BAE Systems cyber incident disabled the Bankruptcy Noticing Center for seven days starting October 9, preventing all US federal bankruptcy courts from sending required legal notices. The outage demonstrates critical vulnerabilities in third-party government services.
Attackers compromised ConnectWise Cloud Backup credentials to access 173 Microsoft 365 tenants, exploiting broad OAuth permissions. The breach demonstrates critical risks of vendor credential compromise in multitenant SaaS environments and the need for enhanced monitoring.
BeyondTrust patched a critical zero-day in Remote Support actively exploited since August 2024. Organizations using BeyondTrust RS face four months of potential unauthorized privileged access. Immediate patching and retrospective security analysis required.
AI agents inadvertently expose API keys and cloud secrets through conversation histories, execution logs, and model contexts. Organizations deploying autonomous agents must implement agent-specific security controls including credential redaction, just-in-time access, and specialized monitoring.
Microsoft patched CVE-2026-96951, a zero-day in Windows Shell actively exploited to bypass Mark of the Web security controls. The CVSS 8.8 flaw affects all Windows versions and requires immediate patching as threat actors weaponized it before disclosure.
Budget Android devices ship with preinstalled Midnight Mimosa malware that exploits MediaTek chipsets to enable silent app installation, ad fraud, and residential proxy abuse. This firmware-level supply chain compromise affects multiple manufacturers and cannot be removed through standard…
CVE-2024-53704, a critical unauthenticated SSRF vulnerability in SonicWall SMA 1000 appliances, is under active exploitation. The maximum-severity flaw allows attackers to bypass access controls and potentially execute code. Immediate patching to version 12.4.3-02854 is required.
A four-hour DDoS attack on October 8, 2026 disrupted Canonical’s Ubuntu websites and security APIs, preventing access to vulnerability data and updates. This second major incident this year highlights critical dependency risks for security teams relying on single-source infrastructure.
NVIDIA patched CVE-2026-47483, allowing unauthenticated attackers to crash DCGM Exporter via resource exhaustion. The high-severity flaw threatens GPU monitoring for AI workloads. Organizations should apply patches immediately to protect critical infrastructure.
Nippon Columbia’s malware infection exposed 8.6M+ karaoke customer records including names, addresses, and contact details from Daiichi Kosho’s network. The incident demonstrates third-party risk in entertainment infrastructure and credential theft potential.