Cybersecurity
Cybersecurity news — Tuesday 06 October 2026
150 stories from 10 sources, every one in English. Each links to its publisher.
-
Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks
FortiBleed, a credential compromise campaign targeting Fortinet firewalls and VPN gateways, is an ongoing threat that can lock users out of their Fortinet accounts and also lead to ransomware attacks, the FBI and Secret Service said in an…
-
Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create rogue admin accounts. [...]
-
Wiretapping change sparks big privacy fight in the Golden State
A bipartisan update to a California wiretapping law will eliminate the right to sue over internet-based surveillance, ending a key provision of a 57-year-old wiretapping law. Advocates say it is an overdue correction meant to prevent…
-
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned $388,500 after exploiting 32 zero-days. [...]
-
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity…
-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name…
-
Use Gemini for free? You’ll soon be limited to its weakest AI model
Google is cutting off free users from the Flash and Pro models. AI Plus subscribers are losing out too
-
Former NSA chief Nakasone says agency overhaul is ‘probably needed’
Former National Security Agency Director Paul Nakasone said a reported broad reorganization of the agency is “probably necessary” as it confronts faster-moving cyberthreats, artificial intelligence and competition with China, but he…
-
Atlassian warns of critical file-access flaw in Jira, Confluence
Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]
-
Office 2021 support ends this month – you have 5 options
Microsoft is ending support and updates for Office 2021 on October 13. What does that mean, and what are your alternatives?
-
ASOS confirms data breach after “HACKED” in-app notifications
UK fashion retailer ASOS confirmed a data breach Tuesday after hackers sent unauthorized push notifications through its mobile app while claiming to have stolen customer data from the company's Snowflake environment. [...]
-
Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
A new campaign targeting ad account managers uses fake ChatGPT, Gemini, Claude, and Perplexity sites that steal login credentials and multi-factor authentication (MFA) codes through browser-in-browser attacks. [...]
-
FBI Blames Contractor’s Missed Patch for ShinyHunters Breach
The FBI has removed an Accenture contractor over a data breach that exposed personal information of thousands of bureau employees. The post FBI Blames Contractor’s Missed Patch for ShinyHunters Breach appeared first on SecurityWeek .
-
ASOS “hackers” send push notifications to customers
Thousands of global fashion retailer ASOS customers have received a push notification through the ASOS app this morning alleging that the company has been hacked. The notification, addressed to ASOS’s data protection officer and IT, says…
-
How to secure RMM software: 8 controls MSPs should test
RMM platforms give MSPs privileged access across customer environments, making their security controls critical to limiting risk. Acronis outlines eight controls MSPs should test when evaluating RMM software, from patching and privileged…
-
Mistral’s new Le Chonk model brings AI cybersecurity to your business – and you control it
Open models are vying to become the everyman defense solution for a growing swarm of agent breaches.
-
FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
An alleged leader of Tren de Aragua’s ATM jackpotting activities, Canelon Aguirre was on the FBI’s top 10 most wanted list since March 2026. The post FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware appeared first on SecurityWeek…
-
Facebook Marketplace scam uses your name and number
Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller. It works like this. You receive a message (in this case iMessage) asking “Is this still available for purchase?”…
-
Incident affecting ASOS customers
ASOS has said it is investigating a cyber incident and that some customer personal information may have been accessed.
-
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There is no warning first, of the kind either program shows before it runs a macro…
-
Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks
Citing growing risks posed by more capable and autonomous AI agents, Apple will introduce additional controls. The post Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks appeared first on SecurityWeek .
- ISC Stormcast For Tuesday, October 6th, 2026 https://isc.sans.edu/podcastdetail/10124, (Tue, Oct 6th)
-
Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits
The Wikimedia Foundation says rogue OpenAI agents made unauthorized Wikipedia edits and may have been partially responsible for a May outage. [...]
-
Here’s how experts think CISA should tell agencies to protect OT
A coalition of cyber firms and critical infrastructure operators on Tuesday spelled out its views on the tasks that the Cybersecurity and Infrastructure Security Agency should assign federal agencies to protect operational technology…
-
Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies
The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia…
-
Domino’s customers targeted in credential stuffing attacks
Domino’s Pizza customers tell us they have received emails saying they account has been accessed by a third party. Domino’s says its internal systems weren’t breached, but that individual accounts were logged into using a password and…
-
Possible Vulnerability in Apple’s Automatic Reboot
404Media is reporting (alternate link ) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure…
-
Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers
In 2024, MCP (Model Context Protocol) set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them…
-
Cybersecurity M&A Roundup: 39 Deals Announced in September 2026
Significant cybersecurity M&A deals announced by Dragos, IBM, Palo Alto Networks, Kiteworks, and Upwind. The post Cybersecurity M&A Roundup: 39 Deals Announced in September 2026 appeared first on SecurityWeek .
-
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign. The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek .
-
8.8 Million Impacted by Data Breach at Denmark’s Central Person Register
Hackers abused a company’s lawful access to the CPR system to steal the personal information of registered citizens. The post 8.8 Million Impacted by Data Breach at Denmark’s Central Person Register appeared first on SecurityWeek .
-
More RMM Tools In the Wild, (Tue, Oct 6th)
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.
-
Nikkei discloses breaches of employees’ Microsoft, Google email accounts
Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails. [...]
-
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects…
-
Social Engineering Detection Moves Into the Live Conversation
Companies are pouring time and dollars into security awareness training, but little evidence shows it actually works against social engineering. The post Social Engineering Detection Moves Into the Live Conversation appeared first on…
-
Engineer sentenced for locking over 3,000 devices on employer network
A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack. [...]
-
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's…
-
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach
The U.S. Federal Bureau of Investigation (FBI) has removed an Accenture contractor for their alleged role in a ShinyHunters-breach that led to the theft of personal details of thousands of bureau employees. That's according to a report…
-
Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
Unauthorized parties have gained access to the names, addresses, and personal identification numbers of about 8.8 million people, living and dead, in Denmark's national population register, the country's digitalization ministry said on…
-
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and executing remote payloads like the typical attack pattern, in this…
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers
- Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers