LATEST

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

A proxyjacking campaign has impacted devices in 34 countries, monetizing victims' internet connections through a commercial residential proxy network. [...]

The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

Is the cybersecurity world really facing a "Bugmageddon?" Thor breaks down the latest CVE and KEV trends in the latest Threat Source newsletter.

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate. The post Context Is King in the Fight Against Modern Cyberattacks appeared first on SecurityWeek.

Fake Arch Linux packages push malware with root privileges

A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru. [...]

Watch Now: Zero Trust Strategies Summit – All Sessions Available on Demand

This summit is laser-focused on the next generation of Zero Trust and Identity security, moving beyond theory to deliver actionable strategies. The post Watch Now: Zero Trust Strategies Summit – All Sessions Available on Demand appeared first on SecurityWeek.

CVE-2026-110812 - Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

Bulletin ID: 2026-136-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/15/2026 09:30 AM PDT Description: Amazon Neptune is a fully managed graph database service. We identified CVE-2026-110812, an issue in Apache TinkerPop related to Gremlin functionality used by Amazon Neptune. Under certain conditions, an authenticated principal with Neptune data-plane (query) permissions could submit a request that causes the query engine to process untrusted input unsafely, w…

CVE-2026-15737 - Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK

CVE-2026-15415 - Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server

CVE-2026-15895: OS command injection in jsii-diff in AWS jsii

CVE-2026-12283 - Issue with Athena Federated Query Synapse Connector

CVE-2026-15746 - Credential disclosure in Strands Agents Tools elasticsearch_memory tool

CVE-2026-8838 - Remote Code Execution in amazon-redshift-python-driver

CVE-2026-9255 - Tool Execution Without Authorization via Piped Stdin in Kiro CLI

CVE-2026-10591 - Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths

CVE-2026-11400 and CVE-2026-11401

Issue with Amazon SageMaker Python SDK - Model artifact integrity verification issues (CVE-2026-8596 & CVE-2026-8597)

CVE-2026-8178 - Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver

CVE-2026-31431

Ongoing updates on Copy.fail and variants

Fragnesia Local Privilege Escalation report via ESP-in-TCP in the Linux Kernel

CVE-2026-8686 - Heap out-of-bounds read in coreMQTT MQTT5 property parsing

Dirty Frag and other issues in Amazon Linux kernels

AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs

We applied AWS Security Agent (now part of AWS Continuum), our autonomous penetration-testing agent, to 37 real, recently disclosed Common Vulnerabilities and Exposures (CVEs), each packaged as a live, containerized target with a flag hidden at the vulnerability’s intended sink. Starting from an unauthenticated or low-privilege position (an endpoint URL and a one-line hint, no […]

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed no click or other action from the user, researchers at the Citizen Lab said Thursday. The hidden attack code ran the moment an ad loaded on the screen, and in some cases the ad loaded out of sight, in the background. The Citizen

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives

Vulnerability Management Isn't About the Score — It's About How It Applies to You

Organizations need to move away from vendor-assigned, theoretical scores toward real exploit data specific to their environments.

UK Legal Aid Agency hack worse than thought, with stolen records dating back to 1978

A cyberattack on Britain’s Legal Aid Agency (LAA) stole far older and broader records than the government previously disclosed.

Thoma Bravo's Proofpoint to buy Varonis Systems in $6.3 billion all-cash deal

Proofpoint to Acquire Varonis in $6.3 Billion Cybersecurity Deal

UK Legal Aid Agency Hack Scope Widens After Forensic Review

Most of the data is related to applications, claims, and payments submitted between 2007 and 2025. The post UK Legal Aid Agency Hack Scope Widens After Forensic Review appeared first on SecurityWeek.