Latest threats →Get the daily brief →

CyberSecureTodayNewsThreatsInsightsCyberSecureToday

Search Subscribe

Archive

Latest coverage, page 4

Everything we've published, newest first, across threats, news, research, analysis and guides.

324 articlesUpdated 28 Sep 2026Page 4 of 14

ThreatsCloud & SaaSCritical
Critical Azure Cosmos DB Downstream Injection Flaw Enabled Cloud Privilege Escalation CVE-2026-87701
Microsoft addresses CVSS 9.6 vulnerability CVE-2026-87701 in Azure Cosmos DB allowing authenticated attackers to execute downstream injection and elevate privileges.
CST Newsroom23 Sep 202615 min read
InsightsBanking & Fintech
RBI Issues Consolidated 2026 Cybersecurity and Technology Resilience Directions for Commercial Banks
The Reserve Bank of India overhauls bank cyber regulations with the 2026 Directions, mandating Board-level accountability, assurance audits, and 6-hour reporting.
Priya Raman23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Critical Check Point Security Management Server Path Traversal Flaw Exploited to Gain Root System Access CVE-2026-93616
Check Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.
CST Newsroom23 Sep 202616 min read
NewsBanking & Fintech
Navient Corporation Files SEC Form 8-K After Third-Party Law Firm Ransomware Exfiltrates Borrower Records
Navient files SEC Form 8-K Item 1.05 after a ransomware attack on an external law firm exposed sensitive student loan borrower PII and Social Security numbers.
CST Newsroom23 Sep 202614 min read
ResearchCloud & SaaS
vLLM Multimodal Special Token Injection Triggers Remote Engine Crash and Service Denial CVE-2026-44222
High-severity flaw CVE-2026-44222 in vLLM allows remote unauthenticated users to crash distributed GPU inference clusters via crafted multimodal tokens.
CST Newsroom23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Critical Arista VeloCloud Orchestrator Zero-Day Exploited to Hijack SD-WAN Edge Gateways CVE-2026-93952
Arista confirms active in-the-wild exploitation of CVSS 10.0 CVE-2026-93952, allowing unauthenticated attackers to hijack on-prem VeloCloud Orchestrators.
CST Newsroom23 Sep 202617 min read
ThreatsCloud & SaaSHigh
Critical OCI Artifact Library Flaw in ORAS-Go Enables Symlink Path Traversal and Supply Chain Compromise CVE-2026-85731
A high-severity CVSS 8.8 path traversal vulnerability in oras-go allows malicious OCI container artifacts to escape extraction roots and execute arbitrary code.
CST Newsroom23 Sep 202616 min read
ThreatsIndustrial & OTCritical
Siemens Siveillance Control Arbitrary File Upload Flaw Grants Unauthenticated Root Access to Physical Security Systems CVE-2026-50093
Siemens patches critical CVSS 9.0 flaw CVE-2026-50093 in Siveillance Control OIS web service, enabling unauthenticated remote attackers to obtain root privileges.
CST Newsroom23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Critical F5 BIG-IP APM Heap Overflow Weaponized to Hijack Enterprise Gateway Data Planes CVE-2026-94127
F5 confirms active zero-day exploitation of CVE-2026-94127, a critical heap buffer overflow in BIG-IP APM OAuth gateways allowing unauthenticated remote code execution.
CST Newsroom23 Sep 202617 min read
NewsHealthcare & Pharma
Nutex Health Discloses Material Cyber Extortion in SEC 8-K Filing Following Patient PHI Exfiltration and Data Leak
Nutex Health files amended SEC Form 8-K Item 1.05 confirming patient PHI and provider records exfiltrated and published following ransomware double extortion.
Priya Raman23 Sep 202615 min read
InsightsBanking & Fintech
India Operationalizes DPDP Enforcement Rules Mandating Significant Data Fiduciary Audits and ₹250 Crore Breach Penalties
India operationalizes DPDP Rules 2026, establishing Data Protection Board inquiries, mandatory resident DPOs, independent audits, and ₹250 Crore breach fines.
Daniel Okafor23 Sep 202616 min read
ThreatsCloud & SaaSCritical
Google Cloud Patches Critical GKE Multi-Cloud Flaw Enabling Cross-Project Cluster Hijack and Service Account Impersonation
Google Cloud remediates critical GCP-2026-058 flaw in GKE Multi-Cloud APIs where missing project checks enabled unauthorized cluster registration and IAM impersonation.
CST Newsroom23 Sep 202616 min read
ThreatsCloud & SaaSHigh
BragJack Prompt Forcing Flaws in Chrome and Edge Allow Malicious Extensions to Seize Agentic Browser Control Planes
Security researchers demonstrate BragJack prompt forcing attacks against Chrome and Edge, hijacking agentic AI control planes to exfiltrate files and spy via camera.
Mei-Lin Chen23 Sep 202617 min read
ThreatsIndustrial & OTHigh
OpenPLC Runtime Stored XSS Flaw Enables Operator Session Hijacking and Unauthorized Physical Process Control CVE-2026-88020
CISA warns of CVE-2026-88020 in OpenPLC Runtime v3 web interface, allowing attackers to hijack operator sessions and manipulate physical industrial processes.
CST Newsroom23 Sep 202615 min read
ThreatsIndustrial & OTHigh
CareCam CM2507 IP Cameras Exposed to Video Stream Interception and Privileged Access Takeover CVE-2026-88259
CISA issues advisory for CareCam CM2507 IP cameras detailing unauthenticated video streaming, empty ONVIF passwords, and hardcoded root hashes risking facility surveillance.
CST Newsroom22 Sep 202615 min read
NewsHealthcare & Pharma
West Pharmaceutical Services Discloses Material Cyberattack and Global Manufacturing Outage in SEC Form 8-K Filing
Injectable drug packaging leader West Pharmaceutical Services files SEC Form 8-K Item 1.05 disclosing data exfiltration and systems encryption halting global manufacturing.
CST Newsroom22 Sep 202616 min read
InsightsGov & Defence
EU NIS2 Directive Enforcement Mandates 24-Hour Incident Reporting and C-Suite Liability Across 18 Critical Sectors
The European Union enacts NIS2 Directive enforcement, establishing mandatory 24-hour incident notifications, personal C-suite liability, and strict supply chain audits.
CST Newsroom22 Sep 202617 min read
ThreatsCloud & SaaSHigh
OpenNext Cloudflare Adapter Flaw Enables Server-Side Request Forgery and Private Cache Disclosure CVE-2026-3125
Cloudflare and OpenNext patch high-severity flaw CVE-2026-3125, where path normalization bypasses allow attackers to trigger SSRF and extract private Next.js cache assets.
CST Newsroom22 Sep 202615 min read
NewsHealthcare & Pharma
iRhythm Holdings Discloses Social Engineering Attack and Patient PHI Extortion in SEC Form 8-K Filing
Digital healthcare firm iRhythm Holdings files SEC Form 8-K Item 1.05 following social engineering compromise of cloud apps and extortion threats over patient cardiac data.
CST Newsroom22 Sep 202616 min read
ThreatsIndustrial & OTHigh
Siemens Teamcenter Authentication Redirect Flaw Exposes Industrial PLM Blueprints to Session Hijacking CVE-2026-58113
Siemens and CISA issue advisory ICSA-26-258-07 for CVE-2026-58113 in Teamcenter PLM, where reflected XSS in authentication redirects allows remote attackers to hijack CAD sessions.
CST Newsroom22 Sep 202615 min read
ThreatsCloud & SaaSHigh
Strands Agents Tools HTTP Request Authorization Flaw Enables Indirect Prompt Injection Credential Theft CVE-2026-18394
AWS resolves high-severity vulnerability CVE-2026-18394 in Strands Agents Tools, where indirect prompt injection forces AI agents to exfiltrate bearer credentials via malicious proxy parameters.
CST Newsroom22 Sep 202615 min read
NewsHealthcare & Pharma
Amgen Discloses Unauthorized Cloud Data Exfiltration and Patient PHI Theft in SEC Form 8-K Filing
Biotechnology giant Amgen files SEC Form 8-K Item 1.05 after unauthorized actors infiltrated third-party cloud environments and exfiltrated sensitive patient PHI and clinical research data.
CST Newsroom22 Sep 202616 min read
InsightsBanking & Fintech
RBI Enforces Stricter Cyber Resilience & 6-Hour Breach Reporting for Banks and Regulated Financial Entities
The Reserve Bank of India mandates accelerated 6-hour incident disclosures, board-level oversight, and strict third-party cloud risk controls across banks and financial institutions.
Priya Raman22 Sep 202617 min read
ThreatsCloud & SaaSHigh
AWS SDK for Go v2 Event Stream Header Decoder Flaw Triggers Remote Denial of Service Panic CVE-2026-89090
AWS patches medium-severity flaw CVE-2026-89090 in AWS SDK for Go v2, where malformed event stream response frames trigger unrecovered runtime panics and service crashes.
CST Newsroom22 Sep 202614 min read