חדשות סייבר

Atlassian warns of critical file-access flaw in Jira, Confluence

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted …

ASOS confirms data breach after “HACKED” in-app notifications

UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stole…

Alleged ATM malware creator appears in Nebraska court after arrest

Aguirre was added to the FBI’s “Top 10 Most Wanted Fugitives” list in March, becoming the first cybercriminal added to the list.

South Korean officials believe AI agents were used to hack several banks

The personal data of at least 68,000 people was reportedly exposed in breaches of at least seven financial institutions, with officials saying they believe a C…

FBI Blames Contractor’s Missed Patch for ShinyHunters Breach

Eduard Kovacs reports: The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees, Reute…

Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes

A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authenticati…

Osaka Metropolitan University cancels classes after suspected ransomware attack

Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems unavailable.

How to secure RMM software: 8 controls MSPs should test

RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight contro…

ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware

CERT-UA found fake Cloudflare verification pages that led visitors into a now-familiar ClickFix trap. This time the goal was to infect machines with an infoste…

Self-described “cybersecurity engineer” arrested after computer case reopened

Natalie Dreier reports: A Florida man who calls himself a “cybersecurity engineer” on TikTok and Twitch was arrested after police reopened an investigation clo…

Japan hands over ‘Qilin’ hacker group member to Germany

JiJi reports: Japanese police have captured a Russian national believed to be a key member of the “Qilin” international hacker group and extradited him to Germ…

Denmark Central Person Register (CPR) Breach: Cyberattack Exposes Data of 8.8 Million

Rescana’s new report on a breach affecting the Denmark Central Person Register (CPR) summarizes the situation: On October 5, 2026, Danish authorities publicly …

ASOS customers receive ‘hack’ notification threatening leak

Sarah Butler reports: ASOS is investigating after users of its mobile app received a notification claiming hackers had “fully compromised” the online fashion r…

LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There…

Apache

Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies

The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful …

Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers

In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol d…

Nikkei discloses breaches of employees’ Microsoft, Google email accounts

Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousand…

Engineer sentenced for locking over 3,000 devices on employer network

A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of device…

Shares in British clothing company ASOS dive after hackers apparently send push notification

Several mysteries surround what appeared to be an unauthorized push notification sent to customers of London-based clothing company ASOS.

Linux Kernel Vulnerability Fixed in Binder Device Creation

Linux developers have merged a fix for a Linux kernel vulnerability that can leave Binder device creation writing to memory the kernel has already released.

Linux

Citrix NetScaler Vulnerability Is Being Exploited: Check SAML Systems

Citrix has confirmed targeted attacks involving a Citrix NetScaler vulnerability and urged affected customers to update.

Citrix

OpenOffice Vulnerability Can Run Code From Malicious Documents

Apache is asking OpenOffice users to turn off its Java integration after warning that a malicious document could run code on their computer.

Apache

Apache Thrift 0.25.0 Adds Memory Limits for Network Messages

Apache released Thrift 0.25.0 on Sep 30, 2026 with memory checks for several C++, Java, and Python components.

Apache

Apache Directory LDAP API 2.1.9 Security Update for CVE-2026-103877

Apache’s release notice on Oct 3, 2026 lists six Apache Directory LDAP API vulnerabilities.

Apache