OperTraitor, an open-source, LLM-powered engine that identifies Kubernetes operators whose RBAC (Role-Based Access Control) privileges exceed their…
WHIPSHOT and SLAPSHOT: the tools behind an active Citrix NetScaler campaign
Mandiant and GTIG detail active exploitation of a Citrix NetScaler zero-day, deploying custom web shells WHIPSHOT and SLAPSHOT for root access. Mandiant…
UK rail cops’ £320K face-scanning spree nets zero matches
British Transport Police’s six-month facial recognition pilot produced one alert, and it was a false positive
U.S. CISA adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple Multiple Products flaw to its Known Exploited Vulnerabilities catalog. The U.S.…
International investigation identifies over 70 potential victims exploited in Indian restaurants
The coordinated action conducted on 18 September 2026 led to two arrests. Allegedly, the traffickers forced their victims to work up to 16 hours per day,…
Linux Kernel CVE-2026-72018 Flaw Lets Local Attackers Gain Root Access
A high-severity Linux kernel vulnerability, tracked as CVE-2026-72018, lets a local attacker with CAP_NET_ADMIN privileges escalate to root. This…
Former US Air Force members behind million-dollar BEC scheme head to prison
Two men who ran BEC and phishing campaigns against US businesses while serving in the Air Force have been sentenced to a combined 189 months in federal…
Spain, Denmark and the Netherlands win Europol 2026 Excellence Awards in Innovation
At the European Police Chiefs Convention on 29 September 2026, Europol announced the winners of its 2026 Excellence Awards in Innovation. Law enforcement…
IT Security News Hourly Summary 2026-09-30 10h : 13 posts
13 posts published in the last hour 07:31Star Blizzard, Cloudflare CA, GPT-6.1 scuttled 07:31Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA 07:31Tech Company Halo Moves Into Futuristic Ipswich Headquarters 07:31MCP Python SDK OAuth Flaw Lets…
Star Blizzard, Cloudflare CA, GPT-6.1 scuttled
Microsoft details new Star Blizzard and NeedyMantis activity Cloudflare to become a public certificate authority Safety concerns scuttle GPT-6.1 Get the…
Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA
Threat actors have targeted more than 5,700 Microsoft 365 accounts across 28 tenants in a password-spraying campaign that successfully breached seven…
Tech Company Halo Moves Into Futuristic Ipswich Headquarters
Global software company Halo moves from Stowmarket into Norman Foster-designed Willis Building in Ipswich
MCP Python SDK OAuth Flaw Lets Malicious Servers Hijack AI Agent Accounts
A high-severity flaw in the official Model Context Protocol (MCP) Python SDK could allow a malicious MCP server to steal OAuth authentication material and…
Spectre bug is back, this time to haunt JIT engines
Researchers find a way to recover stale indirect branch prediction entries
OpenAI Rolled out Codex Security Cloud, an Always-on Application Security Service
OpenAI has upgraded Codex with Codex Security Cloud, an always-on application security service designed to scan GitHub repositories, monitor incoming…
SpaceX’s Starship Orbits Earth For First Time
Starship vehicle, planned by NASA to carry humans to the Moon, successfully completes two orbits of Earth, deploys satellites
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL
Roughly a dozen vulnerabilities have been patched in each of the open source cryptographic libraries.
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
Cybersecurity researchers have disclosed technical details of a recently patched critical security flaw in Citrix NetScaler ADC and Gateway that has come…
Genea brings AI agents to access control with role-based permissions
Genea has announced the release of Genea MCP, a Model Context Protocol (MCP) server that connects AI agents directly to the Genea Access Control platform.…
Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover
Microsoft has detailed a cloud-focused intrusion attributed to Storm-3068, in which attackers turned a compromised user account into a launch point for…
Security tools can now scan Claude Enterprise chats and uploads for sensitive data
More than 100 security and compliance vendors have integrations with the Claude Compliance API, which lets a company send Claude activity into the…
IT Security News Hourly Summary 2026-09-30 09h : 6 posts
6 posts published in the last hour 06:31Apple Hit By $5.7bn Verdict Over Vibration Patents 06:31Unsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face Models 06:02Android Malware Turns Gemini AI Into an Assistant for On-Device Attacks 06:02OWASP Noir:…
Apple Hit By $5.7bn Verdict Over Vibration Patents
US jury finds Apple devices infringe two patents on haptic feedback belonging to Taction Technologies
Unsloth Fixes Arbitrary Code Execution Flaw Triggered by Malicious Hugging Face Models
Unsloth has addressed a critical arbitrary code execution vulnerability in its Studio web interface. This flaw allowed a malicious Hugging Face model…