CISA orders patch for Ivanti Connect Secure zero‑day after Oct 1 exploitation
The directive follows Volexity’s report of a three‑flaw chain granting root access and notes the flaw’s CVSS 8.6 rating.
zero-day
-
-
Hackers targeted refrigeration units in hundreds of French supermarkets
The attack set temperatures to 50°C and lengthened defrost cycles to up to eight hours, spoiling large quantities of food.
-
National vulnerability database publishes CVE‑2026‑68875, a buffer over‑read affecting the Windows NTFS driver
The flaw allows an authorized local user to run arbitrary code using the rights of that account.
-
Google revises hacker group naming system with two‑part names
John Hultquist, chief analyst at Google Threat Intelligence Group, stated that Google tracks more than 5,000 activity clusters in several countries
-
OWASP names prompt injection top LLM risk for third straight year
The ranking draws on a database of about 10,000 real‑world AI security incidents tracked by OWASP.
-
Project Zero releases emergency patching guidance for large vendors
Project Zero says the guidance describes four emergency patching methods: feature flags, filtering, alternate channels, and hotpatching.
-
Microsoft discloses Windows Media Foundation buffer overflow CVE-2026-62744
The unauthenticated flaw allows arbitrary code execution when a user opens, previews, or loads a streamed malicious media file, requiring no credentials.
-
Teen Leader of ShinyHunters Detained, Cooperating with FBI
Dutch police arrested alleged ShinyHunters member Pepijn van der Stap, known as "Umbreon," on September 15, 2026, as part of the same investigation.
-
Dutch police arrest alleged ShinyHunters leader amid global cybercrime investigation
The arrest follows a February 2026 social‑engineering breach of Dutch telecom Odido that exposed over 6.2 million customer records.
-
FBI arrests another ShinyHunters suspect after jobs portal breach
Patel said the arrest ties to the FBIjobs.gov breach that exposed agents' personal data.
-
Atlassian discloses critical flaw exploited within hours; Let’s Encrypt cuts TLS lifetime
The Hacker News noted that Atlassian disclosed CVE-2026-21589, a critical flaw in Data Center products exploited within two hours of technical details being released.
-
Attackers hijack Danfoss fridge controllers, raise temps in French supermarkets
Sources reported that the defrost manipulation heated refrigeration units to 50°C, spoiling frozen and fresh food.