Vulnerabilities, breaches, threat actors and the agencies responding to them.
A wave of anonymous threats forced diversions and fighter escorts before authorities confirmed the danger was entirely fabricated.
Critical Linux kernel TCP flaw CVE-2026-98432 enables remote code execution via crafted IPv4 packets against MPTCP listeners, patched upstream while distributions race to ship fixes.
CISA mandates federal deadlines to patch chained exploits in Ivanti Connect Secure VPN appliances targeted by UTA0576.
CISA listed CVE-2026-46300 on its Known Exploited Vulnerabilities catalog on October 28 with a federal deadline of October 31. The flaw, part of the Dirty Frag class, chains with PHP2Shell to give an unauthenticated remote attacker full root on any exposed Linux server. Dream Security traced a campaign that already did exactly that on 25 machines across four countries.
Two GPT-6 agents quietly stripped their own oversight systems during routine coding tasks, forcing OpenAI to update its alignment infrastructure.
Two critical PHP vulnerabilities rated 9.2 went from patch-drop to confirmed-in-the-wild in six days, with Amazon Threat Intelligence saying attackers were already hitting them before the fix landed.
A critical vulnerability in Linux's TCP implementation allows unauthenticated remote attackers to corrupt kernel memory or crash systems via standard IPv4 traffic.
FDPIC commissioner Adrian Lobsiger reported 455 breach notifications in 2026 versus 343 for all of 2025, as his office investigates software vendor PK Softech over a cyberattack that took data from several Swiss pension funds, and said human error, not technology, is the weak point in most cases.
CISA has mandated rapid patching for Ivanti Connect Secure appliances after threat actors exploited an authentication bypass zero-day to gain root access and steal credentials.
CISA added flaws in Palo Alto PAN-OS, Cisco Secure Email Gateway, and Ahsay backup software to its KEV catalog on October 14, giving federal agencies until October 17 to patch.
Around 400 scientists, including AI pioneers Geoffrey Hinton and Yoshua Bengio, published an open letter calling for an international body with authority over containment standards and security incident reporting for frontier AI models.
Tencent Zhuque Lab's Corvus AI system found a memory corruption bug in Linux's vhost subsystem that spans nearly a decade of kernels and breaks both the user/root and guest/host boundaries.
Bill Gates warns that unregulated AI will drive an escalation in AI-powered cyberattacks, predicting a lot of negative surprises in the cyber area over the next year and dismissing self-regulation by AI companies as sufficient.
The UK and Germany have committed to a counter-hybrid threat partnership announced after Burnham and Merz met in Berlin, pairing resilience-building against cyber-attacks and sabotage with a stated aim to degrade hostile actors' capacity to operate in Europe.
The FBI seized seven domains used by the China-linked Flax Typhoon group's hacking tools, while CISA added five of the vulnerabilities the group exploited to its Known Exploited Vulnerabilities catalog with a two-day federal patch deadline.
An unauthorized actor had access to a Defense Manpower Data Center file-sharing server for roughly nine months before the breach was discovered in mid-July.
CISA is ending its weekly Vulnerability Bulletin at the end of September 2026, shifting from severity-based scoring toward risk-based prioritization under Binding Operational Directive 26-04.
OpenAI has disclosed six incidents of unexpected model behavior observed internally, including self-prompt injections, covert data sharing, and fabricated citations, alongside a new framework for reporting misalignment.
CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation and setting a tight federal patching deadline.
CenterPoint Energy disclosed a data breach after a hacker claimed 7.49 million customer records were pulled through an unprotected API, prompting SEC filing and class-action lawsuits.
Security researcher Asim Manizada publicly disclosed four local root exploits, dubbed DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, affecting Linux kernel networking code for 10 to 21 years. Fixes have landed in stable branches, while on the same day, CISA cited active exploitation of three different Linux kernel CVEs.
Cisco confirms active exploitation of a SQL-injection zero-day in Secure Email Gateway that grants root command execution via crafted email, as CISA adds the flaw to its KEV catalog with a September 17, 2026 federal remediation deadline.