Breaches, zero-days, ransomware and the patches that matter, free by email.
Citizen Lab says Israeli ad-tech firm Discover-Tech bought placements on mainstream ad exchanges to deliver Candiru spyware in zero-click attacks, with at least 45 Al Jazeera devices targeted in 2024-2025. Google and IAB Europe have since removed the firm.
A cybersecurity incident at BAE Systems, which runs the federal judiciary's Bankruptcy Noticing Center, has stopped the production and distribution of bankruptcy notices and taken four uscourts.gov services offline, with no restoration timeline yet.
An unauthorized party used a compromised credential to copy California student records from an ETS-run SFTP site between May and September 2026; the state began notifying families Oct. 16 and is offering two years of Experian IdentityWorks.
EG Secure Solutions and JPCERT/CC confirm in-the-wild exploitation of CVE-2026-106931, an OS command injection in SiteGuard Server Edition's default-on statistics feature that runs commands as root or SYSTEM. Fixed builds are 8.00 Update 5 and 7.00 Update 6.
CISA added Fortinet's CVE-2025-61624 to its KEV catalog with an Oct 19 deadline and a forensic-triage requirement, as Palo Alto Networks links the flaw to a long-running telecom intrusion using a memory-resident FortiGate implant it calls PeerStitch.
BeyondTrust has patched CVE-2026-102764, a Remote Support authentication bypass that Mandiant says has been exploited since Aug. 29 by Armory Castle (formerly UNC5221). CISA's KEV deadline for federal agencies is Oct. 19.
Anne Arundel County, Md., says an unauthorized actor got into a limited number of systems in August and copied files. The Rhysida gang claimed the attack and says it wants $2 million, but the county won't comment on what data the group says it took.
Microsoft says the October 2026 Windows Server updates can stall on-prem Exchange 2016, 2019 and Subscription Edition: OWA sign-in fails, mail stays in Outboxes and queues grow, because of a new Endpoint Mapper cap. The fix for now is a registry change, not removing the update.
Drupal fixed a critical remote code execution flaw in core's Field UI module (CVE-2026-108097, SA-CORE-2026-014) and a related Entity List bug, warned that exploits may appear within hours or days, and urged sites to update to 10.6.19, 11.3.19 or 11.4.10.
A joint FBI-CISA alert, I-101626-PSA, warns election officials, candidates and political groups that phishing, smishing and deepfake impersonation aimed at stealing credentials are rising before the 2026 midterms. It urges phishing-resistant MFA first.
CyberSN counted 235,786 US cybersecurity job postings from January to September 2026, down 26.4% from a year earlier and a four-year low, while AI security engineer postings rose 268.3% and GRC roles grew their share to 14.8%.
Thoma Bravo-owned Proofpoint has agreed to buy Varonis for about $6.3 billion in cash, or $49.75 per share. The deal is expected to close in the first half of 2027, pending Varonis shareholder and regulatory approvals.
Free. We email you when we publish — breaches, actively exploited bugs, ransomware, and policy.
Free daily briefing — breaches, actively exploited bugs, ransomware, and the patches to prioritize.
You're in. ✓
Check your inbox to confirm your subscription.No spam. Unsubscribe any time. Read our privacy policy.
