CyberWatch Newsroom Live Intel

Important CVE-2026-48388 Cisco Talos Intelligence

2026-10-07 Cisco Talos Intelligence

Microsoft, Adobe, Apple, and Foxit vulnerabilities

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s third-party vulnerability disclosure policy . For Snort coverage that can detect the exploitation of these …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Telemetry & Research

Advisory

Important The Hacker News

2026-10-08 The Hacker News

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6. Google's own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate The Record by Recorded Future

2026-10-07 The Record by Recorded Future

$11 million plan for psychological support at Cyber Command gets fresh boost from lawmakers

Lawmakers who oversee military cyber policy as well as the Fort Meade, Maryland, hub for those agencies say an $11 million mental health program should be locked in to defense spending legislation.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Important The Record by Recorded Future

2026-10-07 The Record by Recorded Future

Arizona courts say hackers stole info on more than 1.3 million people

The investigation into the incident revealed cybercriminals were able to breach the Fines/Fees and Restitution Enforcement (FARE) Program, a statewide program that helps the court collect outstanding debts tied to traffic and criminal violations.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Critical CVE-2026-102255 SecurityAffairs

2026-10-07 SecurityAffairs

SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances

SonicWall patched a CVSS 10 pre-auth SSRF flaw in SMA1000 appliances that could let unauthenticated attackers reach internal functions. SonicWall released hotfixes for four vulnerabilities in its SMA1000 remote access appliances, including a critical flaw tracked as CVE-2026-102255 (CVSS score of 10.0. The issue is a pre-authentication SSRF bug in the WorkPl…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Important The Hacker News

2026-10-07 The Hacker News

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages s…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate Cloudflare Security

2026-10-07 Cloudflare Security

Building an evidence-grounded agentic security operations harness on Cloudflare

Security alerts rarely arrive one at a time. A single alert can cause a spike across the environment, requiring a human analyst to decide which alerts are related and what they mean. When multiple arrive at the same time, it can quickly overwhelm even a seasoned security analyst. Enter the alert paradox. Now, our built-in, multi-AI-agent security operations …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

DDoS, Botnets & Edge Security

Advisory

Critical The Hacker News

2026-10-07 The Hacker News

SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances

SonicWall has released hotfixes for four flaws in its SMA1000 appliances, the gateways that give remote workers access to a company's network and applications. The most serious could allow an attacker without a login to send requests through the appliance and reach internal functions. SonicWall rates it 10.0 on the CVSS scale and says it has no evidence that…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Moderate BleepingComputer

2026-10-07 BleepingComputer

Microsoft Outlook to block MSIX attachments starting November

Microsoft announced that it will add .msix and .msixbundle attachments to the list of blocked attachments in Outlook Web and the new Outlook Windows client starting next month. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Critical The Hacker News

2026-10-07 The Hacker News

Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely

A critical vulnerability in LMCache, open-source software that speeds up large language model (LLM) servers such as vLLM, lets an attacker run code on the cache server without logging in, and no fixed version is available. The flaw is in LMCache's multiprocess mode, where the cache runs as a standalone server that LLM workers reach over the ZeroMQ messaging …

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Important The Hacker News

2026-10-07 The Hacker News

PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miners and further expand the scale of the botnet. The financially motivated campaign, dubbed Canto Incognito, has been found to instal…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Threat Intelligence

Advisory

Important BleepingComputer

2026-10-07 BleepingComputer

PoeLLM malware infects exposed AI servers in cryptomining attacks

A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate The Record by Recorded Future

2026-10-07 The Record by Recorded Future

Oklahoma judge’s Flock ruling shows the power of Supreme Court’s digital evidence decision

How a recent Supreme Court decision on geofencing influenced a federal judge to toss a sheriff's Flock camera evidence in a drug trafficking case.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Important CVE-2026-21589 SANS Internet Storm Center

2026-10-07 SANS Internet Storm Center

Scans for Atlassian vulnerablity (CVE-2026-21589), (Wed, Oct 7th)

On October 5th, Atlassian published patches for multiple products to fix an "Arbitrary File Access" vulnerability [CVE-2026-21589]. An attacker can read arbitrary files in the web application's directory, potentially exposing sensitive information such as configuration files.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Operational Threat Radar

Advisory

Critical CVE-2026-21589 Help Net Security

2026-10-07 Help Net Security

Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)

One day after Atlassian released patches fixing a critical arbitrary file access vulnerability (CVE-2026-21589) in its self-managed Data Center products, and a few hours after watchTowr researchers published a technical rundown of the flaw, attackers have been spotted attempting to exploit it. CVE-2026-21589 PoC in action (Source: watchTowr) “Exploitation at…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Infosecurity Magazine

2026-10-07 Infosecurity Magazine

OT Coalition Urges CISA to Mandate Federal OT Security

OTCC urged CISA to mandate baseline security requirements for federal operational technology

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Global Cybersecurity News

Advisory

Moderate The Record by Recorded Future

2026-10-07 The Record by Recorded Future

Cyber experts call on CISA to create mandatory federal OT rules

The Operational Technology Cybersecurity Coalition released a white paper urging the CISA to create a new directive centered around operational technology, which is used to monitor and control critical infrastructure.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Critical BleepingComputer

2026-10-07 BleepingComputer

Ransomware has a new target. Is your backup ready?

Ransomware groups are increasingly targeting backup infrastructure to eliminate recovery options and increase pressure on victims to pay. Kaseya explains why organizations need isolated, immutable, and regularly tested backups that attackers cannot easily reach. [...]

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Defense & Malware

Advisory

Moderate Help Net Security

2026-10-07 Help Net Security

Gremlin Foresight AI finds system weaknesses and verifies the fixes

Gremlin has announced the general availability of Gremlin Foresight AI. Following a successful beta, Gremlin Foresight AI has proven it can identify and address reliability risks before they become incidents, helping engineering teams move at AI speed without compromising the resilience of mission-critical production systems. “AI-driven development means shi…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Moderate Help Net Security

2026-10-07 Help Net Security

Imply Lumi connects SIEM tools and AI agents to more security data

Imply has unveiled its expanded vision for the security information and event management (SIEM) market, with Imply Lumi providing the data platform for the agentic SIEM. Imply is bringing modern data architecture to security teams facing growing data volumes, rising costs and new demands from AI-driven investigations, while preserving the SIEM tools and work…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important SecurityAffairs

2026-10-07 SecurityAffairs

FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away

FBI and Secret Service warn FortiBleed, a credential-harvesting campaign against Fortinet firewalls, has compromised 86,644 devices and is locking out admins. The FBI and the U.S. Secret Service issued a joint advisory about FortiBleed , and the headline number alone is worth sitting with: more than 86,644 compromised Fortinet FortiGate devices across 194 co…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Cyber Crime & Data Breaches

Advisory

Critical The Record by Recorded Future

2026-10-07 The Record by Recorded Future

Senate passes healthcare cybersecurity bill after 190 million impacted by Change Healthcare breach

The Health Care Cybersecurity and Resiliency Act of 2026 was passed by unanimous consent last week, potentially expanding federal cyber requirements for healthcare organizations.

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

State-Sponsored Cyber Warfare

Advisory

Important Help Net Security

2026-10-07 Help Net Security

FortiBleed is still active, with attackers locking admins out of Fortinet firewalls

Some organizations hit by the FortiBleed campaign have been locked out of their own Fortinet firewalls, according to a joint FBI and U.S. Secret Service advisory. FortiBleed targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory cites SOCRadar, which has verified more than 86,644 compromised devices in 194 countries. “Based o…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory

Important Help Net Security

2026-10-07 Help Net Security

Vijil DART tests AI agents for security flaws and policy violations

Vijil has released Diamond Adaptive Red Teaming for Agents (DART), an automated testing system that finds security vulnerabilities and policy violations in enterprise AI agents. DART employs multiple adversarial agents of its own to probe the target’s defenses with multi-turn attacks that learn and adapt tactics across turns, episodes, and engagements. Using…

Fix: Review advisory findings, isolate suspect endpoints, and verify threat signatures.

Enterprise Cyber Defense

Advisory