The Swedish Authority for Privacy Protection (IMY) has levied a fine of $183,000 (SEK 1.8 million) against IT systems provider Miljödata following a data breach in August 2025 that exposed the personal information of approximately 2.2 million individuals. The decision underscores the regulator's focus on organizational accountability for data security failures.
Security researchers have identified a vulnerability in external Multi-Factor Authentication (MFA) provider integrations that allows threat actors with privileged access to register rogue MFA services. These rogue providers can intercept and steal user passwords during legitimate login attempts, exploiting the trust established between the login flow and the external MFA service.
Arista and VMware have confirmed active exploitation of CVE-2026-93952, a critical vulnerability in on-premises VeloCloud Orchestrator (VCO). The flaw allows a remote attacker with no login access to privilege internal functions and affect the VCO host. Only VCO deployments configured to authenticate Edge devices using certificates are affected. A CVSS score of 10.0 has been assigned. Patches have been released; organizations are urged to update immediately.
Siemens Industrial Edge Management products contain an authentication bypass vulnerability in the Keycloak services component. The flaw allows an unauthenticated remote attacker to force a password reset for any user account without completing email verification, potentially leading to full account compromise. The vulnerability affects Cloud, Pro V1, Pro V2, and Virtual deployment models across multiple version ranges. Siemens has released updated versions and mitigation guidance to address the issue.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding a critical double free vulnerability in the lwIP (Lightweight IP) networking stack. Exploitation could result in system crashes, denial of service, memory corruption, or code execution on the victim system. The vulnerability affects lwIP API versions from 2.0.1 to 2.2.1. Eric Evenchick of Tetrel Security reported the flaw to CISA. No known public exploitation has been reported at this time.
CISA and Siemens have disclosed that multiple SIMATIC and SIPLUS industrial automation products are vulnerable to a "Copy Fail" flaw tracked as CVE-2026-31431. The vulnerability affects a wide range of HMI and runtime platforms including SIMATIC AX Runtime Core Linux, SIMATIC CN 4100, and various MTP1000, MTP1200, MTP1500, and MTP1900 series devices running affected firmware versions prior to 21.0.2.1. Siemens has released updated versions and recommends immediate updating. No public exploitation has been confirmed, but the advisory notes that unauthenticated attackers may exploit the vulnerability to read sensitive information or cause denial of service. Users are advised to update affected products to the latest available versions or apply recommended countermeasures.
Siemens has disclosed a critical path traversal vulnerability (CVE-2026-67367) affecting SIMOVE Fleetmanager and SIPLANT industrial software platforms. The flaw resides in the embedded HTTP server's file-serving endpoint, which fails to properly validate directory traversal sequences. An unauthenticated, remote attacker could exploit this to read arbitrary files from the underlying operating system, potentially exposing credential stores, private keys, and configuration secrets. Siemens has released updated versions and advisories to address the issue.
A critical remote code execution vulnerability in the Bifrost AI gateway HTTP transport component allows unauthenticated attackers to execute arbitrary commands on the server with a single HTTP request. Tracked as CVE-2026-90898 with a CVSS score of 9.8, the flaw affects all versions before 2.1.0 when management authentication is not properly configured. The open-source gateway routes requests to over 20 LLM providers, making compromised servers a significant risk for broader infrastructure compromise.
Check Point Software Technologies has confirmed that a previously unknown vulnerability in its Security Management Server was exploited in targeted attacks starting July 23, 2026. The flaw, tracked as CVE-2026-93616, permits unauthenticated remote code execution via the server's web service. A security update was released on September 22, 2026, urging immediate patching by all affected organizations.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring federal agencies to patch a high-severity vulnerability in Zyxel GS1900 series switches that is being actively exploited in the wild. The directive, issued on September 22, 2026, mandates remediation by a specified Thursday deadline to address the flaw being leveraged for data theft purposes.
Security researcher Patrick Wardle demonstrated a proof-of-concept on September 21, 2026, showing that malware already present on a macOS system can exploit a hidden configuration in Meta's Muse AI assistant. By modifying a hidden setting, the attacker can redirect voice dictation input away from Muse and to the attacker, effectively turning the assistant into a backdoor for intercepting sensitive user input.
A stored cross-site scripting vulnerability in WordPress core, tracked as CVE-2026-93485 and dubbed "Comment2Shell," was publicly disclosed and patched on September 17, 2026. The flaw allowed anonymous visitors to inject malicious scripts through comments. When a logged-in administrator subsequently viewed the affected page, the script executed in their browser session, potentially enabling remote code execution on the server. WordPress version 7.1.1 contains the fix.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-7273, a stack-based buffer overflow in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, with a CVSS score of 8.8, could allow attackers to execute arbitrary code and gain SYSTEM-level access. Patches have been released by Zyxel, and CISA urges immediate remediation.
Security researchers have identified a campaign in which threat actors are hiding new malware within torrent files that masquerade as popular films. Victims have been identified in Africa, specifically in Kenya and Uganda. The attack leverages the popularity of recent movie releases to distribute malicious payloads to users seeking pirated content.
A recent Dark Reading report highlights that unbounded consumption, identified by OWASP as the sixth most critical risk in its Top 10 for LLM Applications, poses significant financial and operational threats to enterprises deploying AI agents. The vulnerability arises from excessive resource consumption triggered by input to AI agents, potentially leading to runaway costs and service disruption.
A joint cybersecurity advisory attributes a large-scale campaign to North Korean threat actors, compromising at least 30,000 devices across more than 100 countries and siphoning funds or credentials from over 7,000 cryptocurrency wallets. The primary targets are individual web designers, engineers, and cryptocurrency specialists.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. One of the flaws is rated critical and may allow privilege escalation or remote code execution. The agency has issued an emergency directive requiring federal civilian executive branch agencies to patch affected systems within a defined timeframe. The vulnerabilities affect the Linux kernel across multiple distributions, with patches expected from maintainers.
BigCommerce has notified multiple merchants of data breaches resulting from attackers compromising credentials for third-party Ribon applications. The compromised credentials were used to inject malicious scripts into online stores, leading to unauthorized data access. Details regarding the exact volume of affected merchants and the specific types of data exfiltrated remain pending further confirmation.
On September 21, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability is a stack-based buffer overflow in Zyxel GS1900 Series Switches. CISA's action is based on evidence of active exploitation in the wild. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control post-exploitation.
A cross-site request forgery (CSRF) vulnerability in WordPress Core, tracked as 'Click2Shell', has been reported to allow attackers to execute arbitrary PHP code on the server. Technical details and a proof-of-concept exploit have been published. The full extent of affected WordPress versions, exploitation activity, and severity rating remain unconfirmed and require verification through official WordPress security channels.
Microsoft has announced the retirement of the Microsoft 365 Companion apps—Calendar, People, and Files—scheduled for December 16, 2026. Administrators of managed devices are being asked to remove these apps ahead of the deprecation date. The move is part of Microsoft's ongoing efforts to streamline its productivity suite and is not related to any security vulnerability or exploitation.
Ireland's Data Protection Commission has imposed a €403 million ($463 million) fine on Google for multiple GDPR violations related to processing users' location data. The penalty underscores ongoing regulatory scrutiny of big tech companies' data handling practices under European privacy law.
The FBI's Criminal Justice Information Services (CJIS) division has released Security Policy version 6.1, introducing stricter requirements for encryption, vulnerability scanning, and identity management. The update is intended to align federal systems with current security best practices and will affect agencies preparing for upcoming compliance audits.
OpenAI has disclosed six examples of concerning model activity, describing them as misalignment incidents. The company also published a new framework designed to investigate and disclose such incidents more transparently. The report emphasizes that no known exploitation of vulnerabilities occurred, as the incidents relate to unexpected model behavior rather than traditional security flaws.
