ThreatsCloud & SaaSHigh
Critical Open WebUI TOCTOU DNS Rebinding SSRF Flaw Exposes Cloud Metadata and Internal VPC Services CVE-2026-87996
A critical TOCTOU race condition flaw CVE-2026-87996 in Open WebUI enables attackers to execute DNS rebinding SSRF attacks and harvest cloud metadata and credentials.
Priya Raman25 Sep 202617 min read
NewsCloud & SaaS
Halliburton SEC Form 8-K Item 1.05 Filing Details Critical System Disconnections and Material Blast Radius Across Global Energy Operations
Halliburton files SEC Form 8-K Item 1.05 detailing unauthorized corporate network access that forced critical energy infrastructure systems offline across global operations.
Daniel Okafor25 Sep 202619 min read
InsightsBanking & Fintech
EU DORA Enforcement Framework Mandates 4-Hour ICT Incident Disclosure and Threat-Led Penetration Testing for Financial Entities
European supervisory authorities enforce EU DORA standards, requiring financial institutions to implement 4-hour major ICT incident disclosure and strict third-party cloud oversight.
Mei-Lin Chen25 Sep 202618 min read
ThreatsCloud & SaaSCritical
Critical Microsoft Azure Arc Elevation of Privilege Flaw Allows Unauthenticated Confused Deputy Exploitation Across Hybrid Clusters CVE-2026-69399
Microsoft discloses critical CVSS 10.0 flaw CVE-2026-69399 in Azure Arc, enabling unauthenticated attackers to exploit confused deputy proxies across hybrid cloud nodes.
Daniel Okafor25 Sep 202618 min read
ThreatsCloud & SaaSHigh
Critical Ollama GGUF Model Parser Integer Overflow Flaw Exposes Local AI Inference Servers to Memory Corruption CVE-2026-86289
A critical integer overflow flaw CVE-2026-86289 in the Ollama GGUF model decoder allows attackers to trigger memory corruption and remote code execution on AI inference clusters.
Priya Raman25 Sep 202616 min read
ThreatsIndustrial & OTHigh
Rockwell Automation RSLinx Classic CIP Packet Parsing Flaws Enable Remote Denial of Service Across Industrial SCADA Networks
CISA and Rockwell Automation disclose multiple CIP packet parsing flaws in RSLinx Classic (ICSA-26-244-01), enabling attackers to crash industrial SCADA communication gateways.
Mei-Lin Chen25 Sep 202617 min read
ThreatsCloud & SaaSCritical
Critical Adobe Commerce and Magento Authorization Breakdown Flaw Exploited to Hijack E-Commerce Checkout Workflows CVE-2026-71362
Adobe and CISA warn of active exploitation targeting CVE-2026-71362 in Adobe Commerce and Magento, enabling unauthenticated manipulation of checkout orders and customer data.
Daniel Okafor25 Sep 202617 min read