Times Car, a Japanese car-sharing service, has confirmed a data breach compromising approximately 6.6 million user accounts. The incident was disclosed late last week, with the exact attack vector and nature of exposed personal information yet to be fully specified. Authorities and the company are reportedly investigating the breach.
The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.
Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.
An unauthorized access incident at France's Direction Générale des Finances Publiques (DGPP) compromised tax data belonging to hundreds of thousands of taxpayers and businesses between June and July 2026. According to a report published by France's national cybersecurity agency ANSSI on 29 September 2026, the attacker used stolen staff passwords to gain entry. The agency stated the attack was 'not sophisticated' and went undetected for seven weeks due to weak security controls. ANSSI noted that neither the tax administration nor the agency itself observed data exfiltration, though the breach resulted in unauthorized access to sensitive fiscal information.
Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.
The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.
Cybersecurity firms report that attackers are exploiting a zero-day vulnerability in Citrix NetScaler to deploy custom web shells and tunneling malware. The exploitation grants root access, enables credential theft, and facilitates lateral movement into internal networks. Citrix has released patches and security advisories addressing CVE-2026-88772.
The FBI has issued warnings to members of the ShinyHunters extortion group, urging them to turn themselves in following the arrest of an alleged leader by Dutch police. The operation marks a coordinated law enforcement effort to disrupt the group's activities.
A vulnerability in Unsloth Studio's model inspection feature has been patched. The flaw allows malicious AI models to execute arbitrary Python code when the trust_remote_code setting is enabled, potentially compromising systems running the inspection tool. The issue has been addressed in a recent update, and users are advised to update to the latest version.
The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-86950 to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability affects Apple Multiple Products and involves an out-of-bounds write flaw. Evidence of active exploitation has been confirmed, prompting CISA to require Federal Civilian Executive Branch agencies to prioritize rapid remediation on publicly exposed assets per Binding Operational Directive 26-04.
Bitget disclosed that an attacker stole approximately $388 million by exploiting a vulnerability in a third-party security product integrated into the exchange's infrastructure. The threat actor used the flaw to obtain high-level internal credentials, which were subsequently used on September 24 to issue fraudulent withdrawal commands to Bitget's wallet system. The exchange confirmed that most user funds remain secure, though the full extent of exposure is under investigation.
Apple has released security updates to address CVE-2026-86950, an out-of-bounds write vulnerability in the CoreGraphics component. The company reports the flaw may have been exploited in targeted attacks against older versions of iOS, iPadOS, and macOS. Successful exploitation could lead to arbitrary code execution in the context of the user. The updates are now available for affected devices.
Microsoft has attributed a series of destructive operations in early June 2026 to the threat actor tracked as JADEPUFFER, also known as Storm-3168. The attackers used compromised service principals to gain elevated privileges and delete Azure resources over a period of approximately 18 hours. Microsoft describes this activity as an evolution of the threat actor's tradecraft, leveraging identity-based attacks rather than traditional exploit chains.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities in Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities (KEV) catalog. The move follows reports of active exploitation in the wild and applies mandatory remediation requirements for U.S. federal agencies. Organizations using unpatched appliances are advised to apply security updates immediately.
A threat actor identified as JadePuffer leveraged exposed credentials to gain unauthorized access to a Microsoft Azure tenant, resulting in the deletion of cloud-based storage, applications, and databases. The attack is described as destructive, though the exact victim organization, volume of data lost, and actor attribution details remain unconfirmed.
Security researchers have observed the JadePuffer ransomware operator conducting agent-driven attacks against Azure cloud tenants. The attacks involve reconnaissance, credential theft, and the destruction of core cloud components. Details regarding the specific use of agentic AI remain reported but unconfirmed.
A browser extension named 'Poper Blocker' available on the Google Chrome Web Store has been identified as spyware that exfiltrates sensitive user data. Despite reports from researchers warning of its malicious nature, the extension maintained Google's seal of approval and was downloaded by millions of users before being removed.
Cleafy researchers have traced nearly 100 deployments of the RatHat Android banking trojan console since April 2026. The console, operated under a malware-as-a-service model, uses Google's Gemini AI to analyze collected data and identify higher-value victims. Infected devices face financial theft and potential exposure of sensitive data.
Security researchers have identified more than 16,000 Supabase-backed applications with publicly accessible databases. The exposure stems from default allow rules that permit unrestricted read access to tables containing personally identifiable information, passwords, and authentication tokens. The findings highlight the risk of misconfigured backend-as-a-service platforms when security defaults are not adjusted for production use.
Dutch authorities have confirmed the arrest of a 24-year-old man from Amsterdam in connection with an investigation targeting the ShinyHunters hacking group. The operation forms part of broader law enforcement efforts to disrupt the threat actor's activities, though specific details regarding the evidence or the suspect's alleged role remain under investigation.
Microsoft has identified a malware family named NeedyMantis being used by threat actors to maintain long-term, unauthorized access to already-breached networks. The malware has been observed in targeted intrusions across a range of sectors, including telecommunications, universities, medical nonprofits, intergovernmental organizations, and government contractors. Activity has been tracked since at least 2023 and remains ongoing.
Security researchers have identified a new botnet campaign, tracked as Carbonato, that repurposes the open-source Hermes Agent AI framework to compromise Docker hosts. The malware leverages exposed container endpoints to execute arbitrary commands through Telegram integration and harvests AI API keys and other sensitive credentials stored on compromised systems.
A high-severity zero-day vulnerability in the TDengine time-series database allows a single malformed packet to crash OT servers, potentially disrupting industrial, IoT, energy, and automotive operations. Details regarding exploitation status and remediation remain limited.
Keio Corporation, a major private railway operator in Japan, confirmed that a ransomware attack over the weekend disrupted some of its business systems. The incident affected operational networks, though the extent of service disruption and any data exfiltration or ransom demand remains unconfirmed.
