The Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer security research nonprofit, disclosed it was breached after seven incident-free years, with the intrusion executed autonomously by what it called an agentic AI system. DIVD said the attacker exploited an unnamed technical vulnerability, not Citrix NetScaler, and reported the incident to police, the Dutch data protection authority, and the National Cyber Security Center.
bleepingcomputer.com
· 2026-09-29
Security researcher Faav discovered that an internal Microsoft analytics service failed to verify the signature on login tokens, allowing anyone to impersonate an administrator and run unauthorized SQL queries. Faav says the flaw could have exposed roughly 17.3 trillion rows across multiple Microsoft datasets, but reported it through Microsoft's Bug Bounty Program without accessing customer data or PII. Microsoft confirmed it investigated and hardened the affected service in response.
blog.faav.net
· 2026-09-28
A security researcher describes finding a vulnerability in 2020 that granted access to a Brazilian federal system containing near-complete personal records for over 200 million citizens, including IDs, addresses, family details and witness-protection status. The researcher reported the flaw directly to the responsible agency by phone, which was initially skeptical before confirming and fixing the issue quickly without extracting any data.
blog.christianperone.com
· 2026-09-28
Cloudflare fixed a vulnerability in its Containers and Sandboxes service that let Workers Paid customers recover leftover data from other customers' containers on the same physical host. The flaw stemmed from a shared storage pool that reused 64 KiB disk blocks without zeroing them, leaving up to 60 KiB of previous customer data readable when a new customer wrote only 4 KiB to that space. Security researcher Oren Yomtov of Accomplish reported the issue via HackerOne on September 4, and testing found recoverable data—including SQLite databases, .env files, and credential files—on 18 of 24 container placements checked.
bleepingcomputer.com
· 2026-09-27
Canonical says it is switching to a unified two-week release cycle for security updates, citing a surge in CVE reports driven partly by AI-assisted vulnerability discovery and the Linux kernel team's decision to become its own CVE Numbering Authority. The company says it will offer interim workarounds or hardening guidance within 24 to 48 hours of disclosure while full patches are prepared.
news.slashdot.org
· 2026-09-26
The Clop ransomware group has relaunched its dark web leak site at a new Tor address after ShinyHunters defaced the original server, exploiting an unpatched path traversal vulnerability in Grav CMS. ShinyHunters claims to have stolen source code, plugins, server logs and Tor private keys, and demanded a ransom, but Clop denies any contact with the group and disputes that sensitive data was taken.
bleepingcomputer.com
· 2026-09-25
Patchstack disclosed a cross-site request forgery flaw in the Elementor Website Builder plugin, affecting versions 4.3.0 and 4.3.1, used on up to 2 million WordPress sites. The bug let attackers trick a logged-in administrator into clicking a malicious link that silently created a new admin account under attacker control. Elementor patched the issue in version 4.3.2, released two days after Patchstack's report.
bleepingcomputer.com
· 2026-09-25
Researchers identified a double-fetch flaw in Avast's kernel driver that can lead to a pool overflow, potentially allowing code execution outside the antivirus sandbox. The flaw involves multiple reads of the same user-supplied data, which can be manipulated between fetches. Recent Windows updates mitigate this issue by enforcing user-mode access checks, reducing the exploit's viability.
safateam.com
· 2026-09-25
A security researcher discovered a cross-site scripting vulnerability in the ansi2html tool used to render build logs on builds.sr.ht and other Sourcehut instances. The flaw let anyone inject malicious text into a build log, which would then execute in the browser of any user who viewed it, potentially hijacking their account and spreading further through the same mechanism.
blog.arusekk.pl
· 2026-09-24
FedRAMP has confirmed that its Vulnerability Detection and Response (VDR) and Vulnerability Exploitability Rating (VER) rules, issued in response to CISA's BOD 26-04, become mandatory for all cloud service offerings by December 7, 2026, with a grace period through March 7, 2027 for those under a corrective action plan. The rules replace the old monthly scan-and-POA&M model with scan frequencies and remediation deadlines tied to certification class and vulnerability severity, in some cases as short as 12 hours.
bleepingcomputer.com
· 2026-09-24
Radicle disclosed two critical security vulnerabilities affecting every released version of its code collaboration stack: network traffic between nodes is unencrypted and can be read by anyone observing the path, and the connection handshake's peer authentication can be bypassed. Security researcher Konstantinos Maninakis reported the encryption issue on June 24, 2026, prompting the disclosure.
radicle.dev
· 2026-09-23
Security researchers found a zero-day vulnerability in Meta's newly released Muse AI assistant for macOS that lets any locally installed app or terminal command access the token authenticating a user's Muse account, along with a long list of undocumented settings. Amazon has begun blocking Muse on its site, and the flaw undermines macOS permission protections that Apple built to prevent unauthorized apps from reaching sensitive resources like the microphone, camera, and file system.
wired.com
· 2026-09-23
GoKawiil