CISA warns of targeting of internet-accessible refrigeration controllers
CISA, the FBI and three other U.S. agencies say malicious actors are targeting unpatched or internet-accessible industrial refrigeration and cold-chain monitoring systems.
Articles by Cyber Defense Insights News Desk
Binarly Finds Zyxel GS1900 Patch 2 Still Exposed to Root-Level Exploit
Binarly reports that Zyxel’s Patch 2 firmware for 10 GS1900 switch models does not block an exploit targeting a separate flaw, CVE-2026-107441.
GhostMap Android flaw can leave phones stuck in a crash loop after app installation
Bitdefender says a malformed Android app can trigger repeated crashes in a core system service without permissions or being opened.
Barracuda Patches ESG Flaws That Can Be Chained to Root Access
Barracuda has patched an authentication bypass and command-injection vulnerability that can be combined to obtain root access on Email Security Gateway appliances.
Sekoia Reports APT29-Linked Mobile Watering-Hole Campaign Using Compromised Web Code
Sekoia researchers reported a campaign attributed to the Russia-linked APT29 group that profiles visitors through injected JavaScript before serving platform-specific iOS or Android exploit chains....
Zyxel patches GS1900 zero-day used to compromise 996 switches
Zyxel released firmware updates for a newly identified GS1900 vulnerability after researchers determined that an exploit used against 996 switches targeted a flaw separate from...
In-the-Wild Exploitation Attempts Target CryptoPayment Gateway WordPress Plugin
Defused Cyber says it observed exploitation attempts against CVE-2026-81648, a CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin that can expose stored wallet credentials....
Talos reports ransomware rise and help-desk impersonation in Q3
Cisco Talos says ransomware and pre-ransomware incidents accounted for 27 percent of its Q3 2026 incident-response engagements, up from a maximum of 20 percent across...
Polymarket trading resumes after third-party JavaScript wallet-draining incident
Polymarket temporarily halted trading on its international platform after malicious JavaScript delivered through a compromised DebugBear service targeted authenticated users and their assets.
Cisco SD-WAN Exploitation Installed Malware Designed to Capture Encryption Keys
Cisco Talos says attackers exploited CVE-2026-20127 to install the KeyDrift malware framework on Cisco Catalyst SD-WAN controllers and intercept decrypted control-plane traffic.
ZDI Finds Three Chained Flaws Behind Exploited Oracle PeopleSoft Bug
A newly published Zero Day Initiative analysis says CVE-2026-35273 combines three vulnerabilities across Oracle PeopleSoft’s Integration Gateway and Environment Management Hub.
Industrial Vendors Confirm PHP2Shell Exposure as CISA Lists Flaws as Actively Exploited
Siemens, Schneider Electric, ABB and other industrial vendors have identified affected products as CISA adds the PHP2Shell vulnerabilities to its catalog of actively exploited flaws....
Attackers Abuse Microsoft Teams External Chats in IT Support Scams
Arctic Wolf Labs identified a recurring pattern in which attackers use Microsoft Teams external chats, impersonated IT staff and remote-access tools to deliver malware and,...
Sansec Finds Loader Code on 953 Online Stores in Ongoing Campaign
A threat actor has infected 953 online stores, most running Magento, with loader code designed to fingerprint visitors and potentially deliver payloads, according to SecurityWeek’s...
Ruby Releases Fixes for Regex Bugs Linked to Four GitLab RCE Flaws
Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to fix three Onigmo regular-expression bugs that GitLab found could enable remote code execution on its servers....
Exaforce reports attackers exfiltrated GitHub data within minutes of token abuse
A newly published Exaforce analysis describes attacks involving dormant GitHub OAuth tokens, fake AI-tool installers and MFA social engineering, with data theft beginning within minutes...
PHP2Shell: Researchers Warn Against Relying on a Shared Configuration Setting
GMO Flatt Security has clarified that disabling PHP’s Session Upload Progress feature is not a complete fix for two critical remote-code-execution vulnerabilities.
CISA says SafePay ransomware has breached at least 600 critical-infrastructure organizations
A joint advisory says SafePay has affected at least 600 organizations across multiple critical-infrastructure sectors since August 2024.
Leaked PHP flaws put servers on alert ahead of scheduled patches
Details of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked before PHP’s scheduled October 21 security release.
PHP Schedules Critical Security Release for Two CVSS 9.2 Vulnerabilities
PHP’s security team has announced a security release for 21 October to address two critical vulnerabilities, but has not yet published technical details or fixed...
Talos links October’s 1,415 Microsoft flaws to AI-assisted code mining
A new Cisco Talos analysis says AI-assisted vulnerability discovery is helping expose a backlog of weaknesses in older, widely used code, driving Microsoft’s October advisory...
Ahold Delhaize files police report as cyber incident recovery continues
Ahold Delhaize says it has filed a formal report with Dutch police and is restoring websites, apps and e-commerce services after taking systems offline following...
AOMEI says CTO is investigating reports of Backupper update-server tampering
AOMEI told BleepingComputer that its chief technology officer is leading a high-priority investigation after researchers reported that its update and notification infrastructure served malware during...
Siemens confirms active exploitation of Software Center DLL side-loading flaw
Siemens says attackers are actively exploiting CVE-2026-110936 in Siemens Software Center by pairing a legitimate signed executable with malicious DLLs.
Security Incident Disrupts US Bankruptcy Notice System Run by BAE
A security incident affecting BAE Systems’ Bankruptcy Noticing Center has halted bankruptcy notices nationwide for about a week.
Proofpoint agrees to acquire Varonis in $6.3 billion data-security deal
Proofpoint says it will acquire Varonis in an all-cash transaction valued at approximately $6.3 billion, combining Proofpoint’s email and identity-security business with Varonis’ data-visibility and...
KB5127648 may block Smart App Control activation on Windows 11
Microsoft says some Windows 11 devices may be unable to turn Smart App Control back on after installing the October 13 security update KB5127648. Devices...
Cisco Warns of Active Exploitation of Secure Email Gateway Flaw
Cisco says attackers are exploiting CVE-2026-76519, a critical Secure Email Gateway vulnerability that can let unauthenticated remote attackers write files and execute commands as root....