Confiant Threat Intelligence – security@confiant.com
‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online…
Citrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix has released security updates for XenServer 8.4 and XenServer 9. The updates fix several vulnerabilities, three of which could let a malicious…
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory…
FTC says ‘sextortion’ protection companies deceived customers about services
A federal lawsuit claims that Dmitry Belkin and his companies routinely failed to deliver on services to protect customers, generated fake evidence and…
Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
A flaw in Docker Hub, the registry where container images are published and downloaded, let one user push, pull, or delete images as another user. Docker…
U.S. CISA adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The U.S.…
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity…
IT Security News Roundup: 2026-10-15 Morning
IT Security News: Morning roundup, 2026-10-15 Summary This news cycle highlights the escalating double-edged sword of artificial intelligence, as attackers increasingly weaponize autonomous agents while enterprise teams struggle to govern AI permissions and code. Meanwhile, regulatory bodies and security agencies…
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was…
Cartoon Network Leak Exposes 200GB of Source Files, Storyboards and Animation Assets
A large cache of internal Cartoon Network production material is circulating online. It reportedly exceeds 200GB and includes source files, storyboards…
Almost 50 arrested as police target Western Balkan network linked to killings
Nearly 50 suspects have been arrested in an international operation targeting a drug trafficking network with Western Balkan members, linked to killings,…
CenterPoint Energy Data Breach Impacts 1 Million Texans
Personal information such as names, addresses, Social Security numbers, and driver’s license numbers was compromised.
Anthropic conjures another threat that doesn’t exist yet to stoke fears of AI apocalypse
Self-replicating AI botnets could become feasible on IoT hardware within months, claims the Claude maker, if smaller models get smarter
Dangerous flaws in refrigeration equipment were disclosed months before retail attacks
Hundreds of French supermarkets faced a sophisticated cyberattack, allowing hackers to manipulate industrial controls.
Pluto Security raises $42M as AI gives enterprise security teams a new headache
The problem with giving everyone in a company access to AI tools is that people will use them in unexpected ways. And that fact is steadily seeding fears…
Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages
Microsoft and partners reveal a major Chinese-language phishing network centered around the Yam Store marketplace
Microsoft fixes bug causing Windows black screens, Explorer crashes
Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates…
Best NinjaOne Alternatives for Endpoint, Patch, and Vulnerability Management
Compare the best NinjaOne Alternatives for endpoint management, patch management, remote monitoring, IT automation and MSP security workflows.
Ivanti VPN Zero-Day Attacks Target Credentials: What to Patch
Ivanti Connect Secure zero-day attacks exposed credentials and evaded security checks. Here’s what organizations need to patch and investigate.
West African scammers targeted in joint international government-industry operation
Participants said it was the largest joint scam operation to date and the first focused on the region.
PoC Exploit Code Released for Fortinet FortiClient EMS Authentication Bypass Flaw
A public proof-of-concept (PoC) exploit is now available for CVE-2026-35616, a critical authentication bypass in Fortinet FortiClient Endpoint Management…
Claude submitted fake murder tip to Philly police during summertime testing
Anthropic took more than two months to alert cops
AdFection: How mercenary spyware invades victims’ devices through targeted advertising
Researchers say the attacks have serious implications for the online advertising world, and regulators.